[Federal Register Volume 75, Number 46 (Wednesday, March 10, 2010)]
[Proposed Rules]
[Pages 11327-11373]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2010-4991]



[[Page 11327]]

-----------------------------------------------------------------------

Part III





Department of Health and Human Services





-----------------------------------------------------------------------



45 CFR Part 170



Proposed Establishment of Certification Programs for Health Information 
Technology; Proposed Rule

Federal Register / Vol. 75, No. 46 / Wednesday, March 10, 2010 / 
Proposed Rules

[[Page 11328]]


-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Office of the Secretary

45 CFR Part 170

RIN 0991-AB59


Proposed Establishment of Certification Programs for Health 
Information Technology

AGENCY: Office of the National Coordinator for Health Information 
Technology, Department of Health and Human Services.

ACTION: Proposed rule.

-----------------------------------------------------------------------

SUMMARY: Under the authority granted to the National Coordinator for 
Health Information Technology (the National Coordinator) by section 
3001(c)(5) of the Public Health Service Act (PHSA) as added by the 
Health Information Technology for Economic and Clinical Health (HITECH) 
Act, this rule proposes the establishment of two certification programs 
for purposes of testing and certifying health information technology. 
While two certification programs are described in this proposed rule, 
we anticipate issuing separate final rules for each of the programs. 
The first proposal would establish a temporary certification program 
whereby the National Coordinator would authorize organizations to test 
and certify Complete EHRs and/or EHR Modules, thereby assuring the 
availability of Certified EHR Technology prior to the date on which 
health care providers seeking the incentive payments available under 
the Medicare and Medicaid EHR Incentives Program may begin 
demonstrating meaningful use of Certified EHR Technology. The second 
proposal would establish a permanent certification program to replace 
the temporary certification program. The permanent certification 
program would separate the responsibilities for performing testing and 
certification, introduce accreditation requirements, establish 
requirements for certification bodies authorized by the National 
Coordinator related to the surveillance of Certified EHR Technology, 
and would include the potential for certification bodies authorized by 
the National Coordinator to certify other types of health information 
technology besides Complete EHRs and EHR Modules.

DATES: To be assured consideration, written or electronic comments on 
the proposals for the temporary certification program must be received 
at one of the addresses provided below, no later than 5 p.m. on April 
9, 2010. To be assured consideration, written or electronic comments on 
the proposals for the permanent certification program must be received 
at one of the addresses provided below, no later than 5 p.m. on May 10, 
2010.

ADDRESSES: Because of staff and resource limitations, we cannot accept 
comments by facsimile (FAX) transmission. You may submit comments, 
identified by RIN 0991-AB59, by any of the following methods (please do 
not submit duplicate comments).
     Federal eRulemaking Portal: Follow the instructions for 
submitting comments. Attachments should be in Microsoft Word, 
WordPerfect, or Excel; however, we prefer Microsoft Word. http://www.regulations.gov.
     Regular, Express, or Overnight Mail: Department of Health 
and Human Services, Office of the National Coordinator for Health 
Information Technology, Attention: Certification Programs Proposed 
Rule, Hubert H. Humphrey Building, Suite 729D, 200 Independence Ave., 
SW., Washington, DC 20201. Please submit one original and two copies.
     Hand Delivery or Courier: Office of the National 
Coordinator for Health Information Technology, Attention: Certification 
Programs Proposed Rule, Hubert H. Humphrey Building, Suite 729D, 200 
Independence Ave., SW., Washington, DC 20201. Please submit one 
original and two copies. (Because access to the interior of the Hubert 
H. Humphrey Building is not readily available to persons without 
Federal government identification, commenters are encouraged to leave 
their comments in the mail drop slots located in the main lobby of the 
building.)
    Inspection of Public Comments: All comments received before the 
close of the applicable comment period will be available for public 
inspection, including any personally identifiable or confidential 
business information that is included in a comment. Please do not 
include anything in your comment submission that you do not wish to 
share with the general public. Such information includes, but is not 
limited to: a person's social security number; date of birth; driver's 
license number; State identification number or foreign country 
equivalent; passport number; financial account number; credit or debit 
card number; any personal health information; or any business 
information that could be considered to be proprietary. We will post 
all comments received before the close of the applicable comment period 
at http://www.regulations.gov.
    Docket: For access to the docket to read background documents or 
comments received, go to http://www.regulations.gov or U.S. Department 
of Health and Human Services, Office of the National Coordinator for 
Health Information Technology, Hubert H. Humphrey Building, Suite 729D, 
200 Independence Ave., SW., Washington, DC 20201 (call ahead to the 
contact listed below to arrange for inspection).

FOR FURTHER INFORMATION CONTACT: Steven Posnack, Policy Analyst, 202-
690-7151.

SUPPLEMENTARY INFORMATION:

Acronyms

CAH Critical Access Hospital
CCHIT Certification Commission for Health Information Technology
CGD Certification Guidance Document
CMS Centers for Medicare & Medicaid Services
EHR Electronic Health Record
FACA Federal Advisory Committee Act
FFS Fee for Service (Medicare Program)
HHS Department of Health and Human Services
HIT Health Information Technology
HITECH Health Information Technology for Economic and Clinical 
Health
LOINC Logical Observation Identifiers Names and Codes
MA Medicare Advantage
NIST National Institute of Standards and Technology
NVLAP National Voluntary Laboratory Accreditation Program
OIG Office of Inspector General
OMB Office of Management and Budget
ONC Office of the National Coordinator for Health Information 
Technology
ONC-AA ONC-Approved Accreditor
ONC-ACB ONC-Authorized Certification Body
ONC-ATCB ONC-Authorized Testing and Certification Body
OPM Office of Personnel Management
PHSA Public Health Service Act
RFA Regulatory Flexibility Act
RIA Regulatory Impact Analysis
SSA Social Security Act

Table of Contents

I. Background
    A. Previously Defined Terminology
    B. Legislative and Regulatory History
    1. Legislative History
    a. Standards, Implementation Specifications, and Certification 
Criteria
    b. Medicare and Medicaid EHR Incentive Programs
    i. Medicare EHR Incentive Program
    ii. Medicaid EHR Incentive Program
    c. HIT Certification Programs
    2. Regulatory History and Related Guidance
    a. Initial Set of Standards, Implementation Specifications, and 
Certification Criteria
    b. Medicare and Medicaid EHR Incentive Programs Proposed Rule
    c. HIT Certification Programs Proposed Rule
    d. Physician Self-Referral Prohibition and Anti-Kickback EHR 
Exception and Safe Harbor Final Rules and ONC Interim

[[Page 11329]]

Guidance Regarding the Recognition of Certification Bodies
    C. Overview of Temporary Certification Program
    D. Overview of Permanent Certification Program
    E. Factors Influencing the Proposal of Both Temporary and 
Permanent Certification Programs
    1. HIT Policy Committee Recommendations
    2. Coordination With the HIT Standards and Certification 
Criteria Interim Final Rule and the Medicare and Medicaid EHR 
Incentive Programs Proposed Rule
    3. Timeliness Related to the Beginning of the Medicare and 
Medicaid EHR Incentive Programs
    i. Public Comment Period
    ii. Urgency of Establishing the Temporary Certification Program
    4. Consultations With NIST
    F. Additional Context for Comparing the Temporary and Permanent 
Certification Programs
    1. The Distinction Between Testing and Certification
    2. Accreditation
    3. Surveillance
II. Provisions of the Temporary Certification Program
    A. Applicability
    B. Definitions
    1. Definition of Applicant
    2. Definition of Day or Days
    3. Definition of ONC-ATCB
    C. Correspondence With the National Coordinator
    D. Temporary Certification Program Application Process for ONC-
ATCB Status
    1. Application for ONC-ATCB Status
    a. Types of Applicants
    b. Types of ONC-ATCB Authorization
    c. Application Part One
    d. Application Part Two
    2. Application Review
    a. Satisfactory Application
    b. Deficient Application Returned and Opportunity To Revise
    3. ONC-ATCB Application Reconsideration Requests
    4. ONC-ATCB Status
    a. Acknowledgement and Representation
    b. Expiration of Status Under the Temporary Certification 
Program
    E. ONC-ATCB Performance of Testing and Certification and 
Maintaining Good Standing as an ONC-ATCB
    1. Authorization To Test and Certify Complete EHRs
    2. Authorization To Test and Certify EHR Modules
    a. Certification Criterion Scope
    b. When Privacy and Security Certification Criteria Apply to EHR 
Modules
    3. Authorized Testing and Certification Methods
    4. The Testing and Certification of ``Minimum Standards''
    5. Maintaining Good Standing as an ONC-ATCB; Violations That 
Could Lead to the Revocation of ONC-ATCB Status; Revocation of ONC-
ATCB Status
    a. Type-1 Violations
    b. Type-2 Violations
    c. Proposed Revocation
    i. Opportunity To Respond to a Proposed Revocation Notice
    ii. Revocation of an ONC-ATCB's Status
    d. Extent and Duration of Revocation Under the Temporary 
Certification Program
    e. Alternative Considered
    6. Validity of Complete EHR and EHR Module Certification
    F. Sunset
III. Provisions of Permanent Certification Program
    A. Applicability
    B. Definitions
    1. Definition of Applicant
    2. Definition of ONC-Approved Accreditor
    3. Definition of Day or Days
    4. Definition of ONC-ACB
    C. Correspondence With the National Coordinator
    D. Permanent Certification Program Application Process for ONC-
ACB Status
    1. Application for ONC-ACB Status
    a. Types of Applicants
    b. Types of ONC-ACB Authorization
    c. Application for ONC-ACB Status
    d. Proficiency Examination
    2. Application Review
    3. ONC-ACB Application Reconsideration Requests
    4. ONC-ACB Status
    a. Acknowledgement and Representation
    b. Expiration of Status Under the Permanent Certification 
Program
    E. ONC-ACB Performance of Certification and Maintaining Good 
Standing as ONC-ACB
    1. Authorization To Certify Complete EHRs
    2. Authorization To Certify EHR Modules
    3. Authorization To Certify Other HIT
    4. Authorized Certification Methods
    5. The Certification of ``Minimum Standards''
    6. Maintaining Good Standing as an ONC-ACB; Violations That 
Could Lead to Revocation of ONC-ACB Status; Revocation of ONC-ACB 
Status
    7. Validity of Complete EHR and EHR Module Certification
    8. Differential Certification
    F. ONC-Approved Accreditor
    1. Requirements for Becoming an ONC-AA
    2. ONC-AA Ongoing Responsibilities
    3. Number of ONC-AAs and Length of Approval
    G. Promoting Participation in the Permanent Certification 
Program
IV. Response to Comments
V. Collection of Information Requirements
    A. Collection of Information 1: Application for ONC-
ATCB Status Under the Proposed Temporary Certification Program
    B. Collection of Information 2: Application for ONC-ACB 
Status Under the Proposed Permanent Certification Program
    C. Collection of Information 3: ONC-ATCB and ONC-ACB 
Collection and Reporting of Information Related to Complete EHR and/
or EHR Module Certifications
    D. Collection of Information 4: Required Documentation 
for Requesting ONC-Approved Accreditor Status
VI. Regulatory Impact Analysis
    A. Introduction
    B. Why This Rule Is Needed?
    C. Executive Order 12866--Regulatory Planning and Review 
Analyses for the Proposed Temporary and Permanent Certification 
Programs
    1. Temporary Certification Program Estimated Costs
    a. Application Process for ONC-ATCB status
    i. Applicant Costs
    ii. Costs to the Federal Government
    b. Temporary Certification Program: Testing and Certification of 
Complete EHRs and EHR Modules
    2. Permanent Certification Program Estimated Costs
    a. Request for ONC-AA Status
    i. Cost of Submission for Requesting ONC-AA Status
    ii. Cost to the Federal Government
    b. Application Process for ONC-ACB Status and Renewal
    i. Applicant Costs and ONC-ACB Renewal Costs
    ii. Costs to the Federal Government
    c. Permanent Certification Program: Testing and Certification of 
Complete EHRs and EHR Modules
    3. Costs for Collecting, Storing, and Reporting Certification 
Results Under the Temporary and Permanent Certification Programs
    a. Costs to ONC-ATCBs and ONC-ACBs
    b. Costs to the Federal Government
    4. Temporary and Permanent Certification Program Benefits
    D. Regulatory Flexibility Act
    E. Executive Order 13132--Federalism
    F. Unfunded Mandates Reform Act of 1995

I. Background

    [If you choose to comment on the background section, please include 
at the beginning of your comment the caption ``Background'' and any 
additional information to clearly identify the information about which 
you are commenting.]

A. Previously Defined Terminology

    This proposed rule is directly related to the recently published 
(January 13, 2010) health information technology (HIT) Standards and 
Certification Criteria interim final rule (75 FR 2014). Consequently, 
in addition to new terms and definitions discussed later in this 
proposed rule, the following terms have the same meaning as provided at 
45 CFR 170.102.
     Certification criteria means criteria: (1) To establish 
that health information technology meets applicable standards and 
implementation specifications adopted by the Secretary; or (2) that are 
used to test and certify that health information technology includes 
required capabilities.
     Certified EHR Technology means a Complete EHR or a 
combination of EHR Modules, each of which: (1) Meets the

[[Page 11330]]

requirements included in the definition of a Qualified EHR; and (2) has 
been tested and certified in accordance with the certification program 
established by the National Coordinator as having met all applicable 
certification criteria adopted by the Secretary.
     Complete EHR means EHR technology that has been developed 
to meet all applicable certification criteria adopted by the Secretary.
     Disclosure means the release, transfer, provision of 
access to, or divulging in any other manner of information outside the 
entity holding the information.
     EHR Module means any service, component, or combination 
thereof that can meet the requirements of at least one certification 
criterion adopted by the Secretary.
     Implementation specification means specific requirements 
or instructions for implementing a standard.
     Qualified EHR means an electronic record of health-related 
information on an individual that: (1) Includes patient demographic and 
clinical health information, such as medical history and problem lists; 
and (2) has the capacity: (i) To provide clinical decision support; 
(ii) to support physician order entry; (iii) to capture and query 
information relevant to health care quality; and (iv) to exchange 
electronic health information with, and integrate such information from 
other sources.
     Standard means a technical, functional, or performance-
based rule, condition, requirement, or specification that stipulates 
instructions, fields, codes, data, materials, characteristics, or 
actions.

B. Legislative and Regulatory History

1. Legislative History
    The Health Information Technology for Economic and Clinical Health 
(HITECH) Act, Title XIII of Division A and Title IV of Division B of 
the American Recovery and Reinvestment Act of 2009 (ARRA) (Pub. L. 111-
5), was enacted on February 17, 2009. The HITECH Act amended the Public 
Health Service Act (PHSA) and created ``Title XXX--Health Information 
Technology and Quality'' (Title XXX) to improve health care quality, 
safety, and efficiency through the promotion of health information 
technology (HIT) and electronic health information exchange. Section 
3001 of the PHSA establishes by statute the Office of the National 
Coordinator for Health Information Technology (ONC). Title XXX of the 
PHSA provides the National Coordinator and the Secretary of the 
Department of Health and Human Services (the Secretary) with new 
responsibilities and authorities related to HIT. The HITECH Act also 
amended several sections of the Social Security Act (SSA) and in doing 
so established the availability of incentive payments to eligible 
professionals and eligible hospitals to promote the adoption and 
meaningful use of interoperable HIT.
a. Standards, Implementation Specifications, and Certification Criteria
    With the passage of the HITECH Act, two new Federal advisory 
committees were established, the HIT Policy Committee and the HIT 
Standards Committee (sections 3002 and 3003 of the PHSA, respectively). 
Each is responsible for advising the National Coordinator on different 
aspects of standards, implementation specifications, and certification 
criteria. The HIT Policy Committee is responsible for, among other 
duties, recommending priorities for the development, harmonization, and 
recognition of standards, implementation specifications, and 
certification criteria while the HIT Standards Committee is responsible 
for recommending standards, implementation specifications, and 
certification criteria for adoption by the Secretary under section 3004 
of the PHSA consistent with the ONC-Coordinated Federal Health IT 
Strategic Plan (the ``strategic plan'').
    Section 3004 of the PHSA defines how the Secretary adopts 
standards, implementation specifications, and certification criteria. 
Section 3004(a) of the PHSA defines a process whereby an obligation is 
imposed on the Secretary to review standards, implementation 
specifications, and certification criteria and identifies the 
procedures for the Secretary to follow to determine whether to adopt 
any grouping of standards, implementation specifications, or 
certification criteria included among National Coordinator-endorsed 
recommendations.
b. Medicare and Medicaid EHR Incentive Programs
    Title IV, Division B of the HITECH Act establishes incentive 
payments under the Medicare and Medicaid programs for eligible 
professionals and eligible hospitals that meaningfully use Certified 
EHR Technology. The Centers for Medicare & Medicaid Services (CMS) is 
charged with developing the Medicare and Medicaid EHR incentive 
programs.
i. Medicare EHR Incentive Program
    Section 4101 of the HITECH Act added new subsections to section 
1848 of the SSA to establish incentive payments for the meaningful use 
of Certified EHR Technology by eligible professionals participating in 
the Medicare Fee-for-Service (FFS) program beginning in calendar year 
(CY) 2011 and beginning in CY 2015, downward payment adjustments for 
covered professional services provided by eligible professionals who 
are not meaningful users of Certified EHR Technology. Section 4101(c) 
of the HITECH Act added a new subsection to section 1853 of the SSA 
that provides incentive payments to Medicare Advantage (MA) 
organizations for their affiliated eligible professionals who 
meaningfully use Certified EHR Technology beginning in CY2011 and 
beginning in 2015, downward payment adjustments to MA organizations to 
account for certain affiliated eligible professionals who are not 
meaningful users of Certified EHR Technology.
    Section 4102 of the HITECH Act added new subsections to section 
1886 of the SSA that establish incentive payments for the meaningful 
use of Certified EHR Technology by subsection (d) hospitals (defined 
under section 1886(d)(1)(B) of the SSA) that participate in the 
Medicare FFS program beginning in Federal fiscal year (FY) 2011 and 
beginning in FY 2015, downward payment adjustments to the market basket 
updates for inpatient hospital services provided by such hospitals that 
are not meaningful users of Certified EHR Technology. Section 4102(b) 
of the HITECH Act amends section 1814 of the SSA to provide an 
incentive payment to critical access hospitals that meaningfully use 
Certified EHR Technology based on the hospitals' reasonable costs 
beginning in FY 2011 and downward payment adjustments for inpatient 
hospital services provided by such hospitals that are not meaningful 
users of Certified EHR Technology for cost reporting periods beginning 
in FY 2015. Section 4102(c) of the HITECH Act adds a new subsection to 
section 1853 of the SSA to provide incentive payments to MA 
organizations for certain affiliated eligible hospitals that 
meaningfully use Certified EHR Technology and beginning in FY 2015, 
downward payment adjustments to MA organizations for those affiliated 
hospitals that are not meaningful users of Certified EHR Technology.

[[Page 11331]]

ii. Medicaid EHR Incentive Program
    Section 4201 of the HITECH Act amends section 1903 of the SSA to 
provide 100 percent Federal financial participation (FFP) to States for 
incentive payments to certain eligible health care providers 
participating in the Medicaid program to purchase, implement, and 
meaningfully use (including support services and training for staff) 
Certified EHR Technology and 90 percent FFP for State administrative 
expenses related to the incentive program.
c. HIT Certification Programs
    Section 3001(c)(5) of the PHSA provides the National Coordinator 
with the authority to establish a certification program or programs for 
the voluntary certification of HIT. Specifically, section 3001(c)(5)(A) 
specifies that the ``National Coordinator, in consultation with the 
Director of the National Institute of Standards and Technology, shall 
keep or recognize a program or programs for the voluntary certification 
of health information technology as being in compliance with applicable 
certification criteria adopted under this subtitle'' (i.e., 
certification criteria adopted by the Secretary under section 3004 of 
the PHSA). The certification program(s) must also ``include, as 
appropriate, testing of the technology in accordance with section 
13201(b) of the [HITECH] Act.''
    Section 13201(b) of the HITECH Act requires that with respect to 
the development of standards and implementation specifications, the 
Director of the National Institute of Standards and Technology (NIST), 
in coordination with the HIT Standards Committee, ``shall support the 
establishment of a conformance testing infrastructure, including the 
development of technical test beds.'' The United States Congress also 
indicated that ``[t]he development of this conformance testing 
infrastructure may include a program to accredit independent, non-
Federal laboratories to perform testing.''

2. Regulatory History and Related Guidance

a. Initial Set of Standards, Implementation Specifications, and 
Certification Criteria
    In accordance with section 3004(b)(1) of the PHSA, the Secretary 
published an interim final rule with request for comments entitled 
``Health Information Technology: Initial Set of Standards, 
Implementation Specifications, and Certification Criteria for 
Electronic Health Record Technology'' (HIT Standards and Certification 
Criteria interim final rule) (75 FR 2014), which adopted an initial set 
of standards, implementation specifications, and certification 
criteria. The standards, implementation specifications, and 
certification criteria adopted by the Secretary establish the 
capabilities that Certified EHR Technology must include in order to, at 
a minimum, support the achievement of what has been proposed for 
meaningful use Stage 1 by eligible professionals and eligible hospitals 
under the Medicare and Medicaid EHR Incentive Programs proposed rule 
(see 75 FR 1844 for more information about meaningful use and the 
proposed Stage 1 requirements).
b. Medicare and Medicaid EHR Incentive Programs Proposed Rule
    On January 13, 2010, CMS published in the Federal Register (75 FR 
1844) the Medicare and Medicaid EHR Incentive Program proposed rule. 
The rule proposes a definition for meaningful use Stage 1 and 
regulations associated with the incentive payments made available under 
Division B, Title IV of the HITECH Act. CMS has proposed that 
meaningful use Stage 1 would begin in 2011 and has proposed that Stage 
1 would focus on ``electronically capturing health information in a 
coded format; using that information to track key clinical conditions 
and communicating that information for care coordination purposes 
(whether that information is structured or unstructured), but in 
structured format whenever feasible; consistent with other provisions 
of Medicare and Medicaid law, implementing clinical decision support 
tools to facilitate disease and medication management; and reporting 
clinical quality measures and public health information.''
c. HIT Certification Programs Proposed Rule
    Section 3001(c)(5) of the PHSA, specifies that the National 
Coordinator ``shall keep or recognize a program or programs for the 
voluntary certification of health information technology as being in 
compliance with applicable certification criteria adopted [by the 
Secretary] under this subtitle.'' We are using this authority to 
propose both temporary and permanent certification programs for HIT. 
These certification programs are necessary in order to assure that 
eligible professionals and eligible hospitals are able to adopt and 
implement Certified EHR Technology in an effort to qualify for 
meaningful use incentive payments.
    Although the initial and primary purpose of our proposed temporary 
and permanent certification programs would be to test and certify 
Complete EHRs and EHR Modules, we believe that Congress did not intend 
to limit the National Coordinator's authority solely to this purpose. 
The National Coordinator is expressly authorized to establish a 
voluntary certification program or programs for ``health information 
technology,'' not simply EHRs. As a result, we expect that our 
permanent certification program could also include the testing and 
certification of other types and aspects of HIT. Examples of other 
types of HIT that could be tested and certified under the permanent 
certification program include personal health records (PHRs) and 
networks designed for the electronic exchange of health information. We 
invite public comment on the need for additional HIT certifications, 
the types of HIT that would be appropriate for certification, and on 
any of the potential benefits or challenges associated with certifying 
other types of HIT.
d. Physician Self-Referral Prohibition and Anti-Kickback EHR Exception 
and Safe Harbor Final Rules and ONC Interim Guidance Regarding the 
Recognition of Certification Bodies
    In August 2006, HHS published two final rules in which CMS and the 
Office of Inspector General (OIG) promulgated an exception to the 
physician self-referral prohibition and a safe harbor under the anti-
kickback statute, respectively, for certain arrangements involving the 
donation of interoperable EHR software to physicians and other health 
care practitioners or entities (71 FR 45140 and 71 FR 45110, 
respectively). The exception and safe harbor provide that EHR software 
will be ``deemed to be interoperable if a certifying body recognized by 
the Secretary has certified the software no more than 12 months prior 
to the date it is provided to the [physician/recipient].'' ONC 
published separately a Certification Guidance Document (CGD) (71 FR 
44296) to explain the factors ONC would use to determine whether to 
recommend to the Secretary a body for ``recognized certification body'' 
status. The CGD serves as a guide for ONC to evaluate applications for 
``recognized certification body'' status and provides the information a 
body would need to apply for and obtain such status. To date, the 
Certification Commission for Health Information Technology (CCHIT) has 
been the only organization that has both applied for and been granted 
``recognized certification body'' status under the CGD.
    In section VI of the CGD, ONC notified the public, including 
potential

[[Page 11332]]

applicants, that the recognition process explained in the CGD would be 
formalized through notice and comment rulemaking and that when a final 
rule has been promulgated to govern the process by which a ``recognized 
certification body'' is determined, certification bodies recognized 
under the CGD would be required to complete new applications and 
successfully demonstrate compliance with all requirements of the final 
rule.
    This proposed rule marks the beginning of the formal notice and 
comment rulemaking described in the CGD. As a result, the processes we 
propose for the temporary certification program and permanent 
certification program, once finalized, would supersede the CGD, and the 
authorization process would constitute the new established method for 
``recognizing'' certification bodies, as referenced in the physician 
self-referral prohibition and anti-kickback EHR exception and safe 
harbor final rules. Consequently, certifications issued by a 
certification body ``authorized'' by the National Coordinator would 
enable Complete EHRs and EHR Modules to meet the definition of 
Certified EHR Technology, and it would constitute certification by ``a 
certifying body recognized by the Secretary'' in the context of the 
physician self-referral EHR exception and anti-kickback EHR safe 
harbor.
    We request comment on whether we should construe the proposed new 
``authorization'' process as the Secretary's method for ``recognizing'' 
certification bodies in the context of the physician self-referral EHR 
exception and anti-kickback EHR safe harbor.

C. Overview of Temporary Certification Program

    We are proposing a temporary certification program to describe the 
process by which an organization would become an ONC-Authorized Testing 
and Certification Body (ONC-ATCB) and authorized under the temporary 
certification program to perform the testing and certification of 
Complete EHRs and/or EHR Modules. Under the temporary certification 
program, the National Coordinator would assume many of the 
responsibilities that we have proposed that other organizations would 
otherwise fulfill under the permanent certification program.
    In order to become an ONC-ATCB, an organization (or organizations) 
would need to submit an application to the National Coordinator to 
demonstrate its competency and ability to test and certify Complete 
EHRs and/or EHR Modules. We propose under the temporary certification 
program that in order to become an ONC-ATCB, an applicant must be able 
to both test and certify Complete EHRs and/or EHR Modules. We 
anticipate that only a few organizations would qualify and become ONC-
ATCBs under the temporary certification program. We also propose 
conditions and requirements applicable to the testing and certification 
of Complete EHRs and EHR Modules. Under the temporary program, the 
National Coordinator would accept applications for ONC-ATCB status at 
any time. The temporary program would sunset once the permanent 
certification program is established and at least one certification 
body has been authorized by the National Coordinator.

D. Overview of Permanent Certification Program

    For the permanent certification program, we are proposing that 
several of the responsibilities assumed by the National Coordinator 
under the temporary certification program would be fulfilled by others. 
The National Coordinator would, where appropriate, seek to move as many 
of the temporary certification program's processes as possible to 
organizations in the private sector. We are proposing a process in the 
permanent certification program by which an organization would become 
an ONC-Authorized Certification Body (ONC-ACB). Please note, that an 
``ONC-ACB'' in the permanent certification program is different than an 
``ONC-ATCB'' in the temporary certification program. Under the 
permanent certification program, we are proposing that the National 
Coordinator's authorization would be valid solely for certification. We 
are also proposing that an applicant for ONC-ACB status must be 
accredited prior to submitting an application to the National 
Coordinator. An applicant's accreditation would be a critical factor in 
the National Coordinator's decision to grant it ONC-ACB status. We 
discuss in section III.F the process by which the National Coordinator 
would approve an accreditor (an ``ONC-Approved Accreditor'' (ONC-AA)) 
for certification bodies who intend to apply for ONC-ACB status.
    Accreditation would also play an important role with respect to 
testing. As we discuss, the National Coordinator's authorization in the 
permanent certification program would no longer be valid for the 
purposes of testing Complete EHRs and EHR Modules. Instead, we propose 
that NIST through the National Voluntary Laboratory Accreditation 
Program (NVLAP) (and in accordance with section 13201(b) of the HITECH 
Act) would be responsible for accrediting testing laboratories and 
determining their competency. In this role, NIST would be solely 
responsible for overseeing activities related to testing laboratories. 
We further propose that ONC-ACBs would only be permitted to accept test 
results from NVLAP-accredited testing laboratories when evaluating a 
Complete EHR or EHR Module for certification. We also propose for the 
permanent certification program, similar to the temporary certification 
program, conditions and requirements that would apply to the 
certification of Complete EHRs and EHR Modules. Finally, unlike the 
temporary certification program, we propose that an ONC-ACB would be 
required to renew its status every two years under the permanent 
certification program.

E. Factors Influencing the Proposal of both Temporary and Permanent 
Certification Programs

    A number of factors played a role in our decision to propose a 
temporary certification program that could be implemented quickly, and 
a permanent certification program that would be established for the 
long term. These factors include the recommendations of the HIT Policy 
Committee; the interrelationships of this proposed rule with the HIT 
Standards and Certification Criteria interim final rule (75 FR 2014) 
and the Medicare and Medicaid EHR Incentive Programs proposed rule (75 
FR 1844); the need for eligible professionals and eligible hospitals to 
have Certified EHR Technology available in a timely manner; and our 
consultations with NIST.
1. HIT Policy Committee Recommendations
    As noted above, section 3002(b) requires the HIT Policy Committee 
to make recommendations to the National Coordinator related to the 
implementation of a nationwide health information technology 
infrastructure. As part of this responsibility, the HIT Policy 
Committee made five recommendations to the National Coordinator on 
August 14, 2009, which support the approach proposed in this rule. The 
recommendations addressed the scope of the certification process in 
general and the approach the National Coordinator should take to 
establish certification programs. The HIT Policy Committee recommended 
``that in defining the certification process[hellip]the following 
objectives are pursued:
    (1) Focus certification on Meaningful Use.

[[Page 11333]]

    (2) Leverage the certification process to improve progress on 
privacy, security, and interoperability.
    (3) Improve the objectivity and transparency of the certification 
process.
    (4) Expand certification to include a range of software sources, 
e.g., open source, self-developed, etc.
    (5) Develop a short-term certification transition plan.''
    The National Coordinator reviewed and considered the 
recommendations made by the HIT Policy Committee and concluded that 
they should be used to provide direction for the proposals included in 
this rule. We believe that the proposals in this rule reflect the 
overall intent of the HIT Policy Committee's recommendations.
    We interpret the HIT Policy Committee's use of the word ``self-
developed'' and use it throughout the preamble to mean a Complete EHR 
or EHR Module that has been designed, modified, or created by, or under 
contract for, a person or entity that will assume the total costs for 
its testing and certification and will be a primary user of the 
Complete EHR or EHR Module. Self-developed Complete EHRs and EHR 
Modules could include brand new Complete EHRs or EHR Modules developed 
by a health care provider or their contractor. It could also include a 
previously purchased Complete EHR or EHR Module which is subsequently 
modified by the health care provider or their contractor and where such 
modifications are made to capabilities addressed by certification 
criteria adopted by the Secretary. We limit the scope of 
``modification'' to only those capabilities for which the Secretary has 
adopted certification criteria because other capabilities (e.g., a 
different graphical user interface (GUI)) would not affect the 
underlying capabilities a Complete EHR or EHR Module would need to 
include in order to be tested and certified.
    Accordingly, we would only refer to the Complete EHR or EHR Module 
as ``self-developed'' if the health care provider paid the total costs 
to have the Complete EHR or EHR Module tested and certified. For 
example, if hospital A self-develops a Complete EHR, pays for the 
Complete EHR to be tested and certified, and then goes on to sell or 
make it freely available to additional hospitals, we would not refer to 
the Complete EHRs used by those hospitals (other than hospital A) as 
being self-developed.
2. Coordination With the HIT Standards and Certification Criteria 
Interim Final Rule and the Medicare and Medicaid EHR Incentive Programs 
Proposed Rule
    This proposed rule is the third and final element of HHS's 
coordinated rulemakings to define the meaningful use of Certified EHR 
Technology and support the achievement of meaningful use.
    As required by the HITECH Act, eligible professionals and eligible 
hospitals must demonstrate meaningful use of Certified EHR Technology 
in order to receive incentive payments under the Medicare and Medicaid 
EHR Incentive Programs. This proposed rule would create the 
certification programs under which Complete EHRs and EHR Modules could 
be tested and certified and subsequently used as Certified EHR 
Technology by eligible professionals and eligible hospitals. Once 
authorized by the National Coordinator, ONC-ATCBs under the temporary 
certification program and ONC-ACBs under the permanent certification 
program would be obligated to use the certification criteria adopted by 
the Secretary and identified at 45 CFR 170.302, 45 CFR 170.304, and 45 
CFR 170.306. The Secretary intends to adopt subsequent certification 
criteria to support the requirements for future meaningful use stages 
once promulgated in regulation by CMS and may, where appropriate, adopt 
certification criteria for other types of HIT.
3. Timeliness Related to the Beginning of the Medicare and Medicaid EHR 
Incentive Programs
i. Public Comment Period
    Congress established specific timeframes in the HITECH Act for the 
beginning of the Medicare EHR incentive program. The first payment year 
for eligible professionals was defined as calendar year 2011 (i.e., the 
year beginning January 1, 2011) and the first payment year for eligible 
hospitals was defined as fiscal year 2011 (i.e., the year beginning 
October 1, 2010). Congress specified in section 1903(t)(6)(C)(i)(I) of 
the SSA that ``for the first year of payment to a Medicaid provider 
under this subsection, the Medicaid provider [must] demonstrate that it 
is engaged in efforts to adopt, implement, or upgrade certified EHR 
technology.'' Although there is no specified date for States to begin 
implementing the Medicaid EHR incentives program, Congress did set a 
cutoff for when first payments would no longer be permitted to Medicaid 
providers (``for any year beginning after 2016''). While the Medicare 
and Medicaid EHR Incentive Programs proposed rule provides more detail 
for this statutory provision, it is important to note that Medicaid 
providers will not be able to receive an incentive payment for 
``adopting, implementing, or upgrading Certified EHR Technology'' until 
a certification program is established to allow for the testing and 
certification of Complete EHRs and EHR Modules.
    To meet the previously mentioned timeframes, Certified EHR 
Technology must be available before the fall of 2010. Accomplishing 
this goal will require many simultaneous actions:
     Complete EHRs and EHR Modules may need to be reprogrammed 
or redesigned in order to meet the certification criteria adopted by 
the Secretary;
     A certification program must be established to allow for 
testing and certification of Complete EHRs and EHR Modules; and
     A collection of Complete EHRs and EHR Modules will need to 
be tested and certified under the established temporary certification 
program.
    For these reasons, among others discussed below, we have chosen to 
propose the establishment of a temporary certification program that 
could be established and become quickly operational in order to assure 
the availability of Certified EHR Technology prior to the beginning of 
meaningful use Stage 1.
    With these timing constraints in mind, we have provided for a 30-
day public comment period on our proposals for the temporary 
certification program and a 60-day comment period on our proposals for 
the permanent certification program. Section 6(a)(1) of Executive Order 
12866 on Regulatory Planning and Review (September 30, 1993, as further 
amended) states that ``each agency should afford the public a 
meaningful opportunity to comment on any proposed regulation, which in 
most cases should include a comment period of not less than 60 days.'' 
We believe that it is appropriate to follow this guidance in soliciting 
public comment on our proposed permanent certification program because 
the permanent certification program's final rule will be issued some 
months after the final rule for the temporary certification program. 
However, as discussed throughout the preamble, the circumstances and 
time constraints under which the temporary certification program must 
be established are different. As a result, we believe that a 30-day 
comment period provides a meaningful opportunity for the public to 
comment on our proposals for the temporary certification program

[[Page 11334]]

and that it will allow ONC to thoughtfully consider comments before 
issuing a timely final rule to implement the temporary certification 
program. In light of the common proposals we have made for certain 
parts of the temporary and permanent certification programs, we 
anticipate considering all comments made on this proposed rule when we 
finalize the permanent certification program's final rule.
    We have proposed a temporary certification program based on our 
estimates that it would take too long to establish some of the elements 
included in our proposed permanent certification program. For example, 
these elements include approximately 6-9 months for the establishment 
of the accreditation processes for both testing laboratories by NVLAP 
and certification bodies by an ONC-AA as well as the time following for 
organizations to gain their accreditation and then subsequently apply 
to the National Coordinator for ONC-ACB status. Given our goal to 
assure availability of Certified EHR Technology prior to the beginning 
of meaningful use Stage 1, we believe that the establishment of a 
temporary certification program is a pragmatic and prudent approach to 
take. Additionally, we believe that a temporary certification program 
is necessary because even assuming the National Coordinator receives 
applications from organizations seeking to become ONC-ATCBs under the 
temporary certification program on the first possible day they can 
apply, we efficiently process the applications, and ultimately 
authorize one or more organizations, it is likely that ONC-ATCBs will 
not exist until May or June 2010. It will also take ONC-ATCBs time to 
process requests for testing and certification under the temporary 
certification program.
ii. Urgency of Establishing the Temporary Certification Program
    As we have discussed, the HITECH Act provides that eligible 
professionals and eligible hospitals must demonstrate meaningful use of 
Certified EHR Technology in order to receive incentive payments under 
the Medicare and Medicaid EHR Incentive Programs.
    This rule proposes the creation of a temporary certification 
program, in addition to a permanent certification program, under which 
Complete EHRs and EHR Modules could be tested and certified, and 
subsequently adopted and implemented by eligible professionals and 
eligible hospitals in order to attempt to qualify for incentive 
payments under meaningful use Stage 1. Establishing the temporary 
certification program in a timely fashion is critical to begin enabling 
eligible professionals and eligible hospitals to achieve meaningful use 
within the required timeframes. For this goal to be accomplished both 
the HIT industry and the Department will have to achieve several 
milestones before Complete EHRs and EHR Modules can be tested and 
certified. After the close of the public comment period for the 
proposed temporary certification program, ONC will review and consider 
timely submitted public comments and then draft and publish the 
temporary certification program's final rule. The HIT industry will 
then need to respond. Organizations seeking to apply for ONC-ATCB 
status will submit their applications, the National Coordinator will 
then review and assess them, and if necessary, seek additional 
information through the established process. Once the National 
Coordinator has authorized the first ONC-ATCB, the testing and 
certification of Complete EHRs and EHR Modules will need to take place 
in accordance with the temporary certification program provisions.
    To facilitate an immediate launch of the ONC-ATCB application 
review process under the temporary certification program, we are also 
proposing that the National Coordinator accept and hold all 
applications for ONC-ATCB status received prior to the final rule 
effective date. Under the Administrative Procedure Act (5 U.S.C. 
553(d)), publication of a substantive final rule must occur not less 
than 30 days before its effective date, absent certain statutory 
exceptions. In other words, a substantive rule cannot become effective 
until 30 days after its publication, unless an exception applies. We 
are consequently proposing that the National Coordinator simply accept 
and hold all applications for ONC-ATCB status that are received prior 
to the temporary certification program's final rule's effective date, 
so that immediately upon the final rule becoming effective, the 
National Coordinator could begin reviewing received applications 
without further delay. We request public comment on this proposal and 
the urgency of establishing the temporary certification program, 
including how this provision might affect the ability of eligible 
professionals and eligible hospitals to timely achieve meaningful use 
Stage 1.
4. Consultations With NIST
    Section 3001(c)(5) of the PHSA directs the National Coordinator to 
consult with the Director of the NIST in the development of a 
certification program or programs. Consistent with this statutory 
provision, we have developed our proposed certification programs with 
the guidance and cooperation of NIST subject matter experts in testing 
and certification. Based on NIST recommendations, we believe it is 
appropriate to use the International Organization for Standardization 
(ISO) and the International Electrotechnical Commission (IEC) ISO/IEC 
Guide 65, ISO/IEC 17025, and ISO/IEC 17011 to structure how testing, 
certification, and accreditation are conducted under our proposed 
certification programs. The ISO Committee on conformity assessment 
(CASCO) prepared ISO/IEC Guide 65, ISO/IEC 17025, and ISO/IEC 17011 and 
we believe the use of the ISO/IEC guide and standards will help ensure 
that the proposed certification programs operate in a manner consistent 
with national and international practices for testing and 
certification.
    Under the temporary certification program we propose that 
applicants for ONC-ATCB status will need to demonstrate to the National 
Coordinator their conformance to both ISO/IEC Guide 65:1996 (Guide 65) 
and ISO/IEC 17025:2005 (ISO 17025). Under the permanent certification 
program applicants for ONC-ACB status would be required to be 
accredited by an ONC-AA for certification which would require a 
demonstration of conformance to Guide 65. Guide 65 specifies the 
``general requirements for bodies operating product certification 
systems.'' The certification of products (including processes and 
services) to this standard provides assurance that the products comply 
with specified technical and business requirements. ISO 17025 is an 
international standard that specifies the ``general requirements for 
competence of testing and calibration laboratories.'' This standard 
addresses how testing should be performed using standard methods, non-
standard methods, and laboratory-developed methods. We believe Guide 65 
and ISO 17025 are necessary and appropriate for ONC-ATCBs to follow 
under the temporary certification program because they provide standard 
procedures and requirements for testing and certification widely 
accepted by the information technology industry and would ensure 
consistency and efficiency in the testing and certification procedures 
ONC-ATCBs would perform.
    Under the permanent certification program we believe and have 
proposed that an ONC-AA for certification would have to conform to ISO/
IEC 17011:2004 (ISO 17011). ISO 17011 is an international standard that 
specifies the ``general requirements for accreditation bodies 
accrediting conformity

[[Page 11335]]

assessment bodies,'' such as certification bodies.
    The ISO/IEC documents use certain terminology that differs from the 
terminology used in this proposed rule. We recognize that this proposed 
rule has been drafted to ensure consistency with existing regulatory 
and/or statutory terms, whereas the ISO/IEC documents were drafted for 
a different purpose and have a broader application to a variety of 
industries. Nevertheless, we intend certain terms in Guide 65, ISO 
17025, and ISO 17011 to have the same meaning as related terms in this 
proposed rule. To ensure a consistent application of the ISO/IEC 
documents in the context of this proposed rule, we are therefore 
proposing the following crosswalk. The indicated terms in the documents 
specified below would have the meanings attributed to the related terms 
used in this proposed rule, as provided in the following table.

------------------------------------------------------------------------
Terms used in Guide 65, ISO 17025, and ISO   Terms used in this Proposed
                   17011                                Rule
------------------------------------------------------------------------
 Bodies operating product            ONC-ATCB.
 certification systems.
                                             ONC-ACB.
 Certification body...............   Testing and
                                             certification body.
 Conformity assessment bodies.....   Certification body.
 Testing and calibration             Testing laboratory.
 laboratories.
 Accreditation body...............   Accreditation
                                             organization.
                                             ONC-AA.
 Products.........................   Complete EHRs.
                                             EHR Modules.
                                             HIT.
------------------------------------------------------------------------

F. Additional Context for Comparing the Temporary and Permanent 
Certification Programs

    Rather than proposing the temporary and permanent certification 
programs in two separate proposed rules, we have proposed them together 
in this notice of proposed rulemaking because we believe this approach 
provides the public with a broader context for each of the programs and 
a better opportunity to make informed comments. In an effort to prevent 
confusion, though, we first discuss our complete set of proposals for 
the temporary certification program (section II) and then our complete 
set of proposals for the permanent certification program (section III). 
As a result, some of the proposals discussed below for both proposed 
certification programs are very similar, if not the same, and are 
included twice--in the discussions of the temporary certification 
program and the permanent certification program. In other cases, there 
are significant differences between our proposals underlying the 
temporary and permanent certification programs. Before discussing our 
complete set of proposals for the temporary certification program and 
to provide additional context for the temporary program, we summarize 
some of the more significant differences between the temporary and 
permanent certification programs.
1. The Distinction Between Testing and Certification
    We believe that there is a distinct difference between the 
``testing'' and ``certification'' of a Complete EHR and/or EHR Module. 
In this proposed rule, ``testing'' is meant to describe the process 
used to determine the degree to which a Complete EHR or EHR Module can 
meet specific, predefined, measurable, quantitative requirements. These 
results would be able to be compared to and evaluated in accordance 
with predefined measures. In contrast, ``certification'' is meant to 
describe the assessment (and subsequent assertion) made by an 
organization, once it has analyzed the quantitative results rendered 
from testing along with other qualitative factors, that a Complete EHR 
or EHR Module has met all of the applicable certification criteria 
adopted by the Secretary. Qualitative factors could include whether a 
Complete EHR or EHR Module developer has a quality management system in 
place, or whether the Complete EHR or EHR Module developer has agreed 
to the policies and conditions associated with being certified (e.g., 
proper logo usage). Above and beyond testing, the act of certification 
typically promotes confidence in the quality of a product (and the 
vendor that produced it), offers assurance that the product will 
perform as described, and helps to make it easier for consumers to 
differentiate which products have met specific criteria from others 
that have not.
    A fundamental difference between testing and certification is that 
testing is intended to result in objective, unanalyzed data. In 
contrast, certification is expected to result in an overall assessment 
of the test results, consideration of their significance, and 
consideration of other factors to determine whether the prerequisites 
for certification have been achieved. The following is a simple example 
to illustrate an important difference between testing and 
certification.
    An e-prescribing EHR Module developer that seeks to have its EHR 
Module certified would first submit the EHR Module to be tested. To 
successfully pass the established testing requirements, the e-
prescribing EHR Module would, among other functions, need to transmit 
an electronic prescription using mock patient data according to the 
standards adopted by the Secretary. Provided that the e-prescribing EHR 
Module successfully passed this test it would next be evaluated for 
certification. Certification could require that the EHR Module 
developer agree to a number of provisions, including, for example, 
displaying the EHR Module's version and revision number so potential 
purchasers could compare when the EHR Module was last updated or 
certified. If the EHR Module developer agreed to all of the applicable 
certification requirements and the EHR Module achieved a passing test 
result, the e-prescribing EHR Module would be certified. In these 
situations, both the EHR Module passing the technical requirements 
tests and the EHR Module vendor meeting the other certification 
requirements would be required for the EHR Module to achieve 
certification.
2. Accreditation
    We have proposed, in the interest of expediency and to facilitate 
timely certification of Complete EHRs and EHR Modules, that ONC-ATCBs 
under temporary certification program would be authorized (and 
required) to perform both the testing and certification of Complete 
EHRs and/or EHR Modules. Under the temporary certification program, the 
National Coordinator would serve in a role similar to an accreditor and 
would assess an ONC-ATCB applicant's competency to perform both testing 
and certification before granting the applicant ONC-ATCB status. 
However, we do not believe that this would be an optimal or practical 
approach for the long-term because specialized accreditors in the 
private sector are better equipped to react effectively and efficiently 
to changes in the HIT market and to more rigorously oversee the 
certification bodies they accredit. Moreover, we have observed in other 
industries, such as the manufacturing of water-conserving products, 
that testing and certification processes are typically handled 
independently and separately.\1\ Consequently, under the permanent 
certification program, we have proposed to shift the accreditation 
responsibilities for testing laboratories and certification bodies from 
the National Coordinator to other organizations. As previously

[[Page 11336]]

mentioned, we understand that it may take several months to establish 
separate accreditation programs for testing laboratories and 
certification bodies and this factor weighed heavily in our decision to 
propose a temporary certification program. We consequently believe that 
the additional time the temporary certification program would afford 
the Department and HIT industry to develop a HIT-oriented accreditation 
program would greatly assist the HIT industry's transition to the 
accreditation process we have proposed under the permanent 
certification program.
---------------------------------------------------------------------------

    \1\ See http://www.epa.gov/watersense/partners/certification.html.
---------------------------------------------------------------------------

    Under the permanent certification program, we propose the use of 
accreditation as a mechanism to ensure that organizations that test and 
certify Complete EHRs and/or EHR Modules possess the requisite 
competencies to perform such actions with a high degree of precision. 
We believe that the proposed accreditation process will also introduce 
rigor, transparency, trust, and objectivity to the permanent 
certification program. Additionally, accreditation provides an 
oversight mechanism to ensure that testing laboratories and 
certification bodies are properly performing their respective duties. 
Consequently, in order for an applicant under the permanent 
certification program to become an ONC-ACB, we would require that it be 
accredited by an ``ONC-Approved Accreditor'' (ONC-AA) for certification 
in addition to meeting our other proposed application requirements. 
Along these lines, we propose a process by which accreditation 
organizations can request the National Coordinator's approval to become 
an ONC-AA. We believe this process is necessary because we propose 
several responsibilities for an ONC-AA to fulfill in order to ensure 
our programmatic objectives for the permanent certification program are 
met. Additionally, an approval process for an ONC-AA is necessary in 
order for potential applicants for ONC-ACB status to know from whom 
they can request accreditation.
    As we mention above, under the permanent certification program, the 
National Coordinator would only authorize organizations to engage in 
certification. We emphasize that this is not meant to preclude, limit, 
or in any way prevent an organization from also performing the testing 
of Complete EHRs and/or EHR Modules. However, in order for a single 
organization (which may comprise subsidiaries or components) to perform 
both testing and certification under the permanent certification 
program it would need to be: (1) Accredited by an ONC-AA and 
subsequently become an ONC-ACB; and (2) accredited by the NVLAP. We 
request public comment on whether we should give organizations who are 
``dual accredited'' and also become an ONC-ACB a special designation to 
indicate to the public that such an organization would be capable of 
performing both testing and certification under the permanent 
certification program.
    The NVLAP, established by the NIST, develops specific laboratory 
accreditation programs (LAPs) for testing and calibration laboratories 
in response to legislative or administrative actions, requests from 
government agencies or, in special circumstances, from private sector 
entities.\2\ The National Coordinator would make a final determination 
about whether to issue a request to NVLAP to develop a LAP for testing 
laboratories after considering public comments on our proposals for the 
permanent certification program. To ensure that ONC-ACBs review test 
results from legitimate and competent testing laboratories, we propose 
that ONC-ACBs would only be permitted to certify Complete EHRs and/or 
EHR Modules that have been tested by a NVLAP-accredited testing 
laboratory.
---------------------------------------------------------------------------

    \2\ ``What is the NVLAP'' http://ts.nist.gov/Standards/upload/What-is-the-NVLAP.pdf.
---------------------------------------------------------------------------

3. Surveillance
    Under the permanent certification program we propose requirements 
for ONC-ACBs related to the surveillance of certified Complete EHRs and 
certified EHR Modules. We also propose certain requirements relating to 
surveillance for ONC-ATCBs under the temporary certification program. 
However, we anticipate that the temporary certification program would 
end close to the time an appropriate sample size of implemented 
certified Complete EHRs and certified EHR Modules would be available 
for ONC-ATCBs to perform ongoing surveillance. As a result of this 
limitation, we have proposed affording less weight to surveillance 
requirement compliance as well as less stringent requirements for ONC-
ATCBs related to surveillance in the temporary certification program 
than we have proposed for ONC-ACBs under the permanent certification 
program.
    We previously mentioned that we would require applicants for ONC-
ACB status to be accredited by an ONC-AA. We propose that an ONC-AA in 
performing accreditation verify a certification body's conformance, at 
a minimum, to Guide 65. As a result, we expect that ONC-ACBs will 
perform surveillance in accordance at a minimum with Guide 65, which in 
section 13, among other provisions, provides that the ``certification 
body [or `ONC-ACB'] shall periodically evaluate the marked [or 
`certified'] products to confirm that they continue to conform to the 
[adopted] standards.'' ONC-ACBs consequently would be required to 
evaluate and reevaluate previously certified Complete EHRs and/or EHR 
Modules to determine whether the Complete EHRs and/or EHR Modules they 
had certified in a controlled environment also perform in an 
acceptable, if not the same, manner in the field as they had performed 
when they were being certified. We discuss our proposals related to 
surveillance in the permanent certification program at section 
III.D.1.c.iii.

II. Provisions of the Temporary Certification Program

    [If you choose to comment on the provisions of the temporary 
certification program, please include at the beginning of your comment 
the specific section title and any additional information to clearly 
identify the proposal about which you are commenting. For example, 
``Definitions'' or ``Sunset.'']

A. Applicability

    This subpart would establish the processes that applicants for ONC-
ATCB status must follow to be granted ONC-ATCB status by the National 
Coordinator, the processes the National Coordinator would follow when 
assessing applicants and granting ONC-ATCB status, and the requirements 
of ONC-ATCBs for testing and certifying Complete EHRs and/or EHR 
Modules in accordance with the applicable certification criteria 
adopted by the Secretary in subpart C.

B. Definitions

1. Definition of Applicant
    We propose that the term applicant mean a single organization or a 
consortium of organizations that seeks to become an ONC-ATCB by 
requesting and subsequently submitting an application for ONC-ATCB 
status to the National Coordinator.
2. Definition of Day or Days
    We propose that unless otherwise explicitly specified, the term day 
or days shall mean a calendar day or calendar days.
3. Definition of ONC-ATCB
    We propose ONC-ATCB to mean an organization or a consortium of 
organizations that has applied to and been authorized by the National 
Coordinator pursuant to the sections

[[Page 11337]]

below to perform the testing and certification of Complete EHRs and/or 
EHR Modules under the temporary certification program.

C. Correspondence With the National Coordinator

    Throughout the following sections, we have proposed numerous 
instances where applicants for ONC-ATCB status and ONC-ATCBs would have 
to correspond with the National Coordinator and vice versa. These 
instances are almost always associated with specific timeframes (e.g., 
the amount of days an applicant has to respond to a deficient 
application notice, etc.). Additionally, because such timeframes either 
trigger the beginning of a review process or the close of a response 
period it is important for there to be clear, unambiguous beginnings 
and endings for when such events must occur (e.g., receipt of an 
application).
    Moreover, it is the National Coordinator's preference to use e-mail 
whenever possible to communicate with an applicant for ONC-ATCB status 
or an ONC-ATCB. Therefore, we generally propose that any communication 
by the National Coordinator would be via e-mail and, where applicable, 
that we would consider the official date of receipt of any e-mail 
between the National Coordinator and an applicant for ONC-ATCB status 
or an ONC-ATCB to be the day the e-mail was sent, as indicated by the 
e-mail time-stamp. Where it is necessary for correspondence to take 
place via regular or express mail, we propose to use ``delivery 
confirmation'' documentation to establish the official date of receipt.

D. Temporary Certification Program Application Process for ONC-ATCB 
Status

1. Application for ONC-ATCB Status
    In order to be considered for ONC-ATCB status, we propose that an 
applicant must submit an application to the National Coordinator. The 
application would be comprised of two parts. In order to receive an 
application, an applicant would have to request one in writing from the 
National Coordinator (requests would be made to the following e-mail 
address: ATCBapplication@hhs.gov).
a. Types of Applicants
    We propose that single organizations and consortia would be 
eligible to apply for ONC-ATCB status under the temporary certification 
program. We expect a consortium, for example, would be comprised of one 
organization that would serve as a testing laboratory and a separate 
organization that would serve as a certification body. When viewed as a 
single applicant, this applicant would be able to perform all of the 
required responsibilities of an ONC-ATCB under the temporary 
certification program. We support this approach and believe that the 
combined expertise of two or more organizations could also result in a 
qualified applicant.
b. Types of ONC-ATCB Authorization
    In order to properly categorize the application provided to an 
applicant, we would require applicants to indicate the type of testing 
and certification they seek authorization to perform under the 
temporary certification program. We propose that applicants must 
request authorization to perform the testing and certification of 
Complete EHRs or solely EHR Modules. We would treat a request for 
authorization to perform the testing and certification of Complete EHRs 
to encompass a request for authorization to perform the testing and 
certification of EHR Modules because, by default, an ONC-ATCB 
authorized to test and certify Complete EHRs would be able to test and 
certify all of the certification criteria adopted by the Secretary at 
45 CFR part 170, subpart C. Therefore, we believe, from a technical 
perspective, that if an ONC-ATCB can test and certify a Complete EHR it 
would also be capable of testing and certifying EHR Modules. With 
respect to EHR Modules, this does not mean that an ONC-ATCB would be 
expected to determine whether one certified EHR Module would be able to 
seamlessly integrate with another EHR Module. Again, as discussed in 
the HIT Standards and Certification Criteria interim final rule, if an 
eligible professional or eligible hospital chooses to use a combination 
of certified EHR Modules to customize their HIT to meet the definition 
of Certified EHR Technology, they have the responsibility to ensure 
that the certified EHR Modules can properly work together. Please note, 
though, that some EHR Modules may be subject to certain additional 
Federal requirements.
    We request public comment on whether ONC-ATCBs should also be 
required to test and certify that any EHR Module presented by one EHR 
Module developer for testing and certification would properly work 
(i.e., integrate) with another EHR Module presented by a different EHR 
Module developer (this request for public comment would also apply to 
ONC-ACBs under the permanent certification program).
    Additionally, we request public comment on whether the National 
Coordinator should permit applicants to seek authorization to test and 
certify only Complete EHRs designed for an ambulatory setting or, 
alternatively, Complete EHRs designed for an inpatient setting. Under 
our current proposal, an applicant seeking authorization to perform 
Complete EHR testing and certification would be required to test and 
certify Complete EHRs designed for both ambulatory and inpatient 
settings. However, if we were to separately authorize Complete EHR 
testing and certification, we see certain benefits for the temporary 
certification program as well as some negative effects. Among the 
benefits, this approach could create the potential that more 
organizations would apply for ONC-ATCB status because fewer resources 
may be needed and could be focused on one type of testing and 
certification. Among the negative effects, this approach could result 
in a situation in which no ONC-ATCB exists to certify one or another 
type of Complete EHR. This would prevent the testing and certification 
of Complete EHRs designed for either an ambulatory or inpatient setting 
from being able to be tested and certified.
    With respect to EHR Modules, we would require applicants to 
identify the type(s) of EHR Module(s) they seek authorization to test 
and certify and would restrict any authorization granted to only those 
types of EHR Module(s). For example, if an applicant requests 
authorization to test and certify electronic prescribing EHR Modules, 
and is subsequently authorized to do so, it would not also be 
authorized to test and certify other EHR Modules, such as those related 
to clinical decision support.
c. Application Part One
    We propose that an applicant must address the following four 
sections in part one of its application:
    i. Under section one, the applicant would be required to provide 
the following general information to, among other reasons, ensure that 
we have proper contact information:
     The name, address, city, State, ZIP code, and Web site of 
the applicant;
     The name, title, phone number, and e-mail of the person 
who will serve as the point of contact for the applicant. This person 
must be legally authorized to execute and submit an application on 
behalf of the applicant (we refer to this person as an ``authorized 
representative'').
    ii. Under section two, the applicant would be required to provide 
the following information in an effort to demonstrate conformance to 
Guide 65

[[Page 11338]]

(which specifies the standards for operating a certification program):
     The results of a completed self-audit to all sections of 
Guide 65. We expect that applicants would complete this self-audit to 
the best of their ability. Because the temporary certification program 
will only be in existence for a relatively short period of time, we 
recognize that certain limitations exist with respect to specific 
sections of Guide 65. In particular, while we expect an applicant to 
address Guide 65 section 13 (surveillance), we anticipate putting 
relatively little weight on the specific responsibilities for ONC-ATCBs 
related to surveillance in the temporary certification program;
     A description of the applicant's management structure 
according to section 4.2 of Guide 65 (Section 4.2 requires an applicant 
to provide a description of its organization including, but not limited 
to, legal or ownership status, decision making processes, assurance of 
objectivity and impartiality in order to justify its ability to 
appropriately operate a certification program);
     A copy of the applicant's quality manual that has been 
developed according to section 4.5.3 of Guide 65 (Section 4.5.3 
requires a quality manual documenting the organization's quality 
system, including, but not limited to, quality objectives and 
commitment to quality, and associated policies and procedures to ensure 
quality);
     The applicant's policies and approach to confidentiality 
according to section 4.10 of Guide 65 (Section 4.10 requires 
documentation of arrangements for safeguarding confidentiality of 
information, consistent with applicable laws);
     The qualifications of each of the applicant's personnel 
who oversee or perform certification according to section 5.2 of Guide 
65 (Section 5.2 requires information on the relevant qualifications, 
training, and expertise of each staff member involved in the 
certification process to be retained and kept up-to-date);
     A copy of the applicant's evaluation reporting procedures 
according to section 11 of Guide 65 (Section 11 requires a description 
of evaluation reporting procedures for conformity or nonconformity of 
products with all certification requirements, including any remedial 
actions necessary for conformity); and
     A copy of the applicant's policies for use and display of 
certificates (e.g., logos) according to section 14 of Guide 65 (Section 
14 requires evidence of policies and procedures for use and display of 
certificates, as appropriate).
    iii. Under section three, the applicant would be required to 
provide the following information in an effort to demonstrate 
conformance to ISO 17025 (which specifies the standards for operating a 
testing program):
     The results of a completed self-audit to all sections of 
ISO 17025;
     A copy of the applicant's quality system document 
according to section 4.2.2 of ISO 17025 (Section 4.2.2 requires a 
quality system document to describe the management system policies 
related to quality, including a quality policy statement covering such 
items as purpose, objectives, and commitment to appropriate standards 
and best professional practices);
     A copy of the applicant's policies and procedures for 
handling testing nonconformities according to section 4.9.1 of ISO 
17025 (Section 4.9.1 requires a description of policies and procedures 
used to identify, evaluate, and correct any nonconformity to testing 
procedures or other requirements); and
     The qualifications of each of the applicant's personnel 
who oversee or perform testing according to section 5.2 of ISO 17025 
(Section 5.2 requires personnel competency records on the relevant 
qualifications, training, and expertise of each staff member involved 
in performing testing to be retained and kept up-to-date).
    iv. Under section four, the applicant would be required to submit a 
properly executed agreement that it will adhere to the ``Principles of 
Proper Conduct for ONC-ATCBs.'' The Principles of Proper Conduct for 
ONC-ATCBs would require an ONC-ATCB to:
     Operate its certification program in accordance with Guide 
65 and its testing program in accordance with ISO 17025.
     Maintain an effective quality management system which 
addresses all requirements of ISO 17025.
     Attend all mandatory ONC training and program update 
sessions.
     Maintain a training program that includes documented 
procedures and training requirements to ensure its personnel are 
competent to test and certify Complete EHRs and/or EHR Modules.
     Use testing tools and procedures published by NIST (e.g., 
published on its Web site or through a notice in the Federal Register) 
or functionally equivalent testing tools and procedures published by 
another entity for the purposes of assessing Complete EHRs and/or EHR 
Modules compliance with the certification criteria adopted by the 
Secretary.
     Report to ONC within 15 days any changes that materially 
affect its:
    [cir] Legal, commercial, organizational, or ownership status;
    [cir] Organization and management, including key testing and 
certification personnel;
    [cir] Policies or procedures;
    [cir] Location;
    [cir] Facilities, working environment or other resources;
    [cir] ONC authorized representative (point of contact); or
    [cir] Other such matters that may otherwise materially affect its 
ability to test and certify Complete EHRs and/or EHR Modules.
     Allow ONC, or its authorized agents(s), to periodically 
observe on site (unannounced or scheduled) during normal business 
hours, any testing and/or certification performed to demonstrate 
compliance with the requirements of the temporary certification 
program.
     Provide ONC, no less frequently than weekly, a current 
list of Complete EHRs and/or EHR Modules that have been tested and 
certified which includes, at a minimum, the vendor name (if 
applicable), the date certified, product version, the unique 
certification number or other specific product identification, and 
where applicable, the certification criterion or certification criteria 
to which each EHR Module has been tested and certified.
     Retain all records related to the testing and 
certification of Complete EHRs and/or EHR Modules for the duration of 
the temporary certification program and provide copies of all testing 
and certification records to ONC at the sunset of the temporary 
certification program.
     Promptly refund any and all fees received for tests and 
certifications that will not be completed.
    We believe that adherence to these principles is necessary because 
they will help protect the integrity of the certification program and 
ensure that an applicant is capable of satisfactorily carrying out the 
required duties and responsibilities of an ONC-ATCB.
    With respect to the third-to-the last principle listed, and in an 
effort to make it easier for eligible professionals and eligible 
hospitals to cross-validate that they have in fact adopted Certified 
EHR Technology, the National Coordinator intends to make a master 
``certified HIT products list'' of all Complete EHRs and EHR Modules 
tested and certified by ONC-ATCBs available on the ONC Web site. This 
Web site would be a public service and would be a single, aggregate 
source of all the certified product information ONC-ATCBs provide to 
the

[[Page 11339]]

National Coordinator. The master certified HIT products list would also 
represent all of the Complete EHRs and EHR Modules that could be used 
to meet the definition of Certified EHR Technology. Over time, we 
anticipate adding features to this Web site, which could include 
interactive functions to enable eligible professionals and eligible 
hospitals to use to determine whether a combination of certified EHR 
Modules, for instance, constitutes Certified EHR Technology.
    With respect to the second to the last listed principle of proper 
conduct, because we anticipate that the temporary certification program 
will sunset in a relatively short period of time, we have proposed that 
all testing and certification records created by ONC-ATCBs must be 
retained, at a minimum, for the duration of the temporary certification 
program rather than proposing a specific preset length of time for 
record retention. Further, we propose that when the temporary 
certification program sunsets, all ONC-ATCBs would be required to 
provide to the National Coordinator copies of all of their testing and 
certification records. We also propose a specific minimum time period 
for record retention in the permanent certification program.
d. Application Part Two
    In part two of the ONC-ATCB application process, applicants would 
be required to complete a proficiency examination. A proficiency 
examination would be used to assess whether an applicant can 
competently test and certify Complete EHRs and/or EHR Modules. Because 
the National Coordinator under the temporary certification program is 
performing a role similar to an accreditor, we believe a proficiency 
examination is a necessary requirement. We propose to create the 
proficiency examination with NIST's assistance and to design it to 
evaluate an applicant's knowledge and understanding of HIT 
functionality and standards and certification criteria, as well as 
their ability to properly test and certify Complete EHRs and/or EHR 
Modules. We believe that key personnel directly employed by applicants 
should be primarily responsible for completing the proficiency 
examination. Due to the topics it will cover, we anticipate that 
several key personnel may be required to complete the proposed 
proficiency examination. While we have not proposed to prohibit 
applicants from consulting with outside experts to complete their 
application, applicants would still need to clearly demonstrate in the 
material they submit to the National Coordinator that they will be able 
to competently operate a testing and certification program. In 
reviewing applications, the National Coordinator would take such 
assistance into account in order to determine whether an applicant's 
purported competency is not artificially inflated by temporarily 
retained outside expertise.
    We propose to include questions in each proficiency exam from the 
following three sections. While a proficiency examination would address 
each of the sections below, we plan to generate a pool of questions 
from which a random selection would be used for an individual 
proficiency examination to ensure that no two proficiency examinations 
will be exactly the same. We have provided example questions for each 
section, but we do not believe that the specific proficiency exam 
questions should be made publicly available. The purpose of a 
proficiency examination is for an applicant to prove to the National 
Coordinator at the time of application submission that it possesses an 
adequate level of knowledge to competently perform the testing and 
certification of Complete EHRs and/or EHR Modules. Consequently, our 
rationale for posing different questions in each proficiency 
examination is the same as our reason for not making the specific 
proficiency examination questions available prior to an applicant 
submitting a satisfactory application--we seek to prevent an applicant 
from preparing answers in advance, which could inaccurately reflect an 
applicant's true competency. We are proposing that the applicant also 
affirmatively attest that it will not copy, retain, disclose, or in any 
way divulge any information from the proficiency examination.
 Section 1--Knowledge Quiz
    This section would require an applicant to demonstrate a solid 
understanding of, and technical expertise in, Complete EHRs and/or EHR 
Modules. The applicant would be required to address the following 
concepts in a quiz format: Basic health IT knowledge; familiarity with 
the standards, implementation specifications, and certification 
criteria adopted by the Secretary; familiarity with test methods 
associated with the certification criteria adopted by the Secretary; 
and ability to determine how a test should be performed for a 
particular set of certification criteria.
    An example question for section 1 would be: Please indicate the 
certification criteria adopted by the Secretary that also require 
compliance with specific standards. For each certification criterion, 
indicate its purpose and, if applicable, the potential alternative 
standard(s) adopted by the Secretary to which a Complete EHR or EHR 
Module could be tested and certified.
 Section 2--Identification of Test Tools
    This section would require an applicant to demonstrate that it can 
correctly identify and use test tools published by ONC for Complete 
EHRs and EHR Modules. The test tools and functional testing techniques 
for the certification criteria adopted by the Secretary have been or 
will be developed by NIST. We expect that these test tools will 
available prior to, or at the same time as the temporary certification 
program's final rule is published.
    An example question for section 2 would be: Please describe the 
steps you would take to test the capability of a Complete EHR or EHR 
Module to generate a patient summary record.
 Section 3--Proper Use of Test Tools and Understanding Test 
Results
    This section would require an applicant to demonstrate that it can 
properly use test tools (e.g., a continuity of care document (CCD) 
validation tool), can correctly interpret test results generated by 
test tools, and further when using test tools that the test results the 
applicant produces are consistent.
    An example question for section 3 would be: Using the XYZ test tool 
with the following sample data sets, please indicate which data sets 
passed the test, which data sets failed because of errors, and for 
those that data sets that resulted in a failure discuss why such a 
failure occurred.
2. Application Review
    An applicant would be permitted to submit its application 
electronically via e-mail or on paper, or via regular or express mail 
(we believe that electronic applications would be the most efficient). 
We propose that the National Coordinator be permitted up to 30 days to 
review an application once it has been received (the National 
Coordinator would notify the applicant's authorized representative to 
acknowledge that the application was received). We propose to review 
applications for ONC-ATCB status in the order in which they are 
received and to review and rule on an application's parts sequentially 
(i.e., we will first review part one of an application and if 
deficiencies are found we will not review part two). We propose to 
notify the applicant if: (1) Its entire application was reviewed and

[[Page 11340]]

found to be satisfactory or; (2) if its application was reviewed and 
deficiencies were found in either part one or part two of the 
application. In instances where deficiencies have been found, we 
propose to return the entire application with the deficiencies 
identified in the applicable part of the application.
a. Satisfactory Application
    Applicants with satisfactory applications would be notified of 
their successful achievement of ONC-ATCB status and upon receipt of 
this notification would be permitted to represent themselves as ``ONC-
ATCBs'' and begin testing and certifying Complete EHRs and/or EHR 
Modules, as applicable.
b. Deficient Application Returned and Opportunity To Revise
    We propose to formally return an application if part one or part 
two contains deficiencies. If we discover deficiencies in part one of 
an application, we would not review part two until part one is 
satisfactory. In the event that a portion of an applicant's response to 
its proficiency examination is determined to be deficient, the National 
Coordinator may pose an equivalent replacement question for an 
applicant to respond to from the appropriate question pool. We propose 
that the National Coordinator would have the discretion to have an 
element of an application clarified or request that an inadvertent 
error or minor omission be corrected. In these cases, before issuing a 
formal deficiency notice, we propose that the National Coordinator may 
request such information from the applicant's authorized representative 
as an addendum to its application. If the applicant fails to provide 
such information to the National Coordinator in the timeframe specified 
by the National Coordinator, but no less than 5 days, the National 
Coordinator could issue a formal deficiency notice. In other 
circumstances, the National Coordinator could immediately send a formal 
deficiency notice if it is determined that significant deficiencies 
exist which cannot be addressed by a clarification or correction of a 
minor omission. A formal deficiency notice would be sent to the 
applicant's authorized representative and would include all 
deficiencies related to a part of an application requiring correction. 
If the National Coordinator issues a formal deficiency notice, we 
propose to permit an applicant one opportunity per application part to 
revise the relevant application part in response and that a revised 
application part must be received by the National Coordinator within 15 
days of the applicant's receipt of a formal deficiency notice. If an 
applicant receives a formal deficiency notice related to part one of 
its application, because we have noted that part two would not have 
been reviewed, the applicant would be free to revise part two at the 
same time it is revising part one and resubmit an entirely updated 
application.
    We propose that the National Coordinator be permitted up to 15 days 
to review a revised application once it has been received. If, upon a 
second review of the application, the National Coordinator determines 
that the revised application still contains deficiencies, the applicant 
will be issued a denial notice stating that it will no longer be 
considered for ONC-ATCB status under the temporary certification 
program. We propose to permit applicants to request that the National 
Coordinator reconsider this decision only when the applicant can 
demonstrate that clear, factual errors were made in the review of its 
application and that the errors' correction could lead to the applicant 
receiving ONC-ATCB status. Requests for reconsideration of revised 
applications will be conducted according to the process described in 
the next section. We seek public comment on whether there are other 
instances in which the National Coordinator should reconsider an 
application that has been deemed deficient multiple times.
    We also request public comment on whether it would be preferable 
for applicants to have their entire application reviewed all at once 
and then issued a formal deficiency notice or whether we should, as 
proposed, review applications in parts. While the former may seem more 
efficient for an applicant, the latter would potentially be more 
efficient overall because the National Coordinator would be able to 
notify an applicant about deficiencies earlier as well as spend less 
time and resources reviewing an application that may need significant 
corrections.
3. ONC-ATCB Application Reconsideration Requests
    We propose that an applicant for ONC-ATCB status who has had part 1 
or part 2 of its application returned twice because of deficiencies and 
has subsequently received a denial notice would be able to request that 
the National Coordinator reconsider this determination. For applicants, 
this would be at most a formal third and final opportunity (per 
application part) to continue their pursuit of ONC-ATCB status. While 
we believe the following would be highly unlikely, it is possible that 
an applicant's request for reconsideration of part 2 of their 
application could constitute their sixth formal opportunity (i.e., 
three opportunities for part 1 and two prior opportunities for part 2 
before the reconsideration request) to continue their pursuit of ONC-
ATCB status. Again, per our request for public comment above, if we 
were to change our approach to reviewing applications for ONC-ATCB 
status, the amount of formal opportunities to revise an application 
would be reduced.
    As previously discussed, we would only permit applicants to request 
the National Coordinator to reconsider a deficient application when the 
applicant could demonstrate that clear, factual errors were made in the 
review of its application and that the errors' correction could lead to 
the applicant receiving ONC-ATCB status.
    In order to make a reconsideration request, an applicant would be 
required to submit to the National Coordinator, within 15 days of 
receipt of a denial notice, a written statement (preferably via e-mail) 
contesting the decision and explaining what factual errors it believes 
can account for the denial. An applicant would be required to include 
sufficient documentation to support its explanation. If the applicant 
does not file the reconsideration request within the specified 
timeframe, the National Coordinator could reject the reconsideration 
request.
    Upon receipt of the reconsideration request, the National 
Coordinator would be permitted up to 15 days to review the information 
submitted by the applicant. If, based on the documentation submitted, 
the National Coordinator determines that when the application was 
reviewed a clear factual error(s) was made and that correction of the 
error(s) would lead to the applicant receiving ONC-ATCB status, the 
National Coordinator would notify the applicant's authorized 
representative that such an error occurred and that its application 
would continue to be processed. If the National Coordinator determined 
that a clear factual error(s) was made in part 1 of an application and 
that correction of the error(s) would lead to a satisfactory submission 
for part 1 of an application, the National Coordinator would 
subsequently review part 2 of the application. If the National 
Coordinator determined that a clear factual error(s) was made in part 2 
of an application and that correction of the error(s) would lead to a 
completely satisfactory application, the applicant's authorized 
representative would be

[[Page 11341]]

notified that the applicant successfully achieved ONC-ATCB status. If, 
however, after reviewing an applicant's reconsideration request the 
National Coordinator determines that the applicant did not provide 
sufficient evidence in its explanation to identify the factual error or 
errors that were made during the review of its application, the 
National Coordinator could reject the applicant's reconsideration 
request.
4. ONC-ATCB Status
a. Acknowledgement and Representation
    We propose to make publicly available at http://healthit.hhs.gov 
the name of each ONC-ATCB, the date each ONC-ATCB was authorized by the 
National Coordinator, and the type(s) of testing and certification each 
ONC-ATCB is authorized to perform. Further, to prevent an ONC-ATCB from 
misrepresenting the scope of its authorization, we propose that an ONC-
ATCB must prominently and unambiguously identify on its Web site and in 
all marketing and communications statements (written and oral) the 
scope of its authorization (e.g., the HIT Certification Group is an 
ONC-ATCB for e-prescribing EHR Modules).
b. Expiration of Status Under the Temporary Certification Program
    As previously mentioned, we expect to publish a final rule for the 
permanent certification program within a few months of publishing the 
temporary certification program's final rule. When this occurs, we 
would immediately begin to implement the permanent certification 
program's final provisions with the goal of having ONC-ACBs authorized 
under the permanent certification program by or before the beginning of 
calendar year 2012 in order to coincide with the certification 
activities that would need to take place in the coming months for 
meaningful use Stage 2. We believe it will take between 8 to 16 months 
to implement the permanent certification program, and therefore, we 
expect ONC-ATCBs under the temporary certification program would only 
be responsible for testing and certifying Complete EHRs and/or EHR 
Modules to the certification criteria adopted by the Secretary that are 
applicable to meaningful use Stage 1. Moreover, we will be working to 
assure that ONC-ACBs authorized under the permanent certification 
program will be in place with sufficient time to certify Complete EHRs 
and EHR Modules to the certification criteria adopted by the Secretary 
that are applicable to meaningful use Stage 2. However, if the 
transition to the permanent certification program occurs prior to the 
end of 2011, it is possible that a small percentage of late or new-to-
market Complete EHRs and/or EHR Modules developed to meet the 
certification criteria associated with meaningful use Stage 1 may wind 
up being tested and certified according to the policies established in 
the permanent certification program.
    Because the temporary certification program would be operational 
only for a short period of time (less than 2 years), we do not believe 
that it is necessary to require an ONC-ATCB to renew their ``authorized 
status'' under the temporary certification program. As a result, we 
have not proposed a renewal requirement for ONC-ATCB status. All ONC-
ATCBs would maintain their status (unless revoked) until the temporary 
certification program sunsets (see section II.F). The chart below 
illustrates the anticipated operational periods (denoted by quarters 
within each calendar year) for the temporary and permanent 
certification programs, along with the respective proposed meaningful 
use Stage 1 and 2 beginning points for eligible hospitals (Q4) and 
eligible professionals (Q1).
[GRAPHIC] [TIFF OMITTED] TP10MR10.036

E. ONC-ATCB Performance of Testing and Certification and Maintaining 
Good Standing as an ONC-ATCB

1. Authorization To Test and Certify Complete EHRs
    We propose that authorization to test and certify Complete EHRs 
under the temporary certification program would require an ONC-ATCB to 
be capable of performing ``complete'' testing and certification. 
Complete testing and certification would result in the ONC-ATCB testing 
and certifying Complete EHRs to all applicable certification criteria 
adopted by the Secretary. For example, the certification criteria 
applicable to Complete EHRs that eligible professionals would adopt 
would need to be tested and certified to all of the certification 
criteria at 45 CFR 170.302 and 45 CFR 170.304.
2. Authorization To Test and Certify EHR Modules
    We propose that authorization to test and certify EHR Modules under 
the temporary certification program would require an ONC-ATCB to do so 
in accordance with the applicable certification criterion or 
certification criteria adopted by the Secretary. Furthermore, because 
an EHR Module, once certified, can be used in combination with other 
certified EHR Modules to meet the definition of Certified EHR 
Technology, we propose that an ONC-ATCB authorized to test and certify 
EHR Modules would be required to clearly indicate the certification 
criterion or certification criteria to which an EHR Module has been 
tested and certified. We believe this requirement would benefit 
potential adopters of certified EHR Modules and make it easier for them 
to determine the full capabilities that a combination of certified EHR 
Modules includes. To benefit potential adopters of certified EHR 
Modules, we would also expect EHR Module developers to clearly indicate 
the certification criterion or certification criteria to which an EHR 
Module they have developed has been tested and certified.
a. Certification Criterion Scope
    As specified at 45 CFR 170.102, the definition of EHR Module means 
``any service, component, or combination thereof that can meet the 
requirements of at least one certification criterion adopted by the 
Secretary.'' In some cases, the certification criteria specified at 45 
CFR 170.302, 45 CFR 170.304, and 45 CFR 170.306 simply reference a 
criterion at the first paragraph level, for example, 45 CFR 170.302, 
paragraph ``(f)'' states, ``Smoking Status. Enable a user to 
electronically record, modify, and retrieve the smoking status of a 
patient. Smoking status types must

[[Page 11342]]

include: current smoker, former smoker, or never smoked.'' In other 
cases, for example, a certification criterion like ``Drug-Drug, Drug-
Allergy, Drug-Formulary Checks'' at 45 CFR 170.302 paragraph ``(a)'' 
includes a second level ``(1)'' through ``(4)'' which articulate 
partial aspects of a single, complete capability. For the purposes of 
testing and certifying an EHR Module, we therefore interpret ``one 
certification criterion'' in the definition of EHR Module to mean the 
entirety of the capabilities encompassed by what is specified at the 
first paragraph level.
b. When Privacy and Security Certification Criteria Apply to EHR 
Modules
    We believe that EHR Modules hold great promise with respect to 
innovation. However, we also recognize that the potential innovative 
benefits EHR Modules can provide will be significantly compromised if 
these same EHR Modules do not include appropriate privacy and security 
safeguards to instill trust.
    EHR Modules can come in many forms and can provide a large set of 
capabilities or a single capability. This variability, which promotes 
innovation, also poses several challenges to determining when it is 
appropriate to require EHR Modules be tested and certified to the 
privacy and security certification criteria adopted by the Secretary 
(45 CFR 170.302(o) through (v)). Our goal for determining when this 
should occur is two-fold: (1) Assure eligible professionals and 
eligible hospitals that EHR Modules will not negatively affect how 
Certified EHR Technology in its entirety protects electronic health 
information; and (2) appropriately require (or not require) the testing 
and certification of EHR Modules to privacy and security certification 
criteria.
    In the context of EHR Modules and testing and certification, it is 
important to keep in mind that we are discussing a point before 
``implementation'' in the HIT lifecycle. Accordingly, ONC-ATCBs will 
test and certify EHR Modules independent of, and disassociated from, 
their potential operating environments. Below, we identify several 
challenges to determining when an ONC-ATCB should be required to test 
and certify EHR Modules to the privacy and security certification 
criteria adopted by the Secretary. After discussing these challenges, 
we propose, and request public comment on a potential approach that 
establishes when ONC-ATCBs should be required to test and certify EHR 
Modules to the privacy and security certification criteria adopted by 
the Secretary in addition to the capability or capabilities the EHR 
Module may be specifically designed to provide.
    One challenge with respect to determining when EHR Modules should 
be tested and certified to the privacy and security certification 
criteria adopted by the Secretary occurs when EHR Modules operate in an 
environment separate from other EHR Modules--when they are so-to-speak 
``autonomous.'' For example, an e-prescribing EHR Module or a patient 
portal EHR Module provided by an application service provider (ASP) 
could be hosted and maintained by the ASP (not by the end-user). In 
these cases, an end-user (e.g., eligible professional) may be unable to 
control or specify the level or amount of privacy and security 
safeguards associated with the health information stored, modified, or 
transmitted by the EHR Module. We believe that it would be 
irresponsible and potentially dangerous to permit such EHR Modules to 
be tested and certified solely to their specific capability, and not to 
the privacy and security certification criteria adopted by the 
Secretary.
    On the flipside, a second challenge relates to EHR Modules that, by 
design, may provide specific capabilities which make it technically 
infeasible to require that they separately meet the privacy and 
security certification criteria adopted by the Secretary. One example 
could be a medication reconciliation EHR Module which, from a technical 
perspective, would be designed to function ``behind the scenes'' as 
part of the internal workings of Certified EHR Technology. In all 
likelihood, it would therefore depend on another EHR Module's or EHR 
Modules' privacy and security capabilities. In this example, we believe 
that it would be technically infeasible for the medication 
reconciliation EHR Module to have its own authentication capability 
because, in all likelihood, an end-user would have had to have been 
authenticated prior to gaining access to the medication reconciliation 
EHR Module. Conversely, while it is unlikely that the medication 
reconciliation EHR Module would retain or store health information, 
other EHR Modules might, and it may be appropriate to require such EHR 
Modules to be tested and certified to some or all of the privacy and 
security certification criteria adopted by the Secretary.
    Because of the context specific nature of EHR Modules, and the fact 
that we expect them to provide many different capabilities, it is 
difficult to establish with absolute certainty an approach that will 
work for all EHR Modules. However, we believe that an appropriate 
starting point for such an approach should focus first on protecting 
individuals' health information and then on whether there exist 
appropriate exceptions to the approach that would exempt EHR Modules 
from the requirement to be tested and certified to adopted privacy and 
security certification criteria. As a result, we propose that ONC-ATCBs 
would be required to test and certify all EHR Modules to the privacy 
and security certification criteria adopted by the Secretary unless the 
EHR Modules is/are presented for testing and certification in one of 
the following manners:
     The EHR Module(s) are presented for testing and 
certification as a pre-coordinated, integrated ``bundle'' of EHR 
Modules, which could otherwise constitute a Complete EHR. In such 
instances, the EHR Module(s) would be tested and certified in the same 
manner as a Complete EHR. Because the bundle of EHR Modules would 
constitute a single, integrated product, we believe that it would be 
unnecessary in such cases to require each EHR Module to be tested and 
certified independently to privacy and security certification criteria. 
We propose one variation to this exception for pre-coordinated bundles 
of EHR Modules which include EHR Module(s) that would not be part of an 
eligible professional or eligible hospital's local system and under its 
direct control (e.g., a patient portal EHR Module that is not hosted 
and maintained). In these situations, the constituent EHR Modules of 
such an integrated bundle would need to be separately tested and 
certified to all privacy and security certification criteria;
     An EHR Module is presented for testing and certification, 
and the presenter can demonstrate to the ONC-ATCB that it would be 
technically infeasible for the EHR Module to be tested and certified in 
accordance with some or all of the privacy and security certification 
criteria. For example, we believe that it would be technically 
infeasible for an EHR Module that does not store even temporarily, or 
maintain any health information to be required to include a capability 
to encrypt health information at rest or include an audit log. 
Alternatively, it would presumably be technically infeasible for an EHR 
Module that does not provide a capability for exchange to be required 
to include the capabilities to encrypt health information for exchange 
or account for treatment, payment, or health care operations 
disclosures; or

[[Page 11343]]

     An EHR Module is presented for testing and certification, 
and the presenter can demonstrate to the ONC-ATCB that the EHR Module 
is designed to perform a specific privacy and security capability. In 
such instances, we do not believe that it should be tested and 
certified to the other privacy and security certification criteria 
adopted by the Secretary. For example, an encryption EHR Module would 
not be required to be tested and certified as also including the 
capability to terminate an electronic session after a predetermined 
time of inactivity.
    We believe that the approach we have articulated above provides an 
appropriate framework for determining when ONC-ATCBs would be required 
to test and certify EHR Modules to the privacy and security 
certification criteria adopted by the Secretary. We request public 
comment on whether there are additional alternatives to the ones 
proposed above and other circumstances where an EHR Module should be 
tested and certified to none, some, or all of the privacy and security 
certification criterion adopted by the Secretary.
3. Authorized Testing and Certification Methods
    We propose that in being authorized to test and certify Complete 
EHRs and/or EHR Modules, ONC-ATCBs must have the capacity to test and 
certify Complete EHRs and/or EHR Modules at their facility. We propose 
further that an ONC-ATCB must also have the capacity to test and 
certify Complete EHRs and/or EHR Modules through some secondary means 
or at a secondary location. Such secondary methods would include 
testing and certification: (1) At the site (i.e., physical location) 
where a Complete EHR or EHR Module has been developed (e.g., at a 
Complete EHR developer's facility); or (2) at the site (i.e., physical 
location) where the Complete EHR or EHR Module resides (e.g., at a 
hospital where the HIT has been installed); or (3) remotely (i.e., 
through other means, such as through secure electronic transmissions 
and automated Web-based tools, or at a location other than the ONC-
ATCB's facilities). We believe that these secondary testing and 
certification methods will better accommodate self-developed Complete 
EHRs and EHR Modules. For example, a Complete EHR developer may submit 
a Complete EHR to an ONC-ATCB to be tested and certified at the ONC-
ATCB's facility. In other cases, it may not be practicable for a 
hospital with a self-developed Complete EHR to submit its Complete EHR 
to an ONC-ATCB for testing and certification at the ONC-ATCBs facility 
and, in these cases, we expect that ONC-ATCBs would either test and 
certify the hospital's Complete EHR at the hospital where the Complete 
EHR resides or remotely through other means that do not require the 
ONC-ATCB to be physically present at the hospital. We expect that the 
most common form of remote testing and certification will employ the 
use of automated programs that can be accessed by the hospital via the 
Internet to demonstrate to the ONC-ATCB that its Complete EHR meets all 
applicable certification criteria adopted by the Secretary. Other forms 
of remote testing and certification may include an employee of the ONC-
ATCB walking through a particular scripted scenario with predefined 
data that the hospital would have to ``plug-in'' to their Complete EHR 
and then convey the result (e.g., the hospital would be asked to enter 
fabricated information on a group of ``test'' patients into its 
Complete EHR and provide responses to specific questions asked by the 
ONC-ATCB employee). We request public comment on whether an ONC-ATCB 
should be required to perform any of the secondary methods discussed 
above in addition to testing and certifying Complete EHRs and/or EHR 
Modules at its facility.
    Our proposals do not preclude eligible professionals and eligible 
hospitals who have already adopted and implemented HIT that they 
believe meets the definition of Certified EHR Technology from seeking 
to have such HIT tested and certified themselves. Rather than relying 
on the vendor(s) that supplied their HIT to them to apply for testing 
and certification, eligible professionals and eligible hospitals could 
go directly to an ONC-ATCB to get their HIT tested and certified. 
However, eligible professionals and eligible hospitals should keep in 
mind that they alone would bear the full costs of testing and 
certification if they went directly to an ONC-ATCB.
4. The Testing and Certification of ``Minimum Standards''
    In the HIT Standards and Certification Criteria interim final rule 
(75 FR 2014), we explained how we would approach the testing and 
certification of Complete EHRs and EHR Modules for certain vocabulary 
code set standards. Our approach included the establishment of these 
standards as ``minimum standards.'' Adopting a particular version of 
the code set as a ``minimum'' permits a Complete EHR and/or EHR Module 
to be tested and certified to a permitted newer version of an adopted 
code set without the need for additional rulemaking on the part of the 
Secretary. For example, on the day the HIT Standards and Certification 
Criteria interim final rule was put on display by the Federal Register 
for public inspection a new version (version 2.29) of Logical 
Observation Identifiers Names and Codes (LOINC[reg]) was released. In 
that regard, we stated the following in the HIT Standards and 
Certification Criteria interim final rule:

    [W]e understand that certain types of standards, specifically 
code sets, must be maintained and frequently updated to serve their 
intended purpose effectively * * * To address this need and 
accommodate industry practice, we have in this interim final rule 
indicated that certain types of standards will be considered a floor 
for certification. We have implemented this approach by preceding 
references to specific adopted standards with the phrase, ``at a 
minimum.'' In those instances, the certification criterion requires 
compliance with the version of the code set that has been adopted 
through incorporation by reference, or any subsequently released 
version of the code set. This approach will permit Complete EHRs and 
EHR Modules to be tested and certified, to, ``at a minimum,'' the 
version of the standard that has been adopted or a more current or 
subsequently released version. This will also enable Certified EHR 
Technology to be updated from an older, ``minimum,'' adopted version 
of a code set to a more current version without adversely affecting 
Certified EHR Technology's ``certified status.'' We intend to 
elaborate in the upcoming HIT Certification Programs proposed rule 
on how testing and certification would be conducted using standards 
we have adopted and designated as ``minimums'' in certain 
certification criteria. That being said, we understand that this 
approach has certain limitations. In some cases, for instance, 
rather than simply maintaining, correcting, or slightly revising a 
code set, a code set maintaining organization will modify the 
structure or framework of a code set to meet developing industry 
needs. We would consider this type of significant revision to a code 
set to be a ``modification,'' rather than maintenance or a minor 
update of the code set. An example of a code set ``modification'' 
would be if a hypothetical XYZ code set version 1 were to use 7-
digit numeric codes to represent health information while XYZ code 
set version 2 used 9-digit alphanumeric codes to represent health 
information. In such cases, interoperability would likely be reduced 
among Complete EHRs and EHR Modules that have adopted different 
versions of the structurally divergent code sets. If a code set that 
we have adopted through incorporation by reference is modified 
significantly, we will update the incorporation by reference of the 
adopted version with the more recent version of the code set prior 
to requiring or permitting certification according to the newer 
version.

    At the end of this discussion we provided examples of when a 
standard would be considered a ``minimum

[[Page 11344]]

standard'' and the limitation to our approach. To address the 
identified limitation, we propose to clarify when a newer version of an 
adopted ``minimum standard'' code set would be permitted for use in 
testing and certification and when it would not. We believe that there 
are two prevailing methods the Secretary could use to determine whether 
a significant revision to a code set represents a ``modification, 
rather than maintenance or a minor update of the code set'' and, 
consequently, when a code set version should not be permitted for 
testing and certification above the minimum adopted by the Secretary 
until additional public comment can be obtained.
    The first method would allow for any member of the general public 
to notify the National Coordinator about a new version of an identified 
``minimum standard'' code set. For this method, we would encourage the 
person or entity who submits a notification to the National Coordinator 
to include any relevant information the National Coordinator would need 
to correctly identify the ``minimum standard'' code set (e.g., name and 
version) and any additional information that the National Coordinator 
could use to determine whether the new version constitutes general 
maintenance or minor updates, or a significant revision or 
modification. Upon receipt of these notifications and a determination 
by the National Coordinator that the new version of the code set did 
not represent a significant revision or modification, the National 
Coordinator would request the Secretary to permit the use of the 
identified new version for testing and certification purposes.
    The second method we considered, and solicit public comment on, 
would be for the Secretary to proactively identify newly published 
versions of adopted minimum standard code sets and issue determinations 
as to whether they reflect maintenance efforts or minor updates of the 
adopted code set and would be permitted for testing and certification.
    For either method above, we propose that once the Secretary has 
granted permission for a new version of an adopted minimum standard 
code to be used:
    (1) Any ONC-ATCB may test and certify Complete EHRs and/or EHR 
Modules according to the new version;
    (2) Certified EHR Technology may be upgraded to comply with the new 
version of an adopted minimum standard accepted by the Secretary 
without adversely affecting the certification status of the Certified 
EHR Technology; and
    (3) ONC-ATCBs would not be required to test and certify Complete 
EHRs and/or EHR Modules according to the new version until we updated 
the incorporation by reference of the adopted version to a newer 
version.
    For either method, we also propose to regularly publish (on 
quarterly basis) either by presenting to the HIT Standards Committee or 
by posting a notification on our Web site, any Secretarial 
determinations that have been made with respect to ``minimum standard'' 
code sets. We request public comment on whether a quarterly publication 
is an appropriate notification interval. We also seek public comment on 
other methods we might take to identify acceptable newer versions of 
minimum standard code sets in addition to the two methods we have 
discussed. Please note that the two methods we have proposed are not 
mutually exclusive and we request public comment on whether it would be 
advantageous to pursue both methods.
5. Maintaining Good Standing as an ONC-ATCB; Violations That Could Lead 
to the Revocation of ONC-ATCB Status; Revocation of ONC-ATCB Status
    In order to maintain good standing as an ONC-ATCB, we propose that 
an ONC-ATCB would have to abide by the Principles of Proper Conduct for 
ONC-ATCBs. In addition, we expect that an ONC-ATCB would follow other 
Federal and State laws to which it is subject and refrain from engaging 
in other types of inappropriate behavior.
    Further, we propose that the National Coordinator would be capable 
of revoking an ONC-ATCB's status under the temporary certification 
program when either of two types of violations occurs. We describe 
these violations and the revocation process below.
a. Type-1 Violations
    Type-1 violations would include violations of law or temporary 
certification program policies that threaten or significantly undermine 
the integrity of the temporary certification program. Type-1 violations 
would include, but are not limited to, false, fraudulent, or abusive 
activities that affect: The temporary certification program; a program 
administered by HHS; or any program administered by the Federal 
government. These violations could jeopardize the integrity of the 
temporary certification program and would include examples such as, the 
ONC-ATCB or a principal employee, owner, or agent of an ONC-ATCB being 
convicted of fraud, embezzlement or extortion or of violating a similar 
Federal or State securities laws while participating in the temporary 
certification program, falsifying or manipulating test results and 
certifications, or withholding information that would indicate false or 
fraudulent activity had occurred within the temporary certification 
program.
    We believe that the National Coordinator must ensure that the 
certification program is fair and honest and provides users of 
Certified EHR Technology with faith in the integrity of the temporary 
certification program (e.g., that Complete EHRs and EHR Modules have 
been properly tested and certified). Therefore, if the National 
Coordinator has evidence that an ONC-ATCB committed one or more of the 
above-mentioned violations (false, fraudulent, and abusive activities) 
the National Coordinator could issue the ONC-ATCB a notice proposing to 
revoke its ONC-ATCB status.
b. Type-2 Violations
    ``Type-2'' violations would include inappropriate conduct by an 
ONC-ATCB under the temporary certification program. A Type-2 violation 
would include, but not be limited to, the failure of an ONC-ATCB to 
adhere to the Principles of Proper Conduct for ONC-ATCBs and engaging 
in other types of inappropriate behavior. Examples of these types of 
violations include, but are not limited to: failing to attend mandatory 
ONC training programs, failing to meet specified reporting 
requirements, misrepresenting the scope of its authorization, and an 
ONC-ATCB testing and certifying Complete EHRs and/or EHR Modules for 
which it does not have authorization.
    If the National Coordinator obtains reliable evidence from fact-
gathering, requesting information from an ONC-ATCB, contacting an ONC-
ATCB's customers, witnessing an ONC-ATCB perform testing or 
certification, and/or substantiated complaints that an ONC-ATCB's 
conduct may indicate a failure to adhere to the Principles of Proper 
Conduct for ONC-ATCBs or exhibited other inappropriate behavior, the 
National Coordinator would notify the ONC-ATCB of a possible Type-2 
violation. The notification would include all pertinent information 
regarding the National Coordinator's assessment.
    Unless otherwise specified by the National Coordinator, an ONC-ATCB 
would be permitted up to 30 days from the date it is notified about 
possible Type-2 violation(s) to submit a written response and any 
accompanying documentation that could demonstrate

[[Page 11345]]

no violation(s) occurred or validate that violation(s) occurred and 
were corrected. If the ONC-ATCB fails to submit a response to the 
National Coordinator within 30 days, the National Coordinator could 
issue the ONC-ATCB a notice proposing to revoke its ONC-ATCB status.
    If an ONC-ATCB submits a response, the National Coordinator would 
be permitted up to 30 days to evaluate the ONC-ATCB's response (and 
request additional information, if necessary). If the National 
Coordinator determines that the ONC-ATCB did not commit a Type-2 
violation, or may have committed a Type-2 violation but satisfactorily 
corrected any violation(s) that may have occurred, a memo will be 
issued to the ONC-ATCB to confirm this determination. If the National 
Coordinator determines that the ONC-ATCB's response is insufficient and 
that a Type-2 violation had occurred and had not been adequately 
corrected, then the National Coordinator could propose to revoke an 
ONC-ATCB's status.
c. Proposed Revocation
    We propose that the National Coordinator could propose the 
revocation of an ONC-ATCB's status for alleged Type-1 violations and 
for failing to respond to, or satisfactorily address, a notification 
related to a Type-2 violation.
    We request public comment on whether the National Coordinator 
should also consider proposing the revocation of an ONC-ATCB's status 
for repeatedly committing Type-2 violations even if the ONC-ATCB has 
adequately corrected the violations each time. We further request 
comment on how many corrected Type-2 violations would be sufficient for 
proposing revocation of an ONC-ATCB and to what extent the frequency of 
these violations should be a consideration. While we have not repeated 
this request for public comment in our discussion of the permanent 
certification program, we nevertheless encourage comments regarding 
this option for that program as well.
i. Opportunity To Respond to a Proposed Revocation Notice
    We propose that an ONC-ATCB could respond to a proposed revocation 
notice within 10 days of receipt of the proposed revocation notice in 
order to contest the proposed revocation and explain why its status 
should not be revoked. We propose that if an ONC-ATCB responds to a 
revocation notice, it must include sufficient documentation to support 
its explanation. Upon receipt of an ONC-ATCB's response to a proposed 
revocation notice, the National Coordinator would be permitted up to 30 
days to review the information submitted by the ONC-ATCB.
    During the time period provided for an ONC-ATCB to respond to the 
proposed revocation notice and the National Coordinator's review 
period, we propose to permit the ONC-ATCB to continue its operations 
under the temporary certification program. We believe this proposal 
affords the ONC-ATCB meaningful due process and would minimally impact 
the temporary certification program because we have proposed procedures 
for reaching a timely final decision on revocation. We welcome comments 
on this proposal and whether it would be more appropriate for the 
National Coordinator to immediately suspend an ONC-ATCB's operations 
for the time between the issuance of a proposed revocation notice and a 
final decision on revocation.
    If the National Coordinator determines that an ONC-ATCB's status 
should not be revoked, the National Coordinator would notify the ONC-
ATCB's authorized representative in writing to express this 
determination.
ii. Revocation of an ONC-ATCB's Status
    We propose that the National Coordinator could revoke an ONC-ATCB's 
status if it is determined that revocation is appropriate after 
considering the information provided by the ONC-ATCB in response to the 
proposed revocation notice or if the ONC-ATCB does not respond to a 
proposed revocation notice within the specified timeframe.
    We propose that a decision to revoke an ONC-ATCB's status would be 
final and would not be subject to further review unless the National 
Coordinator chooses to reconsider the revocation.
d. Extent and Duration of Revocation Under the Temporary Certification 
Program
    We propose that the revocation of an ONC-ATCB's status would become 
effective as soon as the ONC-ATCB receives the revocation notice. A 
testing and certification body whose ONC-ATCB status has been revoked 
would be prohibited from accepting new requests for testing and 
certification and would be required to cease its current testing and 
certification operations related to Complete EHRs and/or EHR Modules 
(i.e., the National Coordinator's revocation would not apply to other 
testing and certification operations that are not within the scope of 
this rule). We would also expect it to issue a complete refund to any 
entity whose Complete EHR or EHR Module was being tested and certified 
by the ONC-ATCB at the time its status was revoked. If a testing and 
certification body were to refuse or fail to issue a complete refund(s) 
upon having its ONC-ATCB status revoked, we propose that the refusal or 
failure should be a consideration in determining the qualifications of 
a testing and certification body if it were to apply at a later date to 
be an ONC-ACB under the proposed permanent certification program. We 
welcome comments on this proposal, including any potential 
alternatives.
    Once an ONC-ATCB has had its status revoked, the testing and 
certification body would be permitted to reapply for ONC-ATCB status 
under the temporary certification program and apply under our proposed 
permanent certification program unless it had its status revoked for a 
Type-1 violation. Type-1 violations would significantly undermine the 
integrity of the temporary certification program and we do not believe 
it would be appropriate to allow the same testing and certification 
body to reapply for ONC-ATCB right away. Further, we believe that Type-
1 violations could so significantly undermine the public's faith in our 
proposed certification programs that we propose to prohibit the testing 
and certification body from reapplying for ONC-ATCB status for 1 year 
and to count that 1 year prohibition towards the ONC-ACB application 
period under the permanent certification program if the temporary 
certification program sunsets during this time. We request public 
comment on any other alternatives regarding the treatment of ``former 
ONC-ATCBs'' that have had their status revoked.
    We recognize that in instances where an ONC-ATCB has had its status 
revoked, some people may call into question the legitimacy of the 
certifications issued by the former ONC-ATCB. To address this matter, 
we propose that the ``certified status'' of Complete EHRs and/or EHR 
Modules certified by the former ONC-ATCB will remain intact unless a 
Type-1 violation was committed that calls into question the legitimacy 
of the certifications issued by the former ONC-ATCB. In these 
circumstances, which we believe would be extremely rare, we propose 
that the National Coordinator would review the facts surrounding the 
revocation of the ONC-ATCB's status and publish a notice on ONC's Web 
site if the National Coordinator believes that Complete EHRs and/or EHR 
Modules were fraudulently certified by a former

[[Page 11346]]

ONC-ATCB and the certification process itself failed to comply with 
regulatory requirements. If the National Coordinator determines that 
Complete EHRs and/or EHR Modules were improperly certified, we propose 
that the ``certified status'' of impacted Complete EHRs and/or EHR 
Modules would remain intact for 120 days after the National Coordinator 
publishes the notice. We believe that 120 days is a suitable timeframe 
for the developers of the impacted Complete EHRs and/or EHR Modules to 
get their HIT re-certified by an ONC-ATCB in good standing. We request 
public comment on our proposed approach and the timeframe for re-
certification. Although highly unlikely, it is important to note that 
if a Complete EHR or EHR Module developer whose product was improperly 
certified does not seek to remedy this improper certification in the 
timeframe provided that all of the end-users (e.g., eligible 
professionals and eligible hospitals) that have adopted the Complete 
EHR or EHR Module developer's product would no longer have HIT that 
meets the definition of Certified EHR Technology.
e. Alternative Considered
    As noted briefly above, another alternative approach to the 
revocation process described above (where the National Coordinator 
would issue a notice to an ONC-ATCB proposing to revoke its status) 
would be a suspension process whereby an ONC-ATCB's status would be 
suspended if the ONC-ATCB is reasonably suspected of having committed a 
Type-1 violation or if the ONC-ATCB fails to respond in a timely manner 
to a possible Type-2 violation or has not appropriately addressed an 
admitted Type-2 violation. Such a process would result in the National 
Coordinator issuing an ONC-ATCB a suspension notification. Upon receipt 
of a suspension notification, an ONC-ATCB would have to temporarily 
cease testing and certifying Complete EHRs and/or EHR Modules. 
Additionally, during the suspension an ONC-ATCB would also be 
prohibited from accepting new requests for testing and certification.
    If the National Coordinator issues a suspension notice to an ONC-
ATCB, the ONC-ATCB could respond directly to the National Coordinator 
and explain in writing why its status should not have been suspended. 
Upon receiving the ONC-ATCB's response, the National Coordinator would 
review the information submitted by the ONC-ATCB and reply within 7 
days. In the reply, the National Coordinator could extend the 
suspension for an additional 14 days to obtain further information, 
terminate the suspension, or propose revocation while extending 
suspension during the pendency of the revocation process.
    We believe that a suspension process is an alternative worth 
considering because it could assist the National Coordinator in 
preventing further untoward actions by an ONC-ATCB, whereas the process 
we discuss above would permit, albeit presumably for a short amount of 
time, an ONC-ATCB to continue to test and certify Complete EHRs and/or 
EHR Modules while revocation procedures are underway. Therefore, we 
request public comment on whether the National Coordinator should also 
include a process to suspend an ONC-ATCB's status. We have not repeated 
this request for public comment in our discussion of the permanent 
certification program, but we encourage commenters to consider this as 
an option for that program as well and provide comments.
6. Validity of Complete EHR and EHR Module Certification
    In the HIT Standards and Certification Criteria interim final rule, 
we defined Certified EHR Technology to mean ``a Complete EHR or a 
combination of EHR Modules, each of which: (1) Meets the requirements 
included in the definition of a Qualified EHR; and (2) has been tested 
and certified in accordance with the certification program established 
by the National Coordinator as having met all applicable certification 
criteria adopted by the Secretary.''
    Part two of the definition of Certified EHR Technology specifies an 
important concept--that in order to meet the definition, a tested and 
certified Complete EHR or combination of separately tested and 
certified EHR Modules must meet all applicable certification criteria 
adopted by the Secretary. Certification represents a snapshot, a fixed 
point in time, where it has been confirmed that a Complete EHR or EHR 
Module has met all applicable certification criteria adopted by the 
Secretary. From that point forward, a specific Complete EHR or EHR 
Module version which has been certified would be forever labeled 
``certified.'' However, as the Department adopts new or modified 
certification criteria, previously adopted certification criteria would 
no longer constitute all of the applicable certification criteria to 
which a Complete EHR or EHR Module would need to be tested and 
certified. As a result, Complete EHRs and EHR Modules that had been 
certified to a previously adopted set of certification criteria would 
no longer be considered ``Certified EHR Technology'' for purposes of 
enabling an eligible professional or eligible hospital to attempt to 
achieve a future stage of meaningful use.
    As previously mentioned in both the HIT Standards and Certification 
Criteria interim final rule and the Medicare and Medicaid EHR Incentive 
Programs proposed rule, we and CMS stated that we anticipate that the 
requirements for meaningful use will be adjusted every two years. 
Accordingly, and because the HITECH Act requires eligible professionals 
and eligible hospitals to use Certified EHR Technology in order to 
qualify for incentive payments, we expect that there will continue to 
be a close correlation and connection between certification criteria 
adopted by the Secretary and future meaningful use objectives (and 
their associated measures).
    In that regard, when a set of objectives and measures for a future 
stage of meaningful use has been proposed, we anticipate that the 
Secretary would also propose to adopt certification criteria to 
replace, amend, or add to previously adopted certification criteria. 
Presumably, those additional or modified certification criteria would 
set a new, higher bar for the capabilities that Certified EHR 
Technology would need to include and for which eligible professionals 
and eligible hospitals would need in order to attempt to achieve the 
next proposed meaningful use stage.
    We believe the planned two-year schedule for updates to meaningful 
use objectives and measures and correlated certification criteria 
creates a natural expiration for the ``certified status'' of Complete 
EHRs and EHR Modules. Accordingly, after the Secretary has adopted new 
or modified certification criteria, the validity of the certification 
associated with previously certified Complete EHRs and EHR Modules will 
expire and those Complete EHRs and EHR Modules would need to be re-
certified in order for eligible professionals and eligible hospitals to 
continue to possess HIT that meets ``all applicable certification 
criteria adopted by the Secretary'' and consequently also meets the 
definition of Certified EHR Technology.
    Stated another way, regardless of the year and meaningful use stage 
at which an eligible professional or eligible hospital enters the 
Medicare or Medicaid EHR Incentive Program, the Certified EHR 
Technology that would be used would have to include the capabilities 
necessary to meet the most current certification criteria adopted by 
the Secretary at 45 CFR 170 subpart C

[[Page 11347]]

in order to meet the definition of Certified EHR Technology. For 
example, if the Secretary adopts 5 new certification criteria in 2012 
which would be applicable to, and in support of, meaningful use Stage 
2, an eligible professional who implemented Certified EHR Technology in 
2011 would need to ensure that its HIT was upgraded with newly 
certified software or a certified EHR Module by 2013 to include the 5 
new capabilities the Secretary adopted in the certification criteria in 
order to continue to have HIT that meets the definition of Certified 
EHR Technology and could provide the capabilities they would need to 
continue to attempt to achieve meaningful use.
    We also want to point out and clarify an apparent, yet temporary, 
inconsistency that would occur in 2013 and 2014 should CMS finalize its 
proposed staggered approach for meaningful use stages to provide 
flexible entry points for eligible professionals and eligible hospitals 
(e.g., an eligible professional whose first payment year is 2013 would 
start at meaningful use Stage 1 in 2013, while an eligible professional 
whose first payment year was 2011 would be required to meet meaningful 
use Stage 2 requirements in 2013). The apparent inconsistency pertains 
to the HIT an eligible professional or eligible hospital would need to 
have to meet the definition of Certified EHR Technology and the 
meaningful use stage the eligible professional or eligible hospital 
would need to meet to qualify for incentive payments. As proposed, 
eligible professionals and eligible hospitals who seek to have their 
first payment year begin in 2013 or 2014 would only need to meet 
meaningful use stage 1 requirements; however, the Certified EHR 
Technology they would need to use, would need to meet the most recent 
certification criteria adopted by the Secretary, which at that time 
would be in support of meaningful use stage 2. As a result, should CMS 
finalize its proposed staggered approach for meaningful use stages, 
these eligible professionals and eligible hospitals would need to use 
``meaningful use stage 2 Certified EHR Technology'' even though they 
would only have to meet meaningful use stage 1 metrics.
    Should CMS finalize its proposed staggered approach for meaningful 
use stages, we recognize that some confusion within the HIT industry 
may arise during 2013 and 2014 because of this apparent inconsistency 
and the divergent use of the term ``meaningful use.'' We would 
anticipate, therefore, that ONC-ACBs would clearly indicate the 
certification criteria used when certifying Complete EHRs and/or EHR 
Modules, and identify certifications according to the calendar year and 
month rather than the meaningful use stage to reflect the currency of 
the certification criteria against which the Complete EHRs and/or EHR 
Modules have been certified. Consequently, if an eligible professional 
or eligible hospital were seeking to obtain a certified Complete EHR or 
certified EHR Module in 2014, for instance, that eligible professional 
or eligible hospital would look for Complete EHRs and EHR Modules 
certified in accordance with certification criteria current in 2014, 
rather than Complete EHRs and EHR Modules certified as meeting 
certification criteria intended to support meaningful use Stage 1, 
Stage 2, or Stage 3. We request comments on ways to ensure greater 
clarity in the certification of Complete EHRs and EHR Modules.
    We believe this proposed approach would benefit eligible 
professionals and eligible hospitals whose first payment year is in 
2013 because they would already have the Certified EHR Technology they 
would need in order to meet meaningful use stage 2, which, as proposed, 
would begin for them in the following year (2014). Eligible 
professionals and eligible hospitals, whose first payment year is 2014, 
would also benefit. They would have adopted more advanced HIT and would 
need to be familiar with the additional capabilities it provides, 
because, as proposed, they would need to meet meaningful use Stage 3 
requirements in the following year (2015). This approach would also 
assist other HIT users with whom eligible professionals and eligible 
hospitals would exchange information by ensuring improved 
interoperability among their respective HIT systems.
    We again note that this apparent inconsistency would exist only for 
the years 2013 and 2014. By 2015, if as proposed by CMS an eligible 
professional or eligible hospital seeks to begin participating in the 
Medicare and Medicaid incentive programs, that eligible professional or 
eligible hospital would need to implement Complete EHRs or EHR Modules 
certified to certification criteria that support meaningful use Stage 3 
and would have to meet meaningful use Stage 3 metrics.

F. Sunset

    We propose to sunset the temporary certification program and the 
rules that govern it when the National Coordinator has authorized at 
least one ONC-ACB under the permanent certification program. We further 
propose that on the date at which this sunset occurs that ONC-ATCBs 
under the temporary certification program will be prohibited from 
accepting new requests to certify Complete EHRs and/or EHR Modules. 
That means that ONC-ATCBs will be able to review any pending 
applications that they will have received prior to the termination date 
of the temporary certification program, and complete the certification 
process for those Complete EHRs and EHR Modules. We request public 
comment on whether we should establish a set date for the temporary 
program to sunset, such as 12/31/2011, instead of date that depends on 
a particular action--the authorization of at least one ONC-ACB. A set 
date would provide certainty and create a clear termination point for 
the temporary certification program by indicating to any ONC-ATCBs and 
other certification bodies that in order to be authorized to certify 
Complete EHRs and/or EHR Modules after 12/31/2011, they would need to 
be accredited and reapply to become ONC-ACBs. One potential downside to 
a set date would be the possibility that it would temporarily prevent 
certifications from being issued during the time period it takes 
potential ONC-ACB applicants to get accredited and receive their 
authorizations from the National Coordinator.

III. Provisions of Permanent Certification Program

    [If you choose to comment on the provisions of the permanent 
certification program, please include at the beginning of your comment 
the specific section title and any additional information to clearly 
identify the proposal about which you are commenting. For example, 
``Definitions'' or ``Permanent Certification Program Application 
Process.'']
    As noted above, we have chosen to propose both the temporary and 
permanent certification programs in this notice of proposed rulemaking. 
We believe this format offers the public significantly more context for 
our proposed policies and expect to receive more informed and detailed 
comments on our proposed policies. Similarly, we anticipate that some 
comments will be applicable to both certification programs. In that 
regard, we believe that this approach also reduces the amount of 
redundancy that would have existed had we published two separate 
proposed rules.
    Along those same lines, we have proposed that certain aspects of 
the temporary certification program will be the same as certain 
elements of the permanent certification program. In those cases, to 
reduce unnecessary, duplicative text in this rule, we simply identify 
those proposed elements of

[[Page 11348]]

both programs that are the same. In all other cases, we discuss in 
greater detail those proposals that are unique to the permanent 
certification program. To remain consistent with the section structure 
developed above and to improve readability and comprehension, we have 
presented our proposals for the permanent certification program in the 
same order as those presented in the temporary certification program. 
Additionally, in our proposals for the permanent certification program 
that cross-reference proposed provisions of the temporary certification 
program, all references to ONC-ATCBs should be substituted with 
references to ONC-ACBs, as appropriate.

A. Applicability

    This subpart would establish the processes an applicant for ONC-ACB 
status must follow to be granted ONC-ACB status by the National 
Coordinator, the processes the National Coordinator would follow when 
assessing applicants and granting ONC-ACB status, the requirements of 
ONC-ACBs for certifying Complete EHRs and/or EHR Modules in accordance 
with the applicable certification criteria adopted by the Secretary in 
subpart C. It also establishes the processes accreditation 
organizations would follow to request approval from the National 
Coordinator and that the National Coordinator in turn would follow to 
approve an accreditation organization under the permanent certification 
program as well as certain ongoing responsibilities for an ONC-AA.

B. Definitions

1. Definition of Applicant
    We propose to use the same definition of applicant for the 
permanent certification program with the exception of replacing ONC-
ATCB with ONC-ACB.
2. Definition of Day or Days
    We propose that day or days would have the same meaning under the 
permanent certification program as we have proposed under the temporary 
certification program.
3. Definition of ONC-Approved Accreditor
    We propose that the term ONC-Approved Accreditor (ONC-AA) means an 
accreditation organization that the National Coordinator has approved 
to accredit certification bodies under the permanent certification 
program.
4. Definition of ONC-ACB
    We propose ONC-ACB to mean a single organization or a consortium of 
organizations that has applied to and been authorized by the National 
Coordinator to perform the certification of, at a minimum, Complete 
EHRs and/or EHR Modules using the applicable certification criteria 
adopted by the Secretary. We have included the phrase ``at a minimum'' 
in this definition to take into account the possibility that ONC-ACBs 
may be authorized in the future to certify other types of HIT, such as 
personal health records (PHRs). Please note, however, that for that to 
occur, the Secretary would have to adopt certification criteria 
applicable to these types of HIT.

C. Correspondence With the National Coordinator

    We propose that when applicants for ONC-ACB status and ONC-ACBs 
correspond with the National Coordinator and vice versa, that these 
communications must comply with the same rules we have proposed for the 
temporary certification program.

D. Permanent Certification Program Application Process for ONC-ACB 
Status

    Similar to the temporary certification program, we propose under 
the permanent certification program to permit applicants for ONC-ACB 
status to apply at any time.
1. Application for ONC-ACB Status
    Similar to the temporary certification program, we propose that an 
applicant for ONC-ACB status must submit an application to the National 
Coordinator in the same manner ONC-ATCB applicants must under the 
temporary certification program in order to be considered for ONC-ACB 
status. However, unlike the temporary certification program, applicants 
would no longer need to request an application and would instead be 
permitted to submit an application (which we intend to make available 
on the ONC Web site) to the following e-mail address: 
ACBapplication@hhs.gov.
a. Types of Applicants
    Because the National Coordinator's authorization in the permanent 
certification program is only valid with respect to certification, we 
do not expect that it would be necessary for organizations seeking to 
apply for ONC-ACB status to form a partnership or consortium. However, 
such an applicant would not be prevented from achieving ONC-ACB status 
as long as it could meet all of the requirements of the permanent 
certification program.
b. Types of ONC-ACB Authorization
    Similar to the temporary certification program, we would require an 
applicant for ONC-ACB status to indicate on its application the type of 
certification it seeks authorization to perform under the permanent 
certification program. If the applicant requested authorization to 
certify EHR Modules we would also require it to identify the type(s) of 
EHR Modules which it seeks authorization to certify. The proposed 
requirement for an applicant to indicate the type of certification it 
is seeking would also apply to other types of HIT if the Secretary has 
adopted certification criteria for that HIT.
c. Application for ONC-ACB Status
    We propose that an applicant must include the following information 
in its application:
    i. The applicant would be required to submit the same general 
identifying information required under the temporary certification 
program and section II.D.1.c.i.
    ii. The applicant would be required to submit the information 
necessary for ONC to confirm the applicant's accreditation by an ONC-
AA.
    iii. The applicant would be required to submit a properly executed 
agreement that it will adhere to the ``Principles of Proper Conduct for 
ONC-ACBs.'' The Principles of Proper Conduct for ONC-ACBs would require 
an ONC-ACB to:
     Maintain its accreditation.
     Attend all mandatory ONC training and program update 
sessions.
     Maintain a training program that includes documented 
procedures and training requirements to ensure its personnel are 
competent to certify HIT.
     Report to ONC within 15 days any changes that materially 
affect its:
    [cir] Legal, commercial, organizational, or ownership status;
    [cir] Organization and management including key certification 
personnel;
    [cir] Policies or procedures;
    [cir] Location;
    [cir] Personnel, facilities, working environment or other 
resources;
    [cir] ONC authorized representative (point of contact); or
    [cir] Other such matters that may otherwise materially affect its 
ability to certify HIT.
     Allow ONC, or its authorized agents(s), to periodically 
observe on site (unannounced or scheduled) any certifications performed 
to demonstrate compliance with the requirements of the permanent 
certification program.

[[Page 11349]]

     Provide ONC, no less frequently than weekly, a current 
list of Complete EHRs and/or EHR Modules that have been certified, 
which includes, at a minimum, the vendor name (if applicable), the date 
certified, the product version, the unique certification number or 
other specific product identification, and where applicable, the 
certification criterion or certification criteria to which each EHR 
Module has been certified.
     Retain all records related to the certification of 
Complete EHRs and/or EHR Modules for a minimum of 5 years.
     Only certify HIT, including Complete EHRs and/or EHR 
Modules that have been tested by a NVLAP-accredited testing laboratory.
     Submit an annual surveillance plan to the National 
Coordinator and annually report to the National Coordinator its 
surveillance results.
     Promptly refund any and all fees received for 
certifications that will not be completed.
    The first difference between these Principles of Proper Conduct for 
ONC-ACBs and those proposed under the temporary certification program 
is that we have removed the principles related to Guide 65 and ISO 
17025. The former would be replaced and addressed by the accreditation 
principle for ONC-ACBs and the latter, ISO 17025, would no longer be 
necessary since the National Coordinator's authorization under the 
permanent certification program applies solely to certification.
    The second difference is that we have added the principle that ONC-
ACBs would only be permitted to certify Complete EHRs and/or EHR 
Modules that have been tested by a NVLAP-accredited testing laboratory. 
We believe that NVLAP-accreditation is the best option, because the 
NVLAP is an internationally recognized testing laboratory accreditation 
program and because it will best serve the public's interests. The 
NVLAP will also be able to rely on the significant technical and 
scientific staff NIST employs who have specialized expertise in 
developing and performing tests for and evaluations of HIT. Moreover, 
Congress clearly indicated its intentions both in section 3001(c)(5) of 
the PHSA and in section 13201(b) of the HITECH Act by associating NIST 
with the testing and certification of HIT. In the latter, the HITECH 
Act expressly provides that the Director of NIST, in coordination with 
the HIT Standards Committee, ``shall support the establishment of a 
conformance testing infrastructure * * *'' and that ``[t]he development 
of this conformance testing infrastructure may include a program to 
accredit independent, non-Federal laboratories to perform testing.''
    The third difference pertains to record retention. For the 
permanent certification program, we propose to require that ONC-ACBs 
retain their records related to the certification of Complete EHRs and 
EHR Modules for a minimum of five years. We understand from our 
consultations with NIST that this is standard industry practice for 
organizations involved in certification. Given the fact that it will be 
possible for ONC-ACBs to be authorized under the permanent 
certification program for many years, we believe that this time period 
is necessary in the event that the National Coordinator notifies an 
ONC-ACB of a proposed Type-2 violation or proposes to revoke an ONC-
ACBs status. These records would be directly relevant to a 
determination by the National Coordinator that an ONC-ACB committed a 
Type-2 violation and/or to revoke an ONC-ACB's status. Moreover, we 
believe that the records will be necessary for ONC-ACBs to conduct 
surveillance. Finally, similar to our proposal for the temporary 
certification program, if an ONC-ACB loses its status for any reason it 
could be required to provide the National Coordinator with copies of 
all relevant records related to certification for up to a five year 
period.
    The fourth and final difference is the requirement that an ONC-ACB 
would need to conduct surveillance of Complete EHRs and/or EHR Modules 
that the ONC-ACB had previously certified. As noted in section I.F.3 
when we introduced the concept of surveillance, we expect that as part 
of ONC-ACBs' accreditation to confirm compliance at a minimum with 
Guide 65, they will have addressed section 13. Section 13 specifies the 
general surveillance requirements that a certification body must meet 
in order to become accredited. We propose to require that ONC-ACBs 
agree to submit annual surveillance plans to the National Coordinator 
and annually report to the National Coordinator their surveillance 
results. As discussed below, we also propose a requirement for the ONC-
AA to have processes in place to ensure that the certification bodies 
it accredits properly conduct surveillance. We believe that ONC-ACBs 
should be given the flexibility to conduct surveillance in accordance 
with their accreditation. However, we recognize that it would likely 
benefit the HIT industry if certain common elements of surveillance 
could be developed and we welcome public comment on what those elements 
should be. We anticipate that we would issue annual guidance for ONC-
ACBs before they submit their surveillance plans in order to identify 
ONC priorities. In that regard, we also request public comment on 
whether there are specific approaches to surveillance that have worked 
in other industries and should be replicated for HIT.
    We anticipate using the results of ONC-ACB surveillance to make 
publicly available information related to the implementation and 
performance of Complete EHRs and EHR Modules in the field and as 
feedback for the efficient operation of the permanent certification 
program. We expect that these surveillance results could also be used 
by prospective purchasers of Complete EHRs and/or EHR Modules to 
determine whether a Complete EHR or EHR Module they are considering 
implementing has been the subject of any unsatisfactory surveillance 
reports (and why those unsatisfactory results occurred). We believe 
this requirement is important and would provide the National 
Coordinator and ONC-ACBs with important feedback regarding the 
effectiveness of the permanent certification program and what if any 
changes may need to be made to improve how the program operates.
    We emphasize that surveillance results obtained by ONC-ACBs and 
reported to the National Coordinator would not immediately affect a 
Complete EHR or EHR Module's certification. That is, if after an ONC-
ACB reevaluated a Complete EHR it previously certified and reported 
that the Complete EHR no longer met a certification criterion or 
criteria because, for example, an individual took actions to alter a 
capability provided by the Complete EHR such that it no longer 
performed according to its original design or improperly installed the 
Complete EHR, such a result would not automatically invalidate the 
Complete EHR's certification. However, we would expect ONC-ACBs upon 
the identification of a pattern of poorly performing previously 
certified Complete EHRs and/or EHR Modules to determine whether they 
properly certified the Complete EHR or EHR Module in the past. We 
believe that the publication of surveillance results and market forces 
will sufficiently motivate developers of Complete EHRs and/or EHR 
Modules to continue to improve their products and address any 
shortcoming identified by the ONC-ACB surveillance process. We request 
public comment on whether the National Coordinator should consider 
proactively stepping-in to protect purchasers of Complete EHRs and/or 
EHRs Modules by taking action such as ``de-certifying'' Complete EHRs 
and/or

[[Page 11350]]

EHR Modules if a pattern of unsatisfactory surveillance results emerges 
and the ONC-ACB has not taken any measures to evaluate the poor 
performance.
d. Proficiency Examination
    We no longer propose the use of a proficiency exam in the permanent 
certification program because it would no longer serve a useful 
purpose. Moreover, the accreditation process for ONC-ACB applicants 
encompasses this requirement and we do not believe that any additional 
redundancy is necessary.
2. Application Review
    We propose to use the same timeframes and general processes for 
application review under the permanent certification program as we 
propose for the temporary certification program. The primary difference 
between the permanent certification program's application review 
process and the temporary certification program's is the reduced number 
of opportunities for an applicant to submit revisions in response to 
formal deficiency notices (due to the fact that the application is only 
one part). The timeframes for review, resubmission, and reconsideration 
are the same as those proposed under the temporary certification 
program. The only other difference between our two proposals in this 
section is our reference to ONC-ACB instead of ONC-ATCB and that the 
scope of an ONC-ACBs authorization will only be valid for certification 
and not both testing and certification.
3. ONC-ACB Application Reconsideration Requests
    We propose to use the same timeframes and processes for ONC-ACB 
application reconsideration requests under the permanent certification 
program as we propose for the temporary certification program. Again, 
we now refer to ONC-ACBs instead of ONC-ATCBs.
4. ONC-ACB Status
a. Acknowledgement and Representation
    We propose the same policies for ONC-ACBs related to 
acknowledgement and representation as we do for ONC-ATCBs under the 
temporary certification program.
b. Expiration of Status Under the Permanent Certification Program
    We propose that an ONC-ACB would be required to renew its status 
every two years. To renew its status, we propose that an ONC-ACB would 
need to submit an updated application to the National Coordinator for 
review 60 days prior to the expiration of its status. We request public 
comment on any additional information an ONC-ACB should provide the 
National Coordinator in order to have its status renewed, such as 
documentation of the ONC-ACB's current accreditation status and any 
additional information or updates to the original application that 
would aid in the National Coordinator's review of the renewal request.

E. ONC-ACB Performance of Certification and Maintaining Good Standing 
as ONC-ACB

1. Authorization To Certify Complete EHRs
    We propose, similar to the temporary certification program, that 
ONC-ACBs who seek authorization under the permanent certification 
program to certify Complete EHRs must be capable of certifying Complete 
EHRs to all applicable certification criteria adopted by the Secretary.
2. Authorization To Certify EHR Modules
    We again propose that ONC-ACBs who seek authorization under the 
permanent certification program to certify EHR Modules must be capable 
of certifying EHR Modules in accordance with the applicable 
certification criteria adopted by the Secretary. We would mirror our 
proposals in the temporary certification program related to the scope 
of a ``certification criterion'' and when, in this case, an ONC-ACB 
would be required to certify EHR Modules to the privacy and security 
certification criteria adopted by the Secretary in the permanent 
certification program.
3. Authorization To Certify Other HIT
    As we mention above in the preamble, section 3001(c)(5) of the PHSA 
provides the National Coordinator with broad authority to establish 
certification programs for the ``voluntary certification of health 
information technology as being in compliance with applicable 
certification criteria adopted under this subtitle.'' As a result, we 
requested public comment on the other types of HIT that the permanent 
certification program could include and ONC-ACBs could certify. As the 
statute provides, if the Secretary were to adopt certification criteria 
applicable to other types of HIT that the National Coordinator could 
subsequently authorize an ONC-ACB to certify such HIT under the 
permanent certification program. Therefore, we propose that if the 
Secretary adopts certification criteria for HIT beyond Complete EHRs 
and EHR Modules, a current ONC-ACB would have to submit an addendum to 
its original application to request authorization to certify this other 
type of HIT. If a new organization wanted to be authorized to certify 
another type of HIT it would need to follow the rules for becoming an 
ONC-ACB, including first receiving accreditation from an ONC-AA.
4. Authorized Certification Methods
    Similar to the temporary certification program, we propose that 
ONC-ACBs must have the capacity to certify Complete EHRs and/or EHR 
Modules at their facility and one of the secondary methods we 
identified in the temporary certification program.
5. The Certification of ``Minimum Standards''
    Based on the same rationale provided in the temporary certification 
program discussion above, we propose to adopt the same method or 
methods for identifying which minimum standards (i.e., code sets) that 
an ONC-ACB will use for certification.
6. Maintaining Good Standing as an ONC-ACB; Violations That Could Lead 
to Revocation of ONC-ACB Status; Revocation of ONC-ACB Status
    We propose the same policies and procedures for an ONC-ACB to 
maintain good standing in the permanent certification program as in the 
temporary certification program. We also include the same descriptions 
for the types of violations discussed above in the temporary 
certification program as well as the same timeframes and processes the 
National Coordinator would take to revoke an ONC-ACBs status. Similar 
to the temporary certification program, we propose that if an ONC-ACB 
has its status revoked due to a Type-1 violation, it would be 
prohibited from reapplying for ONC-ACB status for at least 1 year. We 
believe this timeframe is justified because we assume that a former 
ONC-ACB would need a certain amount of time to reorganize its 
management and key personnel after having its status revoked. 
Additionally, depending on the type of violation that led to the former 
ONC-ACBs status being revoked, it is also possible that it would lose 
its accreditation. We request public comment on whether this timeframe 
should be shortened or lengthened, and whether alternative sanctions 
related to ONC-ACBs or former ONC-ACBs should be considered.
    Again, per our discussion above, we maintain our policy proposal 
for the re-certification of Complete EHRs and/or EHR Modules if the 
National

[[Page 11351]]

Coordinator determines that fraudulent certifications were issued.
7. Validity of Complete EHR and EHR Module Certification
    Based on the same rationale provided in the temporary certification 
program we do not believe that we need to adopt an explicit expiration 
date for the certifications associated with Complete EHRs and EHR 
Modules because of the natural expiration that our other regulatory 
actions would create. Additionally, since a new certification program 
would exist, which would include different processes, we emphasize that 
Complete EHRs and EHR Modules tested and certified under the temporary 
certification program by an ONC-ATCB would need to be tested and 
certified according to the permanent certification program once the 
Secretary adopts certification criteria to replace, amend, or add to 
previously adopted certification criteria. We anticipate that this 
would occur to support meaningful use Stage 2 and, as we discussed in 
the temporary certification program section on this matter, the 
capabilities eligible professionals and eligible hospitals would need 
from their Certified EHR Technology would also change, thereby 
affecting the validity and utility of the prior certification.
    That being said, with respect to EHR Modules, we can envision 
situations, especially in the future, where measures associated with a 
meaningful use objective may change, but the capability a certified EHR 
Module would need to provide would not change. As a result, it may be 
impracticable or unnecessary for the EHR Module to be re-certified. For 
example, a hypothetical meaningful use Stage 3 measure for electronic 
prescribing could be 90% of all prescriptions compared to the 80% 
proposed for meaningful use Stage 1. In this example, it may be 
impracticable for a certified EHR Module for electronic prescribing to 
be recertified if the only thing that has changed is the meaningful use 
measure. Alternatively, if the certification criteria (and standard(s) 
associated with those certification criteria) have changed, then it 
would be necessary for the EHR Module to be re-certified. Therefore, we 
request public comment on whether there should be circumstances where 
EHR Modules should not have to be re-certified.
8. Differential Certification
    We expect that over time the certification criteria adopted by the 
Secretary will increase incrementally, much like the approach CMS has 
proposed for meaningful use objectives and measures. As a result, after 
Complete EHRs and EHR Modules have been certified to meet the 
certification criteria associated with meaningful use Stage 1, it may 
benefit both Complete EHR and EHR Module developers as well as eligible 
professionals and eligible hospitals if some form of differential 
certification were available. Differential certification would comprise 
an ONC-ACB certifying Complete EHRs and/or EHR Modules to the 
differences between the certification criteria adopted by the Secretary 
associated with one stage of meaningful use and a subsequent stage of 
meaningful use. For example, if the Secretary were to adopt 5 new 
certification criteria to support meaningful use Stage 2 and those were 
the only additional capabilities that needed to be certified in order 
for a Complete EHR's certification to be valid again (i.e., all other 
certification criteria remained the same) for the purposes of 
meaningful use Stage 2, then the Complete EHR would only have to be 
tested and certified to those 5 criteria rather than the entire set of 
certification criteria again. We request public comment on factors that 
could be considered to determine when differential certification would 
be appropriate and when it would not. Factors we have considered 
include, whether the standard(s) associated with a certification 
criterion or certification criteria change and whether additional 
certification criteria change in such a way that the new capabilities a 
Complete EHR or EHR Module would need to provide impact how other 
previously certified capabilities would perform.
    We believe that differential certification could be a valuable and 
pragmatic approach for the future and that it may further reduce costs 
for certification and expedite the certification process. We request 
public comment on whether we should require ONC-ACBs to offer 
differential certification. In considering this request, we also ask 
when differential certification should begin. That is, should 
differential certification be permitted to begin with Complete EHRs and 
EHR Modules certified under the temporary certification program (i.e., 
the differences between 2011 and 2013) or after all Complete EHRs and 
EHR Modules have been certified once under the permanent certification 
program (i.e., the differences between 2013 and 2015). We ask 
commenters to consider this distinction because of the differences in 
rigor that we expect Complete EHRs and EHR Modules will go through to 
get certified under the permanent certification program.

F. ONC-Approved Accreditor

    We propose that prior to submitting an application to the National 
Coordinator for ONC-ACB status, an organization would need to be 
accredited by an ONC-AA for certification. We propose a specific 
accreditation requirement for the permanent certification program in 
order to conform to industry best practices. We believe that the 
accreditation of applicants for ONC-ACB status is an important 
prerequisite for the permanent certification program because it not 
only introduces additional rigor and objectivity to the certification 
process, but also provides for increased confidence in, and credibility 
to, the certifications performed. In that regard, if Complete EHR and/
or EHR Module developers believe that an ONC-ACB is not performing up 
to par, they would be able to notify the ONC-AA (in addition to the 
National Coordinator, if necessary) in order to expose any potential 
ONC-ACB performance problems. The ONC-AA would be able to assess 
whether these reports are valid, determine whether the ONC-ACB has 
violated any of the terms of its accreditation, and would be able to 
determine if any action is necessary including notifying the National 
Coordinator.
1. Requirements for Becoming an ONC-AA
    In order to become an ONC-AA, we propose that an accreditation 
organization must submit a request in writing to the National 
Coordinator along with the following information to demonstrate its 
ability to serve as an ONC-AA.
     A detailed description of the accreditation organization's 
conformance to ISO 17011 and experience evaluating the conformance of 
certification bodies to Guide 65.
     A detailed description of the accreditation organization's 
accreditation requirements and how those requirements complement the 
Principles of Proper Conduct for ONC-ACBs.
     Detailed information on the accreditation organization's 
procedures that would be used to monitor ONC-ACBs.
     Detailed information, including education and experience, 
about the key personnel who review certification bodies for 
accreditation.

[[Page 11352]]

     Procedures for responding to, and investigating, 
complaints against ONC-ACBs.
    Once the National Coordinator receives such information, we propose 
that the National Coordinator would be permitted up to 30 days to 
review and issue a determination as to whether the accreditation 
organization has been approved. The National Coordinator would judge 
ONC-AA applicants on the information they provide, the completeness of 
their descriptions to the elements listed above, and their overall 
accreditation experience. The National Coordinator would review 
submissions for ONC-AA status on a first come first serve basis and 
would ``approve'' the first accreditation organization that 
satisfactorily demonstrated its ability to serve as an ONC-AA. We 
propose to use the same process for reconsideration of an accreditation 
organization's approval request as we do for ONC-ACB applicants under 
the permanent certification program.
2. ONC-AA Ongoing Responsibilities
    In order to ensure that our programmatic objectives for the 
permanent certification program are met, we propose that an ONC-AA 
would fulfill, at a minimum, the following ongoing responsibilities:
     Maintain conformance with ISO 17011;
     In accrediting certification bodies, verify conformance 
to, at a minimum, Guide 65;
     Verify that ONC-ACBs are performing surveillance in 
accordance with their respective annual plans; and
     Review ONC-ACB surveillance results to determine if the 
results indicate any substantive non-conformance with the terms set by 
the ONC-AA when it granted the ONC-ACB accreditation.
    We request public comment on these and potentially other ongoing 
responsibilities that we should expressly require an ONC-AA to fulfill.
3. Number of ONC-AAs and Length of Approval
    We believe that it is important for all applicants for ONC-ACB 
status to be accredited by the same ONC-AA. Doing so would provide 
stability and consistency for all ONC-ACB applicants and a common point 
of trust for Complete EHR and EHR Module developers. Moreover, Complete 
EHR and EHR Module developers would obtain a level of assurance that 
any ONC-ACBs' certification would be equal to another's because all of 
them had been accredited by the same ONC-AA. As a result, we believe 
that it is important from a programmatic perspective for there to be 
only one ONC-AA at a time and therefore we have proposed to only 
approve one ONC-AA at a time. We request public comment on whether it 
would be in the best interest of the ONC-ACB applicants and Complete 
EHR and EHR Module developers to allow for more than one ONC-AA at a 
time.
    Finally, we propose that ONC-AA status would expire after 3 years. 
Consistent with this proposed expiration of status, we propose to again 
accept requests for ONC-AA status 120 days before the then current ONC-
AA's status is set to expire. We believe that 3 years provides an 
appropriate balance between precluding other qualified accreditation 
organizations from requesting ONC-AA status and providing some level of 
consistency between the ONC-AA and ONC-ACB levels. We request public 
comment on whether we should extend the length of an ONC-AA's status to 
a maximum of 5 years before accepting requests for ONC-AA status or 
shortening the length to 2 years or identify a different period of 
time.

G. Promoting Participation in the Permanent Certification Program

    In the context of the permanent certification program, it is our 
hope and expectation that multiple organizations will step forward to 
apply for and receive ONC-ACB status and that these organizations will 
be able to certify Complete EHRs and EHR Modules in a timely and 
satisfactory manner. Moreover, given the proposed Medicare and Medicaid 
EHR Incentive Programs, we believe that organizations will be motivated 
to become ONC-ACBs to meet the demand for Certified EHR Technology by 
eligible professionals and eligible hospitals. We do not believe that 
the requirements set forth in this proposed rule create prohibitively 
high barriers to market entry for organizations interested in becoming 
ONC-ACBs. However, we welcome comments on whether this proposed rule 
does in fact create high barriers to market entry and, if so, how we 
could revise the proposed requirements to lower those barriers and 
encourage participation. We provide cost and burden estimates in 
Section V (Collection of Information Requirements) and Section VI 
(Regulatory Impact Analysis).
    HHS is responsible for the overall implementation and success of 
the proposed Medicare and Medicaid EHR Incentive Programs and we are 
acutely aware that without a properly operating certification program 
the overall success of the EHR incentive programs could be affected. We 
are concerned about two low probability, but problematic risks--there 
being no ONC-ACBs authorized under the permanent certification program 
or only one ONC-ACB that engages in monopolistic behavior. We are 
therefore interested in public comment regarding potential approaches 
that could be pursued to stimulate market involvement or remediate this 
situation if it were to develop, including the possibility for the 
National Coordinator to establish a temporary ONC-managed certification 
process (``ONC process'') that would include some type of certification 
review board. This would not be a preferred option, and would come with 
significant limitations. Congress, in section 3001(c)(5) of the PHSA, 
did not expressly authorize the National Coordinator or the Secretary 
to assess and collect fees related to the certification of HIT and 
subsequently retain and use those fees to administer an ONC process if 
it were established. We seek public comment on other potential 
approaches that could be employed to address the two risks identified 
above.

IV. Response to Comments

    Because of the large number of public comments normally received in 
response to Federal Register documents, we are not able to acknowledge 
or respond to them individually. We will consider all comments we 
receive by the date and time specified in the DATES section of this 
preamble, and, when we proceed with a subsequent document, we will 
respond to the comments in the preamble of that document.

V. Collection of Information Requirements

    In compliance with the requirement of section 3506(c)(2)(A) of the 
Paperwork Reduction Act of 1995 (PRA), the Office of the Secretary 
(OS), Department of Health and Human Services, is publishing the 
following summary of proposed information collection requests for 
public comment. In order to fairly evaluate an information collection, 
section 3506(c)(2)(A) of the PRA requires that we solicit comment on 
the following issues:
    1. Whether the information collection is necessary and useful to 
carry out the proper functions of the agency;
    2. The accuracy of the agency's estimate of the information 
collection burden;
    3. The quality, utility, and clarity of the information to be 
collected; and

[[Page 11353]]

    4. Recommendations to minimize the information collection burden on 
the affected public, including automated collection techniques.
    Under the PRA, the time, effort, and financial resources necessary 
to meet the information collection requirements referenced in this 
section are to be considered. We explicitly seek, and will consider, 
public comment on our assumptions as they relate to the PRA 
requirements summarized in this section. To comment on the collections 
of information or to obtain copies of the supporting statements and any 
related forms for the proposed paperwork collections referenced in this 
section, e-mail your comment or request, including your address and 
phone number to Sherette.funncoleman@hhs.gov, or call the Reports 
Clearance Office on (202) 690-6162. Written comments and 
recommendations for the proposed information collections must be 
directed to the OS Paperwork Clearance Officer at the above e-mail 
address within 30 days.

Abstract

    The Health Information Technology for Economic and Clinical Health 
(HITECH) Act, Title XIII of Division A and Title IV of Division B of 
the American Recovery and Reinvestment Act of 2009 (ARRA) (Pub. L. 111-
5), was enacted on February 17, 2009. The HITECH Act amended the Public 
Health Service Act (PHSA) and created ``Title XXX--Health Information 
Technology and Quality'' (Title XXX) to improve health care quality, 
safety, and efficiency through the promotion of health information 
technology (HIT) and electronic health information exchange.
    Section 3001(c)(5) of the PHSA requires the National Coordinator, 
in consultation with the Director of the National Institute of 
Standards and Technology, to ``keep or recognize a program or programs 
for the voluntary certification of health information technology as 
being in compliance with applicable certification criteria'' adopted by 
the Secretary under section 3004. In this notice of proposed rulemaking 
implementing section 3001(c)(5), we propose to establish two 
certification programs, a temporary certification program and a 
permanent certification program. The establishment of these programs 
and the proposals therein would require four separate collections of 
information.

A. Collection of Information 1: Application for ONC-ATCB 
Status Under the Proposed Temporary Certification Program

    Under the proposed temporary certification program, an applicant 
who voluntarily applies to become an ONC-ATCB would be required to 
submit an application to the National Coordinator. Based on prior 
experience, we believe that the testing and certification of Complete 
EHRs and/or EHR Modules will require expertise that few in the HIT 
marketplace possess. As a result, we assume that there will be no more 
than 3 applicants for ONC-ATCB status. We believe that there will be no 
more than 3 applicants because we have only seen evidence in the press 
of one organization that has committed to applying and another that has 
expressed its interest in entering the HIT testing and certification 
field. The application requirements include the completion of an 
application form, submission of additional documentation as specified 
in the application form, and completion of a proficiency examination. 
However, the proficiency examination is not considered ``information'' 
for PRA collection purposes because it falls under the exception to the 
definition of information at 5 CFR 1320.3(h)(7). We estimate that it 
will take approximately:
     10 minutes for an applicant to provide the general 
identifying information requested in the application (section 1);
     2 hours to complete the Guide 65 self audit and assemble 
associated documentation (section 2);
     2 hours to complete the ISO 17025 self audit and assemble 
associated documentation (section 3); and
     20 minutes to review and agree to the ``Principles of 
Proper Conduct for ONC-ATCBs'' (section 4).
    As discussed in more detail in section VI, we base these estimates 
on the assumption that qualified applicants for the temporary 
certification program will already be familiar with the relevant 
requirements found in the ISO/IEC standards and will have a majority, 
if not all, of the documentation requested in the application already 
developed and available before applying for ONC-ATCB status. Therefore, 
with the exception of completing a proficiency examination, we believe 
an applicant would only spend time collecting and assembling already 
developed information to submit with their application rather than 
developing, for example, a ``quality manual'' from scratch.
    More specifics about the temporary certification program's proposed 
application requirements and the information that would be collected 
can be found at Sec.  170.420.

                                        Estimated Annualized Burden Hours
----------------------------------------------------------------------------------------------------------------
                                                                   Number of    Average  burden
    Type of respondent (ONC-ATCB applicant)        Number of     responses per     hours per       Total burden
                                                  respondents     respondent        response          hours
----------------------------------------------------------------------------------------------------------------
ATCB Application Section 1....................               3               1          10/60                 .5
ATCB Application Section 2....................               3               1              2                6
ATCB Application Section 3....................               3               1              2                6
ATCB Application Section 4....................               3               1          20/60                1
                                               -----------------------------------------------------------------
    Total.....................................               3               1              4.5             13.5
----------------------------------------------------------------------------------------------------------------

B. Collection of Information 2: Application for ONC-ACB Status 
Under the Proposed Permanent Certification Program

    Under the proposed permanent certification program, an applicant 
who voluntarily applies to become an ONC-ACB would be required to 
submit an application to the National Coordinator. We estimate that 
there will be no more than 6 applicants for ONC-ACB status under the 
permanent certification program. While we believe that the business 
case for entering the HIT market to perform the certification of 
Complete EHRs and EHR Modules could increase as health IT adoption 
rates increase, we believe that it is unlikely (given the expertise 
needed to perform the certification of Complete EHRs and EHR Modules) 
that the number of applicants would extend into the tens of applicants.
    The application requirements include the completion of an 
application form and submission of additional

[[Page 11354]]

documentation as specified in the application form. We estimate that it 
will take approximately:
     10 minutes for an applicant to provide the general 
identifying information requested in the application (section 1);
     30 minutes to assemble the information necessary to 
provide documentation of accreditation by an ONC-AA (section 2); and
     20 minutes to review and agree to the ``Principles of 
Proper Conduct for ONC-ACBs'' (section 3).
    While we anticipate that very few organizations will have the 
expertise to test and certify HIT in the temporary certification 
program, we have proposed to separate these responsibilities in the 
permanent certification program and in doing so, we believe that 
several private sector organizations that currently conduct only 
testing or only certification will be able to enter the HIT testing and 
certification field. Our burden estimates above are based on the 
assumption that these existing entities will already be familiar with 
many of the requirements proposed in this rule and will, for example, 
already have a majority--if not all--of the documentation requested in 
the application already developed and available before applying for 
ONC-ACB status.
    Also, while this rule does impose record keeping requirements, we 
believed that the proposed 5-year requirement is in line with common 
industry practice and, consequently, would not represent an additional 
cost to ONC-ACBs as a result of this rule.
    More specifics about the permanent certification program's proposed 
application requirements and the information that would be collected 
can be found at Sec.  170.502.

                                        Estimated Annualized Burden Hours
----------------------------------------------------------------------------------------------------------------
                                                                     Number of        Average
     Type of respondent (ONC-ACB applicant)          Number of     responses per   burden hours    Total burden
                                                    respondents     respondent     per response        hours
----------------------------------------------------------------------------------------------------------------
ACB Application Section 1.......................               6               1           10/60               1
ACB Application Section 2.......................               6               1           30/60               3
ACB Application Section 3.......................               6               1           20/60               2
                                                 ---------------------------------------------------------------
    Total.......................................               6               1               1               6
----------------------------------------------------------------------------------------------------------------

C. Collection of Information 3: ONC-ATCB and ONC-ACB 
Collection and Reporting of Information Related To Complete EHR and/or 
EHR Module Certifications

    Under both of the proposed certification programs we propose to 
require ONC-ATCBs and ONC-ACBs to provide ONC, no less frequently than 
weekly, a current list of Complete EHRs and/or EHR Modules that have 
been tested and certified which includes, at a minimum, the vendor name 
(if applicable), the date certified, the product version, the unique 
certification number or other specific product identification, and 
where applicable, the certification criterion or certification criteria 
to which each EHR Module has been tested and certified.
    These specific proposed requirements for the temporary 
certification program and the permanent certification program can be 
found at Sec.  170.420 and Sec.  170.520, respectively.
    For the purposes of estimating the potential burden, we assume that 
all of the estimated applicants in the tables above will apply and 
become ONC-ATCBs and ONC-ACBs under the temporary certification program 
and permanent certification program, respectively. We also assume, per 
our requirement specified in the respective Principles of Proper 
Conduct for ONC-ATCBs and ONC-ACBs, that ONC-ATCBs and ONC-ACBs will 
report weekly (i.e., respondents will respond 52 times per year). 
Finally, we assume that the information collections would be 
accomplished through electronic data collection and storage and that 
such collection and storage would be part of ONC-ATCBs and ONC-ACBs 
normal course of business. Therefore, with respect to this proposed 
collection of information, the estimated burden is limited to the 
actual electronic reporting of the information to ONC.

                                        Estimated Annualized Burden Hours
----------------------------------------------------------------------------------------------------------------
                                                                     Number of        Average
               Type of respondent                    Number of     responses per   burden hours    Total burden
                                                    respondents     respondent     per response        hours
----------------------------------------------------------------------------------------------------------------
ONC-ATCB Testing and Certification Results......               3              52               1             156
ONC-ACB Certification Results...................               6              52               1             312
                                                 ---------------------------------------------------------------
    Total.......................................               9             104               2             468
----------------------------------------------------------------------------------------------------------------

D. Collection of Information 4: Required Documentation for 
Requesting ONC-Approved Accreditor Status

    Under the permanent certification program we propose to require 
accreditation organizations who seek to become an ONC-AA to submit 
information to the National Coordinator to demonstrate their ability to 
accredit certification bodies that would eventually apply for ONC-ACB 
status. We assume that there will only be two accreditation 
organizations that will prepare and submit the information sought by 
the National Coordinator. We believe this will be the case based on our 
knowledge of the HIT market and consultations with NIST related to the 
existence of potential accreditation organizations that could seek the 
National Coordinator's approval.
    We have included our estimates of the approximate time commitments 
associated with documenting each requirement that must be included in 
an accreditation organization's submission:
     20 minutes for an accreditation organization to provide a 
detailed description of the accreditation

[[Page 11355]]

organization's conformance to ISO 17011 and experience evaluating the 
conformance of certification bodies to Guide 65;
     20 minutes for an accreditation organization to provide a 
detailed description of the accreditation organization's accreditation 
requirements and how the requirements complement the Principles of 
Proper Conduct for ONC-ACBs;
     5 minutes for an accreditation organization to provide a 
copy of the procedures that would be used to monitor ONC-ACBs;
     10 minutes for an accreditation organization to provide 
detailed information, including education and experience, about the key 
personnel who review certification bodies for accreditation; and
     5 minutes for an accreditation organization to provide a 
copy of the procedures for responding to, and investigating, complaints 
against ONC-ACBs.

These specific proposed requirements for the permanent certification 
program can be found at Sec.  170.503.

                                        Estimated Annualized Burden Hours
----------------------------------------------------------------------------------------------------------------
                                                                     Number of        Average
      Type of respondent (ONC-AA requestor)          Number of     responses per   burden hours    Total burden
                                                    respondents     respondent     per response        hours
----------------------------------------------------------------------------------------------------------------
Documentation of Conformance to ISO 17011 and                  2               1           20/60            .67
 Guide 65 Experience............................
Description of Accreditation Requirements and                  2               1           20/60            .67
 how they Complement the Principles of Proper
 Conduct for ONC-ACBs...........................
Documentation of Monitoring Procedures..........               2               1            5/60            .165
Documentation of Key Personnel..................               2               1           10/60            .33
Documentation of Procedures for Responding to                  2               1            5/60            .165
 and Investigating Complaints...................
                                                 ---------------------------------------------------------------
    Total.......................................               2               1               1           2
----------------------------------------------------------------------------------------------------------------

    As required by Sec.  3504(h) of the Paperwork Reduction Act, we 
have submitted a copy of this document to the Office of Management and 
Budget (OMB) for its review of these information collection 
requirements.

VI. Regulatory Impact Analysis

A. Introduction

    We have examined the impacts of this proposed rule as required by 
Executive Order 12866 on Regulatory Planning and Review (September 30, 
1993, as further amended), the Regulatory Flexibility Act (RFA) (5 
U.S.C. 601 et seq.), section 202 of the Unfunded Mandates Reform Act of 
1995 (2 U.S.C. 1532), Executive Order 13132 on Federalism (August 4, 
1999), and the Congressional Review Act (5 U.S.C. 804(2)).
    Executive Order 12866 directs agencies to assess all costs and 
benefits of available regulatory alternatives and, if regulation is 
necessary, to select regulatory approaches that maximize net benefits 
(including potential economic, environmental, public health and safety 
effects, distributive impacts, and equity). A regulatory impact 
analysis (RIA) must be prepared for major rules with economically 
significant effects ($100 million or more in any one year). Based on 
the analysis of costs and benefits that follows, we have determined 
that this proposed rule, including both the temporary certification 
program and permanent certification program, is not an economically 
significant rule because we estimate that the overall costs and 
benefits associated with the combination of the temporary and permanent 
certification programs as well as the costs associated with the testing 
and certification of Complete EHRs and EHR Modules under both 
certification programs will be less than $100 million per year. 
Nevertheless, because of the public interest in this proposed rule, we 
have prepared an RIA that to the best of our ability presents the costs 
and benefits of the proposed rule broken down by each proposed 
certification program. We request comments on the economic analyses 
provided in this proposed rule.

B. Why This Rule is Needed?

    As stated in earlier sections of this proposed rule, section 
3001(c)(5) of the PHSA provides the National Coordinator with the 
authority to establish a certification program or programs for the 
voluntary certification of HIT. This proposed rule is needed to outline 
the processes by which the National Coordinator would exercise this 
authority to authorize certain organizations to test and certify 
Complete EHRs and/or EHR Modules. Once certified, Complete EHRs and EHR 
Modules would be able to be used by eligible professionals and eligible 
hospitals as, or be combined to create, Certified EHR Technology. 
Eligible professionals and eligible hospitals who seek to qualify for 
incentive payments under the Medicare and Medicaid EHR Incentive 
Programs are required by statute to use Certified EHR Technology.

C. Executive Order 12866--Regulatory Planning and Review Analyses for 
the Proposed Temporary and Permanent Certification Programs

    As required by Executive Order 12866, we have examined the economic 
implications of this proposed rule as it relates to our proposed 
temporary and permanent certification programs. Executive Order 12866 
directs agencies to assess all costs and benefits of available 
regulatory alternatives and, when regulation is necessary, to select 
regulatory approaches that maximize net benefits (including potential 
economic, environmental, public health and safety, and other 
advantages; distributive impacts; and equity). Executive Order 12866 
classifies a regulation as significant if it meets any one of a number 
of specified conditions, including having an annual effect on the 
economy of $100 million, or in a material way adversely affecting the 
economy, a sector of the economy, competition, or jobs. While this rule 
is therefore not ``economically significant,'' as defined by Executive 
Order 12866, OMB has determined that this rule constitutes a 
``significant regulatory action'' as defined by Executive Order 12866 
because it raises novel legal and policy issues.
    Throughout the following analyses we identify specific actions or 
issues for which we expressly ask for comments. The public, however, is 
invited to comment on any and all elements of the analyses and on all 
underlying assumptions.

[[Page 11356]]

1. Temporary Certification Program Estimated Costs
a. Application Process for ONC-ATCB Status
i. Applicant Costs
    As mentioned above, we believe that the testing and certification 
of Complete EHRs and/or EHR Modules will require expertise that not 
many in the HIT marketplace currently possess. Therefore, we assume 
that there will be no more than 3 applicants for ONC-ATCB status. We 
believe that there will be no more than three applicants because we 
have only seen evidence in the press of one organization that has 
committed to applying and another that has expressed its interest in 
entering the HIT testing and certification field.
    As part of the temporary certification program, an applicant would 
be required to submit an application and complete a proficiency exam. 
We do not believe that there will be an appreciable difference in the 
time commitment an applicant for ONC-ATCB status will have to make 
based on the type of authorization it seeks (i.e., we believe the 
application process and time commitment will be the same for applicants 
seeking authorization to conduct either the testing and certification 
of Complete EHRs or EHR Modules). Further, we assume that qualified 
applicants will have reviewed the relevant requirements found in the 
ISO/IEC standards and will have a majority, if not all, of the 
documentation requested in the application already developed and 
available before applying for ONC-ATCB status. Without having such 
documentation (including policies and procedures) we believe that it 
would be difficult for an applicant to operate a legitimate testing and 
certification program. Therefore, with the exception of completing a 
proficiency examination, we believe an applicant would only spend time 
collecting and assembling already developed information to submit with 
their application rather than developing, for example, a ``quality 
manual'' from scratch.
    Based on our assumptions and consultations with NIST, we anticipate 
that it will take an applicant approximately 28.5 hours to complete the 
application and submit the requested documentation. Our estimate 
includes the time discussed above in our collection of information 
section and approximately up to 24 hours to complete the proficiency 
examination--8 hours (1 full work day) to complete section 1 
(demonstration of technical expertise related to Complete EHRs and/or 
EHR Modules); 6 hours to complete section 2 (demonstration of test tool 
identification); and 10 hours to complete section 3 (demonstration of 
proper use of test tools and understanding of test results). Moreover, 
after consulting with NIST we assume that:
    (1) An employee equivalent to the Federal Salary Classification of 
GS-9 Step 1 could provide the general information requested in the 
application and accomplish the paperwork duties associated with the 
application;
    (2) An employee equivalent to the Federal Salary Classification of 
GS-15 Step 1 would be responsible for conducting the self audits and 
agreeing to the ``Principles of Proper Conduct for ONC-ATCBs''; and
    (3) An employee or employees equivalent to the Federal Salary 
Classification of GS-15 Step 1 would be responsible for completing the 
proficiency examination.
    We have taken these employee assumptions and utilized the 
corresponding employee hourly rates for the locality pay area of 
Washington, DC as published by the U.S. Office of Personnel Management 
(OPM), to calculate our cost estimates. We have also calculated the 
costs of an employee's benefits while completing the application. We 
have calculated these costs by assuming that an applicant expends 
thirty-six percent (36%) of an employee's hourly wage on benefits for 
the employee. We have concluded that a 36% expenditure on benefits is 
an appropriate estimate because it is the routine percentage used by 
HHS for contract cost estimates. Our calculations are expressed in 
Tables 1 and 2 below.

           Table 1--Temporary Certification Program: Cost to Applicants To Apply To Become an ONC-ATCB
----------------------------------------------------------------------------------------------------------------
                                                                                      Cost of
                                    Employee                         Employee        employee        Cost per
     Proposed requirement          equivalent      Burden hours     hourly wage    benefits per      applicant
                                                                       rate            hour
----------------------------------------------------------------------------------------------------------------
General Identifying             GS-9 Step 1.....           10/60          $22.39           $8.06           $5.07
 Information.
Self Audits and Documentation.  GS-15 Step 1....               4           59.30           21.35          322.60
Principles of Proper Conduct..  GS-15 Step 1....           20/60           59.30           21.35           26.89
Proficiency Examination.......  GS-15 Step 1....              24           59.30           21.35        1,935.60
                               ---------------------------------------------------------------------------------
    Total Cost Per Application  ................  ..............  ..............  ..............        2,290.16
----------------------------------------------------------------------------------------------------------------


                   Table 2--Temporary Certification Program: Total Cost of Application Process
----------------------------------------------------------------------------------------------------------------
                                                              Cost of application  per
              Anticipated number of applicants                      applicant ($)        Total cost estimate ($)
----------------------------------------------------------------------------------------------------------------
3...........................................................                $2,290.16                 $6,870.48
----------------------------------------------------------------------------------------------------------------

    We based our cost estimates on the amount of applicants that we 
believe will apply over the life of the temporary certification 
program. We assume that all applicants will apply during the first year 
of the program and thus all application costs should be attributed to 
the first year of the program. However, based on our projection that 
the temporary certification program will last approximately two years 
and that one or two applicants may choose to apply in the second year, 
the annualized cost of the application process would be $3,435. We 
invite comments on our estimated number of applicants and on the costs 
associated with the proposed application process under the temporary 
certification program.
ii. Costs to the Federal Government
    We have estimated the cost to develop the ONC-ATCB application, 
including the development and administration of

[[Page 11357]]

the proficiency examination to be $33,079 based on the 473 hours we 
believe it will take to develop the application, prepare standard 
operating procedures as well as create the requisite pools of questions 
for the proficiency examinations. More specifically, we believe it will 
take 360 hours of work of a Federal Salary Classification GS-14 Step 1 
employee located in Washington, DC to develop the proficiency 
examination, 80 hours of work by the same employee to develop the 
standard operation procedures and the actual application, and 33 hours 
to score all the exams and handle related administrative tasks.
    We also anticipate that there would be costs associated with 
reviewing applications under the proposed temporary certification 
program. We believe that a GS-15 Step 1 employee would review the 
applications and the National Coordinator (or designated 
representative) would issue final decisions on all applications. We 
anticipate that it would take approximately 40 hours to review and 
reach a final decision on each application. This estimate assumes a 
satisfactory application (i.e., no formal deficiency notifications) and 
includes the time necessary to verify the information in each 
application, assess the results of the proficiency examination, and 
prepare a briefing for the National Coordinator. We estimate the cost 
for the application review process to be $10,140.
    As a result, we estimate the Federal government's overall cost of 
administering the entire application process, for the length of the 
temporary certification program, at approximately $43,219. Based on our 
projection that the temporary certification program will last 
approximately two years and that one or two applicants may choose to 
apply in the second year, the annualized cost to the Federal government 
for administering the entire application process would be $21,610.
    As previously noted, we will also post the names of applicants 
granted ONC-ATCB status on our Web site. We believe that there would be 
minimal cost associated with this action and have calculated the 
potential cost to be approximately $156 on an annual basis for posting 
and maintaining the information on our Web site (a maximum of 3 hours 
of work for a Federal Salary Classification GS-12 Step 1 employee 
located in Washington, DC).
b. Temporary Certification Program: Testing and Certification of 
Complete EHRs and EHR Modules
    Section 3001(c)(5)(A) of the PHSA indicates that certification is a 
voluntary act; however, due to the fact that the Medicare and Medicaid 
EHR Incentive Programs require eligible professionals and eligible 
hospitals to use Certified EHR Technology in order to qualify for 
incentive payments, we anticipate that a significant portion of 
Complete EHR and EHR Module developers will seek to have their HIT 
tested and certified.
    In table 3 below, we estimate the costs for Complete EHRs and EHR 
Modules to be tested and certified under the temporary certification 
program. As discussed in the HIT Standards and Certification Criteria 
interim final rule, and to remain consistent with our previous 
estimates (75 FR 2039), we believe that approximately 93 commercially-
developed and open source Complete EHRs and 50 EHR Modules will be 
tested and certified under our proposed temporary certification 
program. In addition to these costs, we also take into account what we 
believe will be the costs incurred by a small percentage of eligible 
professionals and eligible hospitals who themselves will incur the 
costs associated with the testing and certification of their self-
developed Complete EHR or EHR Module.
    With respect to the potential for eligible professionals to seek 
testing and certification for a self-developed Complete EHR or EHR 
Module, DesRoches approximates that only 5% of physicians are in large 
practices of over 50 doctors.\3\ Of these large practices, 17% use an 
``advanced EHR system'' that could potentially be tested and certified 
if it were self-developed (we assume that smaller physician practices 
do not have the resources to self-develop a Complete EHR or EHR 
Module). We are unaware of any reliable data on the number of large 
physicians groups who may have a self-developed Complete EHR or EHR 
Module for which they would seek to be tested and certified. As a 
result, we request public comment on what this percentage may be and 
offer the following estimate based on currently available data. We 
believe that the total number of eligible professionals in larger 
practices who both possess and would seek to have a self-developed 
Complete EHR or EHR Module tested and certified will be low--no more 
than 10%. By taking CMS's estimate of approximately 450,000 eligible 
professionals (75 FR 1960) we multiply through by the numbers above 
(450,000 x .05 x .17 x .10) and then divide by a practice size of at 
least 50 which yields approximately 8 self-developed Complete EHRs or 
EHR Modules designed for an ambulatory setting that could be submitted 
for testing and certification.
---------------------------------------------------------------------------

    \3\ DesRoches, CM et al. Electronic Health Records in Ambulatory 
Care--A National Survey of Physicians New England Journal of 
Medicine July 2008; 359:50-60.
---------------------------------------------------------------------------

    With respect to eligible hospitals, similar to eligible 
professionals, we believe that only large eligible hospitals would be 
in a position to have self-developed a Complete EHR or EHR Module and 
seek to have it tested and certified. Again, we are unaware of any 
reliable data on the number of eligible hospitals who may have a self-
developed Complete EHR or EHR Module for which they would seek to be 
tested and certified. As a result, we request public comment on what 
this percentage may be and offer the following estimate based on 
currently available data. We estimate that 10% of large eligible 
hospitals have a self-developed Complete EHR or EHR Module and that all 
of theses hospitals would seek to have it tested and certified. 
Extrapolating from the AHA survey data on hospital adoption described 
by Jha et al. in the New England Journal of Medicine, there would be 
only about 300 large hospitals with advanced systems and, as a result, 
we believe approximately 30 that would be in a position to seek to have 
a self-developed Complete EHR or EHR Module tested and certified.\4\
---------------------------------------------------------------------------

    \4\ Jha, AK et al. Use of Electronic Health Records in U.S. 
Hospitals. New England Journal of Medicine March 2009; 360:1628-38.
---------------------------------------------------------------------------

    We believe that our estimates for eligible professionals and 
eligible hospitals are generous and that a good portion of the eligible 
professionals and eligible hospitals who would likely seek to qualify 
for incentive payments with self-developed Complete EHRs or EHR Modules 
would only do so for meaningful use Stage 1. After meaningful use Stage 
1 we anticipate that the number of eligible professionals and eligible 
hospitals who would incur the costs of testing and certification 
themselves will go down because the effort involved to maintain a 
Complete EHR or EHR Module may be time and cost prohibitive as the 
Secretary continues to adopt additional certification criteria to 
support future stages of meaningful use.
    Due to the fact that an ONC-ATCB will be responsible for testing 
and certifying Complete EHRs and/or EHR Modules, we have combined the 
costs

[[Page 11358]]

for testing and certification because we believe they would be 
difficult to independently estimate. Our cost range for the testing and 
certification of Complete EHRs and EHR Modules includes consideration 
of how the testing and certification will be conducted (i.e., by remote 
testing and certification, on-site testing and certification, or at the 
ONC-ATCB and for the complexity of an EHR Module). To illustrate, we 
assume that the on-site testing and certification of a Complete EHR and 
the testing and certification of a complex EHR Module would both be at 
the high end of their respective cost estimates (i.e., $50,000 and 
$35,000).
    On July 14, 2009, CCHIT testified in front of the HIT Policy 
Committee on the topic of EHR certification, including the 
certification of EHR Modules. CCHIT estimated that ``EHR-
comprehensive'' (Complete EHRs) testing and certification would range 
from approximately $30,000 to $50,000. CCHIT also estimated that the 
testing and certification of EHR Modules would range from approximately 
$5,000 to $35,000 depending on the scope of the testing and 
certification. We believe that these estimates provide a reasonable 
foundation and have used them for our cost estimates. However, we 
assume that competition in the testing and certification market will 
reduce the costs of testing and certification as estimated by CCHIT but 
we are unable to provide a reliable estimate at this time of what the 
potential reduction in costs might be. Please also note, that because 
we have limited data on the number of self-developed Complete EHRs and 
EHR Modules that will be presented for testing and certification, we 
cannot accurately separate the costs for the testing and certification 
of self-developed Complete EHRs from self-developed EHR Modules. As a 
result, we have estimated the lowest possible cost by assuming that all 
of the estimated self-developed HIT that will be presented for testing 
and certification will be EHR Modules and that they would be tested and 
certified at the lowest estimated cost ($5,000 each) and then we 
estimated the highest possible cost by assuming that all of the 
estimated self-developed HIT that will be presented for testing and 
certification will be Complete EHRs and that they would be tested and 
certified at the highest estimated cost ($50,000 each). Our cost 
estimates are expressed in Table 3 below.

                                 Table 3--Temporary Certification Program: Estimated Costs for Testing and Certification
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                                           Cost per complete EHR/EHR module ($M)    Total cost for all complete EHRs/EHR
                                                               Number   ------------------------------------------    modules over 3-year period ($M)
                           Type                              tested and                                           --------------------------------------
                                                             certified        Low          High        Mid-point       Low          High      Mid-point
--------------------------------------------------------------------------------------------------------------------------------------------------------
Commercial/Open Source Complete EHR.......................           93        $0.03         $0.05         $0.04         $2.79        $4.65        $3.72
Commercial/Open Source EHR Module.........................           50         0.005         0.035         0.02          0.25         1.75            1
Self-Developed Complete EHRs and EHR Modules..............           38         0.005         0.05          0.028         0.19         1.90         1.06
                                                           ---------------------------------------------------------------------------------------------
    Total.................................................          181  ............  ............  ............         3.23         8.30         5.78
--------------------------------------------------------------------------------------------------------------------------------------------------------

    Our estimates cover anticipated testing and certification costs 
under the temporary certification program from 2010 through some 
portion of 2012 as we expect the permanent certification program to be 
operational by 2012. However, because we cannot predict the exact date 
at which the temporary certification program will sunset (and the date 
at which ONC-ATCBs will finish any remaining tests and certifications 
in their queue), we believe that it is appropriate to attribute all 
2012 costs for testing and certification to both the temporary 
certification program and the permanent certification program to err on 
the side of overestimating rather than underestimating the costs of our 
proposals. Therefore, we also attribute the 2012 testing and 
certification costs associated with certification criteria adopted by 
the Secretary to support meaningful use Stage 1 in section C.2 below.
    Consistent with our estimates in the HIT Standards and 
Certification Criteria interim final rule (75 FR 2041) about when 
Complete EHRs and EHR Modules will be prepared for testing and 
certification to the certification criteria adopted by the Secretary 
for meaningful use Stage 1, we anticipate that they will be tested and 
certified in the same proportions. Therefore, we believe that of the 
total number of Complete EHRs and EHR Modules that we have estimated 
(commercial, open source, and self-developed), 45% will be tested and 
certified in 2010, 40% will be tested and certified in 2011, and 15% 
will be tested and certified in 2012. Table 4 below represents this 
proportional distribution of the estimated costs we calculated for the 
testing and certification of Complete EHRs and EHR Modules to the 
certification criteria adopted to support meaningful use Stage 1 under 
the temporary certification program as expressed in Table 3 above.

 Table 4--Distributed Total Costs for the Testing and Certification of Complete EHRs and EHR Modules to Stage 1
                                   MU by Year (3-Year Period)--Totals Rounded
----------------------------------------------------------------------------------------------------------------
                                                                                    Total high     Total average
                      Year                             Ratio      Total low cost   cost estimate   cost estimate
                                                     (percent)     estimate ($M)       ($M)            ($M)
----------------------------------------------------------------------------------------------------------------
2010............................................              45           $1.45           $3.74           $2.60
2011............................................              40            1.29            3.32            2.31
2012............................................              15            0.49            1.24            0.87
                                                 ---------------------------------------------------------------
    3-Year Totals...............................  ..............            3.23            8.30            5.78
----------------------------------------------------------------------------------------------------------------


[[Page 11359]]

2. Permanent Certification Program Estimated Costs
a. Request for ONC-AA Status
i. Cost of Submission for Requesting ONC-AA Status
    As noted in the collection of information section, we believe that 
only two accreditation organizations will prepare and submit the 
information sought by the National Coordinator. Additionally, as noted 
in the collection of information section, we estimate that it will take 
1 hour to prepare and submit a request for ONC-AA status. We believe 
that an employee equivalent to the Federal Salary Classification of GS-
15 Step 1 would be responsible for preparing and submitting the 
required information.
    We have utilized the corresponding employee hourly rate for the 
locality pay area of Washington, DC, as published by the OPM, to 
calculate our cost estimates. We have also calculated the costs of an 
employee's benefits while preparing and submitting the required ONC-AA 
documentation. We have calculated these costs by assuming that an 
accreditation organization expends thirty-six percent (36%) of an 
employee's hourly wage on benefits for the employee. We have concluded 
that a 36% expenditure on benefits is an appropriate estimate because 
it is the routine percentage used by HHS for contract cost estimates. 
Our cost estimates are expressed in the Table 5 below.

Table 5--Permanent Certification Program: Cost to Accreditation Organizations To Submit the Information Required
                                               to Become an ONC-AA
----------------------------------------------------------------------------------------------------------------
                                                                                                     Total cost
      Proposed requirement            Employee       Burden hours   Hourly wage   Cost of employee       per
                                     equivalent                        rate      benefits per hour    applicant
----------------------------------------------------------------------------------------------------------------
Submission of Request for ONC-   GS-15 Step 1......            1        $59.30             $21.35        $80.65
 AA Status.
----------------------------------------------------------------------------------------------------------------

    Using our estimates above, we believe that the cost to submit the 
information required to become an ONC-AA will be $81 and the total cost 
for the two accreditation organizations that we estimate will submit 
requests for ONC-AA status will be $161. Based on our estimate of two 
accreditation organizations submitting the required documentation to be 
considered for ONC-AA status and on our proposal that we would seek to 
select an ONC-AA every three years, we estimate the annualized cost of 
this process to be $54. We welcome comments on our estimates for the 
number of accreditation organizations that will request ONC-AA status 
and our cost estimates.
ii. Cost to the Federal Government
    We anticipate that there will be costs associated with reviewing 
the information provided by accreditation organizations requesting to 
become an ONC-AA under the proposed permanent certification program. We 
believe that a GS-15 Step 1 employee would review the submissions and 
the National Coordinator (or designated representative) would issue 
final decisions on all submissions. We anticipate that it would take 10 
hours to review and reach a final decision on each submission. This 
estimate assumes a satisfactory submission (i.e., no formal deficiency 
notifications) and includes the time necessary to verify the 
information in each submission and prepare a briefing for the National 
Coordinator. We estimate the Federal government's overall cost to 
review the submissions and select an ONC-AA to be $1,732. Based on our 
estimate of two accreditation organizations submitting the required 
documentation to be considered for ONC-AA status and on our proposal 
that we would seek to select an ONC-AA every three years, the 
annualized cost to the Federal government for reviewing the submissions 
for ONC-AA status would be $577. If we notify the public of the 
selection of the ONC-AA by posting the information on our Web site or 
by issuing a press release, we believe that we would incur negligible 
costs from these actions.
b. Application Process for ONC-ACB Status and Renewal
i. Applicant Costs and ONC-ACB Renewal Costs
    Similar to the temporary certification program, we propose that an 
applicant for ONC-ACB status would be required to submit an 
application. However, unlike the temporary certification program, we 
have proposed that applicants for ONC-ACB status must be accredited in 
order to be a qualified ONC-ACB applicant. We estimate that there will 
be 6 applicants for ONC-ACB status under the permanent certification 
program and that those 6 applicants will first seek and become 
accredited by an ONC-AA. Because accreditation would include a 
demonstration of conformance to Guide 65 for all organizations that 
seek to be accredited, we do not believe that there will be a 
difference in the cost of accreditation for organizations who seek to 
become ONC-ACBs for EHR Modules versus ONC-ACBs for Complete EHRs.
    Based on our consultations with NIST, we estimate that it would 
take approximately 2 to 5 days for an ONC-AA to complete the 
accreditation process at a cost of $20,000. This cost includes an 
estimated $5,000 administrative fee and an estimated $15,000 fee for 
the accreditation assessment. We expect that the accreditation renewal 
process will occur once between 2012 and 2016 for each ONC-ACB and 
assume that the accreditation renewal process will be less onerous than 
the initial accreditation process because the ONC-ACB would presumably 
apply to the same ONC-AA and that the ONC-AA would rely on prior 
information and not conduct a completely new review of an ONC-ACB. We 
believe this is a reasonable assumption because the ONC-AA will likely 
already be familiar with the ONC-ACB and have its documentation on file 
and we do not expect that the ONC-ACB would make such drastic changes 
to its policies or procedures which would necessitate a lengthy 
assessment of their competency by an ONC-AA. Accordingly, we estimate 
that accreditation renewal would take no more than 3 days and would 
cost no more than $10,000. These estimated costs are expressed in Table 
7 below.
    After becoming accredited by an ONC-AA, an applicant for ONC-ACB 
status would incur minimal costs to prepare and submit an application 
to the National Coordinator. As noted in the collection of information 
section, we believe that it will take 10 minutes to provide the general 
information requested in the application, 30 minutes to assemble the 
information necessary to provide documentation of accreditation by an 
ONC-AA, and 20 minutes to

[[Page 11360]]

review and agree to the ``Principles of Proper Conduct for ONC-ACBs.''
    Based on our consultations with NIST, we believe that an employee 
equivalent to the Federal Salary Classification of GS-9 Step 1 could 
provide the required general identifying information and documentation 
of accreditation status. We believe that an employee equivalent to the 
Federal Salary Classification of GS-15 Step 1 would be responsible for 
reviewing and agreeing to the ``Principles of Proper Conduct for ONC-
ACBs.'' We have taken these employee assumptions and utilized the 
corresponding employee hourly rates for the locality pay area of 
Washington, DC, as published by the OPM, to calculate our cost 
estimates. We have also calculated the costs of an employee's benefits 
while completing the application. We have calculated these costs by 
assuming that an applicant expends thirty-six percent (36%) of an 
employee's hourly wage on benefits for the employee. We have concluded 
that a 36% expenditure on benefits is an appropriate estimate because 
it is the routine percentage used by HHS for contract cost estimates. 
Our cost estimates are expressed in Table 6 below.

 Table 6--Permanent Certification Program: Cost To Applicants To Apply to Become ONC-ACBs and Cost for ONC-ACBs
                                           To Apply for Status Renewal
----------------------------------------------------------------------------------------------------------------
                                                                                         Cost of
                                                              Burden      Employee      employee       Cost per
       Proposed requirement           Emloyee equivalent      hours     hourly wage   benefits per    applicant
                                                                            rate          hour
----------------------------------------------------------------------------------------------------------------
General Identifying Information...  GS-9 Step 1..........        10/60       $22.39           $8.06        $5.07
Documentation of Accreditation....  GS-9 Step 1..........        30/60        22.39            8.06        15.23
Principles of Proper Conduct......  GS-15 Step 1.........        20/60        59.30           21.35        26.89
                                   -----------------------------------------------------------------------------
    Total Cost Per Applicant......  .....................  ...........  ...........  ..............        47.19
----------------------------------------------------------------------------------------------------------------

    We have estimated the applicant costs and ONC-ACB renewal costs 
through 2016, but no further, because we believe that it is premature 
to assume how the meaningful use requirements post-Stage 3 will change 
after the downward payment adjustments for eligible professionals and 
eligible hospitals become effective (e.g., the incentive payment 
adjustments specified at section 1848(a)(7) of the SSA for eligible 
professionals) and what impact, if any, those potential changes will 
have on the permanent certification program. Using our estimates above, 
we believe that the average initial cost for an applicant to become 
accredited and apply to be an ONC-ACB will be approximately $20,047 and 
the total cost for all 6 applicants will be approximately $120,283. We 
estimate that between 2012 and 2016 that all applicants will renew 
their ONC-ACB status twice and their accreditation once. We assume that 
the costs for an ONC-ACB to renew its status with the National 
Coordinator will be similar in burden to its initial application. 
Furthermore, we believe that the average cost for an ONC-ACB to renew 
its accreditation and to apply for renewal of its ONC-ACB status twice 
would be approximately $10,094 and the total renewal costs for all ONC-
ACBs will be approximately $60,566. We estimate that the total costs of 
the accreditation, application and renewal processes under the proposed 
permanent certification program between 2012 and 2016 would be 
approximately $30,142 per applicant/ONC-ACB and approximately $180,849 
for all applicants/ONC-ACBs. Based on our cost estimate timeframe of 5 
years (2012 through 2016), the annualized cost would be $36,170.

  Table 7--Permanent Certification Program: Total Costs of Certification Accreditation, Applying for ONC Certification Authorization, and Accreditation
                                                     and Authorization Renewal Between 2012 and 2016
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                                                         Cost to apply                       Cost to
                                                                          Cost of             for          Cost to renew    renew ONC-     Total cost
                  Anticipated number of applicants                     accreditation     certification     accreditation    ACB status    estimate per
                                                                       per applicant     authorization     per applicant      twice      applicant/ONC-
                                                                                         per applicant                                         ACB
--------------------------------------------------------------------------------------------------------------------------------------------------------
6..................................................................           $20,000            $47.19           $10,000       $94.38        $30,141.57
                                                                    ------------------------------------------------------------------------------------
    Total Cost of Accreditation, Application and Renewal...........  ................  ................  ................  ...........        180,849.42
--------------------------------------------------------------------------------------------------------------------------------------------------------

    We invite comments on the number of entities that will seek to 
become accredited for certification under our proposed permanent 
certification program and the costs associated with accreditation, 
applying for ONC-ACB status, the renewal costs for both, and the 
timeframe we used for estimating costs.
ii. Costs to the Federal Government
    We estimate the cost to develop the ONC-ACB application to be $350 
based on the 5 hours of work we believe it would take a Federal Salary 
Classification GS-14 Step 1 employee located in Washington, DC to 
develop the application form. We also anticipate that there would be 
costs associated with reviewing applications under the proposed 
permanent certification program. We believe that a GS-15 Step 1 
employee would review the applications and the National Coordinator (or 
designated representative) would issue final decisions on all 
applications. We anticipate that it would take approximately 20 hours 
to review and reach a final decision on each application. This estimate 
assumes a satisfactory application (i.e., no formal deficiency 
notifications) and includes the time necessary to verify the 
information in each application and prepare a briefing for the National 
Coordinator. We estimate the cost for the application review process to 
be $10,392. As a result, we estimate the

[[Page 11361]]

Federal government's overall cost of administering the entire 
application process at approximately $10,742. Based on our cost 
estimate timeframe of 5 years (2012 through 2016), the annualized cost 
to the Federal government would be $2,148.
    As previously noted, we would also post the names of applicants 
granted ONC-ACB status on our Web site. We believe that there would be 
minimal cost associated with this action and have calculated the 
potential cost to be approximately $312 on an annual basis for posting 
and maintaining the information on our Web site (a maximum of 6 hours 
of work for a Federal Salary Classification GS-12 Step 1 employee 
located in Washington, DC).
c. Permanent Certification Program: Testing and Certification of 
Complete EHRs and EHR Modules
    As with the temporary certification program, we estimate below the 
costs that Complete EHR and EHR Module developers (commercial, open 
source, self-developed) will incur to have their HIT tested and 
certified between 2012 and 2016. As previously stated in our discussion 
of the appropriate timeframe for estimating costs for the ONC-ACB 
application process, we estimate costs through 2016, but no further, 
because we believe that it is premature to assume how the meaningful 
use requirements post-Stage 3 will change after the Medicare downward 
payment adjustments become effective. Although CMS has proposed to 
promulgate updates to the meaningful use stages every 2 years, we 
assume that there could be more time between stages (i.e., greater than 
2 years) in years post-meaningful use Stage 3 based evaluations of 
earlier meaningful use stages, public feedback, and other factors, 
which would affect when Complete EHRs and/or EHR Modules would need to 
be recertified. However, we do expect meaningful use requirements 
between 2012 and 2016, which would encompass both Stage 2 and Stage 3 
requirements to become more demanding and iterate every 2 years. 
Therefore, we can safely assume that Complete EHRs and EHR Modules will 
need to be tested and certified twice during this time period.
    Even though under the permanent certification program the costs for 
testing and certification could presumably be attributed to different 
entities (i.e., testing costs to a NVLAP-accredited testing laboratory 
and certification costs to an ONC-ACB) we have included them together 
in an effort to reflect the overall effect of this rulemaking. As 
previously mentioned, we cannot predict a specific date for when the 
temporary certification program will sunset, and thus when ONC-ATCBs 
will finish testing and certifying Complete EHRs and/or EHR Modules in 
their queue. Therefore, as similarly calculated for the temporary 
certification program costs, we have estimated and attributed to the 
permanent certification program's costs the 2012 cost for testing and 
certifying 15% of the prior number of Complete EHRs and EHR Modules to 
associated meaningful use Stage 1 certification criteria. We have done 
this to account for the possibility that the ONC-ACBs could be 
authorized as soon as late 2011 and thus all testing and certification 
for 2012 would take place solely under the auspices of the permanent 
certification program. This 15% 2012 cost for testing and certification 
is represented by 15% of the number of each type of Complete EHR and 
EHR Module we previously estimated would be tested and certified to 
Meaningful Use Stage 1 multiplied by the appropriate estimated costs 
for testing and certification. These cost estimates are expressed in 
Table 8 below.

            Table 8--Permanent Certification Program: Estimated 2012 Costs for Testing & Certification Associated With Meaningful Use Stage 1
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                                         Cost per complete EHR/EHR module ($M)     Total cost for all complete EHRs/EHR
                                                             Number   ------------------------------------------     modules over 3-year period ($M)
                          Type                             tested and                                           ----------------------------------------
                                                           certified        Low          High        Mid-point        Low          High       Mid-point
--------------------------------------------------------------------------------------------------------------------------------------------------------
Commercial/Open Source Complete EHR.....................           14        $0.03         $0.05         $0.04         $0.42         $0.70         $0.56
Commercial/Open Source EHR Module.......................            5         0.005         0.035         0.02          0.025         0.18          0.1
Self-Developed Complete EHRs and EHR Modules............            7         0.005         0.05          0.028         0.035         0.35          0.2
                                                         -----------------------------------------------------------------------------------------------
    Total...............................................           26  ............  ............  ............         0.48          1.23          0.86
--------------------------------------------------------------------------------------------------------------------------------------------------------

    In creating Tables 9A and 9B below, we make the following 
assumptions:
     The cost for testing and certification will remain the 
same in the permanent certification program as they were in the 
temporary certification program even with the additional requirement of 
surveillance on the part of ONC-ACBs (which we would expect to be 
included in the cost they charge Complete EHR and/or EHR Module 
developers). We believe this is a reasonable assumption because of the 
low and high ranges we have estimated.
     That testing and certification costs will be unevenly 
distributed across subsequent years. We assume that there will be an 
increase in the year preceding the next stage of meaningful use and a 
decline between stages. We base this assumption on the proposal CMS has 
made to make the reporting period for meaningful use stages as long as 
a full year which would consequently require that eligible 
professionals and eligible hospitals have HIT that meets the definition 
of Certified EHR Technology prior to the start of their next reporting 
period in order to complete a full year reporting period with Certified 
EHR Technology. We assumed the ratios discussed in the temporary 
certification program because the impetus for an increase to occur is 
not same for meaningful use Stage 1 as it will be for later meaningful 
use stages. We assumed a curve that was relatively flat for 2010 and 
2011 which subsequently tapered down in 2012 because of the flexibility 
provided by the proposed reporting period for meaningful use Stage 1 (3 
to 6 months). This shorter reporting period makes it possible for an 
eligible professional or eligible hospital to adopt Certified EHR 
Technology during the first half of their first meaningful use Stage 1 
reporting year and still receive an incentive payment if they satisfy 
the reporting requirements. With respect to the peak years for when 
testing and certification costs would

[[Page 11362]]

most likely occur, we assume that those peak years will be 2012 and 
2014, the years preceding meaningful use Stages 2 and 3, respectively. 
We assume that an increase would encompass 85% of the Complete EHRs and 
EHR Modules to be certified, which would represent most, if not all, 
previously certified Complete EHRs and EHR Modules and that the 
remaining 15% of testing and certification costs for 2013 would likely 
represent new EHR Module entrants to the HIT marketplace and Complete 
EHR or EHR Module developers who were late to get certified.
     As indicated in the HIT Standards and Certification 
Criteria interim final rule, we assume that Complete EHR developers 
would continue to consolidate due to mergers and acquisitions and that 
this consolidation would occur at a rate of 5% between meaningful use 
stages. Therefore, we believe that fewer Complete EHRs will need to be 
tested and certified prior to each meaningful use stage.
     Conversely, we assume that the number of EHR Modules 
developed that would need to be tested and certified to meet associated 
meaningful use Stage 2 (2013) certification criteria and beyond will 
grow at a rate of 20% between meaningful use stages (i.e., based on our 
prior estimate of 50 EHR Modules between 2010 and 2012, there would be 
10 new modules developed during 2012 and during meaningful use Stage 2 
to meet certification criteria associated with meaningful use Stage 2). 
We believe our growth rate is reasonable because the cost barrier for 
EHR Modules to enter the market would be much less than a Complete EHR. 
Coupled with the ability of small or start-up HIT developers to enter 
the market we believe that the potential of EHR Modules would lead to a 
constant stream of new entrants year after year.
     The number of eligible professionals and eligible 
hospitals that incur the testing and certification costs for their 
self-developed Complete EHRs and/or EHR Modules for meaningful use 
Stage 2 will drop by 50% in 2012 and another 25% in 2014 and level out 
after 2014 due to our assumption, that by 2014, and the impending start 
of meaningful use Stage 3, that all of the eligible professionals and 
eligible hospitals who still have a self-developed Complete EHR or EHR 
Module are likely to maintain their HIT rather than switch to a 
commercial product.
    Table 9A illustrates the overall costs for testing and 
certification associated with meaningful use Stage 2. We have factored 
in the assumed 5% reduction in the number of Complete EHRs and 20% 
increase in EHR Modules presented for testing and certification to meet 
the certification criteria associated with meaningful use Stage 2. That 
is, we believe there will be approximately 88 unique Complete EHRs and 
60 EHR Modules that will be tested and certified. We also separately 
factor in the 50% reduction to the number of self-developed Complete 
EHRs and EHR Modules that will be tested and certified to meet the 
certification criteria associated with meaningful use Stage 2.

          Table 9A--Permanent Certification Program: Estimated Overall Costs for Testing & Certification Associated With Meaningful Use Stage 2
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                                         Cost per complete EHR/EHR module ($M)     Total cost for all complete EHRs/EHR
                                                             Number   ------------------------------------------     modules over 3-year period ($M)
                          Type                             tested and                                           ----------------------------------------
                                                           certified        Low          High        Mid-point        Low          High       Mid-point
--------------------------------------------------------------------------------------------------------------------------------------------------------
Commercial/Open Source Complete EHR.....................           88        $0.03         $0.05         $0.04         $2.64         $4.40         $3.52
Commercial/Open Source EHR Module.......................           60         0.005         0.035         0.02          0.30          2.10          1.2
Self-Developed Complete EHRs and EHR Modules............           19         0.005         0.05          0.028         0.095         0.95          0.53
                                                         -----------------------------------------------------------------------------------------------
    Total...............................................          167  ............  ............  ............         3.04          7.45          5.25
--------------------------------------------------------------------------------------------------------------------------------------------------------

    Table 9B illustrates the overall costs for testing and 
certification associated with meaningful use Stage 3. We have again 
factored in the assumed 5% reduction in the number of Complete EHRs and 
20% increase in EHR Modules presented for testing and certification to 
meet the certification criteria associated with meaningful use Stage 3. 
That is, we believe there will be approximately 84 unique Complete EHRs 
and 72 EHR Modules that will be tested and certified. We also 
separately factor in the 25% reduction to the number of self-developed 
Complete EHRs and EHR Modules that will be tested and certified to meet 
the certification criteria associated with meaningful use Stage 3.

          Table 9B--Permanent Certification Program: Estimated Overall Costs for Testing & Certification Associated With Meaningful Use Stage 3
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                                           Cost per complete EHR/EHR module ($M)    Total cost for all complete EHRs/EHR
                                                               Number   ------------------------------------------    modules over 3-year period ($M)
                           Type                              tested and                                           --------------------------------------
                                                             certified        Low          High        Mid-point       Low          High      Mid-point
--------------------------------------------------------------------------------------------------------------------------------------------------------
Commercial/Open Source Complete EHR.......................           84        $0.03         $0.05         $0.04         $2.52        $4.20        $3.36
Commercial/Open Source EHR Module.........................           72         0.005         0.035         0.02          0.36         2.52         1.44
Self-Developed Complete EHRs and EHR Modules..............           14         0.005         0.05          0.028         0.07         0.70         0.39
                                                           ---------------------------------------------------------------------------------------------
    Total.................................................          170  ............  ............  ............         2.95         7.42         5.19
--------------------------------------------------------------------------------------------------------------------------------------------------------


[[Page 11363]]

    Finally, Table 9C illustrates the 85% and 15% testing and 
certification cost distributions we estimate would be attributable to 
meaningful use Stages 2 and 3 (i.e., between 2012 and 2016) under the 
permanent certification program. Additionally, we assume that 100% of 
self-developed Complete EHRs and EHR Modules would be certified in year 
that precedes the next meaningful use stage (i.e., 2012 and 2014) 
because eligible professionals and eligible hospitals who remain self-
developers will be motivated to ensure that their HIT can meet the 
definition of Certified EHR Technology prior to the beginning of a new 
meaningful use stage in order to avoid missing out on the incentives or 
being subject to downward payment adjustments. As a result, the costs 
for self-developers to get their Complete EHRs or EHR Modules are only 
attributed in Table 9C to the years 2012 and 2014. The totals 
multiplied by their respective percentages are derived from Tables 9A 
and 9B above.

 Table 9C--Permanent Certification Program: Estimated Overall Costs for Testing & Certification Associated With Meaningful Use Stages 2 and 3 Accounting
                                                                  for Distributed Costs
--------------------------------------------------------------------------------------------------------------------------------------------------------
         Meaningful use stage               Year(s)       Percentage                  Type                   Low ($M)        High ($M)    Mid-point ($M)
--------------------------------------------------------------------------------------------------------------------------------------------------------
Stage 2...............................            2012              85  Complete EHRs/EHR Modules.......          $2.50            $5.53           $4.01
                                                       -------------------------------------------------------------------------------------------------
                                                                   100  Self-Developed..................           0.095            0.95            0.53
                                       -----------------------------------------------------------------------------------------------------------------
                                             2013/2014              15  Complete EHRs/EHR Modules.......           0.44             0.98            0.71
                                                       -------------------------------------------------------------------------------------------------
                                                                     0  Self-Developed..................           0                0               0
--------------------------------------------------------------------------------------------------------------------------------------------------------
Stage 3...............................            2014              85  Complete EHRs/EHR Modules.......           2.45             5.71            4.08
                                                       -------------------------------------------------------------------------------------------------
                                                                   100  Self-Developed..................           0.07             0.70            0.39
                                       -----------------------------------------------------------------------------------------------------------------
                                             2015/2016              15  Complete EHRs/EHR Modules.......           0.43             1.01            0.72
                                                       -------------------------------------------------------------------------------------------------
                                                                     0  Self-Developed..................           0                0               0
--------------------------------------------------------------------------------------------------------------------------------------------------------

3. Costs for Collecting, Storing, and Reporting Certification Results 
Under the Temporary and Permanent Certification Programs
a. Costs to ONC-ATCBs and ONC-ACBs
    Under both of the proposed certification programs we propose to 
require ONC-ATCBs and ONC-ACBs to provide ONC, no less frequently than 
weekly, an up-to-date list of Complete EHRs and/or EHR Modules that 
have been tested and certified which include, at a minimum, the vendor 
name (if applicable), the date certified, the product version, the 
unique certification number or other specific product identification, 
and where applicable, the certification criterion or certification 
criteria to which each EHR Module has been tested and certified.
    As stated in the collection of information section, we anticipate 
requiring the reporting of this information on a weekly basis and that 
it will take ONC-ATCBs and ONC-ACBs about an hour to prepare and 
electronically transmit the information to ONC each week (i.e., 
respondents will respond 52 times per year).
    We believe that an employee equivalent to the Federal 
Classification of GS-9 Step 1 could complete the transmissions of the 
requested information to ONC under both proposed certification 
programs. We have utilized the corresponding employee hourly rate for 
the locality pay area of Washington, DC, as published by OPM, to 
calculate our cost estimates. We have also calculated the costs of the 
employee's benefits while completing the transmissions of the requested 
information. We have calculated these costs by assuming that an ONC-
ATCB or ONC-ACB expends thirty-six percent (36%) of an employee's 
hourly wage on benefits for the employee. We have concluded that a 36% 
expenditure on benefits is an appropriate estimate because it is the 
routine percentage used by HHS for contract cost estimates. Our cost 
estimates are expressed in Table 10 below.

                Table 10--Annual Costs for ONC-ATCBs and ONC-ACBs To Report Certifications to ONC
----------------------------------------------------------------------------------------------------------------
                                                   Annual burden                      Cost of
                                     Employee     hours per ONC-     Employee        employee     Total cost per
  Proposed program requirement      equivalent    ATCBs/ONC-ACBs    hourly wage    benefits per    ONC-ATCB/ONC-
                                                                       rate            hour             ACB
----------------------------------------------------------------------------------------------------------------
ONC-ATCB Certification Results..     GS-9 Step 1              52          $22.39           $8.06       $1,583.40
ONC-ACB Certification Results...     GS-9 Step 1              52           22.39            8.06        1,583.40
----------------------------------------------------------------------------------------------------------------

    To estimate the highest possible burden, we assume that all of the 
estimated applicants that we anticipate will apply under our proposed 
certification programs will become ONC-ATCBs and ONC-ACBs. Therefore, 
we estimate the total annual reporting cost under the temporary 
certification program to be $4,750 and the total annual reporting cost 
under the permanent certification program to be $9,500.
    We believe that the proposed requirements for ONC-ATCBs to retain 
certification records for the length of the temporary certification 
program and for ONC-ACBs to retain certification records for 5 years 
under the permanent certification program are in line with common 
industry practices and, consequently, would not represent

[[Page 11364]]

additional costs to ONC-ATCBs and ONC-ACBs as a result of this rule.
b. Costs to the Federal Government
    As stated previously in this rule, we propose, under both 
certification programs, to post a comprehensive list of all Certified 
EHR Technology on our Web site. We believe that there would be minimal 
cost associated with this action and have calculated the potential 
cost, including weekly updates, to be $5,392 on an annualized basis. 
This amount is based on 104 hours of yearly work of a Federal Salary 
Classification GS-12 Step 1 employee located in Washington, DC.
4. Temporary and Permanent Certification Program Benefits
    We believe that several benefits will accrue from the establishment 
of both a temporary certification program and permanent certification 
program. The temporary certification program would allow for the rapid 
influx of Complete EHRs and EHR Modules to be tested and certified at a 
sufficient pace for eligible professionals and eligible hospitals to 
adopt and implement Certified EHR Technology for meaningful use Stage 1 
and thus potentially qualify for incentive payments under the CMS 
Medicare and Medicaid EHR Incentive Programs proposed rule. The time 
between the temporary certification program and the permanent 
certification program will permit the HIT industry the time it needs 
for NLVAP-accredited testing laboratories to come forward, for an ONC-
AA to be approved and for additional applicants for ONC-ACB status to 
come forward. We believe that the permanent certification program will 
provide more opportunities for private sector entities to participate 
in the testing and certification of HIT and instill more confidence in 
what it means for HIT to be certified because more rigorous and 
objective processes will be in place. We further believe that both 
programs will meet our overall goals of accelerating health IT adoption 
and increasing levels of interoperability. At this time, we cannot 
predict how fast all of these savings will occur or their precise 
magnitude as they are partly dependent on future final rules for 
meaningful use and the subsequent standards and certification criteria 
adopted by the Secretary.

D. Regulatory Flexibility Act

    The RFA requires agencies to analyze options for regulatory relief 
of small businesses if a rule has a significant impact on a substantial 
number of small entities. For more information on the Small Business 
Administration's (SBA's) size standards, see the SBA's Web site.\5\ For 
purposes of the RFA, small entities include small businesses, nonprofit 
organizations, and small governmental jurisdictions. When conducting a 
RFA we are required to assess the potential effects of our proposed 
rule on small entities and to make every effort to minimize the 
regulatory burden that might be imposed on small entities. We believe 
that the entities that are likely to be directly affected by this 
proposed rule are applicants for ONC-ATCB and ONC-ACB status. 
Furthermore, we believe that these entities would either be classified 
under the North American Industry Classification System (NAICS) codes 
541380 (Testing Laboratories) or 541990 (Professional, Scientific and 
Technical Services).\6\ As previously mentioned, we believe that there 
will be 3 applicants for ONC-ATCB status and 6 applicants for ONC-ACB 
status. According to the NAICS codes identified above, this would mean 
SBA size standards of $12 million and $7 million in annual receipts, 
respectively.\7\ Because this segment of the HIT industry is in a 
nascent stage and is comprised of very few entities, we have been 
unable to find reliable data from which to determine what realistic 
annual receipts would be. However, based on our total estimates for 
Complete EHRs and EHR Modules to be tested and certified, we assume 
that the annual receipts of any one ONC-ATCB or ONC-ACB could be in the 
low millions of dollars. Moreover, it is unclear, whether these 
entities may be involved in other testing and certification programs 
which would increase their annual receipts and potentially place them 
outside the SBA's size standards.
---------------------------------------------------------------------------

    \5\ http://sba.gov/idc/groups/public/documents/sba_homepage/serv_sstd_tablepdf.pdf.
    \6\ See 13 CFR 121.201.
    \7\ The SBA references that annual receipts means ``total 
income'' (or in the case of a sole proprietorship, ``gross income'') 
plus ``cost of goods sold'' as these terms are defined and reported 
on Internal Revenue Service tax return forms. http://www.sba.gov/idc/groups/public/documents/sba_homepage/guide_to_size_standards.pdf.
---------------------------------------------------------------------------

    We believe that we have proposed the minimum amount of requirements 
necessary to accomplish our policy goals and that no appropriate 
regulatory alternatives could be developed to lessen the compliance 
burden for applicants for ONC-ATCB and ONC-ACB status as well as ONC-
ATCBs and ONC-ACBs once they have been granted such status by the 
National Coordinator. Moreover, we believe that this proposed rule will 
create direct positive effects for entities because their attainment of 
ONC-ATCB or ONC-ACB status will permit them to test and certify 
Complete EHRs and/or EHR Modules. Thus, we expect that their annual 
receipts will increase as a result of becoming an ONC-ATCB or ONC-ACB.
    Based on our analysis and discussion above, we have examined the 
economic implications of this proposed rule and do not believe that it 
will have a significant impact on a substantial number of small 
entities. The Secretary certifies that this proposed rule will not have 
a significant impact on a substantial number of small entities.

E. Executive Order 13132--Federalism

    Executive Order 13132 establishes certain requirements that an 
agency must meet when it promulgates a proposed rule (and subsequent 
final rule) that imposes substantial direct requirement costs on State 
and local governments, preempts State law, or otherwise has federalism 
implications.
    Nothing in this proposed rule imposes substantial direct 
requirement costs on State and local governments, preempts State law or 
otherwise has federalism implications. We are not aware of any State 
laws or regulations that conflict with or are impeded by either of our 
proposed certification programs. This proposed rule affords all States 
an opportunity to identify any problems that our temporary or permanent 
certification programs would create, and to propose constructive 
alternatives. We welcome comments from State and local governments.

F. Unfunded Mandates Reform Act of 1995

    Title II of the Unfunded Mandates Reform Act of 1995 (Pub. L. 104-
4) requires cost-benefit and other analyses before any rulemaking if 
the rule includes a ``Federal mandate that may result in the 
expenditure by State, local, and Tribal governments, in the aggregate, 
or by the private sector, of $100,000,000 or more (adjusted annually 
for inflation) in any 1 year.'' The current inflation-adjusted 
statutory threshold is approximately $133 million. We have determined 
that this proposed rule which encompasses our proposals for both the 
temporary and permanent certification programs would not constitute a 
significant rule under the Unfunded Mandates Reform Act, because it 
would impose no mandates.
    OMB reviewed this proposed rule.

List of Subjects in 45 CFR Part 170

    Computer technology, Electronic health record, Electronic 
information system, Electronic transactions, Health, Health care, 
Health information

[[Page 11365]]

technology, Health insurance, Health records, Hospitals, Incorporation 
by reference, Laboratories, Medicaid, Medicare, Privacy, Reporting and 
recordkeeping requirements, Public health, Security.
    For the reasons set forth in the preamble, the Department proposes 
to amend 45 CFR subtitle A, subchapter D, part 170, as follows:

PART 170--HEALTH INFORMATION TECHNOLOGY STANDARDS, IMPLEMENTATION 
SPECIFICATIONS, AND CERTIFICATION CRITERIA AND CERTIFICATION 
PROGRAMS FOR HEALTH INFORMATION TECHNOLOGY

    1. The authority citation for part 170 is revised to read as 
follows:

    Authority: 42 U.S.C 300jj-11; 42 U.S.C 300jj-14; 5 U.S.C. 552.

    2. In Sec.  170.102, add in alphabetical order the definition of 
``Day or Day(s)'' to read as follows:


Sec.  170.102  Definitions.

* * * * *
    Day or Days means a calendar day or calendar days.
* * * * *
    3. Add a new subpart D to part 170 to read as follows:
Subpart D--Temporary Certification Program for HIT
Sec.
170.400 Basis and scope.
170.401 Applicability.
170.402 Definitions.
170.405 Correspondence.
170.410 Types of testing and certification.
170.415 Application prerequisite.
170.420 Application.
170.423 Principles of proper conduct for ONC-ATCBs.
170.425 Application submission.
170.430 Review of application.
170.435 ONC-ATCB application reconsideration.
170.440 ONC-ATCB status.
170.445 Complete EHR testing and certification.
170.450 EHR Module testing and certification.
170.455 Testing and certification to newer versions of certain 
standards.
170.457 Authorized testing and certification methods.
170.460 Good standing as an ONC-ATCB.
170.465 Revocation of authorized testing and certification body 
status.
170.470 Effect of revocation on the certifications issued to 
complete EHRs and EHR Modules.
170.490 Sunset of the temporary certification program.

Subpart D--Temporary Certification Program for HIT


Sec.  170.400  Basis and scope.

    This subpart implements section 3001(c)(5) of the Public Health 
Service Act, and sets forth the rules and procedures related to the 
temporary certification program for health information technology 
administered by the National Coordinator for Health Information 
Technology.


Sec.  170.401  Applicability.

    This subpart establishes the processes that applicants for ONC-ATCB 
status must follow to be granted ONC-ATCB status by the National 
Coordinator, the processes the National Coordinator will follow when 
assessing applicants and granting ONC-ATCB status, and the requirements 
of ONC-ATCBs for testing and certifying Complete EHRs and/or EHR 
Modules in accordance with the applicable certification criteria 
adopted by the Secretary in subpart C of this part.


Sec.  170.402  Definitions.

    For the purposes of this subpart:
    Applicant means a single organization or a consortium of 
organizations that seeks to become an ONC-ATCB by requesting and 
subsequently submitting an application for ONC-ATCB status to the 
National Coordinator.
    ONC-ATCB or ONC-Authorized Testing and Certification Body means an 
organization or a consortium of organizations that has applied to and 
been authorized by the National Coordinator pursuant to this subpart to 
perform the testing and certification of Complete EHRs and/or EHR 
Modules under the temporary certification program.


Sec.  170.405  Correspondence.

    (a) Correspondence and communication with the National Coordinator 
shall be conducted by e-mail, unless otherwise necessary. The official 
date of receipt of any e-mail between the National Coordinator and an 
applicant for ONC-ATCB status or an ONC-ATCB is the day the e-mail was 
sent.
    (b) In circumstances where it is necessary for an applicant for 
ONC-ATCB status to correspond or communicate with the National 
Coordinator by regular or express mail, the official date of receipt 
will be the date of the delivery confirmation.


Sec.  170.410  Types of testing and certification.

    Applicants may seek authorization from the National Coordinator to 
perform the following types of testing and certification:
    (a) Complete EHR testing and certification; and/or
    (b) EHR Module testing and certification.


Sec.  170.415  Application prerequisite.

    Applicants must request in writing an application for ONC-ATCB 
status from the National Coordinator. Applicants must indicate:
    (a) The type of authorization sought pursuant to Sec.  170.410; and
    (b) If seeking authorization to perform EHR Module testing and 
certification, the specific type(s) of EHR Module(s) they seek 
authorization to test and certify. If qualified, applicants will only 
be granted authorization to test and certify the types of EHR Modules 
for which they seek authorization.


Sec.  170.420  Application.

    The application for ONC-ATCB status consists of two parts. 
Applicants must complete both parts of the application in their 
entirety and submit them to the National Coordinator for the 
application to be considered complete.
    (a) Part 1. An applicant must provide all of the following:
    (1) General identifying information including:
    (i) Name, address, city, State, zip code, and Web site of 
applicant; and
    (ii) Designation of an authorized representative, including name, 
title, phone number, and e-mail address of the person who will serve as 
the applicant's point of contact.
    (2) Documentation of the completion and results of a self-audit 
against all sections of ISO/IEC Guide 65:1996, and the following:
    (i) A description of the applicant's management structure according 
to section 4.2 of ISO/IEC Guide 65:1996;
    (ii) A copy of the applicant's quality manual that has been 
developed according to section 4.5.3 of ISO/IEC Guide 65:1996;
    (iii) A copy of the applicant's policies and approach to 
confidentiality according to section 4.10 of ISO/IEC Guide 65:1996;
    (iv) A copy of the qualifications of each of the applicant's 
personnel who oversee or perform certification according to section 5.2 
of ISO/IEC Guide 65:1996;
    (v) A copy of the applicant's evaluation reporting procedures 
according to section 11 of ISO/IEC Guide 65:1996; and
    (vi) A copy of the applicant's policies for use and display of 
certificates according to section 14 of ISO/IEC Guide 65:1996.

[[Page 11366]]

    (3) Documentation of the completion and results of a self-audit 
against all sections of ISO/IEC 17025:2005, and the following:
    (i) A copy of the applicant's quality system document according to 
section 4.2.2 of ISO/IEC 17025:2005;
    (ii) A copy of the applicant's policies and procedures for handling 
testing nonconformities according to section 4.9.1 of ISO/IEC 
17025:2005; and
    (iii) The qualifications of each of the applicant's personnel who 
oversee or conduct testing according to section 5.2 of ISO/IEC 
17025:2005.
    (4) An agreement, properly executed by the applicant's authorized 
representative, that it will adhere to the Principles of Proper Conduct 
for ONC-ATCBs.
    (b) Part 2. An applicant must submit a completed proficiency 
examination.


Sec.  170.423  Principles of proper conduct for ONC-ATCBs.

    An ONC-ATCB shall:
    (a) Operate its certification program in accordance with ISO/IEC 
Guide 65:1996 and testing program in accordance with ISO/IEC 
17025:2005;
    (b) Maintain an effective quality management system which addresses 
all requirements of ISO/IEC 17025:2005;
    (c) Attend all mandatory ONC training and program update sessions;
    (d) Maintain a training program that includes documented procedures 
and training requirements to ensure its personnel are competent to test 
and certify Complete EHRs and/or EHR Modules;
    (e) Use testing tools and procedures published by NIST or 
functionally equivalent testing tools and procedures published by 
another entity for the purposes of assessing Complete EHRs and/or EHR 
Modules compliance with the certification criteria adopted by the 
Secretary;
    (f) Report to ONC within 15 days any changes that materially affect 
its:
    (1) Legal, commercial, organizational, or ownership status;
    (2) Organization and management, including key testing and 
certification personnel;
    (3) Policies or procedures;
    (4) Location;
    (5) Facilities, working environment or other resources;
    (6) ONC authorized representative (point of contact); or
    (7) Other such matters that may otherwise materially affect its 
ability to test and certify Complete EHRs and/or EHR Modules;
    (g) Allow ONC, or its authorized agents(s), to periodically observe 
on site (unannounced or scheduled) during normal business hours, any 
testing and/or certification performed to demonstrate compliance with 
the requirements of the temporary certification program;
    (h) Provide ONC, no less frequently than weekly, a current list of 
Complete EHRs and/or EHR Modules that have been tested and certified 
which includes, at a minimum, the vendor name (if applicable), the date 
certified, product version, the unique certification number or other 
specific product identification, and where applicable, the 
certification criterion or certification criteria to which each EHR 
Module has been tested and certified;
    (i) Retain all records related to the testing and certification of 
Complete EHRs and/or EHR Modules for the duration of the temporary 
certification program and provide copies of all testing and 
certification records to ONC at the sunset of the temporary 
certification program; and
    (j) Promptly refund any and all fees received for tests and 
certifications that will not be completed.


Sec.  170.425  Application submission.

    (a) An applicant for ONC-ATCB status must submit its application 
either electronically via e-mail (or Web submission if available), or 
by regular or express mail.
    (b) An application for ONC-ATCB status may be submitted to the 
National Coordinator at any time during the existence of the temporary 
certification program.


Sec.  170.430  Review of application.

    (a) Method of review and review timeframe.
    (1) Applications will be reviewed in the order they are received.
    (2) The National Coordinator will review Part 1 of the application 
and determine whether Part 1 of the application is complete and 
satisfactory before proceeding to review Part 2 of the application.
    (3) The National Coordinator is permitted up to 30 days to review 
an application (submitted for the first time) upon receipt.
    (b) Application deficiencies.
    (1) If the National Coordinator identifies an area in an 
application that requires the applicant to clarify a statement or 
correct an inadvertent error or minor omission, the National 
Coordinator may contact the applicant to make such clarification or 
correction without issuing a deficiency notice. If the National 
Coordinator has not received the requested information after five days, 
the applicant may be issued a deficiency notice specifying the error, 
omission, or deficient statement.
    (2) If the National Coordinator determines that deficiencies in 
either part of the application exist, the National Coordinator will 
issue a deficiency notice to the applicant and return the application. 
The deficiency notice will identify the areas of the application that 
require additional information or correction.
    (c) Revised application.
    (1) An applicant is permitted to submit a revised application in 
response to a deficiency notice.
    (2) In order to continue to be considered for ONC-ATCB status, an 
applicant's revised application must address the specified deficiencies 
and be received by the National Coordinator within 15 days of the 
applicant's receipt of the deficiency notice.
    (3) The National Coordinator is permitted up to 15 days to review a 
revised application once it has been received.
    (4) If the National Coordinator determines that a revised 
application still contains deficiencies, the applicant will be issued a 
denial notice indicating that the applicant will no longer be 
considered for authorization under the temporary certification program. 
An applicant may request reconsideration of this decision in accordance 
with Sec.  170.435.
    (d) Satisfactory application.
    (1) An application will be deemed satisfactory if it meets all 
application requirements, including a passing score on the proficiency 
examination.
    (2) The National Coordinator will notify the applicant's authorized 
representative of its satisfactory application and its successful 
achievement of ONC-ATCB status.
    (3) Once notified by the National Coordinator of its successful 
achievement of ONC-ATCB status, the applicant may represent itself as 
an ONC-ATCB and begin testing and certifying Complete EHRs and/or EHR 
Modules consistent with its authorization.


Sec.  170.435  ONC-ATCB application reconsideration.

    (a) An applicant may request that the National Coordinator 
reconsider a denial notice issued for each part of an application only 
if the applicant can demonstrate that clear, factual errors were made 
in the review of the applicable part of the application and that the 
errors' correction could lead to the applicant obtaining ONC-ATCB 
status.
    (b) Submission requirement. An applicant is required to submit, 
within 15 days of receipt of a denial notice, a written statement to 
the National

[[Page 11367]]

Coordinator contesting the decision to deny its application and 
explaining with sufficient documentation what factual errors it 
believes can account for the denial. If the National Coordinator does 
not receive the applicant's submission within the specified timeframe, 
its reconsideration request may be rejected.
    (c) Reconsideration request review. If the National Coordinator 
receives a timely reconsideration request, the National Coordinator is 
permitted up to 15 days from the date of receipt to review the 
information submitted by the applicant and issue a decision.
    (d) Decision.
    (1) If the National Coordinator determines that clear, factual 
errors were made during the review of the application and that 
correction of the errors would remove all identified deficiencies, the 
applicant's authorized representative will be notified of the National 
Coordinator's decision to reverse the previous decision(s) not to 
approve part of the applicant's application or the entire application.
    (i) If the National Coordinator's decision to reverse the previous 
decision(s) affected part 1 of an application, the National Coordinator 
will subsequently review part 2 of the application.
    (ii) If the National Coordinator's decision to reverse the previous 
decision(s) affected part 2 of an application, the applicant's 
authorized representative will be notified of the National 
Coordinator's decision as well as the applicant's successful 
achievement of ONC-ATCB status.
    (2) If, after reviewing an applicant's reconsideration request, the 
National Coordinator determines that the applicant did not identify any 
factual errors or that correction of those factual errors would not 
remove all identified deficiencies in the application, the National 
Coordinator may reject the applicant's reconsideration request.
    (3) Final decision. A reconsideration decision issued by the 
National Coordinator is final and not subject to further review.


Sec.  170.440  ONC-ATCB status.

    (a) Acknowledgement and publication. The National Coordinator will 
acknowledge and make publicly available the names of ONC-ATCBs, 
including the date each was authorized and the type(s) of testing and 
certification each has been authorized to perform.
    (b) Representation. Each ONC-ATCB must prominently and 
unambiguously identify on its Web site and in all marketing and 
communications statements (written and oral) the scope of its 
authorization.
    (c) Renewal. ONC-ATCB status does not need to be renewed during the 
temporary certification program.
    (d) Expiration. The status of all ONC-ATCBs will expire upon the 
sunset of the temporary certification program in accordance with Sec.  
170.490.


Sec.  170.445  Complete EHR testing and certification.

    (a) To be authorized to test and certify Complete EHRs under the 
temporary certification program, an ONC-ATCB must be capable of testing 
and certifying Complete EHRs to all applicable certification criteria 
adopted by the Secretary at subpart C of this part.
    (b) An ONC-ATCB that has been authorized to test and certify 
Complete EHRs is also authorized to test and certify all EHR Modules 
under the temporary certification program.


Sec.  170.450  EHR module testing and certification.

    (a) When testing and certifying EHR Modules, an ONC-ATCB must test 
and certify in accordance with the applicable certification criterion 
or certification criteria adopted by the Secretary at subpart C of this 
part.
    (b) EHR Modules are required to be tested and certified to at least 
one certification criterion.
    (c) Privacy and security testing and certification. EHR Modules 
shall be tested and certified to all privacy and security certification 
criteria adopted by the Secretary unless the EHR Module(s) is/are 
presented for testing and certification in one of the following 
manners:
    (1) The EHR Module(s) are presented for testing and certification 
as a pre-coordinated, integrated ``bundle'' of EHR Modules, which could 
otherwise constitute a Complete EHR. In such instances, the EHR 
Module(s) shall be tested and certified in the same manner as a 
Complete EHR. Pre-coordinated bundles of EHR Module(s) which include 
EHR Module(s) that would not be part of a local system and under the 
end user's direct control are excluded from this exception. The 
constituent EHR Modules of such an integrated bundle must be separately 
tested and certified to all privacy and security certification 
criteria;
    (2) An EHR Module is presented for testing and certification, and 
the presenter can demonstrate to the ONC-ATCB that it would be 
technically infeasible for the EHR Module to be tested and certified in 
accordance with some or all of the privacy and security certification 
criteria; or
    (3) An EHR Module is presented for testing and certification, and 
the presenter can demonstrate to the ONC-ATCB that the EHR Module is 
designed to perform a specific privacy and security capability. In such 
instances, the EHR Module may only be tested and certified in 
accordance with the applicable privacy and security certification 
criterion/criteria.
    (d) ONC-ATCBs authorized to test and certify EHR Modules must 
clearly indicate the certification criterion or certification criteria 
to which an EHR Module has been tested and certified in its 
certification documentation.


Sec.  170.455  Testing and certification to newer versions of certain 
standards.

    (a) ONC-ATCBs may test and certify Complete EHRs and EHR Modules to 
a newer version of certain identified minimum standards specified at 
subpart B of this part if the Secretary has accepted a newer version of 
an adopted minimum standard.
    (b) Applicability of an accepted new version of an adopted minimum 
standard.
    (1) ONC-ATCBs are not required to test and certify Complete EHRs 
and/or EHR Modules according to newer versions of an adopted minimum 
standard accepted by the Secretary until the incorporation by reference 
provision of the adopted version is updated in the Federal Register 
with a newer version.
    (2) Certified EHR Technology may be upgraded to comply with newer 
versions of an adopted minimum standard accepted by the Secretary 
without adversely affecting the certification status of the Certified 
EHR Technology.


Sec.  170.457  Authorized testing and certification methods.

    (a) Primary method. An ONC-ATCB must have the capacity to test and 
certify Complete EHRs and/or EHR Modules at its facility.
    (b) Secondary methods. An ONC-ATCB must also have the capacity to 
test and certify Complete EHRs and/or EHR Modules through one of the 
following methods:
    (1) At the site where the Complete EHR or EHR Module has been 
developed; or
    (2) At the site where the Complete EHR or EHR Module resides; or
    (3) Remotely (i.e., through other means, such as through secure 
electronic transmissions and automated Web-based tools, or at a 
location other than the ONC-ATCB's facilities).

[[Page 11368]]

Sec.  170.460  Good standing as an ONC-ATCB.

    An ONC-ATCB must maintain good standing by:
    (a) Adhering to the Principles of Proper Conduct for ONC-ATCBs;
    (b) Refraining from engaging in other types of inappropriate 
behavior, including an ONC-ATCB misrepresenting the scope of its 
authorization as well as an ONC-ATCB testing and certifying Complete 
EHRs and/or EHR Modules for which it does not have authorization; and
    (c) Following all other applicable Federal and State laws.


Sec.  170.465  Revocation of authorized testing and certification body 
status.

    (a) Type-1 violations. The National Coordinator may revoke an ONC-
ATCB's status for committing a Type-1 violation. Type-1 violations 
include violations of law or temporary certification program policies 
that threaten or significantly undermine the integrity of the temporary 
certification program. These violations include, but are not limited 
to: false, fraudulent, or abusive activities that affect the temporary 
certification program, a program administered by HHS or any program 
administered by the Federal government.
    (b) Type-2 violations. The National Coordinator may revoke an ONC-
ATCB's status for failing to timely or adequately correct a Type-2 
violation. Type-2 violations comprise noncompliance with Sec.  170.460.
    (1) Noncompliance notification. If the National Coordinator obtains 
reliable evidence that an ONC-ATCB may no longer be in compliance with 
Sec.  170.460, the National Coordinator will issue a noncompliance 
notification with reasons for the notification to the ONC-ATCB 
requesting that the ONC-ATCB respond to the alleged violation and 
correct the violation, if applicable.
    (2) Opportunity to become compliant. After receipt of a 
noncompliance notification, an ONC-ATCB is permitted up to 30 days to 
submit a written response and accompanying documentation that 
demonstrates that no violation occurred or that the alleged violation 
has been corrected.
    (i) If the ONC-ATCB submits a response, the National Coordinator is 
permitted up to 30 days from the time the response is received to 
evaluate the response and reach a decision. The National Coordinator 
may, if necessary, request additional information from the ONC-ATCB 
during this time period.
    (ii) If the National Coordinator determines that no violation 
occurred or that the violation has been sufficiently corrected, the 
National Coordinator will issue a memo to the ONC-ATCB confirming this 
determination.
    (iii) If the National Coordinator determines that the ONC-ATCB 
failed to demonstrate that no violation occurred or to correct the 
area(s) of non-compliance identified under paragraph (b)(1) of this 
section within 30 days of receipt of the noncompliance notification, 
then the National Coordinator may propose to revoke the ONC-ATCB's 
status.
    (c) Proposed revocation.
    (1) The National Coordinator may propose to revoke an ONC-ATCB's 
status if the ONC-ATCB has committed a Type-1 violation; or
    (2) The National Coordinator may propose to revoke an ONC-ATCB's 
status if, after the ONC-ATCB has been notified of a Type-2 violation, 
the ONC-ATCB fails to:
    (i) To rebut the finding of a violation with sufficient evidence 
showing that the violation did not occur or that the violation has been 
corrected; or
    (ii) Submit to the National Coordinator a written response to the 
noncompliance notification within the specified timeframe under 
paragraph (b)(2).
    (3) ONC-ATCB's operations. An ONC-ATCB may continue its operations 
under the temporary certification program during the time periods 
provided for an ONC-ATCB to respond to a proposed revocation notice and 
the National Coordinator to review an ONC-ATCB's response to a proposed 
revocation.
    (d) Opportunity to respond to a proposed revocation notice.
    (1) An ONC-ATCB may respond to a proposed revocation notice, but 
must do so within 10 days of receiving the proposed revocation notice 
and include appropriate documentation explaining in writing why its 
status should not be revoked.
    (2) Upon receipt of an ONC-ATCB's response to a proposed revocation 
notice, the National Coordinator is permitted up to 30 days to review 
the information submitted by the ONC-ATCB and reach a decision.
    (e) Good standing determination. If the National Coordinator 
determines that an ONC-ATCB's status should not be revoked, the 
National Coordinator will notify the ONC-ATCB's authorized 
representative in writing of this determination.
    (f) Revocation.
    (1) The National Coordinator may revoke an ONC-ATCB's status if:
    (i) A determination is made that revocation is appropriate after 
considering the information provided by the ONC-ATCB in response to the 
proposed revocation notice; or
    (ii) The ONC-ATCB does not respond to a proposed revocation notice 
within the specified timeframe in paragraph (d)(1) of this section.
    (2) A decision to revoke an ONC-ATCB's status is final and not 
subject to further review unless the National Coordinator chooses to 
reconsider the revocation.
    (g) Extent and duration of revocation.
    (1) The revocation of an ONC-ATCB is effective as soon as the ONC-
ATCB receives the revocation notice.
    (2) A testing and certification body that has had its ONC-ATCB 
status revoked is prohibited from accepting new requests for testing 
and certification and must cease its current testing and certification 
operations under the temporary certification program.
    (3) A testing and certification body that has had its ONC-ATCB 
status revoked for a Type-1 violation is prohibited from reapplying for 
ONC-ATCB status under the temporary certification program for one year. 
If the temporary certification program sunsets during this time, the 
testing and certification body is prohibited from applying for ONC-ACB 
status under the permanent certification program for the time that 
remains within the one year prohibition.
    (4) The failure of a testing and certification body that has had 
its ONC-ATCB status revoked, to promptly refund any and all fees for 
tests and/or certifications of Complete EHRs and EHR Modules not 
completed will be considered a violation of the Principles of Proper 
Conduct for ONC-ATCBs and will be taken into account by the National 
Coordinator if the testing and certification body reapplies for ONC-
ATCB status under the temporary certification program or applies for 
ONC-ACB status under the permanent certification program.


Sec.  170.470  Effect of revocation on the certifications issued to 
complete EHRs and EHR modules.

    (a) The certified status of Complete EHRs and/or EHR Modules 
certified by an ONC-ATCB that had it status revoked will remain intact 
unless a Type-1 violation was committed that calls into question the 
legitimacy of the certifications issued by the former ONC-ATCB.
    (b) If the National Coordinator determines that a Type-1 violation 
occurred that called into question the legitimacy of certifications 
conducted by the former ONC-ATCB, then the National Coordinator would:

[[Page 11369]]

    (1) Review the facts surrounding the revocation of the ONC-ATCB's 
status; and
    (2) Publish a notice on ONC's Web site if the National Coordinator 
believes that Complete EHRs and/or EHR Modules were improperly 
certified by the former ONC-ATCB.
    (c) If the National Coordinator determines that Complete EHRs and/
or EHR Modules were improperly certified, the certification status of 
affected Complete EHRs and/or EHR Modules would only remain intact for 
120 days after the National Coordinator publishes the notice. The 
certification status of the Complete EHR and/or EHR Module can only be 
maintained thereafter by being re-certified by an ONC-ATCB in good 
standing.


Sec.  170.490  Sunset of the temporary certification program.

    The temporary certification program will sunset on the date when 
the National Coordinator has authorized at least one ONC-ACB under the 
permanent certification program. On the date at which this sunset 
occurs, ONC-ATCBs under the temporary certification program are 
prohibited from accepting new requests to certify Complete EHRs or EHR 
Modules. ONC-ATCBs may, however, complete the processing of Complete 
EHRs and EHR Modules that are being tested and certified at the time 
the sunset occurs.
    4. Add a new subpart E to part 170 to read as follows:
Subpart E--Permanent Certification Program for HIT
Sec.
170.500 Basis and scope.
170.501 Applicability.
170.502 Definitions.
170.503 Requests for ONC-AA status and ONC-AA ongoing 
responsibilities.
170.504 Reconsideration process for requests for ONC-AA status.
170.505 Correspondence.
170.510 Types of certification.
170.520 Application.
170.523 Principles of proper conduct for ONC-ACBs.
170.525 Application submission.
170.530 Review of application.
170.535 ONC-ACB application reconsideration.
170.540 ONC-ACB status.
170.545 Complete EHR certification.
170.550 EHR module certification.
170.553 Certification for health information technology other than 
complete EHRs and EHR modules.
170.555 Certification to newer versions of certain standards.
170.557 Authorized certification methods.
170.560 Good standing as an ONC-ACB.
170.565 Revocation of authorized certification body status.
170.570 Effect of revocation on the certifications issued to 
complete EHRs and EHR modules.

Subpart E--Permanent Certification Program for HIT


Sec.  170.500  Basis and scope.

    This subpart implements section 3001(c)(5) of the Public Health 
Service Act, and sets forth the rules and procedures related to the 
permanent certification program for health information technology 
administered by the National Coordinator for Health Information 
Technology.


Sec.  170.501  Applicability.

    This subpart establishes the processes that applicants for ONC-ACB 
status must follow to be granted ONC-ACB status by the National 
Coordinator, the processes the National Coordinator will follow when 
assessing applicants and granting ONC-ACB status, the requirements of 
ONC-ACBs for certifying Complete EHRs and/or EHR Modules in accordance 
with the applicable certification criteria adopted by the Secretary in 
subpart C of this part. It also establishes the processes accreditation 
organizations must follow to request approval from the National 
Coordinator and that the National Coordinator in turn will follow to 
approve an accreditation organization under the permanent certification 
program as well as certain ongoing responsibilities for an ONC-AA.


Sec.  170.502  Definitions.

    For the purposes of this subpart:
    Applicant means a single organization or a consortium of 
organizations that seeks to become an ONC-ACB by requesting and 
subsequently submitting an application for ONC-ACB status to the 
National Coordinator.
    ONC-ACB or ONC-Authorized Certification Body means an organization 
or a consortium of organizations that has applied to and been 
authorized by the National Coordinator pursuant to this subpart to 
perform the certification of, at a minimum, Complete EHRs and/or EHR 
Modules using the applicable certification criteria adopted by the 
Secretary.
    ONC-Approved Accreditor or ONC-AA means an accreditation 
organization that the National Coordinator has approved to accredit 
certification bodies under the permanent certification program.


Sec.  170.503  Requests for ONC-AA status and ONC-AA ongoing 
responsibilities.

    (a) Only one ONC-Approved Accreditor (ONC-AA) shall be approved by 
the National Coordinator at a time.
    (b) Submission. In order to become an ONC-AA, an accreditation 
organization must submit a request in writing to the National 
Coordinator along with the following information to demonstrate its 
ability to serve as an ONC-AA:
    (1) A detailed description of the accreditation organization's 
conformance to ISO/IEC17011:2004 and experience evaluating the 
conformance of certification bodies to ISO/IEC Guide 65:1996;
    (2) A detailed description of the accreditation organization's 
accreditation requirements and how the requirements complement the 
Principles of Proper Conduct for ONC-ACBs;
    (3) Detailed information on the accreditation organization's 
procedures that would be used to monitor ONC-ACBs;
    (4) Detailed information, including education and experience, about 
the key personnel who review organizations for accreditation; and
    (5) Procedures for responding to, and investigating, complaints 
against ONC-ACBs.
    (c) Approval. The National Coordinator is permitted up to 30 days 
to review a request for ONC-AA status from an accreditation 
organization upon receipt.
    (1) The National Coordinator's determination will be based on the 
information provided, the completeness of the accreditation 
organizations' descriptions to the elements listed in paragraph (b) of 
this section and each accreditation organization's overall 
accreditation experience.
    (2) The National Coordinator will review requests by accreditation 
organizations for ONC-AA status in the order they are received and will 
approve the first qualified accreditation organization consistent with 
the requirements of paragraph (b).
    (d) Reconsideration of a Decision. Any accreditation organization 
seeking to become an ONC-AA may appeal a decision to deny its request 
in accordance with Sec.  170.504, but only if no other accreditation 
organization has been granted ONC-AA status.
    (e) ONC-AA Ongoing Responsibilities. An ONC-AA must:
    (1) Maintain conformance with ISO/IEC 17011:2004;
    (2) In accrediting certification bodies, verify conformance to, at 
a minimum, ISO/IEC Guide 65:1996;

[[Page 11370]]

    (3) Verify that ONC-ACBs are performing surveillance in accordance 
with their respective annual plans; and
    (4) Review ONC-ACB surveillance results to determine if the results 
indicate any substantive non-conformance with the terms set by the ONC-
AA when it granted the ONC-ACB accreditation.
    (f) ONC-AA Status.
    (1) An ONC-AA's status will expire not later than 3 years from the 
date its status was granted by the National Coordinator.
    (2) The National Coordinator will accept requests for ONC-AA status 
120 days before the current ONC-AA's status is set to expire.


Sec.  170.504  Reconsideration process for requests for ONC-AA status.

    (a) An accreditation organization may ask that the National 
Coordinator to reconsider a decision to deny its request for ONC-AA 
status only if the accreditation organization can demonstrate that 
clear, factual errors were made in the review of its request for ONC-AA 
status and that the errors' correction could lead to the accreditation 
organization obtaining ONC-AA status.
    (b) Submission requirement. An accreditation organization is 
required to submit, within 15 days of receipt of a denial notice, a 
written statement to the National Coordinator contesting the decision 
to deny its request for ONC-AA status and explaining with sufficient 
documentation what factual error(s) it believes can account for the 
denial. If the National Coordinator does not receive the accreditation 
organization's submission within the specified timeframe its request 
may be rejected.
    (c) Reconsideration request review. If the National Coordinator 
receives a timely reconsideration request, the National Coordinator 
will be permitted up to 15 days from the date of receipt to review the 
information submitted by the accreditation organization and issue a 
decision.
    (d) Decision.
    (1) If the National Coordinator determines that clear, factual 
errors were made during the review of the request, that correction of 
the errors would remove all identified deficiencies, and that during 
this review no other accreditation organization has been granted ONC-AA 
status, the accreditation organization will be notified by National 
Coordinator that its request for ONC-AA status has been approved.
    (2) If, after reviewing an accreditation organization's 
reconsideration request, the National Coordinator determines that the 
accreditation organization did not identify the factual errors that 
were made during the review of its request for ONC-AA status, the 
National Coordinator may reject its reconsideration request.
    (3) Final Decision. A reconsideration decision issued by the 
National Coordinator is final and not subject to further review.


Sec.  170.505  Correspondence.

    (a) Correspondence and communication with the National Coordinator 
shall be conducted by e-mail, unless otherwise necessary. The official 
date of receipt of any e-mail between the National Coordinator and an 
applicant for ONC-ACB status or an ONC-ACB is the day the e-mail was 
sent.
    (b) In circumstances where it is necessary for an applicant for 
ONC-ACB status to correspond or communicate with the National 
Coordinator by regular or express mail, the official date of receipt 
will be the date of the delivery confirmation.


Sec.  170.510  Types of certification.

    Applicants may seek authorization from the National Coordinator to 
perform the following types of certification:
    (a) Complete EHR certification; and/or
    (b) EHR Module certification; and/or
    (c) Other types of health information technology certification for 
which the Secretary has adopted certification criteria under subpart C 
of this part.


Sec.  170.520  Application.

    Applicants must include the following information in an application 
for ONC-ACB status and submit it to the National Coordinator for the 
application to be considered complete.
    (a) The type of authorization sought pursuant to Sec.  170.510. For 
authorization to perform EHR Module certification, applicants must 
indicate the specific type(s) of EHR Module(s) they seek authorization 
to certify. If qualified, applicants will only be granted authorization 
to certify the types of EHR Modules for which they seek authorization.
    (b) General identifying information including:
    (1) Name, address, city, State, zip code, and Web site of 
applicant; and
    (2) Designation of an authorized representative, including name, 
title, phone number and e-mail address of the person who will serve as 
the applicant's point of contact.
    (c) Documentation that confirms that the applicant has been 
accredited by an ONC-AA.
    (d) An agreement, properly executed by the applicant's authorized 
representative, that it will adhere to the Principles of Proper Conduct 
for ONC-ACBs.


Sec.  170.523  Principles of proper conduct for ONC-ACBs.

    An ONC-ACB shall:
    (a) Maintain its accreditation;
    (b) Attend all mandatory ONC training and program update sessions;
    (c) Maintain a training program that includes documented procedures 
and training requirements to ensure its personnel are competent to 
certify HIT;
    (d) Report to ONC within 15 days any changes that materially affect 
its:
    (1) Legal, commercial, organizational, or ownership status;
    (2) Organization and management including key certification 
personnel;
    (3) Policies or procedures;
    (4) Location;
    (5) Personnel, facilities, working environment or other resources;
    (6) ONC authorized representative (point of contact); or
    (7) Other such matters that may otherwise materially affect its 
ability to certify HIT.
    (e) Allow ONC, or its authorized agents(s), to periodically observe 
on site (unannounced or scheduled) any certifications performed to 
demonstrate compliance with the requirements of the permanent 
certification program;
    (f) Provide ONC, no less frequently than weekly, a current list of 
Complete EHRs and/or EHR Modules that have been certified, which 
includes, at a minimum, the vendor name (if applicable), the date 
certified, the product version, the unique certification number or 
other specific product identification, and where applicable, the 
certification criterion or certification criteria to which each EHR 
Module has been certified;
    (g) Retain all records related to the certification of Complete 
EHRs and/or EHR Modules for a minimum of 5 years;
    (h) Only certify HIT, including Complete EHRs and/or EHR Modules, 
that have been tested by a NVLAP-accredited testing laboratory;
    (i) Submit an annual surveillance plan to the National Coordinator 
and annually report to the National Coordinator its surveillance 
results; and
    (j) Promptly refund any and all fees received for certifications 
that will not be completed.


Sec.  170.525  Application submission.

    (a) An applicant for ONC-ACB status must submit its application 
either electronically, via e-mail (or Web submission if available), or 
by regular or express mail.

[[Page 11371]]

    (b) An application for ONC-ACB status may be submitted to the 
National Coordinator at any time during the existence of the permanent 
certification program.


Sec.  170.530  Review of application.

    (a) Method of review and review timeframe.
    (1) Applications will be reviewed in the order they are received.
    (2) The National Coordinator is permitted up to 30 days from 
receipt to review an application (submitted for the first time).
    (b) Application deficiencies.
    (1) If the National Coordinator identifies an area in an 
application that requires the applicant to clarify a statement or 
correct an inadvertent error or minor omission, the National 
Coordinator may contact the applicant to make such clarification or 
correction without issuing a deficiency notice. If the National 
Coordinator has not received the requested information after five days, 
the applicant may be issued a deficiency notice specifying the error, 
omission, or deficient statement.
    (2) If the National Coordinator determines that deficiencies in 
either part of the application exist, the National Coordinator will 
issue a deficiency notice to the applicant and return the application. 
The deficiency notice will identify the areas of the application that 
require additional information or correction.
    (c) Revised application.
    (1) An applicant is permitted to submit a revised application in 
response to a deficiency notice.
    (2) In order to continue to be considered for ONC-ACB status, an 
applicant's revised application must be received by the National 
Coordinator within 15 days of the applicant's receipt of the deficiency 
notice.
    (3) The National Coordinator is permitted 15 days to review a 
revised application once it has been received.
    (4) If the National Coordinator determines that a revised 
application still contains deficiencies, the applicant will be issued a 
denial notice indicating that the applicant will no longer be 
considered for authorization under the permanent certification program. 
An applicant may request reconsideration of this decision in accordance 
with Sec.  170.535.
    (d) Satisfactory application.
    (1) An application will be deemed satisfactory if it meets all the 
application requirements.
    (2) The National Coordinator will notify the applicant's authorized 
representative of its satisfactory application and its successful 
achievement of ONC-ACB status.
    (3) Once notified by the National Coordinator of its successful 
achievement of ONC-ACB status, the applicant may represent itself as an 
ONC-ACB and begin certifying health information technology consistent 
with its authorization.


Sec.  170.535  ONC-ACB application reconsideration.

    (a) An applicant may request that the National Coordinator 
reconsider a denial notice only if the applicant can demonstrate that 
clear, factual errors were made in the review of its application and 
that the errors' correction could lead to the applicant obtaining ONC-
ACB status.
    (b) Submission requirement. An applicant is required to submit, 
within 15 days of receipt of a denial notice, a written statement to 
the National Coordinator contesting the decision to deny its 
application and explaining with sufficient documentation what factual 
errors it believes can account for the denial. If the National 
Coordinator does not receive the applicant's reconsideration request 
within the specified timeframe its reconsideration request may be 
rejected.
    (c) Reconsideration request review. If the National Coordinator 
receives a timely reconsideration request, the National Coordinator is 
permitted up to 15 days from the date of receipt to review the 
information submitted by the applicant and issue a decision.
    (d) Decision.
    (1) If the National Coordinator determines that clear, factual 
errors were made during the review of the application and that 
correction of the errors would remove all identified deficiencies, the 
applicant's authorized representative will be notified of the National 
Coordinator's determination and the applicant's successful achievement 
of ONC-ACB status.
    (2) If, after reviewing an applicant's reconsideration request, the 
National Coordinator determines that the applicant did not identify any 
factual errors or that correction of those factual errors would not 
remove all identified deficiencies in the application, the National 
Coordinator may reject the applicant's reconsideration request.
    (3) Final decision. A reconsideration decision issued by the 
National Coordinator is final and not subject to further review.


Sec.  170.540  ONC-ACB Status.

    (a) Acknowledgement and publication. The National Coordinator will 
acknowledge and make publicly available the names of ONC-ACBs, 
including the date each was authorized and the type(s) of certification 
each has been authorized to perform.
    (b) Representation. Each ONC-ACB must prominently and unambiguously 
identify on its Web site and in all marketing and communications 
statements (written and oral) the scope of its authorization.
    (c) Renewal. An ONC-ACB is required to renew its status every two 
years. An ONC-ACB is required to submit a renewal request to the 
National Coordinator 60 days prior to the expiration of its status.
    (d) Expiration. An ONC-ACB's status will expire two years from the 
date it was granted by the National Coordinator unless it is renewed in 
accordance with paragraph (c) of this section.


Sec.  170.545  Complete EHR Certification.

    (a) To be authorized to certify Complete EHRs under the permanent 
certification program, an ONC-ACB must be capable of certifying 
Complete EHRs to all applicable certification criteria adopted by the 
Secretary at subpart C of this part.
    (b) An ONC-ACB that has been authorized to certify Complete EHRs is 
also authorized to certify all EHR Modules under the permanent 
certification program.


Sec.  170.550  EHR module certification.

    (a) When certifying EHR Modules, an ONC-ACB must certify in 
accordance with the applicable certification criterion or certification 
criteria adopted by the Secretary at subpart C of this part.
    (b) EHR Modules are required to be certified to at least one 
certification criterion.
    (c) Privacy and security certification. EHR Modules shall be 
certified to all privacy and security certification criteria adopted by 
the Secretary unless the EHR Module(s) is/are presented for 
certification in one of the following manners:
    (1) The EHR Module(s) are presented for certification as a pre-
coordinated, integrated ``bundle'' of EHR Modules, which could 
otherwise constitute a Complete EHR. In such instances, the EHR 
Module(s) shall be certified in the same manner as a Complete EHR. Pre-
coordinated bundles of EHR Module(s) which include EHR Module(s) that 
would not be part of a local system and under the end user's direct 
control are excluded from this exception. The constituent EHR Modules 
of such an integrated bundle must be separately certified to all 
privacy and security certification criteria.
    (2) An EHR Module is presented for certification, and the presenter 
can

[[Page 11372]]

demonstrate to the ONC-ACB that it would be technically infeasible for 
the EHR Module to be certified in accordance with some or all of the 
privacy and security certification criteria; or
    (3) An EHR Module is presented for certification, and the presenter 
can demonstrate to the ONC-ACB that the EHR Module is designed to 
perform a specific privacy and security capability. In such instances, 
the EHR Module may only be certified in accordance with the applicable 
privacy and security certification criterion/criteria.
    (d) ONC-ACBs authorized to certify EHR Modules must clearly 
indicate the certification criterion or certification criteria to which 
an EHR Module has been certified in its certification documentation.


Sec.  170.553  Certification for health information technology other 
than complete EHRs and EHR modules.

    An ONC-ACB authorized to certify health information technology 
other than Complete EHRs and/or EHR Modules must certify such health 
information technology in accordance with the applicable certification 
criterion or certification criteria adopted by the Secretary at subpart 
C of this part.


Sec.  170.555  Certification to newer versions of certain standards.

    (a) ONC-ACBs may test and certify Complete EHRs and EHR Modules to 
a newer version of certain identified minimum standards specified at 
subpart B of this part if the Secretary has accepted a newer version of 
an adopted minimum standard.
    (b) Applicability of an accepted new version of an adopted minimum 
standard.
    (1) ONC-ACBs are not required to test and certify Complete EHRs 
and/or EHR Modules according to newer versions of an adopted minimum 
standard accepted by the Secretary until the incorporation by reference 
provision of the adopted version is updated in the Federal Register 
with a newer version.
    (2) Certified EHR Technology may be upgraded to comply with newer 
versions of an adopted minimum standard accepted by the Secretary 
without adversely affecting the certification status of the Certified 
EHR Technology.


Sec.  170.557  Authorized certification methods.

    (a) Primary method. An ONC-ACB must have the capacity to certify 
Complete EHRs and/or EHR Modules at their facility.
    (b) Secondary methods. An ONC-ACB must also have the capacity to 
certify Complete EHRs and/or EHR Modules through one of the following 
methods:
    (1) At the site where the Complete EHR or EHR Module has been 
developed; or
    (2) At the site where the Complete EHR or EHR Module resides; or
    (3) Remotely (i.e., through other means, such as through secure 
electronic transmissions and automated Web-based tools, or at a 
location other than the ONC-ACB's facilities).


Sec.  170.560  Good standing as an ONC-ACB.

    An ONC-ACB must maintain good standing by:
    (a) Adhering to the Principles of Proper Conduct for ONC-ACBs;
    (b) Refraining from engaging in other types of inappropriate 
behavior, including an ONC-ACB misrepresenting the scope of its 
authorization as well as an ONC-ACB testing and certifying Complete 
EHRs and/or EHR Modules for which it does not have authorization; and
    (c) Following all other applicable Federal and State laws.


Sec.  170.565  Revocation of authorized certification body status.

    (a) Type-1 violations. The National Coordinator may revoke an ONC-
ACB's status for committing a Type-1 violation. Type-1 violations 
include violations of law or permanent certification program policies 
that threaten or significantly undermine the integrity of the permanent 
certification program. These violations include, but are not limited 
to: False, fraudulent, or abusive activities that affect the permanent 
certification program, a program administered by HHS or any program 
administered by the Federal government.
    (b) Type-2 violations. The National Coordinator may revoke an ONC-
ACB's status for failing to timely or adequately correct a Type-2 
violation. Type-2 violations comprise noncompliance with Sec.  170.560.
    (1) Noncompliance notification. If the National Coordinator obtains 
reliable evidence that an ONC-ACB may no longer be in compliance with 
Sec.  170.560, the National Coordinator will issue a noncompliance 
notification with reasons for the notification to the ONC-ACB 
requesting that the ONC-ACB respond to the alleged violation and 
correct the violation, if applicable.
    (2) Opportunity to become compliant. After receipt of a 
noncompliance notification, an ONC-ACB is permitted to 30 days to 
submit a written response and accompanying documentation that 
demonstrates that no violation occurred or that the alleged violation 
has been corrected.
    (i) If the ONC-ACB submits a response, the National Coordinator is 
permitted up to 30 days from the time the response is received to 
evaluate the response and reach a decision. The National Coordinator 
may, if necessary, request additional information from the ONC-ACB 
during this time period.
    (ii) If the National Coordinator determines that no violation 
occurred or that the violation has been sufficiently corrected, the 
National Coordinator will issue a memo to the ONC-ACB confirming this 
determination.
    (iii) If the National Coordinator determines that the ONC-ACB 
failed to demonstrate that no violation occurred or to correct the 
area(s) of non-compliance identified under paragraph (b)(1) of this 
section within 30 days of receipt of the noncompliance notification, 
then the National Coordinator may propose to revoke the ONC-ACB's 
status.
    (c) Proposed revocation.
    (1) The National Coordinator may propose to revoke an ONC-ACB's 
status if the ONC-ACB has committed a Type-1 violation; or
    (2) The National Coordinator may propose to revoke an ONC-ACB's 
status if, after the ONC-ACB has been notified of a Type-2 violation, 
the ONC-ACB fails to:
    (i) To rebut the finding of a violation with sufficient evidence 
showing that the violation did not occur or that the violation has been 
corrected; or
    (ii) Submit to the National Coordinator a written response to the 
noncompliance notification within the specified timeframe under 
paragraph (b)(2).
    (3) ONC-ACB's operations. An ONC-ACB may continue its operations 
under the permanent certification program during the time periods 
provided for an ONC-ACB to respond to a proposed revocation notice and 
the National Coordinator to review an ONC-ACB's response to a proposed 
revocation.
    (d) Opportunity to respond to a proposed revocation notice.
    (1) An ONC-ACB may respond to a proposed revocation notice, but 
must do so within 10 days of receiving the proposed revocation notice 
and include appropriate documentation explaining in writing why its 
status should not be revoked.
    (2) Upon receipt of an ONC-ACB's response to a proposed revocation 
notice, the National Coordinator is permitted up to 30 days to review 
the information submitted by the ONC-ACB and reach a decision.

[[Page 11373]]

    (e) Good standing determination. If the National Coordinator 
determines that an ONC-ACB's status should not be revoked, the National 
Coordinator will notify the ONC-ACB's authorized representative in 
writing of this determination.
    (f) Revocation.
    (1) The National Coordinator may revoke an ONC-ACB's status if:
    (i) A determination is made that revocation is appropriate after 
considering the information provided by the ONC-ACB in response to the 
proposed revocation notice; or
    (ii) The ONC-ACB does not respond to a proposed revocation notice 
within the specified timeframe in paragraph (d)(1) of this section.
    (2) A decision to revoke an ONC-ACB's status is final and not 
subject to further review unless the National Coordinator chooses to 
reconsider the revocation.
    (g) Extent and duration of revocation.
    (1) The revocation of an ONC-ACB is effective as soon as the ONC-
ACB receives the revocation notice.
    (2) A certification body that has had its ONC-ACB status revoked is 
prohibited from accepting new requests for certification and must cease 
its current certification operations under the permanent certification 
program.
    (3) A certification body that has had its ONC-ACB has its status 
revoked for a Type-1 violation, is not permitted to reapply for ONC-ACB 
status under the permanent certification program for a period of 1 
year.
    (4) The failure of a certification body that has had its ONC-ACB 
status revoked to promptly refund any and all fees for certifications 
of Complete EHRs and EHR Modules not completed will be considered a 
violation of the Principles of Proper Conduct for ONC-ACBs and will be 
taken into account by the National Coordinator if the certification 
body reapplies for ONC-ACB status under the permanent certification 
program.


Sec.  170.570  Effect of revocation on the certifications issued to 
complete EHRs and EHR modules.

    (a) The certified status of Complete EHRs and/or EHR Modules 
certified by an ONC-ACB that had it status revoked will remain intact 
unless a Type-1 violation was committed that calls into question the 
legitimacy of the certifications issued by the former ONC-ACB.
    (b) If the National Coordinator determines that a Type-1 violation 
occurred that called into question the legitimacy of certifications 
conducted by the former ONC-ACB, then the National Coordinator would:
    (1) Review the facts surrounding the revocation of the ONC-ACB's 
status; and
    (2) Publish a notice on ONC's Web site if the National Coordinator 
believes that Complete EHRs and/or EHR Modules were improperly 
certified by the former ONC-ACB.
    (c) If the National Coordinator determines that Complete EHRs and/
or EHR Modules were improperly certified, the certification status of 
affected Complete EHRs and/or EHR Modules would only remain intact for 
120 days after the National Coordinator publishes the notice. The 
certification status of the Complete EHR and/or EHR Module can only be 
maintained thereafter by being re-certified by an ONC-ACB in good 
standing.

Kathleen Sebelius,
Secretary.
[FR Doc. 2010-4991 Filed 3-4-10; 4:15 pm]
BILLING CODE 4150-45-P