Certification Programs for Health Information Technology; Morgan Passiment Director, Information Resources Outreach

Transcription

1 ONC Proposed Establishment of Certification Programs for Health Information Technology; Proposed Rule Morgan Passiment Director, Information Resources Outreach March 31, 2010

2 Background ONC rule published in Federal Register March 10, 2010 Comments on the proposed temporary EHR testing and certification program are due by April 9, 2010 (30 days after publication of the proposed rule). Comments on the proposed permanent EHR testing and certification program are due by May 10, 2010 (60 days after publication of the proposed rule). 2

3 Background Meaningful use of certified EHR technology is required to qualify for Medicare and Medicaid EHR incentive payments authorized under the American Recovery and Reinvestment Act (ARRA). Establish the process for National Coordinator to authorize organizations to perform HIT testing and certification Specify how Complete EHRs and EHR Modules would be tested and certified Uses the same Certified health information technology, Complete EHR and EHR Module definitions defined in the Standards and Certification Criteria Rule (75 FR 2014). 3

4 Two Certification Programs Proposed Temporary Certification Program Operational for Meaningful Use Stage 1 Anticipate publishing final rule synchronously y with final rules for meaningful use and standards and certification criteria in late spring One body conducts both testing and certification ONC oversees accreditation Permanent Certification Program Operational for Meaningful Use Stage 2 Anticipated final rule early fall Testing and certification are conducted separately Separate body for accreditation of permanent certification bodies 4

5 Definitions ONC-ATCB ONC Authorized Testing and Certification Body (temporary program only) ONC-ACB ONC Authorized Certification Body ONC-AA ONC Approved Accreditor NVLAP National Voluntary Laboratory Accreditation Program (NIST) 5

6 Definitions Self-developed Complete EHR or EHR Module that has been designed, modified, or created by or under contract for, a person or entity that will assume the total costs for testing and certification and will be the primary user of the complete EHR or EHR Module. Complete EHRs or EHR Modules purchased and subsequently modified by the health care provider or their contractor to meet certification criteria. 6

7 ONC-ATCB Application Process Two Parts: 1) Application demonstrating ti applicant s conformance to Guide 65 and ISO ) Proficiency examination assess applicant s ability to test and certify complete EHR and/or EHR Modules ONC application process for the permanent program will be streamlined since testing will be handled by NIST 7

8 Program Requirements ONC and NIST developed the requirements for how testing, certification and accreditation will be conducted under the proposed certification programs. Temporary Program ONC-ATCB must demonstrate conformance with: ISO/IEC Guide 65: 1996 (Guide 65) ISO/IEC 17025:2005 (ISO 17025) Permanent Program ONC-AA conform to ISO/IEC 17011:2004 (ISO 17011) 8

9 9

10 10

11 ONC-ATCB Temporary Program ONC-ATCB will be authorized and required to perform both the testing and certification of complete EHRs and/or EHR Modules ONC will serve the role of accreditor and will assess applications and grant ONC-ATCB status 11

12 Temporary Certification Program NIST National Coordinator Autho rizes Deve lops Test Methods ONC-Authorized Testing & Certification Bodies Tests and Certifies Complete EHRs/EHR Modules Vendors/ Self-Developers Source: ONC Policy/Standards Committee Presentation 12

13 Temporary Certification Program Publishes National NIST 5 Certified HIT Coordinator Products List Testing: Tools/Data/Scripts Technical Requirements Autho rizes ONC-Authorized Testing & Certification Bodies 4 Reports Certified Product Info Complete EHR/ EHR Module Submitted Test Report Vendors/ Self-Developers Certification Application and Agreement Source: ONC Policy/Standards Committee Presentation 13

14 Permanent Certification Program Separates testing and certification Accreditation role shifts to the ONC-AA National Coordinator would approve an accreditation organization for certification bodies NVLAP (NIST) would accredit testing laboratories Surveillance reevaluate previously certified EHR Technology to determine if they perform the same in the field as in a controlled environment 14

15 Permanent Certification Program NIST NVLAP Acc credits [Testing] [Certification] National Coordinator Approves ONC-AA Accredits Autho orizes NVLAP-Accredited Testing Laboratories ONC-Authorized Certification Bodies Tests Complete EHRs/ EHR Modules Vendors/ Self-Developers Certifies Complete EHRs/ EHR Modules Source: ONC Policy/Standards Committee Presentation 15

16 Permanent Certification Program NIST NVLAP Acc credits Testing: Tools/Data/ Scripts Technical Requirements Publishes National Coordinator 5 Approves ONC-AA Accredits Autho rizes 4 Certified HIT Products List Reports Certified Product Info NVLAP-Accredited Testing Laboratories ONC-Authorized Certification Bodies Complete EHR/ EHR Module Submitted 1 Test Report 2 3 Vendors/ Self-Developers Certification Application and Agreement Source: ONC Policy/Standards Committee Presentation 16

17 Module Integration Testing/Certification Under the current rule, certifying bodies are not required to test or certify integration of EHR Modules. Should ONC-ATCB/ONC-ACBs also be required to test and certify that any EHR Module presented by one EHR Module developer would properly work (integrate) with another EHR Module? 17

18 Expiration of Temporary Program The temporary certification program will sunset on the date when the National Coordinator has authorized at least one ONC-ACB under the permanent program. Should a set date be established for the temporary program to sunset rather than depending on authorization of at least one ONC-ACB? 18

19 Recertification EHR Technology certified under the ONC-ATCB would need to be re-certified to meet Stage 2 certification criteria under the ONC-ACB. However, for some EHR Modules only the meaningful use measures will change and not the capabilities. Are there circumstances where EHR Modules should not have to be re-certified? 19

20 Validity of Certification The proposed rule requires recertification on a two year schedule based on meaningful use updates. Regardless of year and meaningful use stage at which eligible providers enter the program certified EHR Technology would have to meet current certification criteria. NOTE: Providers entering the HIT incentive program in 2013 or 2014 at CMS's "Meaningful Use Stage 1" would have to certify their EHRs to the Stage 2 criteria, not Stage 1 criteria. 20

21 Differential Certification ONC-ACB could certify EHR Technology to the differences between the certification criteria adopted by the Secretary associated with one stage of meaningful use and a subsequent stage of meaningful use. ONC suggests a differential certification could reduce cost and expedite the certification process. What factors would help determine when differential certification would be appropriate and should ONC-ACBs be required to offer it? 21

22 Secondary Testing Self Developed Primary Method: ONC-ATCBs/ONC-ACBs must have the capacity to [test and] certify at their facility. Secondary Methods: also have the capacity to [test t and] certify through some secondary means or at a secondary location: at the site (i.e., physical location) where an EHR or Module has been developed d (e.g., at a Complete EHR developer s facility); or at the site where the EHR or Module resides (e.g., at a hospital where the HIT has been installed); or remotely (i.e., through other means, such as secure electronic transmissions and automated web-based tools, or at a location other than the ONC-ATCB s facilities). Should and ONC-ATCB be required to perform secondary testing? 22

23 Privacy and Security ONC-ATCBs would be required to test and certify all EHR Modules to the privacy and security certification criteria except for the following: EHR Module is presented as a pre-coordinated, integrated bundle Would not be part of an eligible provider s local system under their direct controlo Technically infeasible to be tested and certified Performs specific privacy and security capability Are there other approaches to establish when testing and certification for privacy and security should be required? 23

24 Minimum Necessary Code Sets When the Secretary adopts a new version of a minimum standard code the following apply: 1) Any ONC-ATCB may test and certify according to the new version. 2) Certified EHR Technology may be upgraded without adversely affecting the certification status. 3) ONC-ATCBs would not be required to test and certify until ONC incorporates the new version by reference of the adopted version to the new version. ONC proposes publishing updates quarterly either by presentation to the HIT Standards Committee or posting on the web site. Is quarterly publication an appropriate interval? 24

25 Impact of Revoked Certification on Providers National Coordinator may revoke ONC-ATCB status for committing a violation of law or the temporary certification program policies threaten or significantly undermine the program s integrity. Improperly certified Complete EHR or EHR Module certification status will remain in effect for 120 days. Thereafter certification can only be maintained by being re-certified by an ONC-ATCB in good standing. Is this timeframe appropriate? Are there alternative solutions if the product is functioning properly? 25

26 Comments and Questions Resources: