11328 Federal Register / Vol. 75, No. 46 / Wednesday, March 10, 2010 / Proposed Rules 

DEPARTMENT OF HEALTH AND 

HUMAN SERVICES 

Office of the Secretary 

45 CFR Part 170 

RIN 0991–AB59 

Proposed Establishment of 

Certification Programs for Health 

Information Technology 

AGENCY: Office of the National 

Coordinator for Health Information 

Technology, Department of Health and 

Human Services. 

ACTION: Proposed rule. 

SUMMARY: Under the authority granted 

to the National Coordinator for Health 

Information Technology (the National 

Coordinator) by section 3001(c)(5) of the 

Public Health Service Act (PHSA) as 

added by the Health Information 

Technology for Economic and Clinical 

Health (HITECH) Act, this rule proposes 

the establishment of two certification 

programs for purposes of testing and 

certifying health information 

technology. While two certification 

programs are described in this proposed 

rule, we anticipate issuing separate final 

rules for each of the programs. The first 

proposal would establish a temporary 

certification program whereby the 

National Coordinator would authorize 

organizations to test and certify 

Complete EHRs and/or EHR Modules, 

thereby assuring the availability of 

Certified EHR Technology prior to the 

date on which health care providers 

seeking the incentive payments 

available under the Medicare and 

Medicaid EHR Incentives Program may 

begin demonstrating meaningful use of 

Certified EHR Technology. The second 

proposal would establish a permanent 

certification program to replace the 

temporary certification program. The 

permanent certification program would 

separate the responsibilities for 

performing testing and certification, 

introduce accreditation requirements, 

establish requirements for certification 

bodies authorized by the National 

Coordinator related to the surveillance 

of Certified EHR Technology, and would 

include the potential for certification 

bodies authorized by the National 

Coordinator to certify other types of 

health information technology besides 

Complete EHRs and EHR Modules. 

DATES: To be assured consideration, 

written or electronic comments on the 

proposals for the temporary certification 

program must be received at one of the 

addresses provided below, no later than 

5 p.m. on April 9, 2010. To be assured 

consideration, written or electronic 

comments on the proposals for the 

permanent certification program must 

be received at one of the addresses 

provided below, no later than 5 p.m. on 

May 10, 2010. 

ADDRESSES: Because of staff and 

resource limitations, we cannot accept 

comments by facsimile (FAX) 

transmission. You may submit 

comments, identified by RIN 0991– 

AB59, by any of the following methods 

(please do not submit duplicate 

comments). 

• Federal eRulemaking Portal: Follow 

the instructions for submitting 

comments. Attachments should be in 

Microsoft Word, WordPerfect, or Excel; 

however, we prefer Microsoft Word. 

http://www.regulations.gov. 

• Regular, Express, or Overnight Mail: 

Department of Health and Human 

Services, Office of the National 

Coordinator for Health Information 

Technology, Attention: Certification 

Programs Proposed Rule, Hubert H. 

Humphrey Building, Suite 729D, 200 

Independence Ave., SW., Washington, 

DC 20201. Please submit one original 

and two copies. 

• Hand Delivery or Courier: Office of 

the National Coordinator for Health 

Information Technology, Attention: 

Certification Programs Proposed Rule, 

Hubert H. Humphrey Building, Suite 

729D, 200 Independence Ave., SW., 

Washington, DC 20201. Please submit 

one original and two copies. (Because 

access to the interior of the Hubert H. 

Humphrey Building is not readily 

available to persons without Federal 

government identification, commenters 

are encouraged to leave their comments 

in the mail drop slots located in the 

main lobby of the building.) 

Inspection of Public Comments: All 

comments received before the close of 

the applicable comment period will be 

available for public inspection, 

including any personally identifiable or 

confidential business information that is 

included in a comment. Please do not 

include anything in your comment 

submission that you do not wish to 

share with the general public. Such 

information includes, but is not limited 

to: a person’s social security number; 

date of birth; driver’s license number; 

State identification number or foreign 

country equivalent; passport number; 

financial account number; credit or 

debit card number; any personal health 

information; or any business 

information that could be considered to 

be proprietary. We will post all 

comments received before the close of 

the applicable comment period at http:// 

www.regulations.gov. 

Docket: For access to the docket to 

read background documents or 

comments received, go to http:// 

www.regulations.gov or U.S. Department 

of Health and Human Services, Office of 

the National Coordinator for Health 

Information Technology, Hubert H. 

Humphrey Building, Suite 729D, 200 

Independence Ave., SW., Washington, 

DC 20201 (call ahead to the contact 

listed below to arrange for inspection). 

FOR FURTHER INFORMATION CONTACT: 

Steven Posnack, Policy Analyst, 202– 

690–7151. 

SUPPLEMENTARY INFORMATION: 

Acronyms 

CAH Critical Access Hospital 

CCHIT Certification Commission for Health 

Information Technology 

CGD Certification Guidance Document 

CMS Centers for Medicare & Medicaid 

Services 

EHR Electronic Health Record 

FACA Federal Advisory Committee Act 

FFS Fee for Service (Medicare Program) 

HHS Department of Health and Human 

Services 

HIT Health Information Technology 

HITECH Health Information Technology for 

Economic and Clinical Health 

LOINC Logical Observation Identifiers 

Names and Codes 

MA Medicare Advantage 

NIST National Institute of Standards and 

Technology 

NVLAP National Voluntary Laboratory 

Accreditation Program 

OIG Office of Inspector General 

OMB Office of Management and Budget 

ONC Office of the National Coordinator for 

Health Information Technology 

ONC–AA ONC-Approved Accreditor 

ONC–ACB ONC-Authorized Certification 

Body 

ONC–ATCB ONC-Authorized Testing and 

Certification Body 

OPM Office of Personnel Management 

PHSA Public Health Service Act 

RFA Regulatory Flexibility Act 

RIA Regulatory Impact Analysis 

SSA Social Security Act 

Table of Contents 

I. Background 

A. Previously Defined Terminology 

B. Legislative and Regulatory History 

1. Legislative History 

a. Standards, Implementation 

Specifications, and Certification Criteria 

b. Medicare and Medicaid EHR Incentive 

Programs 

i. Medicare EHR Incentive Program 

ii. Medicaid EHR Incentive Program 

c. HIT Certification Programs 

2. Regulatory History and Related 

Guidance 

a. Initial Set of Standards, Implementation 

Specifications, and Certification Criteria 

b. Medicare and Medicaid EHR Incentive 

Programs Proposed Rule 

c. HIT Certification Programs Proposed 

Rule 

d. Physician Self-Referral Prohibition and 

Anti-Kickback EHR Exception and Safe 

Harbor Final Rules and ONC Interim 


erowe on DSK5CLS3C1PROD with PROPOSALS2
Federal Register / Vol. 75, No. 46 / Wednesday, March 10, 2010 / Proposed Rules 11329 

Guidance Regarding the Recognition of 

Certification Bodies 

C. Overview of Temporary Certification 

Program 

D. Overview of Permanent Certification 

Program 

E. Factors Influencing the Proposal of Both 

Temporary and Permanent Certification 

Programs 

1. HIT Policy Committee 

Recommendations 

2. Coordination With the HIT Standards 

and Certification Criteria Interim Final 

Rule and the Medicare and Medicaid 

EHR Incentive Programs Proposed Rule 

3. Timeliness Related to the Beginning of 

the Medicare and Medicaid EHR 

Incentive Programs 

i. Public Comment Period 

ii. Urgency of Establishing the Temporary 

Certification Program 

4. Consultations With NIST 

F. Additional Context for Comparing the 

Temporary and Permanent Certification 

Programs 

1. The Distinction Between Testing and 

Certification 

2. Accreditation 

3. Surveillance 

II. Provisions of the Temporary Certification 

Program 

A. Applicability 

B. Definitions 

1. Definition of Applicant 

2. Definition of Day or Days 

3. Definition of ONC–ATCB 

C. Correspondence With the National 

Coordinator 

D. Temporary Certification Program 

Application Process for ONC–ATCB 

Status 

1. Application for ONC–ATCB Status 

a. Types of Applicants 

b. Types of ONC–ATCB Authorization 

c. Application Part One 

d. Application Part Two 

2. Application Review 

a. Satisfactory Application 

b. Deficient Application Returned and 

Opportunity To Revise 

3. ONC–ATCB Application 

Reconsideration Requests 

4. ONC–ATCB Status 

a. Acknowledgement and Representation 

b. Expiration of Status Under the 

Temporary Certification Program 

E. ONC–ATCB Performance of Testing and 

Certification and Maintaining Good 

Standing as an ONC–ATCB 

1. Authorization To Test and Certify 

Complete EHRs 

2. Authorization To Test and Certify EHR 

Modules 

a. Certification Criterion Scope 

b. When Privacy and Security Certification 

Criteria Apply to EHR Modules 

3. Authorized Testing and Certification 

Methods 

4. The Testing and Certification of 

‘‘Minimum Standards’’ 

5. Maintaining Good Standing as an ONC– 

ATCB; Violations That Could Lead to the 

Revocation of ONC–ATCB Status; 

Revocation of ONC–ATCB Status 

a. Type-1 Violations 

b. Type-2 Violations 

c. Proposed Revocation 

i. Opportunity To Respond to a Proposed 

Revocation Notice 

ii. Revocation of an ONC–ATCB’s Status 

d. Extent and Duration of Revocation 

Under the Temporary Certification 

Program 

e. Alternative Considered 

6. Validity of Complete EHR and EHR 

Module Certification 

F. Sunset 

III. Provisions of Permanent Certification 

Program 

A. Applicability 

B. Definitions 

1. Definition of Applicant 

2. Definition of ONC-Approved Accreditor 

3. Definition of Day or Days 

4. Definition of ONC–ACB 

C. Correspondence With the National 

Coordinator 

D. Permanent Certification Program 

Application Process for ONC–ACB 

Status 

1. Application for ONC–ACB Status 

a. Types of Applicants 

b. Types of ONC–ACB Authorization 

c. Application for ONC–ACB Status 

d. Proficiency Examination 

2. Application Review 

3. ONC–ACB Application Reconsideration 

Requests 

4. ONC–ACB Status 

a. Acknowledgement and Representation 

b. Expiration of Status Under the 

Permanent Certification Program 

E. ONC–ACB Performance of Certification 

and Maintaining Good Standing as ONC– 

ACB 

1. Authorization To Certify Complete EHRs 

2. Authorization To Certify EHR Modules 

3. Authorization To Certify Other HIT 

4. Authorized Certification Methods 

5. The Certification of ‘‘Minimum 

Standards’’ 

6. Maintaining Good Standing as an ONC– 

ACB; Violations That Could Lead to 

Revocation of ONC–ACB Status; 

Revocation of ONC–ACB Status 

7. Validity of Complete EHR and EHR 

Module Certification 

8. Differential Certification 

F. ONC–Approved Accreditor 

1. Requirements for Becoming an ONC–AA 

2. ONC–AA Ongoing Responsibilities 

3. Number of ONC–AAs and Length of 

Approval 

G. Promoting Participation in the 

Permanent Certification Program 

IV. Response to Comments 

V. Collection of Information Requirements 

A. Collection of Information #1: 

Application for ONC–ATCB Status 

Under the Proposed Temporary 

Certification Program 

B. Collection of Information #2: 

Application for ONC–ACB Status Under 

the Proposed Permanent Certification 

Program 

C. Collection of Information #3: ONC– 

ATCB and ONC–ACB Collection and 

Reporting of Information Related to 

Complete EHR and/or EHR Module 

Certifications 

D. Collection of Information #4: Required 

Documentation for Requesting ONC– 

Approved Accreditor Status 

VI. Regulatory Impact Analysis 

A. Introduction 

B. Why This Rule Is Needed? 

C. Executive Order 12866—Regulatory 

Planning and Review Analyses for the 

Proposed Temporary and Permanent 

Certification Programs 

1. Temporary Certification Program 

Estimated Costs 

a. Application Process for ONC–ATCB 

status 

i. Applicant Costs 

ii. Costs to the Federal Government 

b. Temporary Certification Program: 

Testing and Certification of Complete 

EHRs and EHR Modules 

2. Permanent Certification Program 

Estimated Costs 

a. Request for ONC–AA Status 

i. Cost of Submission for Requesting ONC– 

AA Status 

ii. Cost to the Federal Government 

b. Application Process for ONC–ACB 

Status and Renewal 

i. Applicant Costs and ONC–ACB Renewal 

Costs 

ii. Costs to the Federal Government 

c. Permanent Certification Program: 

Testing and Certification of Complete 

EHRs and EHR Modules 

3. Costs for Collecting, Storing, and 

Reporting Certification Results Under the 

Temporary and Permanent Certification 

Programs 

a. Costs to ONC–ATCBs and ONC–ACBs 

b. Costs to the Federal Government 

4. Temporary and Permanent Certification 

Program Benefits 

D. Regulatory Flexibility Act 

E. Executive Order 13132—Federalism 

F. Unfunded Mandates Reform Act of 1995 

I. Background 

[If you choose to comment on the 

background section, please include at 

the beginning of your comment the 

caption ‘‘Background’’ and any 

additional information to clearly 

identify the information about which 

you are commenting.] 

A. Previously Defined Terminology 

This proposed rule is directly related 

to the recently published (January 13, 

2010) health information technology 

(HIT) Standards and Certification 

Criteria interim final rule (75 FR 2014). 

Consequently, in addition to new terms 

and definitions discussed later in this 

proposed rule, the following terms have 

the same meaning as provided at 45 CFR 

170.102. 

• Certification criteria means criteria: 

(1) To establish that health information 

technology meets applicable standards 

and implementation specifications 

adopted by the Secretary; or (2) that are 

used to test and certify that health 

information technology includes 

required capabilities. 

• Certified EHR Technology means a 

Complete EHR or a combination of EHR 

Modules, each of which: (1) Meets the 


erowe on DSK5CLS3C1PROD with PROPOSALS2
11330 Federal Register / Vol. 75, No. 46 / Wednesday, March 10, 2010 / Proposed Rules 

requirements included in the definition 

of a Qualified EHR; and (2) has been 

tested and certified in accordance with 

the certification program established by 

the National Coordinator as having met 

all applicable certification criteria 

adopted by the Secretary. 

• Complete EHR means EHR 

technology that has been developed to 

meet all applicable certification criteria 

adopted by the Secretary. 

• Disclosure means the release, 

transfer, provision of access to, or 

divulging in any other manner of 

information outside the entity holding 

the information. 

• EHR Module means any service, 

component, or combination thereof that 

can meet the requirements of at least 

one certification criterion adopted by 

the Secretary. 

• Implementation specification 

means specific requirements or 

instructions for implementing a 

standard. 

• Qualified EHR means an electronic 

record of health-related information on 

an individual that: (1) Includes patient 

demographic and clinical health 

information, such as medical history 

and problem lists; and (2) has the 

capacity: (i) To provide clinical decision 

support; (ii) to support physician order 

entry; (iii) to capture and query 

information relevant to health care 

quality; and (iv) to exchange electronic 

health information with, and integrate 

such information from other sources. 

• Standard means a technical, 

functional, or performance-based rule, 

condition, requirement, or specification 

that stipulates instructions, fields, 

codes, data, materials, characteristics, or 

actions. 

B. Legislative and Regulatory History 

1. Legislative History 

The Health Information Technology 

for Economic and Clinical Health 

(HITECH) Act, Title XIII of Division A 

and Title IV of Division B of the 

American Recovery and Reinvestment 

Act of 2009 (ARRA) (Pub. L. 111–5), was 

enacted on February 17, 2009. The 

HITECH Act amended the Public Health 

Service Act (PHSA) and created ‘‘Title 

XXX—Health Information Technology 

and Quality’’ (Title XXX) to improve 

health care quality, safety, and 

efficiency through the promotion of 

health information technology (HIT) and 

electronic health information exchange. 

Section 3001 of the PHSA establishes by 

statute the Office of the National 

Coordinator for Health Information 

Technology (ONC). Title XXX of the 

PHSA provides the National 

Coordinator and the Secretary of the 

Department of Health and Human 

Services (the Secretary) with new 

responsibilities and authorities related 

to HIT. The HITECH Act also amended 

several sections of the Social Security 

Act (SSA) and in doing so established 

the availability of incentive payments to 

eligible professionals and eligible 

hospitals to promote the adoption and 

meaningful use of interoperable HIT. 

a. Standards, Implementation 

Specifications, and Certification Criteria 

With the passage of the HITECH Act, 

two new Federal advisory committees 

were established, the HIT Policy 

Committee and the HIT Standards 

Committee (sections 3002 and 3003 of 

the PHSA, respectively). Each is 

responsible for advising the National 

Coordinator on different aspects of 

standards, implementation 

specifications, and certification criteria. 

The HIT Policy Committee is 

responsible for, among other duties, 

recommending priorities for the 

development, harmonization, and 

recognition of standards, 

implementation specifications, and 

certification criteria while the HIT 

Standards Committee is responsible for 

recommending standards, 

implementation specifications, and 

certification criteria for adoption by the 

Secretary under section 3004 of the 

PHSA consistent with the ONCCoordinated Federal Health IT Strategic 

Plan (the ‘‘strategic plan’’). 

Section 3004 of the PHSA defines 

how the Secretary adopts standards, 

implementation specifications, and 

certification criteria. Section 3004(a) of 

the PHSA defines a process whereby an 

obligation is imposed on the Secretary 

to review standards, implementation 

specifications, and certification criteria 

and identifies the procedures for the 

Secretary to follow to determine 

whether to adopt any grouping of 

standards, implementation 

specifications, or certification criteria 

included among National Coordinatorendorsed recommendations. 

b. Medicare and Medicaid EHR 

Incentive Programs 

Title IV, Division B of the HITECH 

Act establishes incentive payments 

under the Medicare and Medicaid 

programs for eligible professionals and 

eligible hospitals that meaningfully use 

Certified EHR Technology. The Centers 

for Medicare & Medicaid Services (CMS) 

is charged with developing the 

Medicare and Medicaid EHR incentive 

programs. 

i. Medicare EHR Incentive Program 

Section 4101 of the HITECH Act 

added new subsections to section 1848 

of the SSA to establish incentive 

payments for the meaningful use of 

Certified EHR Technology by eligible 

professionals participating in the 

Medicare Fee-for-Service (FFS) program 

beginning in calendar year (CY) 2011 

and beginning in CY 2015, downward 

payment adjustments for covered 

professional services provided by 

eligible professionals who are not 

meaningful users of Certified EHR 

Technology. Section 4101(c) of the 

HITECH Act added a new subsection to 

section 1853 of the SSA that provides 

incentive payments to Medicare 

Advantage (MA) organizations for their 

affiliated eligible professionals who 

meaningfully use Certified EHR 

Technology beginning in CY2011 and 

beginning in 2015, downward payment 

adjustments to MA organizations to 

account for certain affiliated eligible 

professionals who are not meaningful 

users of Certified EHR Technology. 

Section 4102 of the HITECH Act 

added new subsections to section 1886 

of the SSA that establish incentive 

payments for the meaningful use of 

Certified EHR Technology by subsection 

(d) hospitals (defined under section 

1886(d)(1)(B) of the SSA) that 

participate in the Medicare FFS program 

beginning in Federal fiscal year (FY) 

2011 and beginning in FY 2015, 

downward payment adjustments to the 

market basket updates for inpatient 

hospital services provided by such 

hospitals that are not meaningful users 

of Certified EHR Technology. Section 

4102(b) of the HITECH Act amends 

section 1814 of the SSA to provide an 

incentive payment to critical access 

hospitals that meaningfully use 

Certified EHR Technology based on the 

hospitals’ reasonable costs beginning in 

FY 2011 and downward payment 

adjustments for inpatient hospital 

services provided by such hospitals that 

are not meaningful users of Certified 

EHR Technology for cost reporting 

periods beginning in FY 2015. Section 

4102(c) of the HITECH Act adds a new 

subsection to section 1853 of the SSA to 

provide incentive payments to MA 

organizations for certain affiliated 

eligible hospitals that meaningfully use 

Certified EHR Technology and 

beginning in FY 2015, downward 

payment adjustments to MA 

organizations for those affiliated 

hospitals that are not meaningful users 

of Certified EHR Technology. 


erowe on DSK5CLS3C1PROD with PROPOSALS2
Federal Register / Vol. 75, No. 46 / Wednesday, March 10, 2010 / Proposed Rules 11331 

ii. Medicaid EHR Incentive Program 

Section 4201 of the HITECH Act 

amends section 1903 of the SSA to 

provide 100 percent Federal financial 

participation (FFP) to States for 

incentive payments to certain eligible 

health care providers participating in 

the Medicaid program to purchase, 

implement, and meaningfully use 

(including support services and training 

for staff) Certified EHR Technology and 

90 percent FFP for State administrative 

expenses related to the incentive 

program. 

c. HIT Certification Programs 

Section 3001(c)(5) of the PHSA 

provides the National Coordinator with 

the authority to establish a certification 

program or programs for the voluntary 

certification of HIT. Specifically, section 

3001(c)(5)(A) specifies that the 

‘‘National Coordinator, in consultation 

with the Director of the National 

Institute of Standards and Technology, 

shall keep or recognize a program or 

programs for the voluntary certification 

of health information technology as 

being in compliance with applicable 

certification criteria adopted under this 

subtitle’’ (i.e., certification criteria 

adopted by the Secretary under section 

3004 of the PHSA). The certification 

program(s) must also ‘‘include, as 

appropriate, testing of the technology in 

accordance with section 13201(b) of the 

[HITECH] Act.’’ 

Section 13201(b) of the HITECH Act 

requires that with respect to the 

development of standards and 

implementation specifications, the 

Director of the National Institute of 

Standards and Technology (NIST), in 

coordination with the HIT Standards 

Committee, ‘‘shall support the 

establishment of a conformance testing 

infrastructure, including the 

development of technical test beds.’’ The 

United States Congress also indicated 

that ‘‘[t]he development of this 

conformance testing infrastructure may 

include a program to accredit 

independent, non-Federal laboratories 

to perform testing.’’ 

2. Regulatory History and Related 

Guidance 

a. Initial Set of Standards, 

Implementation Specifications, and 

Certification Criteria 

In accordance with section 3004(b)(1) 

of the PHSA, the Secretary published an 

interim final rule with request for 

comments entitled ‘‘Health Information 

Technology: Initial Set of Standards, 

Implementation Specifications, and 

Certification Criteria for Electronic 

Health Record Technology’’ (HIT 

Standards and Certification Criteria 

interim final rule) (75 FR 2014), which 

adopted an initial set of standards, 

implementation specifications, and 

certification criteria. The standards, 

implementation specifications, and 

certification criteria adopted by the 

Secretary establish the capabilities that 

Certified EHR Technology must include 

in order to, at a minimum, support the 

achievement of what has been proposed 

for meaningful use Stage 1 by eligible 

professionals and eligible hospitals 

under the Medicare and Medicaid EHR 

Incentive Programs proposed rule (see 

75 FR 1844 for more information about 

meaningful use and the proposed Stage 

1 requirements). 

b. Medicare and Medicaid EHR 

Incentive Programs Proposed Rule 

On January 13, 2010, CMS published 

in the Federal Register (75 FR 1844) the 

Medicare and Medicaid EHR Incentive 

Program proposed rule. The rule 

proposes a definition for meaningful use 

Stage 1 and regulations associated with 

the incentive payments made available 

under Division B, Title IV of the 

HITECH Act. CMS has proposed that 

meaningful use Stage 1 would begin in 

2011 and has proposed that Stage 1 

would focus on ‘‘electronically 

capturing health information in a coded 

format; using that information to track 

key clinical conditions and 

communicating that information for care 

coordination purposes (whether that 

information is structured or 

unstructured), but in structured format 

whenever feasible; consistent with other 

provisions of Medicare and Medicaid 

law, implementing clinical decision 

support tools to facilitate disease and 

medication management; and reporting 

clinical quality measures and public 

health information.’’ 

c. HIT Certification Programs Proposed 

Rule 

Section 3001(c)(5) of the PHSA, 

specifies that the National Coordinator 

‘‘shall keep or recognize a program or 

programs for the voluntary certification 

of health information technology as 

being in compliance with applicable 

certification criteria adopted [by the 

Secretary] under this subtitle.’’ We are 

using this authority to propose both 

temporary and permanent certification 

programs for HIT. These certification 

programs are necessary in order to 

assure that eligible professionals and 

eligible hospitals are able to adopt and 

implement Certified EHR Technology in 

an effort to qualify for meaningful use 

incentive payments. 

Although the initial and primary 

purpose of our proposed temporary and 

permanent certification programs would 

be to test and certify Complete EHRs 

and EHR Modules, we believe that 

Congress did not intend to limit the 

National Coordinator’s authority solely 

to this purpose. The National 

Coordinator is expressly authorized to 

establish a voluntary certification 

program or programs for ‘‘health 

information technology,’’ not simply 

EHRs. As a result, we expect that our 

permanent certification program could 

also include the testing and certification 

of other types and aspects of HIT. 

Examples of other types of HIT that 

could be tested and certified under the 

permanent certification program include 

personal health records (PHRs) and 

networks designed for the electronic 

exchange of health information. We 

invite public comment on the need for 

additional HIT certifications, the types 

of HIT that would be appropriate for 

certification, and on any of the potential 

benefits or challenges associated with 

certifying other types of HIT. 

d. Physician Self-Referral Prohibition 

and Anti-Kickback EHR Exception and 

Safe Harbor Final Rules and ONC 

Interim Guidance Regarding the 

Recognition of Certification Bodies 

In August 2006, HHS published two 

final rules in which CMS and the Office 

of Inspector General (OIG) promulgated 

an exception to the physician selfreferral prohibition and a safe harbor 

under the anti-kickback statute, 

respectively, for certain arrangements 

involving the donation of interoperable 

EHR software to physicians and other 

health care practitioners or entities (71 

FR 45140 and 71 FR 45110, 

respectively). The exception and safe 

harbor provide that EHR software will 

be ‘‘deemed to be interoperable if a 

certifying body recognized by the 

Secretary has certified the software no 

more than 12 months prior to the date 

it is provided to the [physician/ 

recipient].’’ ONC published separately a 

Certification Guidance Document (CGD) 

(71 FR 44296) to explain the factors 

ONC would use to determine whether to 

recommend to the Secretary a body for 

‘‘recognized certification body’’ status. 

The CGD serves as a guide for ONC to 

evaluate applications for ‘‘recognized 

certification body’’ status and provides 

the information a body would need to 

apply for and obtain such status. To 

date, the Certification Commission for 

Health Information Technology (CCHIT) 

has been the only organization that has 

both applied for and been granted 

‘‘recognized certification body’’ status 

under the CGD. 

In section VI of the CGD, ONC 

notified the public, including potential 


erowe on DSK5CLS3C1PROD with PROPOSALS2
11332 Federal Register / Vol. 75, No. 46 / Wednesday, March 10, 2010 / Proposed Rules 

applicants, that the recognition process 

explained in the CGD would be 

formalized through notice and comment 

rulemaking and that when a final rule 

has been promulgated to govern the 

process by which a ‘‘recognized 

certification body’’ is determined, 

certification bodies recognized under 

the CGD would be required to complete 

new applications and successfully 

demonstrate compliance with all 

requirements of the final rule. 

This proposed rule marks the 

beginning of the formal notice and 

comment rulemaking described in the 

CGD. As a result, the processes we 

propose for the temporary certification 

program and permanent certification 

program, once finalized, would 

supersede the CGD, and the 

authorization process would constitute 

the new established method for 

‘‘recognizing’’ certification bodies, as 

referenced in the physician self-referral 

prohibition and anti-kickback EHR 

exception and safe harbor final rules. 

Consequently, certifications issued by a 

certification body ‘‘authorized’’ by the 

National Coordinator would enable 

Complete EHRs and EHR Modules to 

meet the definition of Certified EHR 

Technology, and it would constitute 

certification by ‘‘a certifying body 

recognized by the Secretary’’ in the 

context of the physician self-referral 

EHR exception and anti-kickback EHR 

safe harbor. 

We request comment on whether we 

should construe the proposed new 

‘‘authorization’’ process as the 

Secretary’s method for ‘‘recognizing’’ 

certification bodies in the context of the 

physician self-referral EHR exception 

and anti-kickback EHR safe harbor. 

C. Overview of Temporary Certification 

Program 

We are proposing a temporary 

certification program to describe the 

process by which an organization would 

become an ONC-Authorized Testing and 

Certification Body (ONC–ATCB) and 

authorized under the temporary 

certification program to perform the 

testing and certification of Complete 

EHRs and/or EHR Modules. Under the 

temporary certification program, the 

National Coordinator would assume 

many of the responsibilities that we 

have proposed that other organizations 

would otherwise fulfill under the 

permanent certification program. 

In order to become an ONC–ATCB, an 

organization (or organizations) would 

need to submit an application to the 

National Coordinator to demonstrate its 

competency and ability to test and 

certify Complete EHRs and/or EHR 

Modules. We propose under the 

temporary certification program that in 

order to become an ONC–ATCB, an 

applicant must be able to both test and 

certify Complete EHRs and/or EHR 

Modules. We anticipate that only a few 

organizations would qualify and become 

ONC–ATCBs under the temporary 

certification program. We also propose 

conditions and requirements applicable 

to the testing and certification of 

Complete EHRs and EHR Modules. 

Under the temporary program, the 

National Coordinator would accept 

applications for ONC–ATCB status at 

any time. The temporary program would 

sunset once the permanent certification 

program is established and at least one 

certification body has been authorized 

by the National Coordinator. 

D. Overview of Permanent Certification 

Program 

For the permanent certification 

program, we are proposing that several 

of the responsibilities assumed by the 

National Coordinator under the 

temporary certification program would 

be fulfilled by others. The National 

Coordinator would, where appropriate, 

seek to move as many of the temporary 

certification program’s processes as 

possible to organizations in the private 

sector. We are proposing a process in 

the permanent certification program by 

which an organization would become an 

ONC–Authorized Certification Body 

(ONC–ACB). Please note, that an ‘‘ONC– 

ACB’’ in the permanent certification 

program is different than an ‘‘ONC– 

ATCB’’ in the temporary certification 

program. Under the permanent 

certification program, we are proposing 

that the National Coordinator’s 

authorization would be valid solely for 

certification. We are also proposing that 

an applicant for ONC–ACB status must 

be accredited prior to submitting an 

application to the National Coordinator. 

An applicant’s accreditation would be a 

critical factor in the National 

Coordinator’s decision to grant it ONC– 

ACB status. We discuss in section III.F 

the process by which the National 

Coordinator would approve an 

accreditor (an ‘‘ONC–Approved 

Accreditor’’ (ONC–AA)) for certification 

bodies who intend to apply for ONC– 

ACB status. 

Accreditation would also play an 

important role with respect to testing. 

As we discuss, the National 

Coordinator’s authorization in the 

permanent certification program would 

no longer be valid for the purposes of 

testing Complete EHRs and EHR 

Modules. Instead, we propose that NIST 

through the National Voluntary 

Laboratory Accreditation Program 

(NVLAP) (and in accordance with 

section 13201(b) of the HITECH Act) 

would be responsible for accrediting 

testing laboratories and determining 

their competency. In this role, NIST 

would be solely responsible for 

overseeing activities related to testing 

laboratories. We further propose that 

ONC–ACBs would only be permitted to 

accept test results from NVLAPaccredited testing laboratories when 

evaluating a Complete EHR or EHR 

Module for certification. We also 

propose for the permanent certification 

program, similar to the temporary 

certification program, conditions and 

requirements that would apply to the 

certification of Complete EHRs and EHR 

Modules. Finally, unlike the temporary 

certification program, we propose that 

an ONC–ACB would be required to 

renew its status every two years under 

the permanent certification program. 

E. Factors Influencing the Proposal of 

both Temporary and Permanent 

Certification Programs 

A number of factors played a role in 

our decision to propose a temporary 

certification program that could be 

implemented quickly, and a permanent 

certification program that would be 

established for the long term. These 

factors include the recommendations of 

the HIT Policy Committee; the 

interrelationships of this proposed rule 

with the HIT Standards and 

Certification Criteria interim final rule 

(75 FR 2014) and the Medicare and 

Medicaid EHR Incentive Programs 

proposed rule (75 FR 1844); the need for 

eligible professionals and eligible 

hospitals to have Certified EHR 

Technology available in a timely 

manner; and our consultations with 

NIST. 

1. HIT Policy Committee 

Recommendations 

As noted above, section 3002(b) 

requires the HIT Policy Committee to 

make recommendations to the National 

Coordinator related to the 

implementation of a nationwide health 

information technology infrastructure. 

As part of this responsibility, the HIT 

Policy Committee made five 

recommendations to the National 

Coordinator on August 14, 2009, which 

support the approach proposed in this 

rule. The recommendations addressed 

the scope of the certification process in 

general and the approach the National 

Coordinator should take to establish 

certification programs. The HIT Policy 

Committee recommended ‘‘that in 

defining the certification process...the 

following objectives are pursued: 

(1) Focus certification on Meaningful 

Use. 


erowe on DSK5CLS3C1PROD with PROPOSALS2
Federal Register / Vol. 75, No. 46 / Wednesday, March 10, 2010 / Proposed Rules 11333 

(2) Leverage the certification process 

to improve progress on privacy, 

security, and interoperability. 

(3) Improve the objectivity and 

transparency of the certification process. 

(4) Expand certification to include a 

range of software sources, e.g., open 

source, self-developed, etc. 

(5) Develop a short-term certification 

transition plan.’’ 

The National Coordinator reviewed 

and considered the recommendations 

made by the HIT Policy Committee and 

concluded that they should be used to 

provide direction for the proposals 

included in this rule. We believe that 

the proposals in this rule reflect the 

overall intent of the HIT Policy 

Committee’s recommendations. 

We interpret the HIT Policy 

Committee’s use of the word ‘‘selfdeveloped’’ and use it throughout the 

preamble to mean a Complete EHR or 

EHR Module that has been designed, 

modified, or created by, or under 

contract for, a person or entity that will 

assume the total costs for its testing and 

certification and will be a primary user 

of the Complete EHR or EHR Module. 

Self-developed Complete EHRs and EHR 

Modules could include brand new 

Complete EHRs or EHR Modules 

developed by a health care provider or 

their contractor. It could also include a 

previously purchased Complete EHR or 

EHR Module which is subsequently 

modified by the health care provider or 

their contractor and where such 

modifications are made to capabilities 

addressed by certification criteria 

adopted by the Secretary. We limit the 

scope of ‘‘modification’’ to only those 

capabilities for which the Secretary has 

adopted certification criteria because 

other capabilities (e.g., a different 

graphical user interface (GUI)) would 

not affect the underlying capabilities a 

Complete EHR or EHR Module would 

need to include in order to be tested and 

certified. 

Accordingly, we would only refer to 

the Complete EHR or EHR Module as 

‘‘self-developed’’ if the health care 

provider paid the total costs to have the 

Complete EHR or EHR Module tested 

and certified. For example, if hospital A 

self-develops a Complete EHR, pays for 

the Complete EHR to be tested and 

certified, and then goes on to sell or 

make it freely available to additional 

hospitals, we would not refer to the 

Complete EHRs used by those hospitals 

(other than hospital A) as being selfdeveloped. 

2. Coordination With the HIT Standards 

and Certification Criteria Interim Final 

Rule and the Medicare and Medicaid 

EHR Incentive Programs Proposed Rule 

This proposed rule is the third and 

final element of HHS’s coordinated 

rulemakings to define the meaningful 

use of Certified EHR Technology and 

support the achievement of meaningful 

use. 

As required by the HITECH Act, 

eligible professionals and eligible 

hospitals must demonstrate meaningful 

use of Certified EHR Technology in 

order to receive incentive payments 

under the Medicare and Medicaid EHR 

Incentive Programs. This proposed rule 

would create the certification programs 

under which Complete EHRs and EHR 

Modules could be tested and certified 

and subsequently used as Certified EHR 

Technology by eligible professionals 

and eligible hospitals. Once authorized 

by the National Coordinator, ONC– 

ATCBs under the temporary 

certification program and ONC–ACBs 

under the permanent certification 

program would be obligated to use the 

certification criteria adopted by the 

Secretary and identified at 45 CFR 

170.302, 45 CFR 170.304, and 45 CFR 

170.306. The Secretary intends to adopt 

subsequent certification criteria to 

support the requirements for future 

meaningful use stages once promulgated 

in regulation by CMS and may, where 

appropriate, adopt certification criteria 

for other types of HIT. 

3. Timeliness Related to the Beginning 

of the Medicare and Medicaid EHR 

Incentive Programs 

i. Public Comment Period 

Congress established specific 

timeframes in the HITECH Act for the 

beginning of the Medicare EHR 

incentive program. The first payment 

year for eligible professionals was 

defined as calendar year 2011 (i.e., the 

year beginning January 1, 2011) and the 

first payment year for eligible hospitals 

was defined as fiscal year 2011 (i.e., the 

year beginning October 1, 2010). 

Congress specified in section 

1903(t)(6)(C)(i)(I) of the SSA that ‘‘for the 

first year of payment to a Medicaid 

provider under this subsection, the 

Medicaid provider [must] demonstrate 

that it is engaged in efforts to adopt, 

implement, or upgrade certified EHR 

technology.’’ Although there is no 

specified date for States to begin 

implementing the Medicaid EHR 

incentives program, Congress did set a 

cutoff for when first payments would no 

longer be permitted to Medicaid 

providers (‘‘for any year beginning after 

2016’’). While the Medicare and 

Medicaid EHR Incentive Programs 

proposed rule provides more detail for 

this statutory provision, it is important 

to note that Medicaid providers will not 

be able to receive an incentive payment 

for ‘‘adopting, implementing, or 

upgrading Certified EHR Technology’’ 

until a certification program is 

established to allow for the testing and 

certification of Complete EHRs and EHR 

Modules. 

To meet the previously mentioned 

timeframes, Certified EHR Technology 

must be available before the fall of 2010. 

Accomplishing this goal will require 

many simultaneous actions: 

• Complete EHRs and EHR Modules 

may need to be reprogrammed or 

redesigned in order to meet the 

certification criteria adopted by the 

Secretary; 

• A certification program must be 

established to allow for testing and 

certification of Complete EHRs and EHR 

Modules; and 

• A collection of Complete EHRs and 

EHR Modules will need to be tested and 

certified under the established 

temporary certification program. 

For these reasons, among others 

discussed below, we have chosen to 

propose the establishment of a 

temporary certification program that 

could be established and become 

quickly operational in order to assure 

the availability of Certified EHR 

Technology prior to the beginning of 

meaningful use Stage 1. 

With these timing constraints in 

mind, we have provided for a 30-day 

public comment period on our 

proposals for the temporary certification 

program and a 60-day comment period 

on our proposals for the permanent 

certification program. Section 6(a)(1) of 

Executive Order 12866 on Regulatory 

Planning and Review (September 30, 

1993, as further amended) states that 

‘‘each agency should afford the public a 

meaningful opportunity to comment on 

any proposed regulation, which in most 

cases should include a comment period 

of not less than 60 days.’’ We believe 

that it is appropriate to follow this 

guidance in soliciting public comment 

on our proposed permanent certification 

program because the permanent 

certification program’s final rule will be 

issued some months after the final rule 

for the temporary certification program. 

However, as discussed throughout the 

preamble, the circumstances and time 

constraints under which the temporary 

certification program must be 

established are different. As a result, we 

believe that a 30-day comment period 

provides a meaningful opportunity for 

the public to comment on our proposals 

for the temporary certification program 


erowe on DSK5CLS3C1PROD with PROPOSALS2
11334 Federal Register / Vol. 75, No. 46 / Wednesday, March 10, 2010 / Proposed Rules 

and that it will allow ONC to 

thoughtfully consider comments before 

issuing a timely final rule to implement 

the temporary certification program. In 

light of the common proposals we have 

made for certain parts of the temporary 

and permanent certification programs, 

we anticipate considering all comments 

made on this proposed rule when we 

finalize the permanent certification 

program’s final rule. 

We have proposed a temporary 

certification program based on our 

estimates that it would take too long to 

establish some of the elements included 

in our proposed permanent certification 

program. For example, these elements 

include approximately 6–9 months for 

the establishment of the accreditation 

processes for both testing laboratories by 

NVLAP and certification bodies by an 

ONC–AA as well as the time following 

for organizations to gain their 

accreditation and then subsequently 

apply to the National Coordinator for 

ONC–ACB status. Given our goal to 

assure availability of Certified EHR 

Technology prior to the beginning of 

meaningful use Stage 1, we believe that 

the establishment of a temporary 

certification program is a pragmatic and 

prudent approach to take. Additionally, 

we believe that a temporary certification 

program is necessary because even 

assuming the National Coordinator 

receives applications from organizations 

seeking to become ONC–ATCBs under 

the temporary certification program on 

the first possible day they can apply, we 

efficiently process the applications, and 

ultimately authorize one or more 

organizations, it is likely that ONC– 

ATCBs will not exist until May or June 

2010. It will also take ONC–ATCBs time 

to process requests for testing and 

certification under the temporary 

certification program. 

ii. Urgency of Establishing the 

Temporary Certification Program 

As we have discussed, the HITECH 

Act provides that eligible professionals 

and eligible hospitals must demonstrate 

meaningful use of Certified EHR 

Technology in order to receive incentive 

payments under the Medicare and 

Medicaid EHR Incentive Programs. 

This rule proposes the creation of a 

temporary certification program, in 

addition to a permanent certification 

program, under which Complete EHRs 

and EHR Modules could be tested and 

certified, and subsequently adopted and 

implemented by eligible professionals 

and eligible hospitals in order to 

attempt to qualify for incentive 

payments under meaningful use Stage 1. 

Establishing the temporary certification 

program in a timely fashion is critical to 

begin enabling eligible professionals 

and eligible hospitals to achieve 

meaningful use within the required 

timeframes. For this goal to be 

accomplished both the HIT industry and 

the Department will have to achieve 

several milestones before Complete 

EHRs and EHR Modules can be tested 

and certified. After the close of the 

public comment period for the proposed 

temporary certification program, ONC 

will review and consider timely 

submitted public comments and then 

draft and publish the temporary 

certification program’s final rule. The 

HIT industry will then need to respond. 

Organizations seeking to apply for 

ONC–ATCB status will submit their 

applications, the National Coordinator 

will then review and assess them, and 

if necessary, seek additional information 

through the established process. Once 

the National Coordinator has authorized 

the first ONC–ATCB, the testing and 

certification of Complete EHRs and EHR 

Modules will need to take place in 

accordance with the temporary 

certification program provisions. 

To facilitate an immediate launch of 

the ONC–ATCB application review 

process under the temporary 

certification program, we are also 

proposing that the National Coordinator 

accept and hold all applications for 

ONC–ATCB status received prior to the 

final rule effective date. Under the 

Administrative Procedure Act (5 U.S.C. 

553(d)), publication of a substantive 

final rule must occur not less than 30 

days before its effective date, absent 

certain statutory exceptions. In other 

words, a substantive rule cannot become 

effective until 30 days after its 

publication, unless an exception 

applies. We are consequently proposing 

that the National Coordinator simply 

accept and hold all applications for 

ONC–ATCB status that are received 

prior to the temporary certification 

program’s final rule’s effective date, so 

that immediately upon the final rule 

becoming effective, the National 

Coordinator could begin reviewing 

received applications without further 

delay. We request public comment on 

this proposal and the urgency of 

establishing the temporary certification 

program, including how this provision 

might affect the ability of eligible 

professionals and eligible hospitals to 

timely achieve meaningful use Stage 1. 

4. Consultations With NIST 

Section 3001(c)(5) of the PHSA directs 

the National Coordinator to consult with 

the Director of the NIST in the 

development of a certification program 

or programs. Consistent with this 

statutory provision, we have developed 

our proposed certification programs 

with the guidance and cooperation of 

NIST subject matter experts in testing 

and certification. Based on NIST 

recommendations, we believe it is 

appropriate to use the International 

Organization for Standardization (ISO) 

and the International Electrotechnical 

Commission (IEC) ISO/IEC Guide 65, 

ISO/IEC 17025, and ISO/IEC 17011 to 

structure how testing, certification, and 

accreditation are conducted under our 

proposed certification programs. The 

ISO Committee on conformity 

assessment (CASCO) prepared ISO/IEC 

Guide 65, ISO/IEC 17025, and ISO/IEC 

17011 and we believe the use of the 

ISO/IEC guide and standards will help 

ensure that the proposed certification 

programs operate in a manner consistent 

with national and international 

practices for testing and certification. 

Under the temporary certification 

program we propose that applicants for 

ONC–ATCB status will need to 

demonstrate to the National Coordinator 

their conformance to both ISO/IEC 

Guide 65:1996 (Guide 65) and ISO/IEC 

17025:2005 (ISO 17025). Under the 

permanent certification program 

applicants for ONC–ACB status would 

be required to be accredited by an ONC– 

AA for certification which would 

require a demonstration of conformance 

to Guide 65. Guide 65 specifies the 

‘‘general requirements for bodies 

operating product certification systems.’’ 

The certification of products (including 

processes and services) to this standard 

provides assurance that the products 

comply with specified technical and 

business requirements. ISO 17025 is an 

international standard that specifies the 

‘‘general requirements for competence of 

testing and calibration laboratories.’’ 

This standard addresses how testing 

should be performed using standard 

methods, non-standard methods, and 

laboratory-developed methods. We 

believe Guide 65 and ISO 17025 are 

necessary and appropriate for ONC– 

ATCBs to follow under the temporary 

certification program because they 

provide standard procedures and 

requirements for testing and 

certification widely accepted by the 

information technology industry and 

would ensure consistency and 

efficiency in the testing and certification 

procedures ONC–ATCBs would 

perform. 

Under the permanent certification 

program we believe and have proposed 

that an ONC–AA for certification would 

have to conform to ISO/IEC 17011:2004 

(ISO 17011). ISO 17011 is an 

international standard that specifies the 

‘‘general requirements for accreditation 

bodies accrediting conformity 


erowe on DSK5CLS3C1PROD with PROPOSALS2
Federal Register / Vol. 75, No. 46 / Wednesday, March 10, 2010 / Proposed Rules 11335 

1See http://www.epa.gov/watersense/partners/ 

certification.html. 

assessment bodies,’’ such as certification 

bodies. 

The ISO/IEC documents use certain 

terminology that differs from the 

terminology used in this proposed rule. 

We recognize that this proposed rule 

has been drafted to ensure consistency 

with existing regulatory and/or statutory 

terms, whereas the ISO/IEC documents 

were drafted for a different purpose and 

have a broader application to a variety 

of industries. Nevertheless, we intend 

certain terms in Guide 65, ISO 17025, 

and ISO 17011 to have the same 

meaning as related terms in this 

proposed rule. To ensure a consistent 

application of the ISO/IEC documents in 

the context of this proposed rule, we are 

therefore proposing the following 

crosswalk. The indicated terms in the 

documents specified below would have 

the meanings attributed to the related 

terms used in this proposed rule, as 

provided in the following table. 

Terms used in Guide 

65, ISO 17025, and 

ISO 17011 

Terms used in this 

Proposed Rule 

• Bodies operating 

product certification 

systems.

• ONC–ATCB. 

• ONC–ACB. 

• Certification body ... • Testing and certification body. 

• Conformity assessment bodies.• Certification body. 

• Testing and calibration laboratories.• Testing laboratory. 

• Accreditation body • Accreditation organization. 

• ONC–AA. 

• Products ................ • Complete EHRs. 

• EHR Modules. 

• HIT. 

F. Additional Context for Comparing the 

Temporary and Permanent Certification 

Programs 

Rather than proposing the temporary 

and permanent certification programs in 

two separate proposed rules, we have 

proposed them together in this notice of 

proposed rulemaking because we 

believe this approach provides the 

public with a broader context for each 

of the programs and a better opportunity 

to make informed comments. In an 

effort to prevent confusion, though, we 

first discuss our complete set of 

proposals for the temporary certification 

program (section II) and then our 

complete set of proposals for the 

permanent certification program 

(section III). As a result, some of the 

proposals discussed below for both 

proposed certification programs are very 

similar, if not the same, and are 

included twice—in the discussions of 

the temporary certification program and 

the permanent certification program. In 

other cases, there are significant 

differences between our proposals 

underlying the temporary and 

permanent certification programs. 

Before discussing our complete set of 

proposals for the temporary certification 

program and to provide additional 

context for the temporary program, we 

summarize some of the more significant 

differences between the temporary and 

permanent certification programs. 

1. The Distinction Between Testing and 

Certification 

We believe that there is a distinct 

difference between the ‘‘testing’’ and 

‘‘certification’’ of a Complete EHR and/ 

or EHR Module. In this proposed rule, 

‘‘testing’’ is meant to describe the 

process used to determine the degree to 

which a Complete EHR or EHR Module 

can meet specific, predefined, 

measurable, quantitative requirements. 

These results would be able to be 

compared to and evaluated in 

accordance with predefined measures. 

In contrast, ‘‘certification’’ is meant to 

describe the assessment (and 

subsequent assertion) made by an 

organization, once it has analyzed the 

quantitative results rendered from 

testing along with other qualitative 

factors, that a Complete EHR or EHR 

Module has met all of the applicable 

certification criteria adopted by the 

Secretary. Qualitative factors could 

include whether a Complete EHR or 

EHR Module developer has a quality 

management system in place, or 

whether the Complete EHR or EHR 

Module developer has agreed to the 

policies and conditions associated with 

being certified (e.g., proper logo usage). 

Above and beyond testing, the act of 

certification typically promotes 

confidence in the quality of a product 

(and the vendor that produced it), offers 

assurance that the product will perform 

as described, and helps to make it easier 

for consumers to differentiate which 

products have met specific criteria from 

others that have not. 

A fundamental difference between 

testing and certification is that testing is 

intended to result in objective, 

unanalyzed data. In contrast, 

certification is expected to result in an 

overall assessment of the test results, 

consideration of their significance, and 

consideration of other factors to 

determine whether the prerequisites for 

certification have been achieved. The 

following is a simple example to 

illustrate an important difference 

between testing and certification. 

An e-prescribing EHR Module 

developer that seeks to have its EHR 

Module certified would first submit the 

EHR Module to be tested. To 

successfully pass the established testing 

requirements, the e-prescribing EHR 

Module would, among other functions, 

need to transmit an electronic 

prescription using mock patient data 

according to the standards adopted by 

the Secretary. Provided that the eprescribing EHR Module successfully 

passed this test it would next be 

evaluated for certification. Certification 

could require that the EHR Module 

developer agree to a number of 

provisions, including, for example, 

displaying the EHR Module’s version 

and revision number so potential 

purchasers could compare when the 

EHR Module was last updated or 

certified. If the EHR Module developer 

agreed to all of the applicable 

certification requirements and the EHR 

Module achieved a passing test result, 

the e-prescribing EHR Module would be 

certified. In these situations, both the 

EHR Module passing the technical 

requirements tests and the EHR Module 

vendor meeting the other certification 

requirements would be required for the 

EHR Module to achieve certification. 

2. Accreditation 

We have proposed, in the interest of 

expediency and to facilitate timely 

certification of Complete EHRs and EHR 

Modules, that ONC–ATCBs under 

temporary certification program would 

be authorized (and required) to perform 

both the testing and certification of 

Complete EHRs and/or EHR Modules. 

Under the temporary certification 

program, the National Coordinator 

would serve in a role similar to an 

accreditor and would assess an ONC– 

ATCB applicant’s competency to 

perform both testing and certification 

before granting the applicant ONC– 

ATCB status. However, we do not 

believe that this would be an optimal or 

practical approach for the long-term 

because specialized accreditors in the 

private sector are better equipped to 

react effectively and efficiently to 

changes in the HIT market and to more 

rigorously oversee the certification 

bodies they accredit. Moreover, we have 

observed in other industries, such as the 

manufacturing of water-conserving 

products, that testing and certification 

processes are typically handled 

independently and separately.1

Consequently, under the permanent 

certification program, we have proposed 

to shift the accreditation responsibilities 

for testing laboratories and certification 

bodies from the National Coordinator to 

other organizations. As previously 


erowe on DSK5CLS3C1PROD with PROPOSALS2
11336 Federal Register / Vol. 75, No. 46 / Wednesday, March 10, 2010 / Proposed Rules 

2 ‘‘What is the NVLAP’’ http://ts.nist.gov/ 

Standards/upload/What-is-the-NVLAP.pdf. 

mentioned, we understand that it may 

take several months to establish separate 

accreditation programs for testing 

laboratories and certification bodies and 

this factor weighed heavily in our 

decision to propose a temporary 

certification program. We consequently 

believe that the additional time the 

temporary certification program would 

afford the Department and HIT industry 

to develop a HIT-oriented accreditation 

program would greatly assist the HIT 

industry’s transition to the accreditation 

process we have proposed under the 

permanent certification program. 

Under the permanent certification 

program, we propose the use of 

accreditation as a mechanism to ensure 

that organizations that test and certify 

Complete EHRs and/or EHR Modules 

possess the requisite competencies to 

perform such actions with a high degree 

of precision. We believe that the 

proposed accreditation process will also 

introduce rigor, transparency, trust, and 

objectivity to the permanent 

certification program. Additionally, 

accreditation provides an oversight 

mechanism to ensure that testing 

laboratories and certification bodies are 

properly performing their respective 

duties. Consequently, in order for an 

applicant under the permanent 

certification program to become an 

ONC–ACB, we would require that it be 

accredited by an ‘‘ONC-Approved 

Accreditor’’ (ONC–AA) for certification 

in addition to meeting our other 

proposed application requirements. 

Along these lines, we propose a process 

by which accreditation organizations 

can request the National Coordinator’s 

approval to become an ONC–AA. We 

believe this process is necessary because 

we propose several responsibilities for 

an ONC–AA to fulfill in order to ensure 

our programmatic objectives for the 

permanent certification program are 

met. Additionally, an approval process 

for an ONC–AA is necessary in order for 

potential applicants for ONC–ACB 

status to know from whom they can 

request accreditation. 

As we mention above, under the 

permanent certification program, the 

National Coordinator would only 

authorize organizations to engage in 

certification. We emphasize that this is 

not meant to preclude, limit, or in any 

way prevent an organization from also 

performing the testing of Complete 

EHRs and/or EHR Modules. However, in 

order for a single organization (which 

may comprise subsidiaries or 

components) to perform both testing 

and certification under the permanent 

certification program it would need to 

be: (1) Accredited by an ONC–AA and 

subsequently become an ONC–ACB; and 

(2) accredited by the NVLAP. We 

request public comment on whether we 

should give organizations who are ‘‘dual 

accredited’’ and also become an ONC– 

ACB a special designation to indicate to 

the public that such an organization 

would be capable of performing both 

testing and certification under the 

permanent certification program. 

The NVLAP, established by the NIST, 

develops specific laboratory 

accreditation programs (LAPs) for 

testing and calibration laboratories in 

response to legislative or administrative 

actions, requests from government 

agencies or, in special circumstances, 

from private sector entities.2 The 

National Coordinator would make a 

final determination about whether to 

issue a request to NVLAP to develop a 

LAP for testing laboratories after 

considering public comments on our 

proposals for the permanent 

certification program. To ensure that 

ONC–ACBs review test results from 

legitimate and competent testing 

laboratories, we propose that ONC– 

ACBs would only be permitted to certify 

Complete EHRs and/or EHR Modules 

that have been tested by a NVLAPaccredited testing laboratory. 

3. Surveillance 

Under the permanent certification 

program we propose requirements for 

ONC–ACBs related to the surveillance 

of certified Complete EHRs and certified 

EHR Modules. We also propose certain 

requirements relating to surveillance for 

ONC–ATCBs under the temporary 

certification program. However, we 

anticipate that the temporary 

certification program would end close to 

the time an appropriate sample size of 

implemented certified Complete EHRs 

and certified EHR Modules would be 

available for ONC–ATCBs to perform 

ongoing surveillance. As a result of this 

limitation, we have proposed affording 

less weight to surveillance requirement 

compliance as well as less stringent 

requirements for ONC–ATCBs related to 

surveillance in the temporary 

certification program than we have 

proposed for ONC–ACBs under the 

permanent certification program. 

We previously mentioned that we 

would require applicants for ONC–ACB 

status to be accredited by an ONC–AA. 

We propose that an ONC–AA in 

performing accreditation verify a 

certification body’s conformance, at a 

minimum, to Guide 65. As a result, we 

expect that ONC–ACBs will perform 

surveillance in accordance at a 

minimum with Guide 65, which in 

section 13, among other provisions, 

provides that the ‘‘certification body [or 

‘ONC–ACB’] shall periodically evaluate 

the marked [or ‘certified’] products to 

confirm that they continue to conform 

to the [adopted] standards.’’ ONC–ACBs 

consequently would be required to 

evaluate and reevaluate previously 

certified Complete EHRs and/or EHR 

Modules to determine whether the 

Complete EHRs and/or EHR Modules 

they had certified in a controlled 

environment also perform in an 

acceptable, if not the same, manner in 

the field as they had performed when 

they were being certified. We discuss 

our proposals related to surveillance in 

the permanent certification program at 

section III.D.1.c.iii. 

II. Provisions of the Temporary 

Certification Program 

[If you choose to comment on the 

provisions of the temporary certification 

program, please include at the 

beginning of your comment the specific 

section title and any additional 

information to clearly identify the 

proposal about which you are 

commenting. For example, ‘‘Definitions’’ 

or ‘‘Sunset.’’] 

A. Applicability 

This subpart would establish the 

processes that applicants for ONC– 

ATCB status must follow to be granted 

ONC–ATCB status by the National 

Coordinator, the processes the National 

Coordinator would follow when 

assessing applicants and granting ONC– 

ATCB status, and the requirements of 

ONC–ATCBs for testing and certifying 

Complete EHRs and/or EHR Modules in 

accordance with the applicable 

certification criteria adopted by the 

Secretary in subpart C. 

B. Definitions 

1. Definition of Applicant 

We propose that the term applicant 

mean a single organization or a 

consortium of organizations that seeks 

to become an ONC–ATCB by requesting 

and subsequently submitting an 

application for ONC–ATCB status to the 

National Coordinator. 

2. Definition of Day or Days 

We propose that unless otherwise 

explicitly specified, the term day or 

days shall mean a calendar day or 

calendar days. 

3. Definition of ONC–ATCB 

We propose ONC–ATCB to mean an 

organization or a consortium of 

organizations that has applied to and 

been authorized by the National 

Coordinator pursuant to the sections 


erowe on DSK5CLS3C1PROD with PROPOSALS2
Federal Register / Vol. 75, No. 46 / Wednesday, March 10, 2010 / Proposed Rules 11337 

below to perform the testing and 

certification of Complete EHRs and/or 

EHR Modules under the temporary 

certification program. 

C. Correspondence With the National 

Coordinator 

Throughout the following sections, 

we have proposed numerous instances 

where applicants for ONC–ATCB status 

and ONC–ATCBs would have to 

correspond with the National 

Coordinator and vice versa. These 

instances are almost always associated 

with specific timeframes (e.g., the 

amount of days an applicant has to 

respond to a deficient application 

notice, etc.). Additionally, because such 

timeframes either trigger the beginning 

of a review process or the close of a 

response period it is important for there 

to be clear, unambiguous beginnings 

and endings for when such events must 

occur (e.g., receipt of an application). 

Moreover, it is the National 

Coordinator’s preference to use e-mail 

whenever possible to communicate with 

an applicant for ONC–ATCB status or an 

ONC–ATCB. Therefore, we generally 

propose that any communication by the 

National Coordinator would be via email and, where applicable, that we 

would consider the official date of 

receipt of any e-mail between the 

National Coordinator and an applicant 

for ONC–ATCB status or an ONC–ATCB 

to be the day the e-mail was sent, as 

indicated by the e-mail time-stamp. 

Where it is necessary for 

correspondence to take place via regular 

or express mail, we propose to use 

‘‘delivery confirmation’’ documentation 

to establish the official date of receipt. 

D. Temporary Certification Program 

Application Process for ONC–ATCB 

Status 

1. Application for ONC–ATCB Status 

In order to be considered for ONC– 

ATCB status, we propose that an 

applicant must submit an application to 

the National Coordinator. The 

application would be comprised of two 

parts. In order to receive an application, 

an applicant would have to request one 

in writing from the National 

Coordinator (requests would be made to 

the following e-mail address: 

ATCBapplication@hhs.gov). 

a. Types of Applicants 

We propose that single organizations 

and consortia would be eligible to apply 

for ONC–ATCB status under the 

temporary certification program. We 

expect a consortium, for example, 

would be comprised of one organization 

that would serve as a testing laboratory 

and a separate organization that would 

serve as a certification body. When 

viewed as a single applicant, this 

applicant would be able to perform all 

of the required responsibilities of an 

ONC–ATCB under the temporary 

certification program. We support this 

approach and believe that the combined 

expertise of two or more organizations 

could also result in a qualified 

applicant. 

b. Types of ONC–ATCB Authorization 

In order to properly categorize the 

application provided to an applicant, 

we would require applicants to indicate 

the type of testing and certification they 

seek authorization to perform under the 

temporary certification program. We 

propose that applicants must request 

authorization to perform the testing and 

certification of Complete EHRs or solely 

EHR Modules. We would treat a request 

for authorization to perform the testing 

and certification of Complete EHRs to 

encompass a request for authorization to 

perform the testing and certification of 

EHR Modules because, by default, an 

ONC–ATCB authorized to test and 

certify Complete EHRs would be able to 

test and certify all of the certification 

criteria adopted by the Secretary at 45 

CFR part 170, subpart C. Therefore, we 

believe, from a technical perspective, 

that if an ONC–ATCB can test and 

certify a Complete EHR it would also be 

capable of testing and certifying EHR 

Modules. With respect to EHR Modules, 

this does not mean that an ONC–ATCB 

would be expected to determine 

whether one certified EHR Module 

would be able to seamlessly integrate 

with another EHR Module. Again, as 

discussed in the HIT Standards and 

Certification Criteria interim final rule, 

if an eligible professional or eligible 

hospital chooses to use a combination of 

certified EHR Modules to customize 

their HIT to meet the definition of 

Certified EHR Technology, they have 

the responsibility to ensure that the 

certified EHR Modules can properly 

work together. Please note, though, that 

some EHR Modules may be subject to 

certain additional Federal requirements. 

We request public comment on 

whether ONC–ATCBs should also be 

required to test and certify that any EHR 

Module presented by one EHR Module 

developer for testing and certification 

would properly work (i.e., integrate) 

with another EHR Module presented by 

a different EHR Module developer (this 

request for public comment would also 

apply to ONC–ACBs under the 

permanent certification program). 

Additionally, we request public 

comment on whether the National 

Coordinator should permit applicants to 

seek authorization to test and certify 

only Complete EHRs designed for an 

ambulatory setting or, alternatively, 

Complete EHRs designed for an 

inpatient setting. Under our current 

proposal, an applicant seeking 

authorization to perform Complete EHR 

testing and certification would be 

required to test and certify Complete 

EHRs designed for both ambulatory and 

inpatient settings. However, if we were 

to separately authorize Complete EHR 

testing and certification, we see certain 

benefits for the temporary certification 

program as well as some negative 

effects. Among the benefits, this 

approach could create the potential that 

more organizations would apply for 

ONC–ATCB status because fewer 

resources may be needed and could be 

focused on one type of testing and 

certification. Among the negative 

effects, this approach could result in a 

situation in which no ONC–ATCB exists 

to certify one or another type of 

Complete EHR. This would prevent the 

testing and certification of Complete 

EHRs designed for either an ambulatory 

or inpatient setting from being able to be 

tested and certified. 

With respect to EHR Modules, we 

would require applicants to identify the 

type(s) of EHR Module(s) they seek 

authorization to test and certify and 

would restrict any authorization granted 

to only those types of EHR Module(s). 

For example, if an applicant requests 

authorization to test and certify 

electronic prescribing EHR Modules, 

and is subsequently authorized to do so, 

it would not also be authorized to test 

and certify other EHR Modules, such as 

those related to clinical decision 

support. 

c. Application Part One 

We propose that an applicant must 

address the following four sections in 

part one of its application: 

i. Under section one, the applicant 

would be required to provide the 

following general information to, among 

other reasons, ensure that we have 

proper contact information: 

• The name, address, city, State, ZIP 

code, and Web site of the applicant; 

• The name, title, phone number, and 

e-mail of the person who will serve as 

the point of contact for the applicant. 

This person must be legally authorized 

to execute and submit an application on 

behalf of the applicant (we refer to this 

person as an ‘‘authorized 

representative’’). 

ii. Under section two, the applicant 

would be required to provide the 

following information in an effort to 

demonstrate conformance to Guide 65 


erowe on DSK5CLS3C1PROD with PROPOSALS2
11338 Federal Register / Vol. 75, No. 46 / Wednesday, March 10, 2010 / Proposed Rules 

(which specifies the standards for 

operating a certification program): 

• The results of a completed selfaudit to all sections of Guide 65. We 

expect that applicants would complete 

this self-audit to the best of their ability. 

Because the temporary certification 

program will only be in existence for a 

relatively short period of time, we 

recognize that certain limitations exist 

with respect to specific sections of 

Guide 65. In particular, while we expect 

an applicant to address Guide 65 section 

13 (surveillance), we anticipate putting 

relatively little weight on the specific 

responsibilities for ONC–ATCBs related 

to surveillance in the temporary 

certification program; 

• A description of the applicant’s 

management structure according to 

section 4.2 of Guide 65 (Section 4.2 

requires an applicant to provide a 

description of its organization 

including, but not limited to, legal or 

ownership status, decision making 

processes, assurance of objectivity and 

impartiality in order to justify its ability 

to appropriately operate a certification 

program); 

• A copy of the applicant’s quality 

manual that has been developed 

according to section 4.5.3 of Guide 65 

(Section 4.5.3 requires a quality manual 

documenting the organization’s quality 

system, including, but not limited to, 

quality objectives and commitment to 

quality, and associated policies and 

procedures to ensure quality); 

• The applicant’s policies and 

approach to confidentiality according to 

section 4.10 of Guide 65 (Section 4.10 

requires documentation of arrangements 

for safeguarding confidentiality of 

information, consistent with applicable 

laws); 

• The qualifications of each of the 

applicant’s personnel who oversee or 

perform certification according to 

section 5.2 of Guide 65 (Section 5.2 

requires information on the relevant 

qualifications, training, and expertise of 

each staff member involved in the 

certification process to be retained and 

kept up-to-date); 

• A copy of the applicant’s evaluation 

reporting procedures according to 

section 11 of Guide 65 (Section 11 

requires a description of evaluation 

reporting procedures for conformity or 

nonconformity of products with all 

certification requirements, including 

any remedial actions necessary for 

conformity); and 

• A copy of the applicant’s policies 

for use and display of certificates (e.g., 

logos) according to section 14 of Guide 

65 (Section 14 requires evidence of 

policies and procedures for use and 

display of certificates, as appropriate). 

iii. Under section three, the applicant 

would be required to provide the 

following information in an effort to 

demonstrate conformance to ISO 17025 

(which specifies the standards for 

operating a testing program): 

• The results of a completed selfaudit to all sections of ISO 17025; 

• A copy of the applicant’s quality 

system document according to section 

4.2.2 of ISO 17025 (Section 4.2.2 

requires a quality system document to 

describe the management system 

policies related to quality, including a 

quality policy statement covering such 

items as purpose, objectives, and 

commitment to appropriate standards 

and best professional practices); 

• A copy of the applicant’s policies 

and procedures for handling testing 

nonconformities according to section 

4.9.1 of ISO 17025 (Section 4.9.1 

requires a description of policies and 

procedures used to identify, evaluate, 

and correct any nonconformity to 

testing procedures or other 

requirements); and 

• The qualifications of each of the 

applicant’s personnel who oversee or 

perform testing according to section 5.2 

of ISO 17025 (Section 5.2 requires 

personnel competency records on the 

relevant qualifications, training, and 

expertise of each staff member involved 

in performing testing to be retained and 

kept up-to-date). 

iv. Under section four, the applicant 

would be required to submit a properly 

executed agreement that it will adhere 

to the ‘‘Principles of Proper Conduct for 

ONC–ATCBs.’’ The Principles of Proper 

Conduct for ONC–ATCBs would require 

an ONC–ATCB to: 

• Operate its certification program in 

accordance with Guide 65 and its 

testing program in accordance with ISO 

17025. 

• Maintain an effective quality 

management system which addresses all 

requirements of ISO 17025. 

• Attend all mandatory ONC training 

and program update sessions. 

• Maintain a training program that 

includes documented procedures and 

training requirements to ensure its 

personnel are competent to test and 

certify Complete EHRs and/or EHR 

Modules. 

• Use testing tools and procedures 

published by NIST (e.g., published on 

its Web site or through a notice in the 

Federal Register) or functionally 

equivalent testing tools and procedures 

published by another entity for the 

purposes of assessing Complete EHRs 

and/or EHR Modules compliance with 

the certification criteria adopted by the 

Secretary. 

• Report to ONC within 15 days any 

changes that materially affect its: 

Æ Legal, commercial, organizational, 

or ownership status; 

Æ Organization and management, 

including key testing and certification 

personnel; 

Æ Policies or procedures; 

Æ Location; 

Æ Facilities, working environment or 

other resources; 

Æ ONC authorized representative 

(point of contact); or 

Æ Other such matters that may 

otherwise materially affect its ability to 

test and certify Complete EHRs and/or 

EHR Modules. 

• Allow ONC, or its authorized 

agents(s), to periodically observe on site 

(unannounced or scheduled) during 

normal business hours, any testing and/ 

or certification performed to 

demonstrate compliance with the 

requirements of the temporary 

certification program. 

• Provide ONC, no less frequently 

than weekly, a current list of Complete 

EHRs and/or EHR Modules that have 

been tested and certified which 

includes, at a minimum, the vendor 

name (if applicable), the date certified, 

product version, the unique certification 

number or other specific product 

identification, and where applicable, the 

certification criterion or certification 

criteria to which each EHR Module has 

been tested and certified. 

• Retain all records related to the 

testing and certification of Complete 

EHRs and/or EHR Modules for the 

duration of the temporary certification 

program and provide copies of all 

testing and certification records to ONC 

at the sunset of the temporary 

certification program. 

• Promptly refund any and all fees 

received for tests and certifications that 

will not be completed. 

We believe that adherence to these 

principles is necessary because they 

will help protect the integrity of the 

certification program and ensure that an 

applicant is capable of satisfactorily 

carrying out the required duties and 

responsibilities of an ONC–ATCB. 

With respect to the third-to-the last 

principle listed, and in an effort to make 

it easier for eligible professionals and 

eligible hospitals to cross-validate that 

they have in fact adopted Certified EHR 

Technology, the National Coordinator 

intends to make a master ‘‘certified HIT 

products list’’ of all Complete EHRs and 

EHR Modules tested and certified by 

ONC–ATCBs available on the ONC Web 

site. This Web site would be a public 

service and would be a single, aggregate 

source of all the certified product 

information ONC–ATCBs provide to the 


erowe on DSK5CLS3C1PROD with PROPOSALS2
Federal Register / Vol. 75, No. 46 / Wednesday, March 10, 2010 / Proposed Rules 11339 

National Coordinator. The master 

certified HIT products list would also 

represent all of the Complete EHRs and 

EHR Modules that could be used to 

meet the definition of Certified EHR 

Technology. Over time, we anticipate 

adding features to this Web site, which 

could include interactive functions to 

enable eligible professionals and eligible 

hospitals to use to determine whether a 

combination of certified EHR Modules, 

for instance, constitutes Certified EHR 

Technology. 

With respect to the second to the last 

listed principle of proper conduct, 

because we anticipate that the 

temporary certification program will 

sunset in a relatively short period of 

time, we have proposed that all testing 

and certification records created by 

ONC–ATCBs must be retained, at a 

minimum, for the duration of the 

temporary certification program rather 

than proposing a specific preset length 

of time for record retention. Further, we 

propose that when the temporary 

certification program sunsets, all ONC– 

ATCBs would be required to provide to 

the National Coordinator copies of all of 

their testing and certification records. 

We also propose a specific minimum 

time period for record retention in the 

permanent certification program. 

d. Application Part Two 

In part two of the ONC–ATCB 

application process, applicants would 

be required to complete a proficiency 

examination. A proficiency examination 

would be used to assess whether an 

applicant can competently test and 

certify Complete EHRs and/or EHR 

Modules. Because the National 

Coordinator under the temporary 

certification program is performing a 

role similar to an accreditor, we believe 

a proficiency examination is a necessary 

requirement. We propose to create the 

proficiency examination with NIST’s 

assistance and to design it to evaluate an 

applicant’s knowledge and 

understanding of HIT functionality and 

standards and certification criteria, as 

well as their ability to properly test and 

certify Complete EHRs and/or EHR 

Modules. We believe that key personnel 

directly employed by applicants should 

be primarily responsible for completing 

the proficiency examination. Due to the 

topics it will cover, we anticipate that 

several key personnel may be required 

to complete the proposed proficiency 

examination. While we have not 

proposed to prohibit applicants from 

consulting with outside experts to 

complete their application, applicants 

would still need to clearly demonstrate 

in the material they submit to the 

National Coordinator that they will be 

able to competently operate a testing 

and certification program. In reviewing 

applications, the National Coordinator 

would take such assistance into account 

in order to determine whether an 

applicant’s purported competency is not 

artificially inflated by temporarily 

retained outside expertise. 

We propose to include questions in 

each proficiency exam from the 

following three sections. While a 

proficiency examination would address 

each of the sections below, we plan to 

generate a pool of questions from which 

a random selection would be used for an 

individual proficiency examination to 

ensure that no two proficiency 

examinations will be exactly the same. 

We have provided example questions 

for each section, but we do not believe 

that the specific proficiency exam 

questions should be made publicly 

available. The purpose of a proficiency 

examination is for an applicant to prove 

to the National Coordinator at the time 

of application submission that it 

possesses an adequate level of 

knowledge to competently perform the 

testing and certification of Complete 

EHRs and/or EHR Modules. 

Consequently, our rationale for posing 

different questions in each proficiency 

examination is the same as our reason 

for not making the specific proficiency 

examination questions available prior to 

an applicant submitting a satisfactory 

application—we seek to prevent an 

applicant from preparing answers in 

advance, which could inaccurately 

reflect an applicant’s true competency. 

We are proposing that the applicant also 

affirmatively attest that it will not copy, 

retain, disclose, or in any way divulge 

any information from the proficiency 

examination. 

• Section 1—Knowledge Quiz 

This section would require an 

applicant to demonstrate a solid 

understanding of, and technical 

expertise in, Complete EHRs and/or 

EHR Modules. The applicant would be 

required to address the following 

concepts in a quiz format: Basic health 

IT knowledge; familiarity with the 

standards, implementation 

specifications, and certification criteria 

adopted by the Secretary; familiarity 

with test methods associated with the 

certification criteria adopted by the 

Secretary; and ability to determine how 

a test should be performed for a 

particular set of certification criteria. 

An example question for section 1 

would be: Please indicate the 

certification criteria adopted by the 

Secretary that also require compliance 

with specific standards. For each 

certification criterion, indicate its 

purpose and, if applicable, the potential 

alternative standard(s) adopted by the 

Secretary to which a Complete EHR or 

EHR Module could be tested and 

certified. 

• Section 2—Identification of Test 

Tools 

This section would require an 

applicant to demonstrate that it can 

correctly identify and use test tools 

published by ONC for Complete EHRs 

and EHR Modules. The test tools and 

functional testing techniques for the 

certification criteria adopted by the 

Secretary have been or will be 

developed by NIST. We expect that 

these test tools will available prior to, or 

at the same time as the temporary 

certification program’s final rule is 

published. 

An example question for section 2 

would be: Please describe the steps you 

would take to test the capability of a 

Complete EHR or EHR Module to 

generate a patient summary record. 

• Section 3—Proper Use of Test Tools 

and Understanding Test Results 

This section would require an 

applicant to demonstrate that it can 

properly use test tools (e.g., a continuity 

of care document (CCD) validation tool), 

can correctly interpret test results 

generated by test tools, and further 

when using test tools that the test 

results the applicant produces are 

consistent. 

An example question for section 3 

would be: Using the XYZ test tool with 

the following sample data sets, please 

indicate which data sets passed the test, 

which data sets failed because of errors, 

and for those that data sets that resulted 

in a failure discuss why such a failure 

occurred. 

2. Application Review 

An applicant would be permitted to 

submit its application electronically via 

e-mail or on paper, or via regular or 

express mail (we believe that electronic 

applications would be the most 

efficient). We propose that the National 

Coordinator be permitted up to 30 days 

to review an application once it has 

been received (the National Coordinator 

would notify the applicant’s authorized 

representative to acknowledge that the 

application was received). We propose 

to review applications for ONC–ATCB 

status in the order in which they are 

received and to review and rule on an 

application’s parts sequentially (i.e., we 

will first review part one of an 

application and if deficiencies are found 

we will not review part two). We 

propose to notify the applicant if: (1) Its 

entire application was reviewed and 


erowe on DSK5CLS3C1PROD with PROPOSALS2
11340 Federal Register / Vol. 75, No. 46 / Wednesday, March 10, 2010 / Proposed Rules 

found to be satisfactory or; (2) if its 

application was reviewed and 

deficiencies were found in either part 

one or part two of the application. In 

instances where deficiencies have been 

found, we propose to return the entire 

application with the deficiencies 

identified in the applicable part of the 

application. 

a. Satisfactory Application 

Applicants with satisfactory 

applications would be notified of their 

successful achievement of ONC–ATCB 

status and upon receipt of this 

notification would be permitted to 

represent themselves as ‘‘ONC–ATCBs’’ 

and begin testing and certifying 

Complete EHRs and/or EHR Modules, as 

applicable. 

b. Deficient Application Returned and 

Opportunity To Revise 

We propose to formally return an 

application if part one or part two 

contains deficiencies. If we discover 

deficiencies in part one of an 

application, we would not review part 

two until part one is satisfactory. In the 

event that a portion of an applicant’s 

response to its proficiency examination 

is determined to be deficient, the 

National Coordinator may pose an 

equivalent replacement question for an 

applicant to respond to from the 

appropriate question pool. We propose 

that the National Coordinator would 

have the discretion to have an element 

of an application clarified or request 

that an inadvertent error or minor 

omission be corrected. In these cases, 

before issuing a formal deficiency 

notice, we propose that the National 

Coordinator may request such 

information from the applicant’s 

authorized representative as an 

addendum to its application. If the 

applicant fails to provide such 

information to the National Coordinator 

in the timeframe specified by the 

National Coordinator, but no less than 5 

days, the National Coordinator could 

issue a formal deficiency notice. In 

other circumstances, the National 

Coordinator could immediately send a 

formal deficiency notice if it is 

determined that significant deficiencies 

exist which cannot be addressed by a 

clarification or correction of a minor 

omission. A formal deficiency notice 

would be sent to the applicant’s 

authorized representative and would 

include all deficiencies related to a part 

of an application requiring correction. If 

the National Coordinator issues a formal 

deficiency notice, we propose to permit 

an applicant one opportunity per 

application part to revise the relevant 

application part in response and that a 

revised application part must be 

received by the National Coordinator 

within 15 days of the applicant’s receipt 

of a formal deficiency notice. If an 

applicant receives a formal deficiency 

notice related to part one of its 

application, because we have noted that 

part two would not have been reviewed, 

the applicant would be free to revise 

part two at the same time it is revising 

part one and resubmit an entirely 

updated application. 

We propose that the National 

Coordinator be permitted up to 15 days 

to review a revised application once it 

has been received. If, upon a second 

review of the application, the National 

Coordinator determines that the revised 

application still contains deficiencies, 

the applicant will be issued a denial 

notice stating that it will no longer be 

considered for ONC–ATCB status under 

the temporary certification program. We 

propose to permit applicants to request 

that the National Coordinator reconsider 

this decision only when the applicant 

can demonstrate that clear, factual 

errors were made in the review of its 

application and that the errors’ 

correction could lead to the applicant 

receiving ONC–ATCB status. Requests 

for reconsideration of revised 

applications will be conducted 

according to the process described in 

the next section. We seek public 

comment on whether there are other 

instances in which the National 

Coordinator should reconsider an 

application that has been deemed 

deficient multiple times. 

We also request public comment on 

whether it would be preferable for 

applicants to have their entire 

application reviewed all at once and 

then issued a formal deficiency notice 

or whether we should, as proposed, 

review applications in parts. While the 

former may seem more efficient for an 

applicant, the latter would potentially 

be more efficient overall because the 

National Coordinator would be able to 

notify an applicant about deficiencies 

earlier as well as spend less time and 

resources reviewing an application that 

may need significant corrections. 

3. ONC–ATCB Application 

Reconsideration Requests 

We propose that an applicant for 

ONC–ATCB status who has had part 1 

or part 2 of its application returned 

twice because of deficiencies and has 

subsequently received a denial notice 

would be able to request that the 

National Coordinator reconsider this 

determination. For applicants, this 

would be at most a formal third and 

final opportunity (per application part) 

to continue their pursuit of ONC–ATCB 

status. While we believe the following 

would be highly unlikely, it is possible 

that an applicant’s request for 

reconsideration of part 2 of their 

application could constitute their sixth 

formal opportunity (i.e., three 

opportunities for part 1 and two prior 

opportunities for part 2 before the 

reconsideration request) to continue 

their pursuit of ONC–ATCB status. 

Again, per our request for public 

comment above, if we were to change 

our approach to reviewing applications 

for ONC–ATCB status, the amount of 

formal opportunities to revise an 

application would be reduced. 

As previously discussed, we would 

only permit applicants to request the 

National Coordinator to reconsider a 

deficient application when the 

applicant could demonstrate that clear, 

factual errors were made in the review 

of its application and that the errors’ 

correction could lead to the applicant 

receiving ONC–ATCB status. 

In order to make a reconsideration 

request, an applicant would be required 

to submit to the National Coordinator, 

within 15 days of receipt of a denial 

notice, a written statement (preferably 

via e-mail) contesting the decision and 

explaining what factual errors it 

believes can account for the denial. An 

applicant would be required to include 

sufficient documentation to support its 

explanation. If the applicant does not 

file the reconsideration request within 

the specified timeframe, the National 

Coordinator could reject the 

reconsideration request. 

Upon receipt of the reconsideration 

request, the National Coordinator would 

be permitted up to 15 days to review the 

information submitted by the applicant. 

If, based on the documentation 

submitted, the National Coordinator 

determines that when the application 

was reviewed a clear factual error(s) was 

made and that correction of the error(s) 

would lead to the applicant receiving 

ONC–ATCB status, the National 

Coordinator would notify the 

applicant’s authorized representative 

that such an error occurred and that its 

application would continue to be 

processed. If the National Coordinator 

determined that a clear factual error(s) 

was made in part 1 of an application 

and that correction of the error(s) would 

lead to a satisfactory submission for part 

1 of an application, the National 

Coordinator would subsequently review 

part 2 of the application. If the National 

Coordinator determined that a clear 

factual error(s) was made in part 2 of an 

application and that correction of the 

error(s) would lead to a completely 

satisfactory application, the applicant’s 

authorized representative would be 


erowe on DSK5CLS3C1PROD with PROPOSALS2
Federal Register / Vol. 75, No. 46 / Wednesday, March 10, 2010 / Proposed Rules 11341 

notified that the applicant successfully 

achieved ONC–ATCB status. If, 

however, after reviewing an applicant’s 

reconsideration request the National 

Coordinator determines that the 

applicant did not provide sufficient 

evidence in its explanation to identify 

the factual error or errors that were 

made during the review of its 

application, the National Coordinator 

could reject the applicant’s 

reconsideration request. 

4. ONC–ATCB Status 

a. Acknowledgement and 

Representation 

We propose to make publicly 

available at http://healthit.hhs.gov the 

name of each ONC–ATCB, the date each 

ONC–ATCB was authorized by the 

National Coordinator, and the type(s) of 

testing and certification each ONC– 

ATCB is authorized to perform. Further, 

to prevent an ONC–ATCB from 

misrepresenting the scope of its 

authorization, we propose that an ONC– 

ATCB must prominently and 

unambiguously identify on its Web site 

and in all marketing and 

communications statements (written 

and oral) the scope of its authorization 

(e.g., the HIT Certification Group is an 

ONC–ATCB for e-prescribing EHR 

Modules). 

b. Expiration of Status Under the 

Temporary Certification Program 

As previously mentioned, we expect 

to publish a final rule for the permanent 

certification program within a few 

months of publishing the temporary 

certification program’s final rule. When 

this occurs, we would immediately 

begin to implement the permanent 

certification program’s final provisions 

with the goal of having ONC–ACBs 

authorized under the permanent 

certification program by or before the 

beginning of calendar year 2012 in order 

to coincide with the certification 

activities that would need to take place 

in the coming months for meaningful 

use Stage 2. We believe it will take 

between 8 to 16 months to implement 

the permanent certification program, 

and therefore, we expect ONC–ATCBs 

under the temporary certification 

program would only be responsible for 

testing and certifying Complete EHRs 

and/or EHR Modules to the certification 

criteria adopted by the Secretary that are 

applicable to meaningful use Stage 1. 

Moreover, we will be working to assure 

that ONC–ACBs authorized under the 

permanent certification program will be 

in place with sufficient time to certify 

Complete EHRs and EHR Modules to the 

certification criteria adopted by the 

Secretary that are applicable to 

meaningful use Stage 2. However, if the 

transition to the permanent certification 

program occurs prior to the end of 2011, 

it is possible that a small percentage of 

late or new-to-market Complete EHRs 

and/or EHR Modules developed to meet 

the certification criteria associated with 

meaningful use Stage 1 may wind up 

being tested and certified according to 

the policies established in the 

permanent certification program. 

Because the temporary certification 

program would be operational only for 

a short period of time (less than 2 years), 

we do not believe that it is necessary to 

require an ONC–ATCB to renew their 

‘‘authorized status’’ under the temporary 

certification program. As a result, we 

have not proposed a renewal 

requirement for ONC–ATCB status. All 

ONC–ATCBs would maintain their 

status (unless revoked) until the 

temporary certification program sunsets 

(see section II.F). The chart below 

illustrates the anticipated operational 

periods (denoted by quarters within 

each calendar year) for the temporary 

and permanent certification programs, 

along with the respective proposed 

meaningful use Stage 1 and 2 beginning 

points for eligible hospitals (Q4) and 

eligible professionals (Q1). 

E. ONC–ATCB Performance of Testing 

and Certification and Maintaining Good 

Standing as an ONC–ATCB 

1. Authorization To Test and Certify 

Complete EHRs 

We propose that authorization to test 

and certify Complete EHRs under the 

temporary certification program would 

require an ONC–ATCB to be capable of 

performing ‘‘complete’’ testing and 

certification. Complete testing and 

certification would result in the ONC– 

ATCB testing and certifying Complete 

EHRs to all applicable certification 

criteria adopted by the Secretary. For 

example, the certification criteria 

applicable to Complete EHRs that 

eligible professionals would adopt 

would need to be tested and certified to 

all of the certification criteria at 45 CFR 

170.302 and 45 CFR 170.304. 

2. Authorization To Test and Certify 

EHR Modules 

We propose that authorization to test 

and certify EHR Modules under the 

temporary certification program would 

require an ONC–ATCB to do so in 

accordance with the applicable 

certification criterion or certification 

criteria adopted by the Secretary. 

Furthermore, because an EHR Module, 

once certified, can be used in 

combination with other certified EHR 

Modules to meet the definition of 

Certified EHR Technology, we propose 

that an ONC–ATCB authorized to test 

and certify EHR Modules would be 

required to clearly indicate the 

certification criterion or certification 

criteria to which an EHR Module has 

been tested and certified. We believe 

this requirement would benefit potential 

adopters of certified EHR Modules and 

make it easier for them to determine the 

full capabilities that a combination of 

certified EHR Modules includes. To 

benefit potential adopters of certified 

EHR Modules, we would also expect 

EHR Module developers to clearly 

indicate the certification criterion or 

certification criteria to which an EHR 

Module they have developed has been 

tested and certified. 

a. Certification Criterion Scope 

As specified at 45 CFR 170.102, the 

definition of EHR Module means ‘‘any 

service, component, or combination 

thereof that can meet the requirements 

of at least one certification criterion 

adopted by the Secretary.’’ In some 

cases, the certification criteria specified 

at 45 CFR 170.302, 45 CFR 170.304, and 

45 CFR 170.306 simply reference a 

criterion at the first paragraph level, for 

example, 45 CFR 170.302, paragraph 

‘‘(f)’’ states, ‘‘Smoking Status. Enable a 

user to electronically record, modify, 

and retrieve the smoking status of a 

patient. Smoking status types must 


erowe on DSK5CLS3C1PROD with PROPOSALS2EP10MR10.036</GPH>
11342 Federal Register / Vol. 75, No. 46 / Wednesday, March 10, 2010 / Proposed Rules 

include: current smoker, former smoker, 

or never smoked.’’ In other cases, for 

example, a certification criterion like 

‘‘Drug-Drug, Drug-Allergy, DrugFormulary Checks’’ at 45 CFR 170.302 

paragraph ‘‘(a)’’ includes a second level 

‘‘(1)’’ through ‘‘(4)’’ which articulate 

partial aspects of a single, complete 

capability. For the purposes of testing 

and certifying an EHR Module, we 

therefore interpret ‘‘one certification 

criterion’’ in the definition of EHR 

Module to mean the entirety of the 

capabilities encompassed by what is 

specified at the first paragraph level. 

b. When Privacy and Security 

Certification Criteria Apply to EHR 

Modules 

We believe that EHR Modules hold 

great promise with respect to 

innovation. However, we also recognize 

that the potential innovative benefits 

EHR Modules can provide will be 

significantly compromised if these same 

EHR Modules do not include 

appropriate privacy and security 

safeguards to instill trust. 

EHR Modules can come in many 

forms and can provide a large set of 

capabilities or a single capability. This 

variability, which promotes innovation, 

also poses several challenges to 

determining when it is appropriate to 

require EHR Modules be tested and 

certified to the privacy and security 

certification criteria adopted by the 

Secretary (45 CFR 170.302(o) through 

(v)). Our goal for determining when this 

should occur is two-fold: (1) Assure 

eligible professionals and eligible 

hospitals that EHR Modules will not 

negatively affect how Certified EHR 

Technology in its entirety protects 

electronic health information; and (2) 

appropriately require (or not require) 

the testing and certification of EHR 

Modules to privacy and security 

certification criteria. 

In the context of EHR Modules and 

testing and certification, it is important 

to keep in mind that we are discussing 

a point before ‘‘implementation’’ in the 

HIT lifecycle. Accordingly, ONC– 

ATCBs will test and certify EHR 

Modules independent of, and 

disassociated from, their potential 

operating environments. Below, we 

identify several challenges to 

determining when an ONC–ATCB 

should be required to test and certify 

EHR Modules to the privacy and 

security certification criteria adopted by 

the Secretary. After discussing these 

challenges, we propose, and request 

public comment on a potential approach 

that establishes when ONC–ATCBs 

should be required to test and certify 

EHR Modules to the privacy and 

security certification criteria adopted by 

the Secretary in addition to the 

capability or capabilities the EHR 

Module may be specifically designed to 

provide. 

One challenge with respect to 

determining when EHR Modules should 

be tested and certified to the privacy 

and security certification criteria 

adopted by the Secretary occurs when 

EHR Modules operate in an 

environment separate from other EHR 

Modules—when they are so-to-speak 

‘‘autonomous.’’ For example, an eprescribing EHR Module or a patient 

portal EHR Module provided by an 

application service provider (ASP) 

could be hosted and maintained by the 

ASP (not by the end-user). In these 

cases, an end-user (e.g., eligible 

professional) may be unable to control 

or specify the level or amount of privacy 

and security safeguards associated with 

the health information stored, modified, 

or transmitted by the EHR Module. We 

believe that it would be irresponsible 

and potentially dangerous to permit 

such EHR Modules to be tested and 

certified solely to their specific 

capability, and not to the privacy and 

security certification criteria adopted by 

the Secretary. 

On the flipside, a second challenge 

relates to EHR Modules that, by design, 

may provide specific capabilities which 

make it technically infeasible to require 

that they separately meet the privacy 

and security certification criteria 

adopted by the Secretary. One example 

could be a medication reconciliation 

EHR Module which, from a technical 

perspective, would be designed to 

function ‘‘behind the scenes’’ as part of 

the internal workings of Certified EHR 

Technology. In all likelihood, it would 

therefore depend on another EHR 

Module’s or EHR Modules’ privacy and 

security capabilities. In this example, 

we believe that it would be technically 

infeasible for the medication 

reconciliation EHR Module to have its 

own authentication capability because, 

in all likelihood, an end-user would 

have had to have been authenticated 

prior to gaining access to the medication 

reconciliation EHR Module. Conversely, 

while it is unlikely that the medication 

reconciliation EHR Module would 

retain or store health information, other 

EHR Modules might, and it may be 

appropriate to require such EHR 

Modules to be tested and certified to 

some or all of the privacy and security 

certification criteria adopted by the 

Secretary. 

Because of the context specific nature 

of EHR Modules, and the fact that we 

expect them to provide many different 

capabilities, it is difficult to establish 

with absolute certainty an approach that 

will work for all EHR Modules. 

However, we believe that an appropriate 

starting point for such an approach 

should focus first on protecting 

individuals’ health information and 

then on whether there exist appropriate 

exceptions to the approach that would 

exempt EHR Modules from the 

requirement to be tested and certified to 

adopted privacy and security 

certification criteria. As a result, we 

propose that ONC–ATCBs would be 

required to test and certify all EHR 

Modules to the privacy and security 

certification criteria adopted by the 

Secretary unless the EHR Modules is/are 

presented for testing and certification in 

one of the following manners: 

• The EHR Module(s) are presented 

for testing and certification as a precoordinated, integrated ‘‘bundle’’ of EHR 

Modules, which could otherwise 

constitute a Complete EHR. In such 

instances, the EHR Module(s) would be 

tested and certified in the same manner 

as a Complete EHR. Because the bundle 

of EHR Modules would constitute a 

single, integrated product, we believe 

that it would be unnecessary in such 

cases to require each EHR Module to be 

tested and certified independently to 

privacy and security certification 

criteria. We propose one variation to 

this exception for pre-coordinated 

bundles of EHR Modules which include 

EHR Module(s) that would not be part 

of an eligible professional or eligible 

hospital’s local system and under its 

direct control (e.g., a patient portal EHR 

Module that is not hosted and 

maintained). In these situations, the 

constituent EHR Modules of such an 

integrated bundle would need to be 

separately tested and certified to all 

privacy and security certification 

criteria; 

• An EHR Module is presented for 

testing and certification, and the 

presenter can demonstrate to the ONC– 

ATCB that it would be technically 

infeasible for the EHR Module to be 

tested and certified in accordance with 

some or all of the privacy and security 

certification criteria. For example, we 

believe that it would be technically 

infeasible for an EHR Module that does 

not store even temporarily, or maintain 

any health information to be required to 

include a capability to encrypt health 

information at rest or include an audit 

log. Alternatively, it would presumably 

be technically infeasible for an EHR 

Module that does not provide a 

capability for exchange to be required to 

include the capabilities to encrypt 

health information for exchange or 

account for treatment, payment, or 

health care operations disclosures; or 


erowe on DSK5CLS3C1PROD with PROPOSALS2
Federal Register / Vol. 75, No. 46 / Wednesday, March 10, 2010 / Proposed Rules 11343 

• An EHR Module is presented for 

testing and certification, and the 

presenter can demonstrate to the ONC– 

ATCB that the EHR Module is designed 

to perform a specific privacy and 

security capability. In such instances, 

we do not believe that it should be 

tested and certified to the other privacy 

and security certification criteria 

adopted by the Secretary. For example, 

an encryption EHR Module would not 

be required to be tested and certified as 

also including the capability to 

terminate an electronic session after a 

predetermined time of inactivity. 

We believe that the approach we have 

articulated above provides an 

appropriate framework for determining 

when ONC–ATCBs would be required 

to test and certify EHR Modules to the 

privacy and security certification 

criteria adopted by the Secretary. We 

request public comment on whether 

there are additional alternatives to the 

ones proposed above and other 

circumstances where an EHR Module 

should be tested and certified to none, 

some, or all of the privacy and security 

certification criterion adopted by the 

Secretary. 

3. Authorized Testing and Certification 

Methods 

We propose that in being authorized 

to test and certify Complete EHRs and/ 

or EHR Modules, ONC–ATCBs must 

have the capacity to test and certify 

Complete EHRs and/or EHR Modules at 

their facility. We propose further that an 

ONC–ATCB must also have the capacity 

to test and certify Complete EHRs and/ 

or EHR Modules through some 

secondary means or at a secondary 

location. Such secondary methods 

would include testing and certification: 

(1) At the site (i.e., physical location) 

where a Complete EHR or EHR Module 

has been developed (e.g., at a Complete 

EHR developer’s facility); or (2) at the 

site (i.e., physical location) where the 

Complete EHR or EHR Module resides 

(e.g., at a hospital where the HIT has 

been installed); or (3) remotely (i.e., 

through other means, such as through 

secure electronic transmissions and 

automated Web-based tools, or at a 

location other than the ONC–ATCB’s 

facilities). We believe that these 

secondary testing and certification 

methods will better accommodate selfdeveloped Complete EHRs and EHR 

Modules. For example, a Complete EHR 

developer may submit a Complete EHR 

to an ONC–ATCB to be tested and 

certified at the ONC–ATCB’s facility. In 

other cases, it may not be practicable for 

a hospital with a self-developed 

Complete EHR to submit its Complete 

EHR to an ONC–ATCB for testing and 

certification at the ONC–ATCBs facility 

and, in these cases, we expect that 

ONC–ATCBs would either test and 

certify the hospital’s Complete EHR at 

the hospital where the Complete EHR 

resides or remotely through other means 

that do not require the ONC–ATCB to be 

physically present at the hospital. We 

expect that the most common form of 

remote testing and certification will 

employ the use of automated programs 

that can be accessed by the hospital via 

the Internet to demonstrate to the ONC– 

ATCB that its Complete EHR meets all 

applicable certification criteria adopted 

by the Secretary. Other forms of remote 

testing and certification may include an 

employee of the ONC–ATCB walking 

through a particular scripted scenario 

with predefined data that the hospital 

would have to ‘‘plug-in’’ to their 

Complete EHR and then convey the 

result (e.g., the hospital would be asked 

to enter fabricated information on a 

group of ‘‘test’’ patients into its Complete 

EHR and provide responses to specific 

questions asked by the ONC–ATCB 

employee). We request public comment 

on whether an ONC–ATCB should be 

required to perform any of the 

secondary methods discussed above in 

addition to testing and certifying 

Complete EHRs and/or EHR Modules at 

its facility. 

Our proposals do not preclude 

eligible professionals and eligible 

hospitals who have already adopted and 

implemented HIT that they believe 

meets the definition of Certified EHR 

Technology from seeking to have such 

HIT tested and certified themselves. 

Rather than relying on the vendor(s) that 

supplied their HIT to them to apply for 

testing and certification, eligible 

professionals and eligible hospitals 

could go directly to an ONC–ATCB to 

get their HIT tested and certified. 

However, eligible professionals and 

eligible hospitals should keep in mind 

that they alone would bear the full costs 

of testing and certification if they went 

directly to an ONC–ATCB. 

4. The Testing and Certification of 

‘‘Minimum Standards’’ 

In the HIT Standards and Certification 

Criteria interim final rule (75 FR 2014), 

we explained how we would approach 

the testing and certification of Complete 

EHRs and EHR Modules for certain 

vocabulary code set standards. Our 

approach included the establishment of 

these standards as ‘‘minimum 

standards.’’ Adopting a particular 

version of the code set as a ‘‘minimum’’ 

permits a Complete EHR and/or EHR 

Module to be tested and certified to a 

permitted newer version of an adopted 

code set without the need for additional 

rulemaking on the part of the Secretary. 

For example, on the day the HIT 

Standards and Certification Criteria 

interim final rule was put on display by 

the Federal Register for public 

inspection a new version (version 2.29) 

of Logical Observation Identifiers 

Names and Codes (LOINC®) was 

released. In that regard, we stated the 

following in the HIT Standards and 

Certification Criteria interim final rule: 

[W]e understand that certain types of 

standards, specifically code sets, must be 

maintained and frequently updated to serve 

their intended purpose effectively * * * To 

address this need and accommodate industry 

practice, we have in this interim final rule 

indicated that certain types of standards will 

be considered a floor for certification. We 

have implemented this approach by 

preceding references to specific adopted 

standards with the phrase, ‘‘at a minimum.’’ 

In those instances, the certification criterion 

requires compliance with the version of the 

code set that has been adopted through 

incorporation by reference, or any 

subsequently released version of the code set. 

This approach will permit Complete EHRs 

and EHR Modules to be tested and certified, 

to, ‘‘at a minimum,’’ the version of the 

standard that has been adopted or a more 

current or subsequently released version. 

This will also enable Certified EHR 

Technology to be updated from an older, 

‘‘minimum,’’ adopted version of a code set to 

a more current version without adversely 

affecting Certified EHR Technology’s 

‘‘certified status.’’ We intend to elaborate in 

the upcoming HIT Certification Programs 

proposed rule on how testing and 

certification would be conducted using 

standards we have adopted and designated as 

‘‘minimums’’ in certain certification criteria. 

That being said, we understand that this 

approach has certain limitations. In some 

cases, for instance, rather than simply 

maintaining, correcting, or slightly revising a 

code set, a code set maintaining organization 

will modify the structure or framework of a 

code set to meet developing industry needs. 

We would consider this type of significant 

revision to a code set to be a ‘‘modification,’’ 

rather than maintenance or a minor update 

of the code set. An example of a code set 

‘‘modification’’ would be if a hypothetical 

XYZ code set version 1 were to use 7-digit 

numeric codes to represent health 

information while XYZ code set version 2 

used 9-digit alphanumeric codes to represent 

health information. In such cases, 

interoperability would likely be reduced 

among Complete EHRs and EHR Modules 

that have adopted different versions of the 

structurally divergent code sets. If a code set 

that we have adopted through incorporation 

by reference is modified significantly, we 

will update the incorporation by reference of 

the adopted version with the more recent 

version of the code set prior to requiring or 

permitting certification according to the 

newer version. 

At the end of this discussion we 

provided examples of when a standard 

would be considered a ‘‘minimum 


erowe on DSK5CLS3C1PROD with PROPOSALS2
11344 Federal Register / Vol. 75, No. 46 / Wednesday, March 10, 2010 / Proposed Rules 

standard’’ and the limitation to our 

approach. To address the identified 

limitation, we propose to clarify when 

a newer version of an adopted 

‘‘minimum standard’’ code set would be 

permitted for use in testing and 

certification and when it would not. We 

believe that there are two prevailing 

methods the Secretary could use to 

determine whether a significant revision 

to a code set represents a ‘‘modification, 

rather than maintenance or a minor 

update of the code set’’ and, 

consequently, when a code set version 

should not be permitted for testing and 

certification above the minimum 

adopted by the Secretary until 

additional public comment can be 

obtained. 

The first method would allow for any 

member of the general public to notify 

the National Coordinator about a new 

version of an identified ‘‘minimum 

standard’’ code set. For this method, we 

would encourage the person or entity 

who submits a notification to the 

National Coordinator to include any 

relevant information the National 

Coordinator would need to correctly 

identify the ‘‘minimum standard’’ code 

set (e.g., name and version) and any 

additional information that the National 

Coordinator could use to determine 

whether the new version constitutes 

general maintenance or minor updates, 

or a significant revision or modification. 

Upon receipt of these notifications and 

a determination by the National 

Coordinator that the new version of the 

code set did not represent a significant 

revision or modification, the National 

Coordinator would request the Secretary 

to permit the use of the identified new 

version for testing and certification 

purposes. 

The second method we considered, 

and solicit public comment on, would 

be for the Secretary to proactively 

identify newly published versions of 

adopted minimum standard code sets 

and issue determinations as to whether 

they reflect maintenance efforts or 

minor updates of the adopted code set 

and would be permitted for testing and 

certification. 

For either method above, we propose 

that once the Secretary has granted 

permission for a new version of an 

adopted minimum standard code to be 

used: 

(1) Any ONC–ATCB may test and 

certify Complete EHRs and/or EHR 

Modules according to the new version; 

(2) Certified EHR Technology may be 

upgraded to comply with the new 

version of an adopted minimum 

standard accepted by the Secretary 

without adversely affecting the 

certification status of the Certified EHR 

Technology; and 

(3) ONC–ATCBs would not be 

required to test and certify Complete 

EHRs and/or EHR Modules according to 

the new version until we updated the 

incorporation by reference of the 

adopted version to a newer version. 

For either method, we also propose to 

regularly publish (on quarterly basis) 

either by presenting to the HIT 

Standards Committee or by posting a 

notification on our Web site, any 

Secretarial determinations that have 

been made with respect to ‘‘minimum 

standard’’ code sets. We request public 

comment on whether a quarterly 

publication is an appropriate 

notification interval. We also seek 

public comment on other methods we 

might take to identify acceptable newer 

versions of minimum standard code sets 

in addition to the two methods we have 

discussed. Please note that the two 

methods we have proposed are not 

mutually exclusive and we request 

public comment on whether it would be 

advantageous to pursue both methods. 

5. Maintaining Good Standing as an 

ONC–ATCB; Violations That Could 

Lead to the Revocation of ONC–ATCB 

Status; Revocation of ONC–ATCB Status 

In order to maintain good standing as 

an ONC–ATCB, we propose that an 

ONC–ATCB would have to abide by the 

Principles of Proper Conduct for ONC– 

ATCBs. In addition, we expect that an 

ONC–ATCB would follow other Federal 

and State laws to which it is subject and 

refrain from engaging in other types of 

inappropriate behavior. 

Further, we propose that the National 

Coordinator would be capable of 

revoking an ONC–ATCB’s status under 

the temporary certification program 

when either of two types of violations 

occurs. We describe these violations and 

the revocation process below. 

a. Type-1 Violations 

Type-1 violations would include 

violations of law or temporary 

certification program policies that 

threaten or significantly undermine the 

integrity of the temporary certification 

program. Type-1 violations would 

include, but are not limited to, false, 

fraudulent, or abusive activities that 

affect: The temporary certification 

program; a program administered by 

HHS; or any program administered by 

the Federal government. These 

violations could jeopardize the integrity 

of the temporary certification program 

and would include examples such as, 

the ONC–ATCB or a principal 

employee, owner, or agent of an ONC– 

ATCB being convicted of fraud, 

embezzlement or extortion or of 

violating a similar Federal or State 

securities laws while participating in 

the temporary certification program, 

falsifying or manipulating test results 

and certifications, or withholding 

information that would indicate false or 

fraudulent activity had occurred within 

the temporary certification program. 

We believe that the National 

Coordinator must ensure that the 

certification program is fair and honest 

and provides users of Certified EHR 

Technology with faith in the integrity of 

the temporary certification program 

(e.g., that Complete EHRs and EHR 

Modules have been properly tested and 

certified). Therefore, if the National 

Coordinator has evidence that an ONC– 

ATCB committed one or more of the 

above-mentioned violations (false, 

fraudulent, and abusive activities) the 

National Coordinator could issue the 

ONC–ATCB a notice proposing to 

revoke its ONC–ATCB status. 

b. Type-2 Violations 

‘‘Type-2’’ violations would include 

inappropriate conduct by an ONC– 

ATCB under the temporary certification 

program. A Type-2 violation would 

include, but not be limited to, the 

failure of an ONC–ATCB to adhere to 

the Principles of Proper Conduct for 

ONC–ATCBs and engaging in other 

types of inappropriate behavior. 

Examples of these types of violations 

include, but are not limited to: failing to 

attend mandatory ONC training 

programs, failing to meet specified 

reporting requirements, misrepresenting 

the scope of its authorization, and an 

ONC–ATCB testing and certifying 

Complete EHRs and/or EHR Modules for 

which it does not have authorization. 

If the National Coordinator obtains 

reliable evidence from fact-gathering, 

requesting information from an ONC– 

ATCB, contacting an ONC–ATCB’s 

customers, witnessing an ONC–ATCB 

perform testing or certification, and/or 

substantiated complaints that an ONC– 

ATCB’s conduct may indicate a failure 

to adhere to the Principles of Proper 

Conduct for ONC–ATCBs or exhibited 

other inappropriate behavior, the 

National Coordinator would notify the 

ONC–ATCB of a possible Type-2 

violation. The notification would 

include all pertinent information 

regarding the National Coordinator’s 

assessment. 

Unless otherwise specified by the 

National Coordinator, an ONC–ATCB 

would be permitted up to 30 days from 

the date it is notified about possible 

Type-2 violation(s) to submit a written 

response and any accompanying 

documentation that could demonstrate 


erowe on DSK5CLS3C1PROD with PROPOSALS2
Federal Register / Vol. 75, No. 46 / Wednesday, March 10, 2010 / Proposed Rules 11345 

no violation(s) occurred or validate that 

violation(s) occurred and were 

corrected. If the ONC–ATCB fails to 

submit a response to the National 

Coordinator within 30 days, the 

National Coordinator could issue the 

ONC–ATCB a notice proposing to 

revoke its ONC–ATCB status. 

If an ONC–ATCB submits a response, 

the National Coordinator would be 

permitted up to 30 days to evaluate the 

ONC–ATCB’s response (and request 

additional information, if necessary). If 

the National Coordinator determines 

that the ONC–ATCB did not commit a 

Type-2 violation, or may have 

committed a Type-2 violation but 

satisfactorily corrected any violation(s) 

that may have occurred, a memo will be 

issued to the ONC–ATCB to confirm 

this determination. If the National 

Coordinator determines that the ONC– 

ATCB’s response is insufficient and that 

a Type-2 violation had occurred and 

had not been adequately corrected, then 

the National Coordinator could propose 

to revoke an ONC–ATCB’s status. 

c. Proposed Revocation 

We propose that the National 

Coordinator could propose the 

revocation of an ONC–ATCB’s status for 

alleged Type-1 violations and for failing 

to respond to, or satisfactorily address, 

a notification related to a Type-2 

violation. 

We request public comment on 

whether the National Coordinator 

should also consider proposing the 

revocation of an ONC–ATCB’s status for 

repeatedly committing Type-2 

violations even if the ONC–ATCB has 

adequately corrected the violations each 

time. We further request comment on 

how many corrected Type-2 violations 

would be sufficient for proposing 

revocation of an ONC–ATCB and to 

what extent the frequency of these 

violations should be a consideration. 

While we have not repeated this request 

for public comment in our discussion of 

the permanent certification program, we 

nevertheless encourage comments 

regarding this option for that program as 

well. 

i. Opportunity To Respond to a 

Proposed Revocation Notice 

We propose that an ONC–ATCB could 

respond to a proposed revocation notice 

within 10 days of receipt of the 

proposed revocation notice in order to 

contest the proposed revocation and 

explain why its status should not be 

revoked. We propose that if an ONC– 

ATCB responds to a revocation notice, 

it must include sufficient 

documentation to support its 

explanation. Upon receipt of an ONC– 

ATCB’s response to a proposed 

revocation notice, the National 

Coordinator would be permitted up to 

30 days to review the information 

submitted by the ONC–ATCB. 

During the time period provided for 

an ONC–ATCB to respond to the 

proposed revocation notice and the 

National Coordinator’s review period, 

we propose to permit the ONC–ATCB to 

continue its operations under the 

temporary certification program. We 

believe this proposal affords the ONC– 

ATCB meaningful due process and 

would minimally impact the temporary 

certification program because we have 

proposed procedures for reaching a 

timely final decision on revocation. We 

welcome comments on this proposal 

and whether it would be more 

appropriate for the National Coordinator 

to immediately suspend an ONC– 

ATCB’s operations for the time between 

the issuance of a proposed revocation 

notice and a final decision on 

revocation. 

If the National Coordinator 

determines that an ONC–ATCB’s status 

should not be revoked, the National 

Coordinator would notify the ONC– 

ATCB’s authorized representative in 

writing to express this determination. 

ii. Revocation of an ONC–ATCB’s Status 

We propose that the National 

Coordinator could revoke an ONC– 

ATCB’s status if it is determined that 

revocation is appropriate after 

considering the information provided by 

the ONC–ATCB in response to the 

proposed revocation notice or if the 

ONC–ATCB does not respond to a 

proposed revocation notice within the 

specified timeframe. 

We propose that a decision to revoke 

an ONC–ATCB’s status would be final 

and would not be subject to further 

review unless the National Coordinator 

chooses to reconsider the revocation. 

d. Extent and Duration of Revocation 

Under the Temporary Certification 

Program 

We propose that the revocation of an 

ONC–ATCB’s status would become 

effective as soon as the ONC–ATCB 

receives the revocation notice. A testing 

and certification body whose ONC– 

ATCB status has been revoked would be 

prohibited from accepting new requests 

for testing and certification and would 

be required to cease its current testing 

and certification operations related to 

Complete EHRs and/or EHR Modules 

(i.e., the National Coordinator’s 

revocation would not apply to other 

testing and certification operations that 

are not within the scope of this rule). 

We would also expect it to issue a 

complete refund to any entity whose 

Complete EHR or EHR Module was 

being tested and certified by the ONC– 

ATCB at the time its status was revoked. 

If a testing and certification body were 

to refuse or fail to issue a complete 

refund(s) upon having its ONC–ATCB 

status revoked, we propose that the 

refusal or failure should be a 

consideration in determining the 

qualifications of a testing and 

certification body if it were to apply at 

a later date to be an ONC–ACB under 

the proposed permanent certification 

program. We welcome comments on 

this proposal, including any potential 

alternatives. 

Once an ONC–ATCB has had its 

status revoked, the testing and 

certification body would be permitted to 

reapply for ONC–ATCB status under the 

temporary certification program and 

apply under our proposed permanent 

certification program unless it had its 

status revoked for a Type-1 violation. 

Type-1 violations would significantly 

undermine the integrity of the 

temporary certification program and we 

do not believe it would be appropriate 

to allow the same testing and 

certification body to reapply for ONC– 

ATCB right away. Further, we believe 

that Type-1 violations could so 

significantly undermine the public’s 

faith in our proposed certification 

programs that we propose to prohibit 

the testing and certification body from 

reapplying for ONC–ATCB status for 1 

year and to count that 1 year prohibition 

towards the ONC–ACB application 

period under the permanent 

certification program if the temporary 

certification program sunsets during this 

time. We request public comment on 

any other alternatives regarding the 

treatment of ‘‘former ONC–ATCBs’’ that 

have had their status revoked. 

We recognize that in instances where 

an ONC–ATCB has had its status 

revoked, some people may call into 

question the legitimacy of the 

certifications issued by the former 

ONC–ATCB. To address this matter, we 

propose that the ‘‘certified status’’ of 

Complete EHRs and/or EHR Modules 

certified by the former ONC–ATCB will 

remain intact unless a Type-1 violation 

was committed that calls into question 

the legitimacy of the certifications 

issued by the former ONC–ATCB. In 

these circumstances, which we believe 

would be extremely rare, we propose 

that the National Coordinator would 

review the facts surrounding the 

revocation of the ONC–ATCB’s status 

and publish a notice on ONC’s Web site 

if the National Coordinator believes that 

Complete EHRs and/or EHR Modules 

were fraudulently certified by a former 


erowe on DSK5CLS3C1PROD with PROPOSALS2
11346 Federal Register / Vol. 75, No. 46 / Wednesday, March 10, 2010 / Proposed Rules 

ONC–ATCB and the certification 

process itself failed to comply with 

regulatory requirements. If the National 

Coordinator determines that Complete 

EHRs and/or EHR Modules were 

improperly certified, we propose that 

the ‘‘certified status’’ of impacted 

Complete EHRs and/or EHR Modules 

would remain intact for 120 days after 

the National Coordinator publishes the 

notice. We believe that 120 days is a 

suitable timeframe for the developers of 

the impacted Complete EHRs and/or 

EHR Modules to get their HIT recertified by an ONC–ATCB in good 

standing. We request public comment 

on our proposed approach and the 

timeframe for re-certification. Although 

highly unlikely, it is important to note 

that if a Complete EHR or EHR Module 

developer whose product was 

improperly certified does not seek to 

remedy this improper certification in 

the timeframe provided that all of the 

end-users (e.g., eligible professionals 

and eligible hospitals) that have adopted 

the Complete EHR or EHR Module 

developer’s product would no longer 

have HIT that meets the definition of 

Certified EHR Technology. 

e. Alternative Considered 

As noted briefly above, another 

alternative approach to the revocation 

process described above (where the 

National Coordinator would issue a 

notice to an ONC–ATCB proposing to 

revoke its status) would be a suspension 

process whereby an ONC–ATCB’s status 

would be suspended if the ONC–ATCB 

is reasonably suspected of having 

committed a Type-1 violation or if the 

ONC–ATCB fails to respond in a timely 

manner to a possible Type-2 violation or 

has not appropriately addressed an 

admitted Type-2 violation. Such a 

process would result in the National 

Coordinator issuing an ONC–ATCB a 

suspension notification. Upon receipt of 

a suspension notification, an ONC– 

ATCB would have to temporarily cease 

testing and certifying Complete EHRs 

and/or EHR Modules. Additionally, 

during the suspension an ONC–ATCB 

would also be prohibited from accepting 

new requests for testing and 

certification. 

If the National Coordinator issues a 

suspension notice to an ONC–ATCB, the 

ONC–ATCB could respond directly to 

the National Coordinator and explain in 

writing why its status should not have 

been suspended. Upon receiving the 

ONC–ATCB’s response, the National 

Coordinator would review the 

information submitted by the ONC– 

ATCB and reply within 7 days. In the 

reply, the National Coordinator could 

extend the suspension for an additional 

14 days to obtain further information, 

terminate the suspension, or propose 

revocation while extending suspension 

during the pendency of the revocation 

process. 

We believe that a suspension process 

is an alternative worth considering 

because it could assist the National 

Coordinator in preventing further 

untoward actions by an ONC–ATCB, 

whereas the process we discuss above 

would permit, albeit presumably for a 

short amount of time, an ONC–ATCB to 

continue to test and certify Complete 

EHRs and/or EHR Modules while 

revocation procedures are underway. 

Therefore, we request public comment 

on whether the National Coordinator 

should also include a process to 

suspend an ONC–ATCB’s status. We 

have not repeated this request for public 

comment in our discussion of the 

permanent certification program, but we 

encourage commenters to consider this 

as an option for that program as well 

and provide comments. 

6. Validity of Complete EHR and EHR 

Module Certification 

In the HIT Standards and Certification 

Criteria interim final rule, we defined 

Certified EHR Technology to mean ‘‘a 

Complete EHR or a combination of EHR 

Modules, each of which: (1) Meets the 

requirements included in the definition 

of a Qualified EHR; and (2) has been 

tested and certified in accordance with 

the certification program established by 

the National Coordinator as having met 

all applicable certification criteria 

adopted by the Secretary.’’ 

Part two of the definition of Certified 

EHR Technology specifies an important 

concept—that in order to meet the 

definition, a tested and certified 

Complete EHR or combination of 

separately tested and certified EHR 

Modules must meet all applicable 

certification criteria adopted by the 

Secretary. Certification represents a 

snapshot, a fixed point in time, where 

it has been confirmed that a Complete 

EHR or EHR Module has met all 

applicable certification criteria adopted 

by the Secretary. From that point 

forward, a specific Complete EHR or 

EHR Module version which has been 

certified would be forever labeled 

‘‘certified.’’ However, as the Department 

adopts new or modified certification 

criteria, previously adopted certification 

criteria would no longer constitute all of 

the applicable certification criteria to 

which a Complete EHR or EHR Module 

would need to be tested and certified. 

As a result, Complete EHRs and EHR 

Modules that had been certified to a 

previously adopted set of certification 

criteria would no longer be considered 

‘‘Certified EHR Technology’’ for 

purposes of enabling an eligible 

professional or eligible hospital to 

attempt to achieve a future stage of 

meaningful use. 

As previously mentioned in both the 

HIT Standards and Certification Criteria 

interim final rule and the Medicare and 

Medicaid EHR Incentive Programs 

proposed rule, we and CMS stated that 

we anticipate that the requirements for 

meaningful use will be adjusted every 

two years. Accordingly, and because the 

HITECH Act requires eligible 

professionals and eligible hospitals to 

use Certified EHR Technology in order 

to qualify for incentive payments, we 

expect that there will continue to be a 

close correlation and connection 

between certification criteria adopted by 

the Secretary and future meaningful use 

objectives (and their associated 

measures). 

In that regard, when a set of objectives 

and measures for a future stage of 

meaningful use has been proposed, we 

anticipate that the Secretary would also 

propose to adopt certification criteria to 

replace, amend, or add to previously 

adopted certification criteria. 

Presumably, those additional or 

modified certification criteria would set 

a new, higher bar for the capabilities 

that Certified EHR Technology would 

need to include and for which eligible 

professionals and eligible hospitals 

would need in order to attempt to 

achieve the next proposed meaningful 

use stage. 

We believe the planned two-year 

schedule for updates to meaningful use 

objectives and measures and correlated 

certification criteria creates a natural 

expiration for the ‘‘certified status’’ of 

Complete EHRs and EHR Modules. 

Accordingly, after the Secretary has 

adopted new or modified certification 

criteria, the validity of the certification 

associated with previously certified 

Complete EHRs and EHR Modules will 

expire and those Complete EHRs and 

EHR Modules would need to be recertified in order for eligible 

professionals and eligible hospitals to 

continue to possess HIT that meets ‘‘all 

applicable certification criteria adopted 

by the Secretary’’ and consequently also 

meets the definition of Certified EHR 

Technology. 

Stated another way, regardless of the 

year and meaningful use stage at which 

an eligible professional or eligible 

hospital enters the Medicare or 

Medicaid EHR Incentive Program, the 

Certified EHR Technology that would be 

used would have to include the 

capabilities necessary to meet the most 

current certification criteria adopted by 

the Secretary at 45 CFR 170 subpart C 


erowe on DSK5CLS3C1PROD with PROPOSALS2
Federal Register / Vol. 75, No. 46 / Wednesday, March 10, 2010 / Proposed Rules 11347 

in order to meet the definition of 

Certified EHR Technology. For example, 

if the Secretary adopts 5 new 

certification criteria in 2012 which 

would be applicable to, and in support 

of, meaningful use Stage 2, an eligible 

professional who implemented Certified 

EHR Technology in 2011 would need to 

ensure that its HIT was upgraded with 

newly certified software or a certified 

EHR Module by 2013 to include the 5 

new capabilities the Secretary adopted 

in the certification criteria in order to 

continue to have HIT that meets the 

definition of Certified EHR Technology 

and could provide the capabilities they 

would need to continue to attempt to 

achieve meaningful use. 

We also want to point out and clarify 

an apparent, yet temporary, 

inconsistency that would occur in 2013 

and 2014 should CMS finalize its 

proposed staggered approach for 

meaningful use stages to provide 

flexible entry points for eligible 

professionals and eligible hospitals (e.g., 

an eligible professional whose first 

payment year is 2013 would start at 

meaningful use Stage 1 in 2013, while 

an eligible professional whose first 

payment year was 2011 would be 

required to meet meaningful use Stage 

2 requirements in 2013). The apparent 

inconsistency pertains to the HIT an 

eligible professional or eligible hospital 

would need to have to meet the 

definition of Certified EHR Technology 

and the meaningful use stage the 

eligible professional or eligible hospital 

would need to meet to qualify for 

incentive payments. As proposed, 

eligible professionals and eligible 

hospitals who seek to have their first 

payment year begin in 2013 or 2014 

would only need to meet meaningful 

use stage 1 requirements; however, the 

Certified EHR Technology they would 

need to use, would need to meet the 

most recent certification criteria 

adopted by the Secretary, which at that 

time would be in support of meaningful 

use stage 2. As a result, should CMS 

finalize its proposed staggered approach 

for meaningful use stages, these eligible 

professionals and eligible hospitals 

would need to use ‘‘meaningful use 

stage 2 Certified EHR Technology’’ even 

though they would only have to meet 

meaningful use stage 1 metrics. 

Should CMS finalize its proposed 

staggered approach for meaningful use 

stages, we recognize that some 

confusion within the HIT industry may 

arise during 2013 and 2014 because of 

this apparent inconsistency and the 

divergent use of the term ‘‘meaningful 

use.’’ We would anticipate, therefore, 

that ONC–ACBs would clearly indicate 

the certification criteria used when 

certifying Complete EHRs and/or EHR 

Modules, and identify certifications 

according to the calendar year and 

month rather than the meaningful use 

stage to reflect the currency of the 

certification criteria against which the 

Complete EHRs and/or EHR Modules 

have been certified. Consequently, if an 

eligible professional or eligible hospital 

were seeking to obtain a certified 

Complete EHR or certified EHR Module 

in 2014, for instance, that eligible 

professional or eligible hospital would 

look for Complete EHRs and EHR 

Modules certified in accordance with 

certification criteria current in 2014, 

rather than Complete EHRs and EHR 

Modules certified as meeting 

certification criteria intended to support 

meaningful use Stage 1, Stage 2, or Stage 

3. We request comments on ways to 

ensure greater clarity in the certification 

of Complete EHRs and EHR Modules. 

We believe this proposed approach 

would benefit eligible professionals and 

eligible hospitals whose first payment 

year is in 2013 because they would 

already have the Certified EHR 

Technology they would need in order to 

meet meaningful use stage 2, which, as 

proposed, would begin for them in the 

following year (2014). Eligible 

professionals and eligible hospitals, 

whose first payment year is 2014, would 

also benefit. They would have adopted 

more advanced HIT and would need to 

be familiar with the additional 

capabilities it provides, because, as 

proposed, they would need to meet 

meaningful use Stage 3 requirements in 

the following year (2015). This approach 

would also assist other HIT users with 

whom eligible professionals and eligible 

hospitals would exchange information 

by ensuring improved interoperability 

among their respective HIT systems. 

We again note that this apparent 

inconsistency would exist only for the 

years 2013 and 2014. By 2015, if as 

proposed by CMS an eligible 

professional or eligible hospital seeks to 

begin participating in the Medicare and 

Medicaid incentive programs, that 

eligible professional or eligible hospital 

would need to implement Complete 

EHRs or EHR Modules certified to 

certification criteria that support 

meaningful use Stage 3 and would have 

to meet meaningful use Stage 3 metrics. 

F. Sunset 

We propose to sunset the temporary 

certification program and the rules that 

govern it when the National Coordinator 

has authorized at least one ONC–ACB 

under the permanent certification 

program. We further propose that on the 

date at which this sunset occurs that 

ONC–ATCBs under the temporary 

certification program will be prohibited 

from accepting new requests to certify 

Complete EHRs and/or EHR Modules. 

That means that ONC–ATCBs will be 

able to review any pending applications 

that they will have received prior to the 

termination date of the temporary 

certification program, and complete the 

certification process for those Complete 

EHRs and EHR Modules. We request 

public comment on whether we should 

establish a set date for the temporary 

program to sunset, such as 12/31/2011, 

instead of date that depends on a 

particular action—the authorization of 

at least one ONC–ACB. A set date would 

provide certainty and create a clear 

termination point for the temporary 

certification program by indicating to 

any ONC–ATCBs and other certification 

bodies that in order to be authorized to 

certify Complete EHRs and/or EHR 

Modules after 12/31/2011, they would 

need to be accredited and reapply to 

become ONC–ACBs. One potential 

downside to a set date would be the 

possibility that it would temporarily 

prevent certifications from being issued 

during the time period it takes potential 

ONC–ACB applicants to get accredited 

and receive their authorizations from 

the National Coordinator. 

III. Provisions of Permanent 

Certification Program 

[If you choose to comment on the 

provisions of the permanent 

certification program, please include at 

the beginning of your comment the 

specific section title and any additional 

information to clearly identify the 

proposal about which you are 

commenting. For example, ‘‘Definitions’’ 

or ‘‘Permanent Certification Program 

Application Process.’’] 

As noted above, we have chosen to 

propose both the temporary and 

permanent certification programs in this 

notice of proposed rulemaking. We 

believe this format offers the public 

significantly more context for our 

proposed policies and expect to receive 

more informed and detailed comments 

on our proposed policies. Similarly, we 

anticipate that some comments will be 

applicable to both certification 

programs. In that regard, we believe that 

this approach also reduces the amount 

of redundancy that would have existed 

had we published two separate 

proposed rules. 

Along those same lines, we have 

proposed that certain aspects of the 

temporary certification program will be 

the same as certain elements of the 

permanent certification program. In 

those cases, to reduce unnecessary, 

duplicative text in this rule, we simply 

identify those proposed elements of 


erowe on DSK5CLS3C1PROD with PROPOSALS2
11348 Federal Register / Vol. 75, No. 46 / Wednesday, March 10, 2010 / Proposed Rules 

both programs that are the same. In all 

other cases, we discuss in greater detail 

those proposals that are unique to the 

permanent certification program. To 

remain consistent with the section 

structure developed above and to 

improve readability and 

comprehension, we have presented our 

proposals for the permanent 

certification program in the same order 

as those presented in the temporary 

certification program. Additionally, in 

our proposals for the permanent 

certification program that crossreference proposed provisions of the 

temporary certification program, all 

references to ONC–ATCBs should be 

substituted with references to ONC– 

ACBs, as appropriate. 

A. Applicability 

This subpart would establish the 

processes an applicant for ONC–ACB 

status must follow to be granted ONC– 

ACB status by the National Coordinator, 

the processes the National Coordinator 

would follow when assessing applicants 

and granting ONC–ACB status, the 

requirements of ONC–ACBs for 

certifying Complete EHRs and/or EHR 

Modules in accordance with the 

applicable certification criteria adopted 

by the Secretary in subpart C. It also 

establishes the processes accreditation 

organizations would follow to request 

approval from the National Coordinator 

and that the National Coordinator in 

turn would follow to approve an 

accreditation organization under the 

permanent certification program as well 

as certain ongoing responsibilities for an 

ONC–AA. 

B. Definitions 

1. Definition of Applicant 

We propose to use the same definition 

of applicant for the permanent 

certification program with the exception 

of replacing ONC–ATCB with ONC– 

ACB. 

2. Definition of Day or Days 

We propose that day or days would 

have the same meaning under the 

permanent certification program as we 

have proposed under the temporary 

certification program. 

3. Definition of ONC-Approved 

Accreditor 

We propose that the term ONCApproved Accreditor (ONC–AA) means 

an accreditation organization that the 

National Coordinator has approved to 

accredit certification bodies under the 

permanent certification program. 

4. Definition of ONC–ACB 

We propose ONC–ACB to mean a 

single organization or a consortium of 

organizations that has applied to and 

been authorized by the National 

Coordinator to perform the certification 

of, at a minimum, Complete EHRs and/ 

or EHR Modules using the applicable 

certification criteria adopted by the 

Secretary. We have included the phrase 

‘‘at a minimum’’ in this definition to take 

into account the possibility that ONC– 

ACBs may be authorized in the future to 

certify other types of HIT, such as 

personal health records (PHRs). Please 

note, however, that for that to occur, the 

Secretary would have to adopt 

certification criteria applicable to these 

types of HIT. 

C. Correspondence With the National 

Coordinator 

We propose that when applicants for 

ONC–ACB status and ONC–ACBs 

correspond with the National 

Coordinator and vice versa, that these 

communications must comply with the 

same rules we have proposed for the 

temporary certification program. 

D. Permanent Certification Program 

Application Process for ONC–ACB 

Status 

Similar to the temporary certification 

program, we propose under the 

permanent certification program to 

permit applicants for ONC–ACB status 

to apply at any time. 

1. Application for ONC–ACB Status 

Similar to the temporary certification 

program, we propose that an applicant 

for ONC–ACB status must submit an 

application to the National Coordinator 

in the same manner ONC–ATCB 

applicants must under the temporary 

certification program in order to be 

considered for ONC–ACB status. 

However, unlike the temporary 

certification program, applicants would 

no longer need to request an application 

and would instead be permitted to 

submit an application (which we intend 

to make available on the ONC Web site) 

to the following e-mail address: 

ACBapplication@hhs.gov. 

a. Types of Applicants 

Because the National Coordinator’s 

authorization in the permanent 

certification program is only valid with 

respect to certification, we do not expect 

that it would be necessary for 

organizations seeking to apply for ONC– 

ACB status to form a partnership or 

consortium. However, such an applicant 

would not be prevented from achieving 

ONC–ACB status as long as it could 

meet all of the requirements of the 

permanent certification program. 

b. Types of ONC–ACB Authorization 

Similar to the temporary certification 

program, we would require an applicant 

for ONC–ACB status to indicate on its 

application the type of certification it 

seeks authorization to perform under 

the permanent certification program. If 

the applicant requested authorization to 

certify EHR Modules we would also 

require it to identify the type(s) of EHR 

Modules which it seeks authorization to 

certify. The proposed requirement for an 

applicant to indicate the type of 

certification it is seeking would also 

apply to other types of HIT if the 

Secretary has adopted certification 

criteria for that HIT. 

c. Application for ONC–ACB Status 

We propose that an applicant must 

include the following information in its 

application: 

i. The applicant would be required to 

submit the same general identifying 

information required under the 

temporary certification program and 

section II.D.1.c.i. 

ii. The applicant would be required to 

submit the information necessary for 

ONC to confirm the applicant’s 

accreditation by an ONC–AA. 

iii. The applicant would be required 

to submit a properly executed 

agreement that it will adhere to the 

‘‘Principles of Proper Conduct for ONC– 

ACBs.’’ The Principles of Proper 

Conduct for ONC–ACBs would require 

an ONC–ACB to: 

• Maintain its accreditation. 

• Attend all mandatory ONC training 

and program update sessions. 

• Maintain a training program that 

includes documented procedures and 

training requirements to ensure its 

personnel are competent to certify HIT. 

• Report to ONC within 15 days any 

changes that materially affect its: 

Æ Legal, commercial, organizational, 

or ownership status; 

Æ Organization and management 

including key certification personnel; 

Æ Policies or procedures; 

Æ Location; 

Æ Personnel, facilities, working 

environment or other resources; 

Æ ONC authorized representative 

(point of contact); or 

Æ Other such matters that may 

otherwise materially affect its ability to 

certify HIT. 

• Allow ONC, or its authorized 

agents(s), to periodically observe on site 

(unannounced or scheduled) any 

certifications performed to demonstrate 

compliance with the requirements of the 

permanent certification program. 


erowe on DSK5CLS3C1PROD with PROPOSALS2
Federal Register / Vol. 75, No. 46 / Wednesday, March 10, 2010 / Proposed Rules 11349 

• Provide ONC, no less frequently 

than weekly, a current list of Complete 

EHRs and/or EHR Modules that have 

been certified, which includes, at a 

minimum, the vendor name (if 

applicable), the date certified, the 

product version, the unique certification 

number or other specific product 

identification, and where applicable, the 

certification criterion or certification 

criteria to which each EHR Module has 

been certified. 

• Retain all records related to the 

certification of Complete EHRs and/or 

EHR Modules for a minimum of 5 years. 

• Only certify HIT, including 

Complete EHRs and/or EHR Modules 

that have been tested by a NVLAPaccredited testing laboratory. 

• Submit an annual surveillance plan 

to the National Coordinator and 

annually report to the National 

Coordinator its surveillance results. 

• Promptly refund any and all fees 

received for certifications that will not 

be completed. 

The first difference between these 

Principles of Proper Conduct for ONC– 

ACBs and those proposed under the 

temporary certification program is that 

we have removed the principles related 

to Guide 65 and ISO 17025. The former 

would be replaced and addressed by the 

accreditation principle for ONC–ACBs 

and the latter, ISO 17025, would no 

longer be necessary since the National 

Coordinator’s authorization under the 

permanent certification program applies 

solely to certification. 

The second difference is that we have 

added the principle that ONC–ACBs 

would only be permitted to certify 

Complete EHRs and/or EHR Modules 

that have been tested by a NVLAPaccredited testing laboratory. We believe 

that NVLAP-accreditation is the best 

option, because the NVLAP is an 

internationally recognized testing 

laboratory accreditation program and 

because it will best serve the public’s 

interests. The NVLAP will also be able 

to rely on the significant technical and 

scientific staff NIST employs who have 

specialized expertise in developing and 

performing tests for and evaluations of 

HIT. Moreover, Congress clearly 

indicated its intentions both in section 

3001(c)(5) of the PHSA and in section 

13201(b) of the HITECH Act by 

associating NIST with the testing and 

certification of HIT. In the latter, the 

HITECH Act expressly provides that the 

Director of NIST, in coordination with 

the HIT Standards Committee, ‘‘shall 

support the establishment of a 

conformance testing infrastructure 

***’’ and that ‘‘[t]he development of 

this conformance testing infrastructure 

may include a program to accredit 

independent, non-Federal laboratories 

to perform testing.’’ 

The third difference pertains to record 

retention. For the permanent 

certification program, we propose to 

require that ONC–ACBs retain their 

records related to the certification of 

Complete EHRs and EHR Modules for a 

minimum of five years. We understand 

from our consultations with NIST that 

this is standard industry practice for 

organizations involved in certification. 

Given the fact that it will be possible for 

ONC–ACBs to be authorized under the 

permanent certification program for 

many years, we believe that this time 

period is necessary in the event that the 

National Coordinator notifies an ONC– 

ACB of a proposed Type-2 violation or 

proposes to revoke an ONC–ACBs 

status. These records would be directly 

relevant to a determination by the 

National Coordinator that an ONC–ACB 

committed a Type-2 violation and/or to 

revoke an ONC–ACB’s status. Moreover, 

we believe that the records will be 

necessary for ONC–ACBs to conduct 

surveillance. Finally, similar to our 

proposal for the temporary certification 

program, if an ONC–ACB loses its status 

for any reason it could be required to 

provide the National Coordinator with 

copies of all relevant records related to 

certification for up to a five year period. 

The fourth and final difference is the 

requirement that an ONC–ACB would 

need to conduct surveillance of 

Complete EHRs and/or EHR Modules 

that the ONC–ACB had previously 

certified. As noted in section I.F.3 when 

we introduced the concept of 

surveillance, we expect that as part of 

ONC–ACBs’ accreditation to confirm 

compliance at a minimum with Guide 

65, they will have addressed section 13. 

Section 13 specifies the general 

surveillance requirements that a 

certification body must meet in order to 

become accredited. We propose to 

require that ONC–ACBs agree to submit 

annual surveillance plans to the 

National Coordinator and annually 

report to the National Coordinator their 

surveillance results. As discussed 

below, we also propose a requirement 

for the ONC–AA to have processes in 

place to ensure that the certification 

bodies it accredits properly conduct 

surveillance. We believe that ONC– 

ACBs should be given the flexibility to 

conduct surveillance in accordance with 

their accreditation. However, we 

recognize that it would likely benefit the 

HIT industry if certain common 

elements of surveillance could be 

developed and we welcome public 

comment on what those elements 

should be. We anticipate that we would 

issue annual guidance for ONC–ACBs 

before they submit their surveillance 

plans in order to identify ONC 

priorities. In that regard, we also request 

public comment on whether there are 

specific approaches to surveillance that 

have worked in other industries and 

should be replicated for HIT. 

We anticipate using the results of 

ONC–ACB surveillance to make 

publicly available information related to 

the implementation and performance of 

Complete EHRs and EHR Modules in 

the field and as feedback for the 

efficient operation of the permanent 

certification program. We expect that 

these surveillance results could also be 

used by prospective purchasers of 

Complete EHRs and/or EHR Modules to 

determine whether a Complete EHR or 

EHR Module they are considering 

implementing has been the subject of 

any unsatisfactory surveillance reports 

(and why those unsatisfactory results 

occurred). We believe this requirement 

is important and would provide the 

National Coordinator and ONC–ACBs 

with important feedback regarding the 

effectiveness of the permanent 

certification program and what if any 

changes may need to be made to 

improve how the program operates. 

We emphasize that surveillance 

results obtained by ONC–ACBs and 

reported to the National Coordinator 

would not immediately affect a 

Complete EHR or EHR Module’s 

certification. That is, if after an ONC– 

ACB reevaluated a Complete EHR it 

previously certified and reported that 

the Complete EHR no longer met a 

certification criterion or criteria 

because, for example, an individual took 

actions to alter a capability provided by 

the Complete EHR such that it no longer 

performed according to its original 

design or improperly installed the 

Complete EHR, such a result would not 

automatically invalidate the Complete 

EHR’s certification. However, we would 

expect ONC–ACBs upon the 

identification of a pattern of poorly 

performing previously certified 

Complete EHRs and/or EHR Modules to 

determine whether they properly 

certified the Complete EHR or EHR 

Module in the past. We believe that the 

publication of surveillance results and 

market forces will sufficiently motivate 

developers of Complete EHRs and/or 

EHR Modules to continue to improve 

their products and address any 

shortcoming identified by the ONC– 

ACB surveillance process. We request 

public comment on whether the 

National Coordinator should consider 

proactively stepping-in to protect 

purchasers of Complete EHRs and/or 

EHRs Modules by taking action such as 

‘‘de-certifying’’ Complete EHRs and/or 


erowe on DSK5CLS3C1PROD with PROPOSALS2
11350 Federal Register / Vol. 75, No. 46 / Wednesday, March 10, 2010 / Proposed Rules 

EHR Modules if a pattern of 

unsatisfactory surveillance results 

emerges and the ONC–ACB has not 

taken any measures to evaluate the poor 

performance. 

d. Proficiency Examination 

We no longer propose the use of a 

proficiency exam in the permanent 

certification program because it would 

no longer serve a useful purpose. 

Moreover, the accreditation process for 

ONC–ACB applicants encompasses this 

requirement and we do not believe that 

any additional redundancy is necessary. 

2. Application Review 

We propose to use the same 

timeframes and general processes for 

application review under the permanent 

certification program as we propose for 

the temporary certification program. 

The primary difference between the 

permanent certification program’s 

application review process and the 

temporary certification program’s is the 

reduced number of opportunities for an 

applicant to submit revisions in 

response to formal deficiency notices 

(due to the fact that the application is 

only one part). The timeframes for 

review, resubmission, and 

reconsideration are the same as those 

proposed under the temporary 

certification program. The only other 

difference between our two proposals in 

this section is our reference to ONC– 

ACB instead of ONC–ATCB and that the 

scope of an ONC–ACBs authorization 

will only be valid for certification and 

not both testing and certification. 

3. ONC–ACB Application 

Reconsideration Requests 

We propose to use the same 

timeframes and processes for ONC–ACB 

application reconsideration requests 

under the permanent certification 

program as we propose for the 

temporary certification program. Again, 

we now refer to ONC–ACBs instead of 

ONC–ATCBs. 

4. ONC–ACB Status 

a. Acknowledgement and 

Representation 

We propose the same policies for 

ONC–ACBs related to acknowledgement 

and representation as we do for ONC– 

ATCBs under the temporary 

certification program. 

b. Expiration of Status Under the 

Permanent Certification Program 

We propose that an ONC–ACB would 

be required to renew its status every two 

years. To renew its status, we propose 

that an ONC–ACB would need to submit 

an updated application to the National 

Coordinator for review 60 days prior to 

the expiration of its status. We request 

public comment on any additional 

information an ONC–ACB should 

provide the National Coordinator in 

order to have its status renewed, such as 

documentation of the ONC–ACB’s 

current accreditation status and any 

additional information or updates to the 

original application that would aid in 

the National Coordinator’s review of the 

renewal request. 

E. ONC–ACB Performance of 

Certification and Maintaining Good 

Standing as ONC–ACB 

1. Authorization To Certify Complete 

EHRs 

We propose, similar to the temporary 

certification program, that ONC–ACBs 

who seek authorization under the 

permanent certification program to 

certify Complete EHRs must be capable 

of certifying Complete EHRs to all 

applicable certification criteria adopted 

by the Secretary. 

2. Authorization To Certify EHR 

Modules 

We again propose that ONC–ACBs 

who seek authorization under the 

permanent certification program to 

certify EHR Modules must be capable of 

certifying EHR Modules in accordance 

with the applicable certification criteria 

adopted by the Secretary. We would 

mirror our proposals in the temporary 

certification program related to the 

scope of a ‘‘certification criterion’’ and 

when, in this case, an ONC–ACB would 

be required to certify EHR Modules to 

the privacy and security certification 

criteria adopted by the Secretary in the 

permanent certification program. 

3. Authorization To Certify Other HIT 

As we mention above in the preamble, 

section 3001(c)(5) of the PHSA provides 

the National Coordinator with broad 

authority to establish certification 

programs for the ‘‘voluntary certification 

of health information technology as 

being in compliance with applicable 

certification criteria adopted under this 

subtitle.’’ As a result, we requested 

public comment on the other types of 

HIT that the permanent certification 

program could include and ONC–ACBs 

could certify. As the statute provides, if 

the Secretary were to adopt certification 

criteria applicable to other types of HIT 

that the National Coordinator could 

subsequently authorize an ONC–ACB to 

certify such HIT under the permanent 

certification program. Therefore, we 

propose that if the Secretary adopts 

certification criteria for HIT beyond 

Complete EHRs and EHR Modules, a 

current ONC–ACB would have to 

submit an addendum to its original 

application to request authorization to 

certify this other type of HIT. If a new 

organization wanted to be authorized to 

certify another type of HIT it would 

need to follow the rules for becoming an 

ONC–ACB, including first receiving 

accreditation from an ONC–AA. 

4. Authorized Certification Methods 

Similar to the temporary certification 

program, we propose that ONC–ACBs 

must have the capacity to certify 

Complete EHRs and/or EHR Modules at 

their facility and one of the secondary 

methods we identified in the temporary 

certification program. 

5. The Certification of ‘‘Minimum 

Standards’’ 

Based on the same rationale provided 

in the temporary certification program 

discussion above, we propose to adopt 

the same method or methods for 

identifying which minimum standards 

(i.e., code sets) that an ONC–ACB will 

use for certification. 

6. Maintaining Good Standing as an 

ONC–ACB; Violations That Could Lead 

to Revocation of ONC–ACB Status; 

Revocation of ONC–ACB Status 

We propose the same policies and 

procedures for an ONC–ACB to 

maintain good standing in the 

permanent certification program as in 

the temporary certification program. We 

also include the same descriptions for 

the types of violations discussed above 

in the temporary certification program 

as well as the same timeframes and 

processes the National Coordinator 

would take to revoke an ONC–ACBs 

status. Similar to the temporary 

certification program, we propose that if 

an ONC–ACB has its status revoked due 

to a Type-1 violation, it would be 

prohibited from reapplying for ONC– 

ACB status for at least 1 year. We 

believe this timeframe is justified 

because we assume that a former ONC– 

ACB would need a certain amount of 

time to reorganize its management and 

key personnel after having its status 

revoked. Additionally, depending on 

the type of violation that led to the 

former ONC–ACBs status being revoked, 

it is also possible that it would lose its 

accreditation. We request public 

comment on whether this timeframe 

should be shortened or lengthened, and 

whether alternative sanctions related to 

ONC–ACBs or former ONC–ACBs 

should be considered. 

Again, per our discussion above, we 

maintain our policy proposal for the recertification of Complete EHRs and/or 

EHR Modules if the National 


erowe on DSK5CLS3C1PROD with PROPOSALS2
Federal Register / Vol. 75, No. 46 / Wednesday, March 10, 2010 / Proposed Rules 11351 

Coordinator determines that fraudulent 

certifications were issued. 

7. Validity of Complete EHR and EHR 

Module Certification 

Based on the same rationale provided 

in the temporary certification program 

we do not believe that we need to adopt 

an explicit expiration date for the 

certifications associated with Complete 

EHRs and EHR Modules because of the 

natural expiration that our other 

regulatory actions would create. 

Additionally, since a new certification 

program would exist, which would 

include different processes, we 

emphasize that Complete EHRs and 

EHR Modules tested and certified under 

the temporary certification program by 

an ONC–ATCB would need to be tested 

and certified according to the 

permanent certification program once 

the Secretary adopts certification 

criteria to replace, amend, or add to 

previously adopted certification criteria. 

We anticipate that this would occur to 

support meaningful use Stage 2 and, as 

we discussed in the temporary 

certification program section on this 

matter, the capabilities eligible 

professionals and eligible hospitals 

would need from their Certified EHR 

Technology would also change, thereby 

affecting the validity and utility of the 

prior certification. 

That being said, with respect to EHR 

Modules, we can envision situations, 

especially in the future, where measures 

associated with a meaningful use 

objective may change, but the capability 

a certified EHR Module would need to 

provide would not change. As a result, 

it may be impracticable or unnecessary 

for the EHR Module to be re-certified. 

For example, a hypothetical meaningful 

use Stage 3 measure for electronic 

prescribing could be 90% of all 

prescriptions compared to the 80% 

proposed for meaningful use Stage 1. In 

this example, it may be impracticable 

for a certified EHR Module for 

electronic prescribing to be recertified if 

the only thing that has changed is the 

meaningful use measure. Alternatively, 

if the certification criteria (and 

standard(s) associated with those 

certification criteria) have changed, then 

it would be necessary for the EHR 

Module to be re-certified. Therefore, we 

request public comment on whether 

there should be circumstances where 

EHR Modules should not have to be recertified. 

8. Differential Certification 

We expect that over time the 

certification criteria adopted by the 

Secretary will increase incrementally, 

much like the approach CMS has 

proposed for meaningful use objectives 

and measures. As a result, after 

Complete EHRs and EHR Modules have 

been certified to meet the certification 

criteria associated with meaningful use 

Stage 1, it may benefit both Complete 

EHR and EHR Module developers as 

well as eligible professionals and 

eligible hospitals if some form of 

differential certification were available. 

Differential certification would 

comprise an ONC–ACB certifying 

Complete EHRs and/or EHR Modules to 

the differences between the certification 

criteria adopted by the Secretary 

associated with one stage of meaningful 

use and a subsequent stage of 

meaningful use. For example, if the 

Secretary were to adopt 5 new 

certification criteria to support 

meaningful use Stage 2 and those were 

the only additional capabilities that 

needed to be certified in order for a 

Complete EHR’s certification to be valid 

again (i.e., all other certification criteria 

remained the same) for the purposes of 

meaningful use Stage 2, then the 

Complete EHR would only have to be 

tested and certified to those 5 criteria 

rather than the entire set of certification 

criteria again. We request public 

comment on factors that could be 

considered to determine when 

differential certification would be 

appropriate and when it would not. 

Factors we have considered include, 

whether the standard(s) associated with 

a certification criterion or certification 

criteria change and whether additional 

certification criteria change in such a 

way that the new capabilities a 

Complete EHR or EHR Module would 

need to provide impact how other 

previously certified capabilities would 

perform. 

We believe that differential 

certification could be a valuable and 

pragmatic approach for the future and 

that it may further reduce costs for 

certification and expedite the 

certification process. We request public 

comment on whether we should require 

ONC–ACBs to offer differential 

certification. In considering this request, 

we also ask when differential 

certification should begin. That is, 

should differential certification be 

permitted to begin with Complete EHRs 

and EHR Modules certified under the 

temporary certification program (i.e., the 

differences between 2011 and 2013) or 

after all Complete EHRs and EHR 

Modules have been certified once under 

the permanent certification program 

(i.e., the differences between 2013 and 

2015). We ask commenters to consider 

this distinction because of the 

differences in rigor that we expect 

Complete EHRs and EHR Modules will 

go through to get certified under the 

permanent certification program. 

F. ONC-Approved Accreditor 

We propose that prior to submitting 

an application to the National 

Coordinator for ONC–ACB status, an 

organization would need to be 

accredited by an ONC–AA for 

certification. We propose a specific 

accreditation requirement for the 

permanent certification program in 

order to conform to industry best 

practices. We believe that the 

accreditation of applicants for ONC– 

ACB status is an important prerequisite 

for the permanent certification program 

because it not only introduces 

additional rigor and objectivity to the 

certification process, but also provides 

for increased confidence in, and 

credibility to, the certifications 

performed. In that regard, if Complete 

EHR and/or EHR Module developers 

believe that an ONC–ACB is not 

performing up to par, they would be 

able to notify the ONC–AA (in addition 

to the National Coordinator, if 

necessary) in order to expose any 

potential ONC–ACB performance 

problems. The ONC–AA would be able 

to assess whether these reports are 

valid, determine whether the ONC–ACB 

has violated any of the terms of its 

accreditation, and would be able to 

determine if any action is necessary 

including notifying the National 

Coordinator. 

1. Requirements for Becoming an 

ONC–AA 

In order to become an ONC–AA, we 

propose that an accreditation 

organization must submit a request in 

writing to the National Coordinator 

along with the following information to 

demonstrate its ability to serve as an 

ONC–AA. 

• A detailed description of the 

accreditation organization’s 

conformance to ISO 17011 and 

experience evaluating the conformance 

of certification bodies to Guide 65. 

• A detailed description of the 

accreditation organization’s 

accreditation requirements and how 

those requirements complement the 

Principles of Proper Conduct for ONC– 

ACBs. 

• Detailed information on the 

accreditation organization’s procedures 

that would be used to monitor ONC– 

ACBs. 

• Detailed information, including 

education and experience, about the key 

personnel who review certification 

bodies for accreditation. 


erowe on DSK5CLS3C1PROD with PROPOSALS2
11352 Federal Register / Vol. 75, No. 46 / Wednesday, March 10, 2010 / Proposed Rules 

• Procedures for responding to, and 

investigating, complaints against ONC– 

ACBs. 

Once the National Coordinator 

receives such information, we propose 

that the National Coordinator would be 

permitted up to 30 days to review and 

issue a determination as to whether the 

accreditation organization has been 

approved. The National Coordinator 

would judge ONC–AA applicants on the 

information they provide, the 

completeness of their descriptions to the 

elements listed above, and their overall 

accreditation experience. The National 

Coordinator would review submissions 

for ONC–AA status on a first come first 

serve basis and would ‘‘approve’’ the 

first accreditation organization that 

satisfactorily demonstrated its ability to 

serve as an ONC–AA. We propose to use 

the same process for reconsideration of 

an accreditation organization’s approval 

request as we do for ONC–ACB 

applicants under the permanent 

certification program. 

2. ONC–AA Ongoing Responsibilities 

In order to ensure that our 

programmatic objectives for the 

permanent certification program are 

met, we propose that an ONC–AA 

would fulfill, at a minimum, the 

following ongoing responsibilities: 

• Maintain conformance with ISO 

17011; 

• In accrediting certification bodies, 

verify conformance to, at a minimum, 

Guide 65; 

• Verify that ONC–ACBs are 

performing surveillance in accordance 

with their respective annual plans; and 

• Review ONC–ACB surveillance 

results to determine if the results 

indicate any substantive nonconformance with the terms set by the 

ONC–AA when it granted the ONC– 

ACB accreditation. 

We request public comment on these 

and potentially other ongoing 

responsibilities that we should 

expressly require an ONC–AA to fulfill. 

3. Number of ONC–AAs and Length of 

Approval 

We believe that it is important for all 

applicants for ONC–ACB status to be 

accredited by the same ONC–AA. Doing 

so would provide stability and 

consistency for all ONC–ACB applicants 

and a common point of trust for 

Complete EHR and EHR Module 

developers. Moreover, Complete EHR 

and EHR Module developers would 

obtain a level of assurance that any 

ONC–ACBs’ certification would be 

equal to another’s because all of them 

had been accredited by the same ONC– 

AA. As a result, we believe that it is 

important from a programmatic 

perspective for there to be only one 

ONC–AA at a time and therefore we 

have proposed to only approve one 

ONC–AA at a time. We request public 

comment on whether it would be in the 

best interest of the ONC–ACB applicants 

and Complete EHR and EHR Module 

developers to allow for more than one 

ONC–AA at a time. 

Finally, we propose that ONC–AA 

status would expire after 3 years. 

Consistent with this proposed 

expiration of status, we propose to again 

accept requests for ONC–AA status 120 

days before the then current ONC–AA’s 

status is set to expire. We believe that 

3 years provides an appropriate balance 

between precluding other qualified 

accreditation organizations from 

requesting ONC–AA status and 

providing some level of consistency 

between the ONC–AA and ONC–ACB 

levels. We request public comment on 

whether we should extend the length of 

an ONC–AA’s status to a maximum of 

5 years before accepting requests for 

ONC–AA status or shortening the length 

to 2 years or identify a different period 

of time. 

G. Promoting Participation in the 

Permanent Certification Program 

In the context of the permanent 

certification program, it is our hope and 

expectation that multiple organizations 

will step forward to apply for and 

receive ONC–ACB status and that these 

organizations will be able to certify 

Complete EHRs and EHR Modules in a 

timely and satisfactory manner. 

Moreover, given the proposed Medicare 

and Medicaid EHR Incentive Programs, 

we believe that organizations will be 

motivated to become ONC–ACBs to 

meet the demand for Certified EHR 

Technology by eligible professionals 

and eligible hospitals. We do not believe 

that the requirements set forth in this 

proposed rule create prohibitively high 

barriers to market entry for 

organizations interested in becoming 

ONC–ACBs. However, we welcome 

comments on whether this proposed 

rule does in fact create high barriers to 

market entry and, if so, how we could 

revise the proposed requirements to 

lower those barriers and encourage 

participation. We provide cost and 

burden estimates in Section V 

(Collection of Information 

Requirements) and Section VI 

(Regulatory Impact Analysis). 

HHS is responsible for the overall 

implementation and success of the 

proposed Medicare and Medicaid EHR 

Incentive Programs and we are acutely 

aware that without a properly operating 

certification program the overall success 

of the EHR incentive programs could be 

affected. We are concerned about two 

low probability, but problematic risks— 

there being no ONC–ACBs authorized 

under the permanent certification 

program or only one ONC–ACB that 

engages in monopolistic behavior. We 

are therefore interested in public 

comment regarding potential 

approaches that could be pursued to 

stimulate market involvement or 

remediate this situation if it were to 

develop, including the possibility for 

the National Coordinator to establish a 

temporary ONC-managed certification 

process (‘‘ONC process’’) that would 

include some type of certification 

review board. This would not be a 

preferred option, and would come with 

significant limitations. Congress, in 

section 3001(c)(5) of the PHSA, did not 

expressly authorize the National 

Coordinator or the Secretary to assess 

and collect fees related to the 

certification of HIT and subsequently 

retain and use those fees to administer 

an ONC process if it were established. 

We seek public comment on other 

potential approaches that could be 

employed to address the two risks 

identified above. 

IV. Response to Comments 

Because of the large number of public 

comments normally received in 

response to Federal Register 

documents, we are not able to 

acknowledge or respond to them 

individually. We will consider all 

comments we receive by the date and 

time specified in the DATES section of 

this preamble, and, when we proceed 

with a subsequent document, we will 

respond to the comments in the 

preamble of that document. 

V. Collection of Information 

Requirements 

In compliance with the requirement 

of section 3506(c)(2)(A) of the 

Paperwork Reduction Act of 1995 

(PRA), the Office of the Secretary (OS), 

Department of Health and Human 

Services, is publishing the following 

summary of proposed information 

collection requests for public comment. 

In order to fairly evaluate an 

information collection, section 

3506(c)(2)(A) of the PRA requires that 

we solicit comment on the following 

issues: 

1. Whether the information collection 

is necessary and useful to carry out the 

proper functions of the agency; 

2. The accuracy of the agency’s 

estimate of the information collection 

burden; 

3. The quality, utility, and clarity of 

the information to be collected; and 


erowe on DSK5CLS3C1PROD with PROPOSALS2
Federal Register / Vol. 75, No. 46 / Wednesday, March 10, 2010 / Proposed Rules 11353 

4. Recommendations to minimize the 

information collection burden on the 

affected public, including automated 

collection techniques. 

Under the PRA, the time, effort, and 

financial resources necessary to meet 

the information collection requirements 

referenced in this section are to be 

considered. We explicitly seek, and will 

consider, public comment on our 

assumptions as they relate to the PRA 

requirements summarized in this 

section. To comment on the collections 

of information or to obtain copies of the 

supporting statements and any related 

forms for the proposed paperwork 

collections referenced in this section, 

e-mail your comment or request, 

including your address and phone 

number to 

Sherette.funncoleman@hhs.gov, or call 

the Reports Clearance Office on (202) 

690–6162. Written comments and 

recommendations for the proposed 

information collections must be directed 

to the OS Paperwork Clearance Officer 

at the above e-mail address within 30 

days. 

Abstract 

The Health Information Technology 

for Economic and Clinical Health 

(HITECH) Act, Title XIII of Division A 

and Title IV of Division B of the 

American Recovery and Reinvestment 

Act of 2009 (ARRA) (Pub. L. 111–5), was 

enacted on February 17, 2009. The 

HITECH Act amended the Public Health 

Service Act (PHSA) and created ‘‘Title 

XXX—Health Information Technology 

and Quality’’ (Title XXX) to improve 

health care quality, safety, and 

efficiency through the promotion of 

health information technology (HIT) and 

electronic health information exchange. 

Section 3001(c)(5) of the PHSA 

requires the National Coordinator, in 

consultation with the Director of the 

National Institute of Standards and 

Technology, to ‘‘keep or recognize a 

program or programs for the voluntary 

certification of health information 

technology as being in compliance with 

applicable certification criteria’’ adopted 

by the Secretary under section 3004. In 

this notice of proposed rulemaking 

implementing section 3001(c)(5), we 

propose to establish two certification 

programs, a temporary certification 

program and a permanent certification 

program. The establishment of these 

programs and the proposals therein 

would require four separate collections 

of information. 

A. Collection of Information #1: 

Application for ONC–ATCB Status 

Under the Proposed Temporary 

Certification Program 

Under the proposed temporary 

certification program, an applicant who 

voluntarily applies to become an ONC– 

ATCB would be required to submit an 

application to the National Coordinator. 

Based on prior experience, we believe 

that the testing and certification of 

Complete EHRs and/or EHR Modules 

will require expertise that few in the 

HIT marketplace possess. As a result, 

we assume that there will be no more 

than 3 applicants for ONC–ATCB status. 

We believe that there will be no more 

than 3 applicants because we have only 

seen evidence in the press of one 

organization that has committed to 

applying and another that has expressed 

its interest in entering the HIT testing 

and certification field. The application 

requirements include the completion of 

an application form, submission of 

additional documentation as specified 

in the application form, and completion 

of a proficiency examination. However, 

the proficiency examination is not 

considered ‘‘information’’ for PRA 

collection purposes because it falls 

under the exception to the definition of 

information at 5 CFR 1320.3(h)(7). We 

estimate that it will take approximately: 

• 10 minutes for an applicant to 

provide the general identifying 

information requested in the application 

(section 1); 

• 2 hours to complete the Guide 65 

self audit and assemble associated 

documentation (section 2); 

• 2 hours to complete the ISO 17025 

self audit and assemble associated 

documentation (section 3); and 

• 20 minutes to review and agree to 

the ‘‘Principles of Proper Conduct for 

ONC–ATCBs’’ (section 4). 

As discussed in more detail in section 

VI, we base these estimates on the 

assumption that qualified applicants for 

the temporary certification program will 

already be familiar with the relevant 

requirements found in the ISO/IEC 

standards and will have a majority, if 

not all, of the documentation requested 

in the application already developed 

and available before applying for ONC– 

ATCB status. Therefore, with the 

exception of completing a proficiency 

examination, we believe an applicant 

would only spend time collecting and 

assembling already developed 

information to submit with their 

application rather than developing, for 

example, a ‘‘quality manual’’ from 

scratch. 

More specifics about the temporary 

certification program’s proposed 

application requirements and the 

information that would be collected can 

be found at § 170.420. 

ESTIMATED ANNUALIZED BURDEN HOURS

Type of respondent 

(ONC–ATCB applicant) 

Number of 

respondents 

Number of 

responses per 

respondent 

Average 

burden hours 

per response 

Total burden 

hours 

ATCB Application Section 1 ........................................................................ 3 1 10/60 .5 

ATCB Application Section 2 ........................................................................ 3 1 2 6 

ATCB Application Section 3 ........................................................................ 3 1 2 6 

ATCB Application Section 4 ........................................................................ 3 1 20/60 1 

Total ...................................................................................................... 3 1 4 .5 13 .5 

B. Collection of Information #2: 

Application for ONC–ACB Status Under 

the Proposed Permanent Certification 

Program 

Under the proposed permanent 

certification program, an applicant who 

voluntarily applies to become an ONC– 

ACB would be required to submit an 

application to the National Coordinator. 

We estimate that there will be no more 

than 6 applicants for ONC–ACB status 

under the permanent certification 

program. While we believe that the 

business case for entering the HIT 

market to perform the certification of 

Complete EHRs and EHR Modules could 

increase as health IT adoption rates 

increase, we believe that it is unlikely 

(given the expertise needed to perform 

the certification of Complete EHRs and 

EHR Modules) that the number of 

applicants would extend into the tens of 

applicants. 

The application requirements include 

the completion of an application form 

and submission of additional 


erowe on DSK5CLS3C1PROD with PROPOSALS2
11354 Federal Register / Vol. 75, No. 46 / Wednesday, March 10, 2010 / Proposed Rules 

documentation as specified in the 

application form. We estimate that it 

will take approximately: 

• 10 minutes for an applicant to 

provide the general identifying 

information requested in the application 

(section 1); 

• 30 minutes to assemble the 

information necessary to provide 

documentation of accreditation by an 

ONC–AA (section 2); and 

• 20 minutes to review and agree to 

the ‘‘Principles of Proper Conduct for 

ONC–ACBs’’ (section 3). 

While we anticipate that very few 

organizations will have the expertise to 

test and certify HIT in the temporary 

certification program, we have proposed 

to separate these responsibilities in the 

permanent certification program and in 

doing so, we believe that several private 

sector organizations that currently 

conduct only testing or only 

certification will be able to enter the 

HIT testing and certification field. Our 

burden estimates above are based on the 

assumption that these existing entities 

will already be familiar with many of 

the requirements proposed in this rule 

and will, for example, already have a 

majority—if not all—of the 

documentation requested in the 

application already developed and 

available before applying for ONC–ACB 

status. 

Also, while this rule does impose 

record keeping requirements, we 

believed that the proposed 5-year 

requirement is in line with common 

industry practice and, consequently, 

would not represent an additional cost 

to ONC–ACBs as a result of this rule. 

More specifics about the permanent 

certification program’s proposed 

application requirements and the 

information that would be collected can 

be found at § 170.502. 

ESTIMATED ANNUALIZED BURDEN HOURS

Type of respondent 

(ONC–ACB applicant) 

Number of 

respondents 

Number of 

responses per 

respondent 

Average 

burden hours 

per response 

Total burden 

hours 

ACB Application Section 1 .............................................................................. 6 1 10/60 1 

ACB Application Section 2 .............................................................................. 6 1 30/60 3 

ACB Application Section 3 .............................................................................. 6 1 20/60 2 

Total .......................................................................................................... 6 1 1 6 

C. Collection of Information #3: ONC– 

ATCB and ONC–ACB Collection and 

Reporting of Information Related To 

Complete EHR and/or EHR Module 

Certifications 

Under both of the proposed 

certification programs we propose to 

require ONC–ATCBs and ONC–ACBs to 

provide ONC, no less frequently than 

weekly, a current list of Complete EHRs 

and/or EHR Modules that have been 

tested and certified which includes, at 

a minimum, the vendor name (if 

applicable), the date certified, the 

product version, the unique certification 

number or other specific product 

identification, and where applicable, the 

certification criterion or certification 

criteria to which each EHR Module has 

been tested and certified. 

These specific proposed requirements 

for the temporary certification program 

and the permanent certification program 

can be found at § 170.420 and § 170.520, 

respectively. 

For the purposes of estimating the 

potential burden, we assume that all of 

the estimated applicants in the tables 

above will apply and become ONC– 

ATCBs and ONC–ACBs under the 

temporary certification program and 

permanent certification program, 

respectively. We also assume, per our 

requirement specified in the respective 

Principles of Proper Conduct for ONC– 

ATCBs and ONC–ACBs, that ONC– 

ATCBs and ONC–ACBs will report 

weekly (i.e., respondents will respond 

52 times per year). Finally, we assume 

that the information collections would 

be accomplished through electronic data 

collection and storage and that such 

collection and storage would be part of 

ONC–ATCBs and ONC–ACBs normal 

course of business. Therefore, with 

respect to this proposed collection of 

information, the estimated burden is 

limited to the actual electronic reporting 

of the information to ONC. 

ESTIMATED ANNUALIZED BURDEN HOURS

Type of respondent Number of 

respondents 

Number of 

responses per 

respondent 

Average 

burden hours 

per response 

Total burden 

hours 

ONC–ATCB Testing and Certification Results ................................................ 3 52 1 156 

ONC–ACB Certification Results ...................................................................... 6 52 1 312 

Total .......................................................................................................... 9 104 2 468 

D. Collection of Information #4: 

Required Documentation for Requesting 

ONC-Approved Accreditor Status 

Under the permanent certification 

program we propose to require 

accreditation organizations who seek to 

become an ONC–AA to submit 

information to the National Coordinator 

to demonstrate their ability to accredit 

certification bodies that would 

eventually apply for ONC–ACB status. 

We assume that there will only be two 

accreditation organizations that will 

prepare and submit the information 

sought by the National Coordinator. We 

believe this will be the case based on 

our knowledge of the HIT market and 

consultations with NIST related to the 

existence of potential accreditation 

organizations that could seek the 

National Coordinator’s approval. 

We have included our estimates of the 

approximate time commitments 

associated with documenting each 

requirement that must be included in an 

accreditation organization’s submission: 

• 20 minutes for an accreditation 

organization to provide a detailed 

description of the accreditation 


erowe on DSK5CLS3C1PROD with PROPOSALS2
Federal Register / Vol. 75, No. 46 / Wednesday, March 10, 2010 / Proposed Rules 11355 

organization’s conformance to ISO 

17011 and experience evaluating the 

conformance of certification bodies to 

Guide 65; 

• 20 minutes for an accreditation 

organization to provide a detailed 

description of the accreditation 

organization’s accreditation 

requirements and how the requirements 

complement the Principles of Proper 

Conduct for ONC–ACBs; 

• 5 minutes for an accreditation 

organization to provide a copy of the 

procedures that would be used to 

monitor ONC–ACBs; 

• 10 minutes for an accreditation 

organization to provide detailed 

information, including education and 

experience, about the key personnel 

who review certification bodies for 

accreditation; and 

• 5 minutes for an accreditation 

organization to provide a copy of the 

procedures for responding to, and 

investigating, complaints against ONC– 

ACBs. 

These specific proposed requirements 

for the permanent certification program 

can be found at § 170.503. 

ESTIMATED ANNUALIZED BURDEN HOURS

Type of respondent 

(ONC–AA requestor) 

Number of 

respondents 

Number of 

responses per 

respondent 

Average 

burden hours 

per response 

Total burden 

hours 

Documentation of Conformance to ISO 17011 and Guide 65 Experience ... 2 1 20/60 .67 

Description of Accreditation Requirements and how they Complement the 

Principles of Proper Conduct for ONC–ACBs ........................................... 2 1 20/60 .67 

Documentation of Monitoring Procedures ..................................................... 2 1 5/60 .165 

Documentation of Key Personnel .................................................................. 2 1 10/60 .33 

Documentation of Procedures for Responding to and Investigating Complaints ......................................................................................................... 2 1 5/60 .165 

Total ........................................................................................................ 2 1 1 2 

As required by § 3504(h) of the 

Paperwork Reduction Act, we have 

submitted a copy of this document to 

the Office of Management and Budget 

(OMB) for its review of these 

information collection requirements. 

VI. Regulatory Impact Analysis 

A. Introduction 

We have examined the impacts of this 

proposed rule as required by Executive 

Order 12866 on Regulatory Planning 

and Review (September 30, 1993, as 

further amended), the Regulatory 

Flexibility Act (RFA) (5 U.S.C. 601 et 

seq.), section 202 of the Unfunded 

Mandates Reform Act of 1995 (2 U.S.C. 

1532), Executive Order 13132 on 

Federalism (August 4, 1999), and the 

Congressional Review Act (5 U.S.C. 

804(2)). 

Executive Order 12866 directs 

agencies to assess all costs and benefits 

of available regulatory alternatives and, 

if regulation is necessary, to select 

regulatory approaches that maximize 

net benefits (including potential 

economic, environmental, public health 

and safety effects, distributive impacts, 

and equity). A regulatory impact 

analysis (RIA) must be prepared for 

major rules with economically 

significant effects ($100 million or more 

in any one year). Based on the analysis 

of costs and benefits that follows, we 

have determined that this proposed 

rule, including both the temporary 

certification program and permanent 

certification program, is not an 

economically significant rule because 

we estimate that the overall costs and 

benefits associated with the 

combination of the temporary and 

permanent certification programs as 

well as the costs associated with the 

testing and certification of Complete 

EHRs and EHR Modules under both 

certification programs will be less than 

$100 million per year. Nevertheless, 

because of the public interest in this 

proposed rule, we have prepared an RIA 

that to the best of our ability presents 

the costs and benefits of the proposed 

rule broken down by each proposed 

certification program. We request 

comments on the economic analyses 

provided in this proposed rule. 

B. Why This Rule is Needed? 

As stated in earlier sections of this 

proposed rule, section 3001(c)(5) of the 

PHSA provides the National 

Coordinator with the authority to 

establish a certification program or 

programs for the voluntary certification 

of HIT. This proposed rule is needed to 

outline the processes by which the 

National Coordinator would exercise 

this authority to authorize certain 

organizations to test and certify 

Complete EHRs and/or EHR Modules. 

Once certified, Complete EHRs and EHR 

Modules would be able to be used by 

eligible professionals and eligible 

hospitals as, or be combined to create, 

Certified EHR Technology. Eligible 

professionals and eligible hospitals who 

seek to qualify for incentive payments 

under the Medicare and Medicaid EHR 

Incentive Programs are required by 

statute to use Certified EHR Technology. 

C. Executive Order 12866—Regulatory 

Planning and Review Analyses for the 

Proposed Temporary and Permanent 

Certification Programs 

As required by Executive Order 

12866, we have examined the economic 

implications of this proposed rule as it 

relates to our proposed temporary and 

permanent certification programs. 

Executive Order 12866 directs agencies 

to assess all costs and benefits of 

available regulatory alternatives and, 

when regulation is necessary, to select 

regulatory approaches that maximize 

net benefits (including potential 

economic, environmental, public health 

and safety, and other advantages; 

distributive impacts; and equity). 

Executive Order 12866 classifies a 

regulation as significant if it meets any 

one of a number of specified conditions, 

including having an annual effect on the 

economy of $100 million, or in a 

material way adversely affecting the 

economy, a sector of the economy, 

competition, or jobs. While this rule is 

therefore not ‘‘economically significant,’’ 

as defined by Executive Order 12866, 

OMB has determined that this rule 

constitutes a ‘‘significant regulatory 

action’’ as defined by Executive Order 

12866 because it raises novel legal and 

policy issues. 

Throughout the following analyses we 

identify specific actions or issues for 

which we expressly ask for comments. 

The public, however, is invited to 

comment on any and all elements of the 

analyses and on all underlying 

assumptions. 


erowe on DSK5CLS3C1PROD with PROPOSALS2
11356 Federal Register / Vol. 75, No. 46 / Wednesday, March 10, 2010 / Proposed Rules 

1. Temporary Certification Program 

Estimated Costs 

a. Application Process for ONC–ATCB 

Status 

i. Applicant Costs 

As mentioned above, we believe that 

the testing and certification of Complete 

EHRs and/or EHR Modules will require 

expertise that not many in the HIT 

marketplace currently possess. 

Therefore, we assume that there will be 

no more than 3 applicants for ONC– 

ATCB status. We believe that there will 

be no more than three applicants 

because we have only seen evidence in 

the press of one organization that has 

committed to applying and another that 

has expressed its interest in entering the 

HIT testing and certification field. 

As part of the temporary certification 

program, an applicant would be 

required to submit an application and 

complete a proficiency exam. We do not 

believe that there will be an appreciable 

difference in the time commitment an 

applicant for ONC–ATCB status will 

have to make based on the type of 

authorization it seeks (i.e., we believe 

the application process and time 

commitment will be the same for 

applicants seeking authorization to 

conduct either the testing and 

certification of Complete EHRs or EHR 

Modules). Further, we assume that 

qualified applicants will have reviewed 

the relevant requirements found in the 

ISO/IEC standards and will have a 

majority, if not all, of the documentation 

requested in the application already 

developed and available before applying 

for ONC–ATCB status. Without having 

such documentation (including policies 

and procedures) we believe that it 

would be difficult for an applicant to 

operate a legitimate testing and 

certification program. Therefore, with 

the exception of completing a 

proficiency examination, we believe an 

applicant would only spend time 

collecting and assembling already 

developed information to submit with 

their application rather than developing, 

for example, a ‘‘quality manual’’ from 

scratch. 

Based on our assumptions and 

consultations with NIST, we anticipate 

that it will take an applicant 

approximately 28.5 hours to complete 

the application and submit the 

requested documentation. Our estimate 

includes the time discussed above in 

our collection of information section 

and approximately up to 24 hours to 

complete the proficiency examination— 

8 hours (1 full work day) to complete 

section 1 (demonstration of technical 

expertise related to Complete EHRs and/ 

or EHR Modules); 6 hours to complete 

section 2 (demonstration of test tool 

identification); and 10 hours to 

complete section 3 (demonstration of 

proper use of test tools and 

understanding of test results). Moreover, 

after consulting with NIST we assume 

that: 

(1) An employee equivalent to the 

Federal Salary Classification of GS–9 

Step 1 could provide the general 

information requested in the application 

and accomplish the paperwork duties 

associated with the application; 

(2) An employee equivalent to the 

Federal Salary Classification of GS–15 

Step 1 would be responsible for 

conducting the self audits and agreeing 

to the ‘‘Principles of Proper Conduct for 

ONC–ATCBs’’; and 

(3) An employee or employees 

equivalent to the Federal Salary 

Classification of GS–15 Step 1 would be 

responsible for completing the 

proficiency examination. 

We have taken these employee 

assumptions and utilized the 

corresponding employee hourly rates for 

the locality pay area of Washington, DC 

as published by the U.S. Office of 

Personnel Management (OPM), to 

calculate our cost estimates. We have 

also calculated the costs of an 

employee’s benefits while completing 

the application. We have calculated 

these costs by assuming that an 

applicant expends thirty-six percent 

(36%) of an employee’s hourly wage on 

benefits for the employee. We have 

concluded that a 36% expenditure on 

benefits is an appropriate estimate 

because it is the routine percentage used 

by HHS for contract cost estimates. Our 

calculations are expressed in Tables 1 

and 2 below. 

TABLE 1—TEMPORARY CERTIFICATION PROGRAM: COST TO APPLICANTS TO APPLY TO BECOME AN ONC–ATCB 

Proposed requirement Employee equivalent Burden hours 

Employee 

hourly wage 

rate 

Cost of 

employee 

benefits per 

hour 

Cost per 

applicant 

General Identifying Information ............................ GS–9 Step 1 ................. 10/60 $22.39 $8.06 $5.07 

Self Audits and Documentation ............................ GS–15 Step 1 ............... 4 59.30 21.35 322.60 

Principles of Proper Conduct ................................ GS–15 Step 1 ............... 20/60 59.30 21.35 26.89 

Proficiency Examination ....................................... GS–15 Step 1 ............... 24 59.30 21.35 1,935.60 

Total Cost Per Application ............................. ....................................... ........................ ........................ ........................ 2,290.16 

TABLE 2—TEMPORARY CERTIFICATION PROGRAM: TOTAL COST OF APPLICATION PROCESS

Anticipated number of applicants 

Cost of application 

per applicant 

($) 

Total cost estimate 

($) 

3 ............................................................................................................................................... $2,290.16 $6,870.48 

We based our cost estimates on the 

amount of applicants that we believe 

will apply over the life of the temporary 

certification program. We assume that 

all applicants will apply during the first 

year of the program and thus all 

application costs should be attributed to 

the first year of the program. However, 

based on our projection that the 

temporary certification program will last 

approximately two years and that one or 

two applicants may choose to apply in 

the second year, the annualized cost of 

the application process would be 

$3,435. We invite comments on our 

estimated number of applicants and on 

the costs associated with the proposed 

application process under the temporary 

certification program. 

ii. Costs to the Federal Government 

We have estimated the cost to develop 

the ONC–ATCB application, including 

the development and administration of 


erowe on DSK5CLS3C1PROD with PROPOSALS2
Federal Register / Vol. 75, No. 46 / Wednesday, March 10, 2010 / Proposed Rules 11357 

3 DesRoches, CM et al. Electronic Health Records 

in Ambulatory Care—A National Survey of 

Physicians New England Journal of Medicine July 

2008; 359:50–60. 

4 Jha, AK et al. Use of Electronic Health Records 

in U.S. Hospitals. New England Journal of Medicine 

March 2009; 360:1628–38. 

the proficiency examination to be 

$33,079 based on the 473 hours we 

believe it will take to develop the 

application, prepare standard operating 

procedures as well as create the 

requisite pools of questions for the 

proficiency examinations. More 

specifically, we believe it will take 360 

hours of work of a Federal Salary 

Classification GS–14 Step 1 employee 

located in Washington, DC to develop 

the proficiency examination, 80 hours of 

work by the same employee to develop 

the standard operation procedures and 

the actual application, and 33 hours to 

score all the exams and handle related 

administrative tasks. 

We also anticipate that there would be 

costs associated with reviewing 

applications under the proposed 

temporary certification program. We 

believe that a GS–15 Step 1 employee 

would review the applications and the 

National Coordinator (or designated 

representative) would issue final 

decisions on all applications. We 

anticipate that it would take 

approximately 40 hours to review and 

reach a final decision on each 

application. This estimate assumes a 

satisfactory application (i.e., no formal 

deficiency notifications) and includes 

the time necessary to verify the 

information in each application, assess 

the results of the proficiency 

examination, and prepare a briefing for 

the National Coordinator. We estimate 

the cost for the application review 

process to be $10,140. 

As a result, we estimate the Federal 

government’s overall cost of 

administering the entire application 

process, for the length of the temporary 

certification program, at approximately 

$43,219. Based on our projection that 

the temporary certification program will 

last approximately two years and that 

one or two applicants may choose to 

apply in the second year, the annualized 

cost to the Federal government for 

administering the entire application 

process would be $21,610. 

As previously noted, we will also post 

the names of applicants granted ONC– 

ATCB status on our Web site. We 

believe that there would be minimal 

cost associated with this action and 

have calculated the potential cost to be 

approximately $156 on an annual basis 

for posting and maintaining the 

information on our Web site (a 

maximum of 3 hours of work for a 

Federal Salary Classification GS–12 

Step 1 employee located in Washington, 

DC). 

b. Temporary Certification Program: 

Testing and Certification of Complete 

EHRs and EHR Modules 

Section 3001(c)(5)(A) of the PHSA 

indicates that certification is a voluntary 

act; however, due to the fact that the 

Medicare and Medicaid EHR Incentive 

Programs require eligible professionals 

and eligible hospitals to use Certified 

EHR Technology in order to qualify for 

incentive payments, we anticipate that a 

significant portion of Complete EHR and 

EHR Module developers will seek to 

have their HIT tested and certified. 

In table 3 below, we estimate the costs 

for Complete EHRs and EHR Modules to 

be tested and certified under the 

temporary certification program. As 

discussed in the HIT Standards and 

Certification Criteria interim final rule, 

and to remain consistent with our 

previous estimates (75 FR 2039), we 

believe that approximately 93 

commercially-developed and open 

source Complete EHRs and 50 EHR 

Modules will be tested and certified 

under our proposed temporary 

certification program. In addition to 

these costs, we also take into account 

what we believe will be the costs 

incurred by a small percentage of 

eligible professionals and eligible 

hospitals who themselves will incur the 

costs associated with the testing and 

certification of their self-developed 

Complete EHR or EHR Module. 

With respect to the potential for 

eligible professionals to seek testing and 

certification for a self-developed 

Complete EHR or EHR Module, 

DesRoches approximates that only 5% 

of physicians are in large practices of 

over 50 doctors.3 Of these large 

practices, 17% use an ‘‘advanced EHR 

system’’ that could potentially be tested 

and certified if it were self-developed 

(we assume that smaller physician 

practices do not have the resources to 

self-develop a Complete EHR or EHR 

Module). We are unaware of any reliable 

data on the number of large physicians 

groups who may have a self-developed 

Complete EHR or EHR Module for 

which they would seek to be tested and 

certified. As a result, we request public 

comment on what this percentage may 

be and offer the following estimate 

based on currently available data. We 

believe that the total number of eligible 

professionals in larger practices who 

both possess and would seek to have a 

self-developed Complete EHR or EHR 

Module tested and certified will be 

low—no more than 10%. By taking 

CMS’s estimate of approximately 

450,000 eligible professionals (75 FR 

1960) we multiply through by the 

numbers above (450,000 × .05 × .17 × 

.10) and then divide by a practice size 

of at least 50 which yields 

approximately 8 self-developed 

Complete EHRs or EHR Modules 

designed for an ambulatory setting that 

could be submitted for testing and 

certification. 

With respect to eligible hospitals, 

similar to eligible professionals, we 

believe that only large eligible hospitals 

would be in a position to have selfdeveloped a Complete EHR or EHR 

Module and seek to have it tested and 

certified. Again, we are unaware of any 

reliable data on the number of eligible 

hospitals who may have a selfdeveloped Complete EHR or EHR 

Module for which they would seek to be 

tested and certified. As a result, we 

request public comment on what this 

percentage may be and offer the 

following estimate based on currently 

available data. We estimate that 10% of 

large eligible hospitals have a selfdeveloped Complete EHR or EHR 

Module and that all of theses hospitals 

would seek to have it tested and 

certified. Extrapolating from the AHA 

survey data on hospital adoption 

described by Jha et al. in the New 

England Journal of Medicine, there 

would be only about 300 large hospitals 

with advanced systems and, as a result, 

we believe approximately 30 that would 

be in a position to seek to have a selfdeveloped Complete EHR or EHR 

Module tested and certified.4

We believe that our estimates for 

eligible professionals and eligible 

hospitals are generous and that a good 

portion of the eligible professionals and 

eligible hospitals who would likely seek 

to qualify for incentive payments with 

self-developed Complete EHRs or EHR 

Modules would only do so for 

meaningful use Stage 1. After 

meaningful use Stage 1 we anticipate 

that the number of eligible professionals 

and eligible hospitals who would incur 

the costs of testing and certification 

themselves will go down because the 

effort involved to maintain a Complete 

EHR or EHR Module may be time and 

cost prohibitive as the Secretary 

continues to adopt additional 

certification criteria to support future 

stages of meaningful use. 

Due to the fact that an ONC–ATCB 

will be responsible for testing and 

certifying Complete EHRs and/or EHR 

Modules, we have combined the costs 


erowe on DSK5CLS3C1PROD with PROPOSALS2
11358 Federal Register / Vol. 75, No. 46 / Wednesday, March 10, 2010 / Proposed Rules 

for testing and certification because we 

believe they would be difficult to 

independently estimate. Our cost range 

for the testing and certification of 

Complete EHRs and EHR Modules 

includes consideration of how the 

testing and certification will be 

conducted (i.e., by remote testing and 

certification, on-site testing and 

certification, or at the ONC–ATCB and 

for the complexity of an EHR Module). 

To illustrate, we assume that the on-site 

testing and certification of a Complete 

EHR and the testing and certification of 

a complex EHR Module would both be 

at the high end of their respective cost 

estimates (i.e., $50,000 and $35,000). 

On July 14, 2009, CCHIT testified in 

front of the HIT Policy Committee on 

the topic of EHR certification, including 

the certification of EHR Modules. 

CCHIT estimated that ‘‘EHRcomprehensive’’ (Complete EHRs) 

testing and certification would range 

from approximately $30,000 to $50,000. 

CCHIT also estimated that the testing 

and certification of EHR Modules would 

range from approximately $5,000 to 

$35,000 depending on the scope of the 

testing and certification. We believe that 

these estimates provide a reasonable 

foundation and have used them for our 

cost estimates. However, we assume that 

competition in the testing and 

certification market will reduce the 

costs of testing and certification as 

estimated by CCHIT but we are unable 

to provide a reliable estimate at this 

time of what the potential reduction in 

costs might be. Please also note, that 

because we have limited data on the 

number of self-developed Complete 

EHRs and EHR Modules that will be 

presented for testing and certification, 

we cannot accurately separate the costs 

for the testing and certification of selfdeveloped Complete EHRs from selfdeveloped EHR Modules. As a result, 

we have estimated the lowest possible 

cost by assuming that all of the 

estimated self-developed HIT that will 

be presented for testing and certification 

will be EHR Modules and that they 

would be tested and certified at the 

lowest estimated cost ($5,000 each) and 

then we estimated the highest possible 

cost by assuming that all of the 

estimated self-developed HIT that will 

be presented for testing and certification 

will be Complete EHRs and that they 

would be tested and certified at the 

highest estimated cost ($50,000 each). 

Our cost estimates are expressed in 

Table 3 below. 

TABLE 3—TEMPORARY CERTIFICATION PROGRAM: ESTIMATED COSTS FOR TESTING AND CERTIFICATION

Type 

Number 

tested and 

certified 

Cost per complete EHR/EHR module ($M) Total cost for all complete EHRs/EHR 

modules over 3-year period ($M) 

Low High Mid-point Low High Mid-point 

Commercial/Open Source Complete 

EHR ................................................ 93 $0 .03 $0 .05 $0 .04 $2.79 $4.65 $3.72 

Commercial/Open Source EHR Module ................................................... 50 0 .005 0 .035 0 .02 0.25 1.75 1 

Self-Developed Complete EHRs and 

EHR Modules ................................. 38 0 .005 0 .05 0 .028 0.19 1.90 1.06 

Total ............................................ 181 ...................... ...................... ...................... 3.23 8.30 5.78 

Our estimates cover anticipated 

testing and certification costs under the 

temporary certification program from 

2010 through some portion of 2012 as 

we expect the permanent certification 

program to be operational by 2012. 

However, because we cannot predict the 

exact date at which the temporary 

certification program will sunset (and 

the date at which ONC–ATCBs will 

finish any remaining tests and 

certifications in their queue), we believe 

that it is appropriate to attribute all 2012 

costs for testing and certification to both 

the temporary certification program and 

the permanent certification program to 

err on the side of overestimating rather 

than underestimating the costs of our 

proposals. Therefore, we also attribute 

the 2012 testing and certification costs 

associated with certification criteria 

adopted by the Secretary to support 

meaningful use Stage 1 in section C.2 

below. 

Consistent with our estimates in the 

HIT Standards and Certification Criteria 

interim final rule (75 FR 2041) about 

when Complete EHRs and EHR Modules 

will be prepared for testing and 

certification to the certification criteria 

adopted by the Secretary for meaningful 

use Stage 1, we anticipate that they will 

be tested and certified in the same 

proportions. Therefore, we believe that 

of the total number of Complete EHRs 

and EHR Modules that we have 

estimated (commercial, open source, 

and self-developed), 45% will be tested 

and certified in 2010, 40% will be tested 

and certified in 2011, and 15% will be 

tested and certified in 2012. Table 4 

below represents this proportional 

distribution of the estimated costs we 

calculated for the testing and 

certification of Complete EHRs and EHR 

Modules to the certification criteria 

adopted to support meaningful use 

Stage 1 under the temporary 

certification program as expressed in 

Table 3 above. 

TABLE 4—DISTRIBUTED TOTAL COSTS FOR THE TESTING AND CERTIFICATION OF COMPLETE EHRS AND EHR MODULES

TO STAGE 1 MU BY YEAR (3-YEAR PERIOD)—TOTALS ROUNDED

Year Ratio 

(percent) 

Total low cost 

estimate 

($M) 

Total high cost 

estimate 

($M) 

Total average 

cost estimate 

($M) 

2010 ................................................................................................................. 45 $1.45 $3.74 $2.60 

2011 ................................................................................................................. 40 1.29 3.32 2.31 

2012 ................................................................................................................. 15 0.49 1.24 0.87 

3-Year Totals ............................................................................................ 3.23 8.30 5.78 


erowe on DSK5CLS3C1PROD with PROPOSALS2
Federal Register / Vol. 75, No. 46 / Wednesday, March 10, 2010 / Proposed Rules 11359 

2. Permanent Certification Program 

Estimated Costs 

a. Request for ONC–AA Status 

i. Cost of Submission for Requesting 

ONC–AA Status 

As noted in the collection of 

information section, we believe that 

only two accreditation organizations 

will prepare and submit the information 

sought by the National Coordinator. 

Additionally, as noted in the collection 

of information section, we estimate that 

it will take 1 hour to prepare and submit 

a request for ONC–AA status. We 

believe that an employee equivalent to 

the Federal Salary Classification of GS– 

15 Step 1 would be responsible for 

preparing and submitting the required 

information. 

We have utilized the corresponding 

employee hourly rate for the locality 

pay area of Washington, DC, as 

published by the OPM, to calculate our 

cost estimates. We have also calculated 

the costs of an employee’s benefits 

while preparing and submitting the 

required ONC–AA documentation. We 

have calculated these costs by assuming 

that an accreditation organization 

expends thirty-six percent (36%) of an 

employee’s hourly wage on benefits for 

the employee. We have concluded that 

a 36% expenditure on benefits is an 

appropriate estimate because it is the 

routine percentage used by HHS for 

contract cost estimates. Our cost 

estimates are expressed in the Table 5 

below. 

TABLE 5—PERMANENT CERTIFICATION PROGRAM: COST TO ACCREDITATION ORGANIZATIONS TO SUBMIT THE

INFORMATION REQUIRED TO BECOME AN ONC–AA 

Proposed requirement Employee equivalent Burden 

hours 

Hourly 

wage 

rate 

Cost of employee benefits 

per hour 

Total cost 

per 

applicant 

Submission of Request for ONC–AA Status.GS–15 Step 1 .................................. 1 $59.30 $21.35 $80.65 

Using our estimates above, we believe 

that the cost to submit the information 

required to become an ONC–AA will be 

$81 and the total cost for the two 

accreditation organizations that we 

estimate will submit requests for ONC– 

AA status will be $161. Based on our 

estimate of two accreditation 

organizations submitting the required 

documentation to be considered for 

ONC–AA status and on our proposal 

that we would seek to select an ONC– 

AA every three years, we estimate the 

annualized cost of this process to be 

$54. We welcome comments on our 

estimates for the number of 

accreditation organizations that will 

request ONC–AA status and our cost 

estimates. 

ii. Cost to the Federal Government 

We anticipate that there will be costs 

associated with reviewing the 

information provided by accreditation 

organizations requesting to become an 

ONC–AA under the proposed 

permanent certification program. We 

believe that a GS–15 Step 1 employee 

would review the submissions and the 

National Coordinator (or designated 

representative) would issue final 

decisions on all submissions. We 

anticipate that it would take 10 hours to 

review and reach a final decision on 

each submission. This estimate assumes 

a satisfactory submission (i.e., no formal 

deficiency notifications) and includes 

the time necessary to verify the 

information in each submission and 

prepare a briefing for the National 

Coordinator. We estimate the Federal 

government’s overall cost to review the 

submissions and select an ONC–AA to 

be $1,732. Based on our estimate of two 

accreditation organizations submitting 

the required documentation to be 

considered for ONC–AA status and on 

our proposal that we would seek to 

select an ONC–AA every three years, the 

annualized cost to the Federal 

government for reviewing the 

submissions for ONC–AA status would 

be $577. If we notify the public of the 

selection of the ONC–AA by posting the 

information on our Web site or by 

issuing a press release, we believe that 

we would incur negligible costs from 

these actions. 

b. Application Process for ONC–ACB 

Status and Renewal 

i. Applicant Costs and ONC–ACB 

Renewal Costs 

Similar to the temporary certification 

program, we propose that an applicant 

for ONC–ACB status would be required 

to submit an application. However, 

unlike the temporary certification 

program, we have proposed that 

applicants for ONC–ACB status must be 

accredited in order to be a qualified 

ONC–ACB applicant. We estimate that 

there will be 6 applicants for ONC–ACB 

status under the permanent certification 

program and that those 6 applicants will 

first seek and become accredited by an 

ONC–AA. Because accreditation would 

include a demonstration of conformance 

to Guide 65 for all organizations that 

seek to be accredited, we do not believe 

that there will be a difference in the cost 

of accreditation for organizations who 

seek to become ONC–ACBs for EHR 

Modules versus ONC–ACBs for 

Complete EHRs. 

Based on our consultations with 

NIST, we estimate that it would take 

approximately 2 to 5 days for an ONC– 

AA to complete the accreditation 

process at a cost of $20,000. This cost 

includes an estimated $5,000 

administrative fee and an estimated 

$15,000 fee for the accreditation 

assessment. We expect that the 

accreditation renewal process will occur 

once between 2012 and 2016 for each 

ONC–ACB and assume that the 

accreditation renewal process will be 

less onerous than the initial 

accreditation process because the ONC– 

ACB would presumably apply to the 

same ONC–AA and that the ONC–AA 

would rely on prior information and not 

conduct a completely new review of an 

ONC–ACB. We believe this is a 

reasonable assumption because the 

ONC–AA will likely already be familiar 

with the ONC–ACB and have its 

documentation on file and we do not 

expect that the ONC–ACB would make 

such drastic changes to its policies or 

procedures which would necessitate a 

lengthy assessment of their competency 

by an ONC–AA. Accordingly, we 

estimate that accreditation renewal 

would take no more than 3 days and 

would cost no more than $10,000. These 

estimated costs are expressed in Table 7 

below. 

After becoming accredited by an 

ONC–AA, an applicant for ONC–ACB 

status would incur minimal costs to 

prepare and submit an application to 

the National Coordinator. As noted in 

the collection of information section, we 

believe that it will take 10 minutes to 

provide the general information 

requested in the application, 30 minutes 

to assemble the information necessary to 

provide documentation of accreditation 

by an ONC–AA, and 20 minutes to 


erowe on DSK5CLS3C1PROD with PROPOSALS2
11360 Federal Register / Vol. 75, No. 46 / Wednesday, March 10, 2010 / Proposed Rules 

review and agree to the ‘‘Principles of 

Proper Conduct for ONC–ACBs.’’ 

Based on our consultations with 

NIST, we believe that an employee 

equivalent to the Federal Salary 

Classification of GS–9 Step 1 could 

provide the required general identifying 

information and documentation of 

accreditation status. We believe that an 

employee equivalent to the Federal 

Salary Classification of GS–15 Step 1 

would be responsible for reviewing and 

agreeing to the ‘‘Principles of Proper 

Conduct for ONC–ACBs.’’ We have 

taken these employee assumptions and 

utilized the corresponding employee 

hourly rates for the locality pay area of 

Washington, DC, as published by the 

OPM, to calculate our cost estimates. 

We have also calculated the costs of an 

employee’s benefits while completing 

the application. We have calculated 

these costs by assuming that an 

applicant expends thirty-six percent 

(36%) of an employee’s hourly wage on 

benefits for the employee. We have 

concluded that a 36% expenditure on 

benefits is an appropriate estimate 

because it is the routine percentage used 

by HHS for contract cost estimates. Our 

cost estimates are expressed in Table 6 

below. 

TABLE 6—PERMANENT CERTIFICATION PROGRAM: COST TO APPLICANTS TO APPLY TO BECOME ONC–ACBS AND COST

FOR ONC–ACBS TO APPLY FOR STATUS RENEWAL

Proposed requirement Emloyee equivalent Burden 

hours 

Employee 

hourly 

wage 

rate 

Cost of 

employee 

benefits per 

hour 

Cost per 

applicant 

General Identifying Information .................................... GS–9 Step 1 ..................... 10/60 $22.39 $8.06 $5.07 

Documentation of Accreditation .................................... GS–9 Step 1 ..................... 30/60 22.39 8.06 15.23 

Principles of Proper Conduct ........................................ GS–15 Step 1 ................... 20/60 59.30 21.35 26.89 

Total Cost Per Applicant ....................................... ........................................... .................... .................... ........................ 47.19 

We have estimated the applicant costs 

and ONC–ACB renewal costs through 

2016, but no further, because we believe 

that it is premature to assume how the 

meaningful use requirements post-Stage 

3 will change after the downward 

payment adjustments for eligible 

professionals and eligible hospitals 

become effective (e.g., the incentive 

payment adjustments specified at 

section 1848(a)(7) of the SSA for eligible 

professionals) and what impact, if any, 

those potential changes will have on the 

permanent certification program. Using 

our estimates above, we believe that the 

average initial cost for an applicant to 

become accredited and apply to be an 

ONC–ACB will be approximately 

$20,047 and the total cost for all 6 

applicants will be approximately 

$120,283. We estimate that between 

2012 and 2016 that all applicants will 

renew their ONC–ACB status twice and 

their accreditation once. We assume that 

the costs for an ONC–ACB to renew its 

status with the National Coordinator 

will be similar in burden to its initial 

application. Furthermore, we believe 

that the average cost for an ONC–ACB 

to renew its accreditation and to apply 

for renewal of its ONC–ACB status twice 

would be approximately $10,094 and 

the total renewal costs for all ONC– 

ACBs will be approximately $60,566. 

We estimate that the total costs of the 

accreditation, application and renewal 

processes under the proposed 

permanent certification program 

between 2012 and 2016 would be 

approximately $30,142 per applicant/ 

ONC–ACB and approximately $180,849 

for all applicants/ONC–ACBs. Based on 

our cost estimate timeframe of 5 years 

(2012 through 2016), the annualized 

cost would be $36,170. 

TABLE 7—PERMANENT CERTIFICATION PROGRAM: TOTAL COSTS OF CERTIFICATION ACCREDITATION, APPLYING FOR ONC 

CERTIFICATION AUTHORIZATION, AND ACCREDITATION AND AUTHORIZATION RENEWAL BETWEEN 2012 AND 2016 

Anticipated number of applicants 

Cost of accreditation per applicant 

Cost to apply for 

certification authorization per 

applicant 

Cost to renew 

accreditation per 

applicant 

Cost to 

renew 

ONC–ACB 

status twice 

Total cost estimate per applicant/ONC–ACB 

6 ............................................................................... $20,000 $47.19 $10,000 $94.38 $30,141.57 

Total Cost of Accreditation, Application and 

Renewal ........................................................ ............................ ............................ ............................ .................... 180,849.42 

We invite comments on the number of 

entities that will seek to become 

accredited for certification under our 

proposed permanent certification 

program and the costs associated with 

accreditation, applying for ONC–ACB 

status, the renewal costs for both, and 

the timeframe we used for estimating 

costs. 

ii. Costs to the Federal Government 

We estimate the cost to develop the 

ONC–ACB application to be $350 based 

on the 5 hours of work we believe it 

would take a Federal Salary 

Classification GS–14 Step 1 employee 

located in Washington, DC to develop 

the application form. We also anticipate 

that there would be costs associated 

with reviewing applications under the 

proposed permanent certification 

program. We believe that a GS–15 Step 

1 employee would review the 

applications and the National 

Coordinator (or designated 

representative) would issue final 

decisions on all applications. We 

anticipate that it would take 

approximately 20 hours to review and 

reach a final decision on each 

application. This estimate assumes a 

satisfactory application (i.e., no formal 

deficiency notifications) and includes 

the time necessary to verify the 

information in each application and 

prepare a briefing for the National 

Coordinator. We estimate the cost for 

the application review process to be 

$10,392. As a result, we estimate the 


erowe on DSK5CLS3C1PROD with PROPOSALS2
Federal Register / Vol. 75, No. 46 / Wednesday, March 10, 2010 / Proposed Rules 11361 

Federal government’s overall cost of 

administering the entire application 

process at approximately $10,742. Based 

on our cost estimate timeframe of 5 

years (2012 through 2016), the 

annualized cost to the Federal 

government would be $2,148. 

As previously noted, we would also 

post the names of applicants granted 

ONC–ACB status on our Web site. We 

believe that there would be minimal 

cost associated with this action and 

have calculated the potential cost to be 

approximately $312 on an annual basis 

for posting and maintaining the 

information on our Web site (a 

maximum of 6 hours of work for a 

Federal Salary Classification GS–12 

Step 1 employee located in Washington, 

DC). 

c. Permanent Certification Program: 

Testing and Certification of Complete 

EHRs and EHR Modules 

As with the temporary certification 

program, we estimate below the costs 

that Complete EHR and EHR Module 

developers (commercial, open source, 

self-developed) will incur to have their 

HIT tested and certified between 2012 

and 2016. As previously stated in our 

discussion of the appropriate timeframe 

for estimating costs for the ONC–ACB 

application process, we estimate costs 

through 2016, but no further, because 

we believe that it is premature to 

assume how the meaningful use 

requirements post-Stage 3 will change 

after the Medicare downward payment 

adjustments become effective. Although 

CMS has proposed to promulgate 

updates to the meaningful use stages 

every 2 years, we assume that there 

could be more time between stages (i.e., 

greater than 2 years) in years postmeaningful use Stage 3 based 

evaluations of earlier meaningful use 

stages, public feedback, and other 

factors, which would affect when 

Complete EHRs and/or EHR Modules 

would need to be recertified. However, 

we do expect meaningful use 

requirements between 2012 and 2016, 

which would encompass both Stage 2 

and Stage 3 requirements to become 

more demanding and iterate every 2 

years. Therefore, we can safely assume 

that Complete EHRs and EHR Modules 

will need to be tested and certified 

twice during this time period. 

Even though under the permanent 

certification program the costs for 

testing and certification could 

presumably be attributed to different 

entities (i.e., testing costs to a NVLAPaccredited testing laboratory and 

certification costs to an ONC–ACB) we 

have included them together in an effort 

to reflect the overall effect of this 

rulemaking. As previously mentioned, 

we cannot predict a specific date for 

when the temporary certification 

program will sunset, and thus when 

ONC–ATCBs will finish testing and 

certifying Complete EHRs and/or EHR 

Modules in their queue. Therefore, as 

similarly calculated for the temporary 

certification program costs, we have 

estimated and attributed to the 

permanent certification program’s costs 

the 2012 cost for testing and certifying 

15% of the prior number of Complete 

EHRs and EHR Modules to associated 

meaningful use Stage 1 certification 

criteria. We have done this to account 

for the possibility that the ONC–ACBs 

could be authorized as soon as late 2011 

and thus all testing and certification for 

2012 would take place solely under the 

auspices of the permanent certification 

program. This 15% 2012 cost for testing 

and certification is represented by 15% 

of the number of each type of Complete 

EHR and EHR Module we previously 

estimated would be tested and certified 

to Meaningful Use Stage 1 multiplied by 

the appropriate estimated costs for 

testing and certification. These cost 

estimates are expressed in Table 8 

below. 

TABLE 8—PERMANENT CERTIFICATION PROGRAM: ESTIMATED 2012 COSTS FOR TESTING & CERTIFICATION ASSOCIATED

WITH MEANINGFUL USE STAGE 1 

Type 

Number 

tested and 

certified 

Cost per complete EHR/EHR module ($M) Total cost for all complete EHRs/EHR 

modules over 3-year period ($M) 

Low High Mid-point Low High Mid-point 

Commercial/Open Source Complete EHR ................................... 14 $0 .03 $0 .05 $0 .04 $0 .42 $0.70 $0 .56 

Commercial/Open Source EHR 

Module ........................................ 5 0 .005 0 .035 0 .02 0 .025 0.18 0 .1 

Self-Developed Complete EHRs 

and EHR Modules ...................... 7 0 .005 0 .05 0 .028 0 .035 0.35 0 .2 

Total ........................................ 26 ...................... ...................... ...................... 0 .48 1.23 0 .86 

In creating Tables 9A and 9B below, 

we make the following assumptions: 

• The cost for testing and certification 

will remain the same in the permanent 

certification program as they were in the 

temporary certification program even 

with the additional requirement of 

surveillance on the part of ONC–ACBs 

(which we would expect to be included 

in the cost they charge Complete EHR 

and/or EHR Module developers). We 

believe this is a reasonable assumption 

because of the low and high ranges we 

have estimated. 

• That testing and certification costs 

will be unevenly distributed across 

subsequent years. We assume that there 

will be an increase in the year preceding 

the next stage of meaningful use and a 

decline between stages. We base this 

assumption on the proposal CMS has 

made to make the reporting period for 

meaningful use stages as long as a full 

year which would consequently require 

that eligible professionals and eligible 

hospitals have HIT that meets the 

definition of Certified EHR Technology 

prior to the start of their next reporting 

period in order to complete a full year 

reporting period with Certified EHR 

Technology. We assumed the ratios 

discussed in the temporary certification 

program because the impetus for an 

increase to occur is not same for 

meaningful use Stage 1 as it will be for 

later meaningful use stages. We 

assumed a curve that was relatively flat 

for 2010 and 2011 which subsequently 

tapered down in 2012 because of the 

flexibility provided by the proposed 

reporting period for meaningful use 

Stage 1 (3 to 6 months). This shorter 

reporting period makes it possible for an 

eligible professional or eligible hospital 

to adopt Certified EHR Technology 

during the first half of their first 

meaningful use Stage 1 reporting year 

and still receive an incentive payment if 

they satisfy the reporting requirements. 

With respect to the peak years for when 

testing and certification costs would 


erowe on DSK5CLS3C1PROD with PROPOSALS2
11362 Federal Register / Vol. 75, No. 46 / Wednesday, March 10, 2010 / Proposed Rules 

most likely occur, we assume that those 

peak years will be 2012 and 2014, the 

years preceding meaningful use Stages 2 

and 3, respectively. We assume that an 

increase would encompass 85% of the 

Complete EHRs and EHR Modules to be 

certified, which would represent most, 

if not all, previously certified Complete 

EHRs and EHR Modules and that the 

remaining 15% of testing and 

certification costs for 2013 would likely 

represent new EHR Module entrants to 

the HIT marketplace and Complete EHR 

or EHR Module developers who were 

late to get certified. 

• As indicated in the HIT Standards 

and Certification Criteria interim final 

rule, we assume that Complete EHR 

developers would continue to 

consolidate due to mergers and 

acquisitions and that this consolidation 

would occur at a rate of 5% between 

meaningful use stages. Therefore, we 

believe that fewer Complete EHRs will 

need to be tested and certified prior to 

each meaningful use stage. 

• Conversely, we assume that the 

number of EHR Modules developed that 

would need to be tested and certified to 

meet associated meaningful use Stage 2 

(2013) certification criteria and beyond 

will grow at a rate of 20% between 

meaningful use stages (i.e., based on our 

prior estimate of 50 EHR Modules 

between 2010 and 2012, there would be 

10 new modules developed during 2012 

and during meaningful use Stage 2 to 

meet certification criteria associated 

with meaningful use Stage 2). We 

believe our growth rate is reasonable 

because the cost barrier for EHR 

Modules to enter the market would be 

much less than a Complete EHR. 

Coupled with the ability of small or 

start-up HIT developers to enter the 

market we believe that the potential of 

EHR Modules would lead to a constant 

stream of new entrants year after year. 

• The number of eligible 

professionals and eligible hospitals that 

incur the testing and certification costs 

for their self-developed Complete EHRs 

and/or EHR Modules for meaningful use 

Stage 2 will drop by 50% in 2012 and 

another 25% in 2014 and level out after 

2014 due to our assumption, that by 

2014, and the impending start of 

meaningful use Stage 3, that all of the 

eligible professionals and eligible 

hospitals who still have a selfdeveloped Complete EHR or EHR 

Module are likely to maintain their HIT 

rather than switch to a commercial 

product. 

Table 9A illustrates the overall costs 

for testing and certification associated 

with meaningful use Stage 2. We have 

factored in the assumed 5% reduction 

in the number of Complete EHRs and 

20% increase in EHR Modules 

presented for testing and certification to 

meet the certification criteria associated 

with meaningful use Stage 2. That is, we 

believe there will be approximately 88 

unique Complete EHRs and 60 EHR 

Modules that will be tested and 

certified. We also separately factor in 

the 50% reduction to the number of selfdeveloped Complete EHRs and EHR 

Modules that will be tested and certified 

to meet the certification criteria 

associated with meaningful use Stage 2. 

TABLE 9A—PERMANENT CERTIFICATION PROGRAM: ESTIMATED OVERALL COSTS FOR TESTING & CERTIFICATION

ASSOCIATED WITH MEANINGFUL USE STAGE 2 

Type 

Number 

tested and 

certified 

Cost per complete EHR/EHR module ($M) Total cost for all complete EHRs/EHR 

modules over 3-year period ($M) 

Low High Mid-point Low High Mid-point 

Commercial/Open Source Complete EHR ................................... 88 $0 .03 $0 .05 $0 .04 $2 .64 $4.40 $3 .52 

Commercial/Open Source EHR 

Module ........................................ 60 0 .005 0 .035 0 .02 0 .30 2.10 1 .2 

Self-Developed Complete EHRs 

and EHR Modules ...................... 19 0 .005 0 .05 0 .028 0 .095 0.95 0 .53 

Total ........................................ 167 ...................... ...................... ...................... 3 .04 7.45 5 .25 

Table 9B illustrates the overall costs 

for testing and certification associated 

with meaningful use Stage 3. We have 

again factored in the assumed 5% 

reduction in the number of Complete 

EHRs and 20% increase in EHR 

Modules presented for testing and 

certification to meet the certification 

criteria associated with meaningful use 

Stage 3. That is, we believe there will be 

approximately 84 unique Complete 

EHRs and 72 EHR Modules that will be 

tested and certified. We also separately 

factor in the 25% reduction to the 

number of self-developed Complete 

EHRs and EHR Modules that will be 

tested and certified to meet the 

certification criteria associated with 

meaningful use Stage 3. 

TABLE 9B—PERMANENT CERTIFICATION PROGRAM: ESTIMATED OVERALL COSTS FOR TESTING & CERTIFICATION

ASSOCIATED WITH MEANINGFUL USE STAGE 3 

Type 

Number 

tested and 

certified 

Cost per complete EHR/EHR module ($M) Total cost for all complete EHRs/EHR 

modules over 3-year period ($M) 

Low High Mid-point Low High Mid-point 

Commercial/Open Source Complete 

EHR ................................................ 84 $0 .03 $0 .05 $0 .04 $2.52 $4.20 $3.36 

Commercial/Open Source EHR Module ................................................... 72 0 .005 0 .035 0 .02 0.36 2.52 1.44 

Self-Developed Complete EHRs and 

EHR Modules ................................. 14 0 .005 0 .05 0 .028 0.07 0.70 0.39 

Total ............................................ 170 ...................... ...................... ...................... 2.95 7.42 5.19 


erowe on DSK5CLS3C1PROD with PROPOSALS2
Federal Register / Vol. 75, No. 46 / Wednesday, March 10, 2010 / Proposed Rules 11363 

Finally, Table 9C illustrates the 85% 

and 15% testing and certification cost 

distributions we estimate would be 

attributable to meaningful use Stages 2 

and 3 (i.e., between 2012 and 2016) 

under the permanent certification 

program. Additionally, we assume that 

100% of self-developed Complete EHRs 

and EHR Modules would be certified in 

year that precedes the next meaningful 

use stage (i.e., 2012 and 2014) because 

eligible professionals and eligible 

hospitals who remain self-developers 

will be motivated to ensure that their 

HIT can meet the definition of Certified 

EHR Technology prior to the beginning 

of a new meaningful use stage in order 

to avoid missing out on the incentives 

or being subject to downward payment 

adjustments. As a result, the costs for 

self-developers to get their Complete 

EHRs or EHR Modules are only 

attributed in Table 9C to the years 2012 

and 2014. The totals multiplied by their 

respective percentages are derived from 

Tables 9A and 9B above. 

TABLE 9C—PERMANENT CERTIFICATION PROGRAM: ESTIMATED OVERALL COSTS FOR TESTING & CERTIFICATION

ASSOCIATED WITH MEANINGFUL USE STAGES 2 AND 3 ACCOUNTING FOR DISTRIBUTED COSTS

Meaningful use 

stage Year(s) Percentage Type Low ($M) 

High 

($M) 

Mid-point 

($M) 

Stage 2 ............. 2012 85 Complete EHRs/EHR Modules ....... $2 .50 $5 .53 $4 .01 

100 Self-Developed ............................... 0 .095 0 .95 0 .53 

2013/2014 15 Complete EHRs/EHR Modules ....... 0 .44 0 .98 0 .71 

0 Self-Developed ............................... 0 0 0 

Stage 3 ............. 2014 85 Complete EHRs/EHR Modules ....... 2 .45 5 .71 4 .08 

100 Self-Developed ............................... 0 .07 0 .70 0 .39 

2015/2016 15 Complete EHRs/EHR Modules ....... 0 .43 1 .01 0 .72 

0 Self-Developed ............................... 0 0 0 

3. Costs for Collecting, Storing, and 

Reporting Certification Results Under 

the Temporary and Permanent 

Certification Programs 

a. Costs to ONC–ATCBs and ONC–ACBs 

Under both of the proposed 

certification programs we propose to 

require ONC–ATCBs and ONC–ACBs to 

provide ONC, no less frequently than 

weekly, an up-to-date list of Complete 

EHRs and/or EHR Modules that have 

been tested and certified which include, 

at a minimum, the vendor name (if 

applicable), the date certified, the 

product version, the unique certification 

number or other specific product 

identification, and where applicable, the 

certification criterion or certification 

criteria to which each EHR Module has 

been tested and certified. 

As stated in the collection of 

information section, we anticipate 

requiring the reporting of this 

information on a weekly basis and that 

it will take ONC–ATCBs and ONC– 

ACBs about an hour to prepare and 

electronically transmit the information 

to ONC each week (i.e., respondents 

will respond 52 times per year). 

We believe that an employee 

equivalent to the Federal Classification 

of GS–9 Step 1 could complete the 

transmissions of the requested 

information to ONC under both 

proposed certification programs. We 

have utilized the corresponding 

employee hourly rate for the locality 

pay area of Washington, DC, as 

published by OPM, to calculate our cost 

estimates. We have also calculated the 

costs of the employee’s benefits while 

completing the transmissions of the 

requested information. We have 

calculated these costs by assuming that 

an ONC–ATCB or ONC–ACB expends 

thirty-six percent (36%) of an 

employee’s hourly wage on benefits for 

the employee. We have concluded that 

a 36% expenditure on benefits is an 

appropriate estimate because it is the 

routine percentage used by HHS for 

contract cost estimates. Our cost 

estimates are expressed in Table 10 

below. 

TABLE 10—ANNUAL COSTS FOR ONC–ATCBS AND ONC–ACBS TO REPORT CERTIFICATIONS TO ONC 

Proposed program requirement Employee 

equivalent 

Annual burden 

hours per 

ONC–ATCBs/ 

ONC–ACBs 

Employee 

hourly wage 

rate 

Cost of 

employee 

benefits per 

hour 

Total cost per 

ONC–ATCB/ 

ONC–ACB 

ONC–ATCB Certification Results ........................................ GS–9 Step 1 52 $22.39 $8.06 $1,583.40 

ONC–ACB Certification Results .......................................... GS–9 Step 1 52 22.39 8.06 1,583.40 

To estimate the highest possible 

burden, we assume that all of the 

estimated applicants that we anticipate 

will apply under our proposed 

certification programs will become 

ONC–ATCBs and ONC–ACBs. 

Therefore, we estimate the total annual 

reporting cost under the temporary 

certification program to be $4,750 and 

the total annual reporting cost under the 

permanent certification program to be 

$9,500. 

We believe that the proposed 

requirements for ONC–ATCBs to retain 

certification records for the length of the 

temporary certification program and for 

ONC–ACBs to retain certification 

records for 5 years under the permanent 

certification program are in line with 

common industry practices and, 

consequently, would not represent 


erowe on DSK5CLS3C1PROD with PROPOSALS2
11364 Federal Register / Vol. 75, No. 46 / Wednesday, March 10, 2010 / Proposed Rules 

5http://sba.gov/idc/groups/public/documents/ 

sba_homepage/serv_sstd_tablepdf.pdf. 

6See 13 CFR 121.201. 

7The SBA references that annual receipts means 

‘‘total income’’ (or in the case of a sole 

proprietorship, ‘‘gross income’’) plus ‘‘cost of goods 

sold’’ as these terms are defined and reported on 

Internal Revenue Service tax return forms. http:// 

www.sba.gov/idc/groups/public/documents/ 

sba_homepage/guide_to_size_standards.pdf. 

additional costs to ONC–ATCBs and 

ONC–ACBs as a result of this rule. 

b. Costs to the Federal Government 

As stated previously in this rule, we 

propose, under both certification 

programs, to post a comprehensive list 

of all Certified EHR Technology on our 

Web site. We believe that there would 

be minimal cost associated with this 

action and have calculated the potential 

cost, including weekly updates, to be 

$5,392 on an annualized basis. This 

amount is based on 104 hours of yearly 

work of a Federal Salary Classification 

GS–12 Step 1 employee located in 

Washington, DC. 

4. Temporary and Permanent 

Certification Program Benefits 

We believe that several benefits will 

accrue from the establishment of both a 

temporary certification program and 

permanent certification program. The 

temporary certification program would 

allow for the rapid influx of Complete 

EHRs and EHR Modules to be tested and 

certified at a sufficient pace for eligible 

professionals and eligible hospitals to 

adopt and implement Certified EHR 

Technology for meaningful use Stage 1 

and thus potentially qualify for 

incentive payments under the CMS 

Medicare and Medicaid EHR Incentive 

Programs proposed rule. The time 

between the temporary certification 

program and the permanent certification 

program will permit the HIT industry 

the time it needs for NLVAP-accredited 

testing laboratories to come forward, for 

an ONC–AA to be approved and for 

additional applicants for ONC–ACB 

status to come forward. We believe that 

the permanent certification program 

will provide more opportunities for 

private sector entities to participate in 

the testing and certification of HIT and 

instill more confidence in what it means 

for HIT to be certified because more 

rigorous and objective processes will be 

in place. We further believe that both 

programs will meet our overall goals of 

accelerating health IT adoption and 

increasing levels of interoperability. At 

this time, we cannot predict how fast all 

of these savings will occur or their 

precise magnitude as they are partly 

dependent on future final rules for 

meaningful use and the subsequent 

standards and certification criteria 

adopted by the Secretary. 

D. Regulatory Flexibility Act 

The RFA requires agencies to analyze 

options for regulatory relief of small 

businesses if a rule has a significant 

impact on a substantial number of small 

entities. For more information on the 

Small Business Administration’s 

(SBA’s) size standards, see the SBA’s 

Web site.5 For purposes of the RFA, 

small entities include small businesses, 

nonprofit organizations, and small 

governmental jurisdictions. When 

conducting a RFA we are required to 

assess the potential effects of our 

proposed rule on small entities and to 

make every effort to minimize the 

regulatory burden that might be 

imposed on small entities. We believe 

that the entities that are likely to be 

directly affected by this proposed rule 

are applicants for ONC–ATCB and 

ONC–ACB status. Furthermore, we 

believe that these entities would either 

be classified under the North American 

Industry Classification System (NAICS) 

codes 541380 (Testing Laboratories) or 

541990 (Professional, Scientific and 

Technical Services).6 As previously 

mentioned, we believe that there will be 

3 applicants for ONC–ATCB status and 

6 applicants for ONC–ACB status. 

According to the NAICS codes 

identified above, this would mean SBA 

size standards of $12 million and $7 

million in annual receipts, 

respectively.7 Because this segment of 

the HIT industry is in a nascent stage 

and is comprised of very few entities, 

we have been unable to find reliable 

data from which to determine what 

realistic annual receipts would be. 

However, based on our total estimates 

for Complete EHRs and EHR Modules to 

be tested and certified, we assume that 

the annual receipts of any one ONC– 

ATCB or ONC–ACB could be in the low 

millions of dollars. Moreover, it is 

unclear, whether these entities may be 

involved in other testing and 

certification programs which would 

increase their annual receipts and 

potentially place them outside the 

SBA’s size standards. 

We believe that we have proposed the 

minimum amount of requirements 

necessary to accomplish our policy 

goals and that no appropriate regulatory 

alternatives could be developed to 

lessen the compliance burden for 

applicants for ONC–ATCB and ONC– 

ACB status as well as ONC–ATCBs and 

ONC–ACBs once they have been granted 

such status by the National Coordinator. 

Moreover, we believe that this proposed 

rule will create direct positive effects for 

entities because their attainment of 

ONC–ATCB or ONC–ACB status will 

permit them to test and certify Complete 

EHRs and/or EHR Modules. Thus, we 

expect that their annual receipts will 

increase as a result of becoming an 

ONC–ATCB or ONC–ACB. 

Based on our analysis and discussion 

above, we have examined the economic 

implications of this proposed rule and 

do not believe that it will have a 

significant impact on a substantial 

number of small entities. The Secretary 

certifies that this proposed rule will not 

have a significant impact on a 

substantial number of small entities. 

E. Executive Order 13132—Federalism 

Executive Order 13132 establishes 

certain requirements that an agency 

must meet when it promulgates a 

proposed rule (and subsequent final 

rule) that imposes substantial direct 

requirement costs on State and local 

governments, preempts State law, or 

otherwise has federalism implications. 

Nothing in this proposed rule imposes 

substantial direct requirement costs on 

State and local governments, preempts 

State law or otherwise has federalism 

implications. We are not aware of any 

State laws or regulations that conflict 

with or are impeded by either of our 

proposed certification programs. This 

proposed rule affords all States an 

opportunity to identify any problems 

that our temporary or permanent 

certification programs would create, and 

to propose constructive alternatives. We 

welcome comments from State and local 

governments. 

F. Unfunded Mandates Reform Act of 

1995 

Title II of the Unfunded Mandates 

Reform Act of 1995 (Pub. L. 104–4) 

requires cost-benefit and other analyses 

before any rulemaking if the rule 

includes a ‘‘Federal mandate that may 

result in the expenditure by State, local, 

and Tribal governments, in the 

aggregate, or by the private sector, of 

$100,000,000 or more (adjusted 

annually for inflation) in any 1 year.’’ 

The current inflation-adjusted statutory 

threshold is approximately $133 

million. We have determined that this 

proposed rule which encompasses our 

proposals for both the temporary and 

permanent certification programs would 

not constitute a significant rule under 

the Unfunded Mandates Reform Act, 

because it would impose no mandates. 

OMB reviewed this proposed rule. 

List of Subjects in 45 CFR Part 170 

Computer technology, Electronic 

health record, Electronic information 

system, Electronic transactions, Health, 

Health care, Health information 


erowe on DSK5CLS3C1PROD with PROPOSALS2
Federal Register / Vol. 75, No. 46 / Wednesday, March 10, 2010 / Proposed Rules 11365 

technology, Health insurance, Health 

records, Hospitals, Incorporation by 

reference, Laboratories, Medicaid, 

Medicare, Privacy, Reporting and 

recordkeeping requirements, Public 

health, Security. 

For the reasons set forth in the 

preamble, the Department proposes to 

amend 45 CFR subtitle A, subchapter D, 

part 170, as follows: 

PART 170—HEALTH INFORMATION 

TECHNOLOGY STANDARDS, 

IMPLEMENTATION SPECIFICATIONS, 

AND CERTIFICATION CRITERIA AND 

CERTIFICATION PROGRAMS FOR 

HEALTH INFORMATION 

TECHNOLOGY 

1. The authority citation for part 170 

is revised to read as follows: 

Authority: 42 U.S.C 300jj–11; 42 U.S.C 

300jj–14; 5 U.S.C. 552. 

2. In § 170.102, add in alphabetical 

order the definition of ‘‘Day or Day(s)’’ 

to read as follows: 

§ 170.102 Definitions. 

* * * * * 

Day or Days means a calendar day or 

calendar days. 

* * * * * 

3. Add a new subpart D to part 170 

to read as follows: 

Subpart D—Temporary Certification 

Program for HIT 

Sec. 

170.400 Basis and scope. 

170.401 Applicability. 

170.402 Definitions. 

170.405 Correspondence. 

170.410 Types of testing and certification. 

170.415 Application prerequisite. 

170.420 Application. 

170.423 Principles of proper conduct for 

ONC–ATCBs. 

170.425 Application submission. 

170.430 Review of application. 

170.435 ONC–ATCB application 

reconsideration. 

170.440 ONC–ATCB status. 

170.445 Complete EHR testing and 

certification. 

170.450 EHR Module testing and 

certification. 

170.455 Testing and certification to newer 

versions of certain standards. 

170.457 Authorized testing and certification 

methods. 

170.460 Good standing as an ONC–ATCB. 

170.465 Revocation of authorized testing 

and certification body status. 

170.470 Effect of revocation on the 

certifications issued to complete EHRs 

and EHR Modules. 

170.490 Sunset of the temporary 

certification program. 

Subpart D—Temporary Certification 

Program for HIT 

§ 170.400 Basis and scope. 

This subpart implements section 

3001(c)(5) of the Public Health Service 

Act, and sets forth the rules and 

procedures related to the temporary 

certification program for health 

information technology administered by 

the National Coordinator for Health 

Information Technology. 

§ 170.401 Applicability. 

This subpart establishes the processes 

that applicants for ONC–ATCB status 

must follow to be granted ONC–ATCB 

status by the National Coordinator, the 

processes the National Coordinator will 

follow when assessing applicants and 

granting ONC–ATCB status, and the 

requirements of ONC–ATCBs for testing 

and certifying Complete EHRs and/or 

EHR Modules in accordance with the 

applicable certification criteria adopted 

by the Secretary in subpart C of this 

part. 

§ 170.402 Definitions. 

For the purposes of this subpart: 

Applicant means a single organization 

or a consortium of organizations that 

seeks to become an ONC–ATCB by 

requesting and subsequently submitting 

an application for ONC–ATCB status to 

the National Coordinator. 

ONC–ATCB or ONC–Authorized 

Testing and Certification Body means an 

organization or a consortium of 

organizations that has applied to and 

been authorized by the National 

Coordinator pursuant to this subpart to 

perform the testing and certification of 

Complete EHRs and/or EHR Modules 

under the temporary certification 

program. 

§ 170.405 Correspondence. 

(a) Correspondence and 

communication with the National 

Coordinator shall be conducted by email, unless otherwise necessary. The 

official date of receipt of any e-mail 

between the National Coordinator and 

an applicant for ONC–ATCB status or an 

ONC–ATCB is the day the e-mail was 

sent. 

(b) In circumstances where it is 

necessary for an applicant for ONC– 

ATCB status to correspond or 

communicate with the National 

Coordinator by regular or express mail, 

the official date of receipt will be the 

date of the delivery confirmation. 

§ 170.410 Types of testing and 

certification. 

Applicants may seek authorization 

from the National Coordinator to 

perform the following types of testing 

and certification: 

(a) Complete EHR testing and 

certification; and/or 

(b) EHR Module testing and 

certification. 

§ 170.415 Application prerequisite. 

Applicants must request in writing an 

application for ONC–ATCB status from 

the National Coordinator. Applicants 

must indicate: 

(a) The type of authorization sought 

pursuant to § 170.410; and 

(b) If seeking authorization to perform 

EHR Module testing and certification, 

the specific type(s) of EHR Module(s) 

they seek authorization to test and 

certify. If qualified, applicants will only 

be granted authorization to test and 

certify the types of EHR Modules for 

which they seek authorization. 

§ 170.420 Application. 

The application for ONC–ATCB status 

consists of two parts. Applicants must 

complete both parts of the application 

in their entirety and submit them to the 

National Coordinator for the application 

to be considered complete. 

(a) Part 1. An applicant must provide 

all of the following: 

(1) General identifying information 

including: 

(i) Name, address, city, State, zip 

code, and Web site of applicant; and 

(ii) Designation of an authorized 

representative, including name, title, 

phone number, and e-mail address of 

the person who will serve as the 

applicant’s point of contact. 

(2) Documentation of the completion 

and results of a self-audit against all 

sections of ISO/IEC Guide 65:1996, and 

the following: 

(i) A description of the applicant’s 

management structure according to 

section 4.2 of ISO/IEC Guide 65:1996; 

(ii) A copy of the applicant’s quality 

manual that has been developed 

according to section 4.5.3 of ISO/IEC 

Guide 65:1996; 

(iii) A copy of the applicant’s policies 

and approach to confidentiality 

according to section 4.10 of ISO/IEC 

Guide 65:1996; 

(iv) A copy of the qualifications of 

each of the applicant’s personnel who 

oversee or perform certification 

according to section 5.2 of ISO/IEC 

Guide 65:1996; 

(v) A copy of the applicant’s 

evaluation reporting procedures 

according to section 11 of ISO/IEC 

Guide 65:1996; and 

(vi) A copy of the applicant’s policies 

for use and display of certificates 

according to section 14 of ISO/IEC 

Guide 65:1996. 


erowe on DSK5CLS3C1PROD with PROPOSALS2
11366 Federal Register / Vol. 75, No. 46 / Wednesday, March 10, 2010 / Proposed Rules 

(3) Documentation of the completion 

and results of a self-audit against all 

sections of ISO/IEC 17025:2005, and the 

following: 

(i) A copy of the applicant’s quality 

system document according to section 

4.2.2 of ISO/IEC 17025:2005; 

(ii) A copy of the applicant’s policies 

and procedures for handling testing 

nonconformities according to section 

4.9.1 of ISO/IEC 17025:2005; and 

(iii) The qualifications of each of the 

applicant’s personnel who oversee or 

conduct testing according to section 5.2 

of ISO/IEC 17025:2005. 

(4) An agreement, properly executed 

by the applicant’s authorized 

representative, that it will adhere to the 

Principles of Proper Conduct for ONC– 

ATCBs. 

(b) Part 2. An applicant must submit 

a completed proficiency examination. 

§ 170.423 Principles of proper conduct for 

ONC–ATCBs. 

An ONC–ATCB shall: 

(a) Operate its certification program in 

accordance with ISO/IEC Guide 65:1996 

and testing program in accordance with 

ISO/IEC 17025:2005; 

(b) Maintain an effective quality 

management system which addresses all 

requirements of ISO/IEC 17025:2005; 

(c) Attend all mandatory ONC training 

and program update sessions; 

(d) Maintain a training program that 

includes documented procedures and 

training requirements to ensure its 

personnel are competent to test and 

certify Complete EHRs and/or EHR 

Modules; 

(e) Use testing tools and procedures 

published by NIST or functionally 

equivalent testing tools and procedures 

published by another entity for the 

purposes of assessing Complete EHRs 

and/or EHR Modules compliance with 

the certification criteria adopted by the 

Secretary; 

(f) Report to ONC within 15 days any 

changes that materially affect its: 

(1) Legal, commercial, organizational, 

or ownership status; 

(2) Organization and management, 

including key testing and certification 

personnel; 

(3) Policies or procedures; 

(4) Location; 

(5) Facilities, working environment or 

other resources; 

(6) ONC authorized representative 

(point of contact); or 

(7) Other such matters that may 

otherwise materially affect its ability to 

test and certify Complete EHRs and/or 

EHR Modules; 

(g) Allow ONC, or its authorized 

agents(s), to periodically observe on site 

(unannounced or scheduled) during 

normal business hours, any testing and/ 

or certification performed to 

demonstrate compliance with the 

requirements of the temporary 

certification program; 

(h) Provide ONC, no less frequently 

than weekly, a current list of Complete 

EHRs and/or EHR Modules that have 

been tested and certified which 

includes, at a minimum, the vendor 

name (if applicable), the date certified, 

product version, the unique certification 

number or other specific product 

identification, and where applicable, the 

certification criterion or certification 

criteria to which each EHR Module has 

been tested and certified; 

(i) Retain all records related to the 

testing and certification of Complete 

EHRs and/or EHR Modules for the 

duration of the temporary certification 

program and provide copies of all 

testing and certification records to ONC 

at the sunset of the temporary 

certification program; and 

(j) Promptly refund any and all fees 

received for tests and certifications that 

will not be completed. 

§ 170.425 Application submission. 

(a) An applicant for ONC–ATCB 

status must submit its application either 

electronically via e-mail (or Web 

submission if available), or by regular or 

express mail. 

(b) An application for ONC–ATCB 

status may be submitted to the National 

Coordinator at any time during the 

existence of the temporary certification 

program. 

§ 170.430 Review of application. 

(a) Method of review and review 

timeframe. 

(1) Applications will be reviewed in 

the order they are received. 

(2) The National Coordinator will 

review Part 1 of the application and 

determine whether Part 1 of the 

application is complete and satisfactory 

before proceeding to review Part 2 of the 

application. 

(3) The National Coordinator is 

permitted up to 30 days to review an 

application (submitted for the first time) 

upon receipt. 

(b) Application deficiencies. 

(1) If the National Coordinator 

identifies an area in an application that 

requires the applicant to clarify a 

statement or correct an inadvertent error 

or minor omission, the National 

Coordinator may contact the applicant 

to make such clarification or correction 

without issuing a deficiency notice. If 

the National Coordinator has not 

received the requested information after 

five days, the applicant may be issued 

a deficiency notice specifying the error, 

omission, or deficient statement. 

(2) If the National Coordinator 

determines that deficiencies in either 

part of the application exist, the 

National Coordinator will issue a 

deficiency notice to the applicant and 

return the application. The deficiency 

notice will identify the areas of the 

application that require additional 

information or correction. 

(c) Revised application. 

(1) An applicant is permitted to 

submit a revised application in response 

to a deficiency notice. 

(2) In order to continue to be 

considered for ONC–ATCB status, an 

applicant’s revised application must 

address the specified deficiencies and 

be received by the National Coordinator 

within 15 days of the applicant’s receipt 

of the deficiency notice. 

(3) The National Coordinator is 

permitted up to 15 days to review a 

revised application once it has been 

received. 

(4) If the National Coordinator 

determines that a revised application 

still contains deficiencies, the applicant 

will be issued a denial notice indicating 

that the applicant will no longer be 

considered for authorization under the 

temporary certification program. An 

applicant may request reconsideration 

of this decision in accordance with 

§ 170.435. 

(d) Satisfactory application. 

(1) An application will be deemed 

satisfactory if it meets all application 

requirements, including a passing score 

on the proficiency examination. 

(2) The National Coordinator will 

notify the applicant’s authorized 

representative of its satisfactory 

application and its successful 

achievement of ONC–ATCB status. 

(3) Once notified by the National 

Coordinator of its successful 

achievement of ONC–ATCB status, the 

applicant may represent itself as an 

ONC–ATCB and begin testing and 

certifying Complete EHRs and/or EHR 

Modules consistent with its 

authorization. 

§ 170.435 ONC–ATCB application 

reconsideration. 

(a) An applicant may request that the 

National Coordinator reconsider a 

denial notice issued for each part of an 

application only if the applicant can 

demonstrate that clear, factual errors 

were made in the review of the 

applicable part of the application and 

that the errors’ correction could lead to 

the applicant obtaining ONC–ATCB 

status. 

(b) Submission requirement. An 

applicant is required to submit, within 

15 days of receipt of a denial notice, a 

written statement to the National 


erowe on DSK5CLS3C1PROD with PROPOSALS2
Federal Register / Vol. 75, No. 46 / Wednesday, March 10, 2010 / Proposed Rules 11367 

Coordinator contesting the decision to 

deny its application and explaining 

with sufficient documentation what 

factual errors it believes can account for 

the denial. If the National Coordinator 

does not receive the applicant’s 

submission within the specified 

timeframe, its reconsideration request 

may be rejected. 

(c) Reconsideration request review. If 

the National Coordinator receives a 

timely reconsideration request, the 

National Coordinator is permitted up to 

15 days from the date of receipt to 

review the information submitted by the 

applicant and issue a decision. 

(d) Decision. 

(1) If the National Coordinator 

determines that clear, factual errors 

were made during the review of the 

application and that correction of the 

errors would remove all identified 

deficiencies, the applicant’s authorized 

representative will be notified of the 

National Coordinator’s decision to 

reverse the previous decision(s) not to 

approve part of the applicant’s 

application or the entire application. 

(i) If the National Coordinator’s 

decision to reverse the previous 

decision(s) affected part 1 of an 

application, the National Coordinator 

will subsequently review part 2 of the 

application. 

(ii) If the National Coordinator’s 

decision to reverse the previous 

decision(s) affected part 2 of an 

application, the applicant’s authorized 

representative will be notified of the 

National Coordinator’s decision as well 

as the applicant’s successful 

achievement of ONC–ATCB status. 

(2) If, after reviewing an applicant’s 

reconsideration request, the National 

Coordinator determines that the 

applicant did not identify any factual 

errors or that correction of those factual 

errors would not remove all identified 

deficiencies in the application, the 

National Coordinator may reject the 

applicant’s reconsideration request. 

(3) Final decision. A reconsideration 

decision issued by the National 

Coordinator is final and not subject to 

further review. 

§ 170.440 ONC–ATCB status. 

(a) Acknowledgement and 

publication. The National Coordinator 

will acknowledge and make publicly 

available the names of ONC–ATCBs, 

including the date each was authorized 

and the type(s) of testing and 

certification each has been authorized to 

perform. 

(b) Representation. Each ONC–ATCB 

must prominently and unambiguously 

identify on its Web site and in all 

marketing and communications 

statements (written and oral) the scope 

of its authorization. 

(c) Renewal. ONC–ATCB status does 

not need to be renewed during the 

temporary certification program. 

(d) Expiration. The status of all ONC– 

ATCBs will expire upon the sunset of 

the temporary certification program in 

accordance with § 170.490. 

§ 170.445 Complete EHR testing and 

certification. 

(a) To be authorized to test and certify 

Complete EHRs under the temporary 

certification program, an ONC–ATCB 

must be capable of testing and certifying 

Complete EHRs to all applicable 

certification criteria adopted by the 

Secretary at subpart C of this part. 

(b) An ONC–ATCB that has been 

authorized to test and certify Complete 

EHRs is also authorized to test and 

certify all EHR Modules under the 

temporary certification program. 

§ 170.450 EHR module testing and 

certification. 

(a) When testing and certifying EHR 

Modules, an ONC–ATCB must test and 

certify in accordance with the 

applicable certification criterion or 

certification criteria adopted by the 

Secretary at subpart C of this part. 

(b) EHR Modules are required to be 

tested and certified to at least one 

certification criterion. 

(c) Privacy and security testing and 

certification. EHR Modules shall be 

tested and certified to all privacy and 

security certification criteria adopted by 

the Secretary unless the EHR Module(s) 

is/are presented for testing and 

certification in one of the following 

manners: 

(1) The EHR Module(s) are presented 

for testing and certification as a precoordinated, integrated ‘‘bundle’’ of EHR 

Modules, which could otherwise 

constitute a Complete EHR. In such 

instances, the EHR Module(s) shall be 

tested and certified in the same manner 

as a Complete EHR. Pre-coordinated 

bundles of EHR Module(s) which 

include EHR Module(s) that would not 

be part of a local system and under the 

end user’s direct control are excluded 

from this exception. The constituent 

EHR Modules of such an integrated 

bundle must be separately tested and 

certified to all privacy and security 

certification criteria; 

(2) An EHR Module is presented for 

testing and certification, and the 

presenter can demonstrate to the ONC– 

ATCB that it would be technically 

infeasible for the EHR Module to be 

tested and certified in accordance with 

some or all of the privacy and security 

certification criteria; or 

(3) An EHR Module is presented for 

testing and certification, and the 

presenter can demonstrate to the ONC– 

ATCB that the EHR Module is designed 

to perform a specific privacy and 

security capability. In such instances, 

the EHR Module may only be tested and 

certified in accordance with the 

applicable privacy and security 

certification criterion/criteria. 

(d) ONC–ATCBs authorized to test 

and certify EHR Modules must clearly 

indicate the certification criterion or 

certification criteria to which an EHR 

Module has been tested and certified in 

its certification documentation. 

§ 170.455 Testing and certification to 

newer versions of certain standards. 

(a) ONC–ATCBs may test and certify 

Complete EHRs and EHR Modules to a 

newer version of certain identified 

minimum standards specified at subpart 

B of this part if the Secretary has 

accepted a newer version of an adopted 

minimum standard. 

(b) Applicability of an accepted new 

version of an adopted minimum 

standard. 

(1) ONC–ATCBs are not required to 

test and certify Complete EHRs and/or 

EHR Modules according to newer 

versions of an adopted minimum 

standard accepted by the Secretary until 

the incorporation by reference provision 

of the adopted version is updated in the 

Federal Register with a newer version. 

(2) Certified EHR Technology may be 

upgraded to comply with newer 

versions of an adopted minimum 

standard accepted by the Secretary 

without adversely affecting the 

certification status of the Certified EHR 

Technology. 

§ 170.457 Authorized testing and 

certification methods. 

(a) Primary method. An ONC–ATCB 

must have the capacity to test and 

certify Complete EHRs and/or EHR 

Modules at its facility. 

(b) Secondary methods. An ONC– 

ATCB must also have the capacity to 

test and certify Complete EHRs and/or 

EHR Modules through one of the 

following methods: 

(1) At the site where the Complete 

EHR or EHR Module has been 

developed; or 

(2) At the site where the Complete 

EHR or EHR Module resides; or 

(3) Remotely (i.e., through other 

means, such as through secure 

electronic transmissions and automated 

Web-based tools, or at a location other 

than the ONC–ATCB’s facilities). 


erowe on DSK5CLS3C1PROD with PROPOSALS2
11368 Federal Register / Vol. 75, No. 46 / Wednesday, March 10, 2010 / Proposed Rules 

§ 170.460 Good standing as an ONC– 

ATCB. 

An ONC–ATCB must maintain good 

standing by: 

(a) Adhering to the Principles of 

Proper Conduct for ONC–ATCBs; 

(b) Refraining from engaging in other 

types of inappropriate behavior, 

including an ONC–ATCB 

misrepresenting the scope of its 

authorization as well as an ONC–ATCB 

testing and certifying Complete EHRs 

and/or EHR Modules for which it does 

not have authorization; and 

(c) Following all other applicable 

Federal and State laws. 

§ 170.465 Revocation of authorized testing 

and certification body status. 

(a) Type-1 violations. The National 

Coordinator may revoke an ONC– 

ATCB’s status for committing a Type-1 

violation. Type-1 violations include 

violations of law or temporary 

certification program policies that 

threaten or significantly undermine the 

integrity of the temporary certification 

program. These violations include, but 

are not limited to: false, fraudulent, or 

abusive activities that affect the 

temporary certification program, a 

program administered by HHS or any 

program administered by the Federal 

government. 

(b) Type-2 violations. The National 

Coordinator may revoke an ONC– 

ATCB’s status for failing to timely or 

adequately correct a Type-2 violation. 

Type-2 violations comprise 

noncompliance with § 170.460. 

(1) Noncompliance notification. If the 

National Coordinator obtains reliable 

evidence that an ONC–ATCB may no 

longer be in compliance with § 170.460, 

the National Coordinator will issue a 

noncompliance notification with 

reasons for the notification to the ONC– 

ATCB requesting that the ONC–ATCB 

respond to the alleged violation and 

correct the violation, if applicable. 

(2) Opportunity to become compliant. 

After receipt of a noncompliance 

notification, an ONC–ATCB is permitted 

up to 30 days to submit a written 

response and accompanying 

documentation that demonstrates that 

no violation occurred or that the alleged 

violation has been corrected. 

(i) If the ONC–ATCB submits a 

response, the National Coordinator is 

permitted up to 30 days from the time 

the response is received to evaluate the 

response and reach a decision. The 

National Coordinator may, if necessary, 

request additional information from the 

ONC–ATCB during this time period. 

(ii) If the National Coordinator 

determines that no violation occurred or 

that the violation has been sufficiently 

corrected, the National Coordinator will 

issue a memo to the ONC–ATCB 

confirming this determination. 

(iii) If the National Coordinator 

determines that the ONC–ATCB failed 

to demonstrate that no violation 

occurred or to correct the area(s) of noncompliance identified under paragraph 

(b)(1) of this section within 30 days of 

receipt of the noncompliance 

notification, then the National 

Coordinator may propose to revoke the 

ONC–ATCB’s status. 

(c) Proposed revocation. 

(1) The National Coordinator may 

propose to revoke an ONC–ATCB’s 

status if the ONC–ATCB has committed 

a Type-1 violation; or 

(2) The National Coordinator may 

propose to revoke an ONC–ATCB’s 

status if, after the ONC–ATCB has been 

notified of a Type-2 violation, the ONC– 

ATCB fails to: 

(i) To rebut the finding of a violation 

with sufficient evidence showing that 

the violation did not occur or that the 

violation has been corrected; or 

(ii) Submit to the National 

Coordinator a written response to the 

noncompliance notification within the 

specified timeframe under paragraph 

(b)(2). 

(3) ONC–ATCB’s operations. An 

ONC–ATCB may continue its operations 

under the temporary certification 

program during the time periods 

provided for an ONC–ATCB to respond 

to a proposed revocation notice and the 

National Coordinator to review an 

ONC–ATCB’s response to a proposed 

revocation. 

(d) Opportunity to respond to a 

proposed revocation notice. 

(1) An ONC–ATCB may respond to a 

proposed revocation notice, but must do 

so within 10 days of receiving the 

proposed revocation notice and include 

appropriate documentation explaining 

in writing why its status should not be 

revoked. 

(2) Upon receipt of an ONC–ATCB’s 

response to a proposed revocation 

notice, the National Coordinator is 

permitted up to 30 days to review the 

information submitted by the ONC– 

ATCB and reach a decision. 

(e) Good standing determination. If 

the National Coordinator determines 

that an ONC–ATCB’s status should not 

be revoked, the National Coordinator 

will notify the ONC–ATCB’s authorized 

representative in writing of this 

determination. 

(f) Revocation. 

(1) The National Coordinator may 

revoke an ONC–ATCB’s status if: 

(i) A determination is made that 

revocation is appropriate after 

considering the information provided by 

the ONC–ATCB in response to the 

proposed revocation notice; or 

(ii) The ONC–ATCB does not respond 

to a proposed revocation notice within 

the specified timeframe in paragraph 

(d)(1) of this section. 

(2) A decision to revoke an ONC– 

ATCB’s status is final and not subject to 

further review unless the National 

Coordinator chooses to reconsider the 

revocation. 

(g) Extent and duration of revocation. 

(1) The revocation of an ONC–ATCB 

is effective as soon as the ONC–ATCB 

receives the revocation notice. 

(2) A testing and certification body 

that has had its ONC–ATCB status 

revoked is prohibited from accepting 

new requests for testing and 

certification and must cease its current 

testing and certification operations 

under the temporary certification 

program. 

(3) A testing and certification body 

that has had its ONC–ATCB status 

revoked for a Type-1 violation is 

prohibited from reapplying for ONC– 

ATCB status under the temporary 

certification program for one year. If the 

temporary certification program sunsets 

during this time, the testing and 

certification body is prohibited from 

applying for ONC–ACB status under the 

permanent certification program for the 

time that remains within the one year 

prohibition. 

(4) The failure of a testing and 

certification body that has had its ONC– 

ATCB status revoked, to promptly 

refund any and all fees for tests and/or 

certifications of Complete EHRs and 

EHR Modules not completed will be 

considered a violation of the Principles 

of Proper Conduct for ONC–ATCBs and 

will be taken into account by the 

National Coordinator if the testing and 

certification body reapplies for ONC– 

ATCB status under the temporary 

certification program or applies for 

ONC–ACB status under the permanent 

certification program. 

§ 170.470 Effect of revocation on the 

certifications issued to complete EHRs and 

EHR modules. 

(a) The certified status of Complete 

EHRs and/or EHR Modules certified by 

an ONC–ATCB that had it status 

revoked will remain intact unless a 

Type-1 violation was committed that 

calls into question the legitimacy of the 

certifications issued by the former 

ONC–ATCB. 

(b) If the National Coordinator 

determines that a Type-1 violation 

occurred that called into question the 

legitimacy of certifications conducted 

by the former ONC–ATCB, then the 

National Coordinator would: 


erowe on DSK5CLS3C1PROD with PROPOSALS2
Federal Register / Vol. 75, No. 46 / Wednesday, March 10, 2010 / Proposed Rules 11369 

(1) Review the facts surrounding the 

revocation of the ONC–ATCB’s status; 

and 

(2) Publish a notice on ONC’s Web 

site if the National Coordinator believes 

that Complete EHRs and/or EHR 

Modules were improperly certified by 

the former ONC–ATCB. 

(c) If the National Coordinator 

determines that Complete EHRs and/or 

EHR Modules were improperly certified, 

the certification status of affected 

Complete EHRs and/or EHR Modules 

would only remain intact for 120 days 

after the National Coordinator publishes 

the notice. The certification status of the 

Complete EHR and/or EHR Module can 

only be maintained thereafter by being 

re-certified by an ONC–ATCB in good 

standing. 

§ 170.490 Sunset of the temporary 

certification program. 

The temporary certification program 

will sunset on the date when the 

National Coordinator has authorized at 

least one ONC–ACB under the 

permanent certification program. On the 

date at which this sunset occurs, ONC– 

ATCBs under the temporary 

certification program are prohibited 

from accepting new requests to certify 

Complete EHRs or EHR Modules. ONC– 

ATCBs may, however, complete the 

processing of Complete EHRs and EHR 

Modules that are being tested and 

certified at the time the sunset occurs. 

4. Add a new subpart E to part 170 to 

read as follows: 

Subpart E—Permanent Certification 

Program for HIT 

Sec. 

170.500 Basis and scope. 

170.501 Applicability. 

170.502 Definitions. 

170.503 Requests for ONC–AA status and 

ONC–AA ongoing responsibilities. 

170.504 Reconsideration process for 

requests for ONC–AA status. 

170.505 Correspondence. 

170.510 Types of certification. 

170.520 Application. 

170.523 Principles of proper conduct for 

ONC–ACBs. 

170.525 Application submission. 

170.530 Review of application. 

170.535 ONC–ACB application 

reconsideration. 

170.540 ONC–ACB status. 

170.545 Complete EHR certification. 

170.550 EHR module certification. 

170.553 Certification for health information 

technology other than complete EHRs 

and EHR modules. 

170.555 Certification to newer versions of 

certain standards. 

170.557 Authorized certification methods. 

170.560 Good standing as an ONC–ACB. 

170.565 Revocation of authorized 

certification body status. 

170.570 Effect of revocation on the 

certifications issued to complete EHRs 

and EHR modules. 

Subpart E—Permanent Certification 

Program for HIT 

§ 170.500 Basis and scope. 

This subpart implements section 

3001(c)(5) of the Public Health Service 

Act, and sets forth the rules and 

procedures related to the permanent 

certification program for health 

information technology administered by 

the National Coordinator for Health 

Information Technology. 

§ 170.501 Applicability. 

This subpart establishes the processes 

that applicants for ONC–ACB status 

must follow to be granted ONC–ACB 

status by the National Coordinator, the 

processes the National Coordinator will 

follow when assessing applicants and 

granting ONC–ACB status, the 

requirements of ONC–ACBs for 

certifying Complete EHRs and/or EHR 

Modules in accordance with the 

applicable certification criteria adopted 

by the Secretary in subpart C of this 

part. It also establishes the processes 

accreditation organizations must follow 

to request approval from the National 

Coordinator and that the National 

Coordinator in turn will follow to 

approve an accreditation organization 

under the permanent certification 

program as well as certain ongoing 

responsibilities for an ONC–AA. 

§ 170.502 Definitions. 

For the purposes of this subpart: 

Applicant means a single organization 

or a consortium of organizations that 

seeks to become an ONC–ACB by 

requesting and subsequently submitting 

an application for ONC–ACB status to 

the National Coordinator. 

ONC–ACB or ONC-Authorized 

Certification Body means an 

organization or a consortium of 

organizations that has applied to and 

been authorized by the National 

Coordinator pursuant to this subpart to 

perform the certification of, at a 

minimum, Complete EHRs and/or EHR 

Modules using the applicable 

certification criteria adopted by the 

Secretary. 

ONC-Approved Accreditor or ONC– 

AA means an accreditation organization 

that the National Coordinator has 

approved to accredit certification bodies 

under the permanent certification 

program. 

§ 170.503 Requests for ONC–AA status 

and ONC–AA ongoing responsibilities. 

(a) Only one ONC-Approved 

Accreditor (ONC–AA) shall be approved 

by the National Coordinator at a time. 

(b) Submission. In order to become an 

ONC–AA, an accreditation organization 

must submit a request in writing to the 

National Coordinator along with the 

following information to demonstrate its 

ability to serve as an ONC–AA: 

(1) A detailed description of the 

accreditation organization’s 

conformance to ISO/IEC17011:2004 and 

experience evaluating the conformance 

of certification bodies to ISO/IEC Guide 

65:1996; 

(2) A detailed description of the 

accreditation organization’s 

accreditation requirements and how the 

requirements complement the 

Principles of Proper Conduct for ONC– 

ACBs; 

(3) Detailed information on the 

accreditation organization’s procedures 

that would be used to monitor ONC– 

ACBs; 

(4) Detailed information, including 

education and experience, about the key 

personnel who review organizations for 

accreditation; and 

(5) Procedures for responding to, and 

investigating, complaints against ONC– 

ACBs. 

(c) Approval. The National 

Coordinator is permitted up to 30 days 

to review a request for ONC–AA status 

from an accreditation organization upon 

receipt. 

(1) The National Coordinator’s 

determination will be based on the 

information provided, the completeness 

of the accreditation organizations’ 

descriptions to the elements listed in 

paragraph (b) of this section and each 

accreditation organization’s overall 

accreditation experience. 

(2) The National Coordinator will 

review requests by accreditation 

organizations for ONC–AA status in the 

order they are received and will approve 

the first qualified accreditation 

organization consistent with the 

requirements of paragraph (b). 

(d) Reconsideration of a Decision. 

Any accreditation organization seeking 

to become an ONC–AA may appeal a 

decision to deny its request in 

accordance with § 170.504, but only if 

no other accreditation organization has 

been granted ONC–AA status. 

(e) ONC–AA Ongoing Responsibilities. 

An ONC–AA must: 

(1) Maintain conformance with ISO/ 

IEC 17011:2004; 

(2) In accrediting certification bodies, 

verify conformance to, at a minimum, 

ISO/IEC Guide 65:1996; 


erowe on DSK5CLS3C1PROD with PROPOSALS2
11370 Federal Register / Vol. 75, No. 46 / Wednesday, March 10, 2010 / Proposed Rules 

(3) Verify that ONC–ACBs are 

performing surveillance in accordance 

with their respective annual plans; and 

(4) Review ONC–ACB surveillance 

results to determine if the results 

indicate any substantive nonconformance with the terms set by the 

ONC–AA when it granted the ONC– 

ACB accreditation. 

(f) ONC–AA Status. 

(1) An ONC–AA’s status will expire 

not later than 3 years from the date its 

status was granted by the National 

Coordinator. 

(2) The National Coordinator will 

accept requests for ONC–AA status 120 

days before the current ONC–AA’s 

status is set to expire. 

§ 170.504 Reconsideration process for 

requests for ONC–AA status. 

(a) An accreditation organization may 

ask that the National Coordinator to 

reconsider a decision to deny its request 

for ONC–AA status only if the 

accreditation organization can 

demonstrate that clear, factual errors 

were made in the review of its request 

for ONC–AA status and that the errors’ 

correction could lead to the 

accreditation organization obtaining 

ONC–AA status. 

(b) Submission requirement. An 

accreditation organization is required to 

submit, within 15 days of receipt of a 

denial notice, a written statement to the 

National Coordinator contesting the 

decision to deny its request for ONC– 

AA status and explaining with sufficient 

documentation what factual error(s) it 

believes can account for the denial. If 

the National Coordinator does not 

receive the accreditation organization’s 

submission within the specified 

timeframe its request may be rejected. 

(c) Reconsideration request review. If 

the National Coordinator receives a 

timely reconsideration request, the 

National Coordinator will be permitted 

up to 15 days from the date of receipt 

to review the information submitted by 

the accreditation organization and issue 

a decision. 

(d) Decision. 

(1) If the National Coordinator 

determines that clear, factual errors 

were made during the review of the 

request, that correction of the errors 

would remove all identified 

deficiencies, and that during this review 

no other accreditation organization has 

been granted ONC–AA status, the 

accreditation organization will be 

notified by National Coordinator that its 

request for ONC–AA status has been 

approved. 

(2) If, after reviewing an accreditation 

organization’s reconsideration request, 

the National Coordinator determines 

that the accreditation organization did 

not identify the factual errors that were 

made during the review of its request for 

ONC–AA status, the National 

Coordinator may reject its 

reconsideration request. 

(3) Final Decision. A reconsideration 

decision issued by the National 

Coordinator is final and not subject to 

further review. 

§ 170.505 Correspondence. 

(a) Correspondence and 

communication with the National 

Coordinator shall be conducted by email, unless otherwise necessary. The 

official date of receipt of any e-mail 

between the National Coordinator and 

an applicant for ONC–ACB status or an 

ONC–ACB is the day the e-mail was 

sent. 

(b) In circumstances where it is 

necessary for an applicant for ONC– 

ACB status to correspond or 

communicate with the National 

Coordinator by regular or express mail, 

the official date of receipt will be the 

date of the delivery confirmation. 

§ 170.510 Types of certification. 

Applicants may seek authorization 

from the National Coordinator to 

perform the following types of 

certification: 

(a) Complete EHR certification; and/or 

(b) EHR Module certification; and/or 

(c) Other types of health information 

technology certification for which the 

Secretary has adopted certification 

criteria under subpart C of this part. 

§ 170.520 Application. 

Applicants must include the 

following information in an application 

for ONC–ACB status and submit it to the 

National Coordinator for the application 

to be considered complete. 

(a) The type of authorization sought 

pursuant to § 170.510. For authorization 

to perform EHR Module certification, 

applicants must indicate the specific 

type(s) of EHR Module(s) they seek 

authorization to certify. If qualified, 

applicants will only be granted 

authorization to certify the types of EHR 

Modules for which they seek 

authorization. 

(b) General identifying information 

including: 

(1) Name, address, city, State, zip 

code, and Web site of applicant; and 

(2) Designation of an authorized 

representative, including name, title, 

phone number and e-mail address of the 

person who will serve as the applicant’s 

point of contact. 

(c) Documentation that confirms that 

the applicant has been accredited by an 

ONC–AA. 

(d) An agreement, properly executed 

by the applicant’s authorized 

representative, that it will adhere to the 

Principles of Proper Conduct for ONC– 

ACBs. 

§ 170.523 Principles of proper conduct for 

ONC–ACBs. 

An ONC–ACB shall: 

(a) Maintain its accreditation; 

(b) Attend all mandatory ONC 

training and program update sessions; 

(c) Maintain a training program that 

includes documented procedures and 

training requirements to ensure its 

personnel are competent to certify HIT; 

(d) Report to ONC within 15 days any 

changes that materially affect its: 

(1) Legal, commercial, organizational, 

or ownership status; 

(2) Organization and management 

including key certification personnel; 

(3) Policies or procedures; 

(4) Location; 

(5) Personnel, facilities, working 

environment or other resources; 

(6) ONC authorized representative 

(point of contact); or 

(7) Other such matters that may 

otherwise materially affect its ability to 

certify HIT. 

(e) Allow ONC, or its authorized 

agents(s), to periodically observe on site 

(unannounced or scheduled) any 

certifications performed to demonstrate 

compliance with the requirements of the 

permanent certification program; 

(f) Provide ONC, no less frequently 

than weekly, a current list of Complete 

EHRs and/or EHR Modules that have 

been certified, which includes, at a 

minimum, the vendor name (if 

applicable), the date certified, the 

product version, the unique certification 

number or other specific product 

identification, and where applicable, the 

certification criterion or certification 

criteria to which each EHR Module has 

been certified; 

(g) Retain all records related to the 

certification of Complete EHRs and/or 

EHR Modules for a minimum of 5 years; 

(h) Only certify HIT, including 

Complete EHRs and/or EHR Modules, 

that have been tested by a NVLAPaccredited testing laboratory; 

(i) Submit an annual surveillance plan 

to the National Coordinator and 

annually report to the National 

Coordinator its surveillance results; and 

(j) Promptly refund any and all fees 

received for certifications that will not 

be completed. 

§ 170.525 Application submission. 

(a) An applicant for ONC–ACB status 

must submit its application either 

electronically, via e-mail (or Web 

submission if available), or by regular or 

express mail. 


erowe on DSK5CLS3C1PROD with PROPOSALS2
Federal Register / Vol. 75, No. 46 / Wednesday, March 10, 2010 / Proposed Rules 11371 

(b) An application for ONC–ACB 

status may be submitted to the National 

Coordinator at any time during the 

existence of the permanent certification 

program. 

§ 170.530 Review of application. 

(a) Method of review and review 

timeframe. 

(1) Applications will be reviewed in 

the order they are received. 

(2) The National Coordinator is 

permitted up to 30 days from receipt to 

review an application (submitted for the 

first time). 

(b) Application deficiencies. 

(1) If the National Coordinator 

identifies an area in an application that 

requires the applicant to clarify a 

statement or correct an inadvertent error 

or minor omission, the National 

Coordinator may contact the applicant 

to make such clarification or correction 

without issuing a deficiency notice. If 

the National Coordinator has not 

received the requested information after 

five days, the applicant may be issued 

a deficiency notice specifying the error, 

omission, or deficient statement. 

(2) If the National Coordinator 

determines that deficiencies in either 

part of the application exist, the 

National Coordinator will issue a 

deficiency notice to the applicant and 

return the application. The deficiency 

notice will identify the areas of the 

application that require additional 

information or correction. 

(c) Revised application. 

(1) An applicant is permitted to 

submit a revised application in response 

to a deficiency notice. 

(2) In order to continue to be 

considered for ONC–ACB status, an 

applicant’s revised application must be 

received by the National Coordinator 

within 15 days of the applicant’s receipt 

of the deficiency notice. 

(3) The National Coordinator is 

permitted 15 days to review a revised 

application once it has been received. 

(4) If the National Coordinator 

determines that a revised application 

still contains deficiencies, the applicant 

will be issued a denial notice indicating 

that the applicant will no longer be 

considered for authorization under the 

permanent certification program. An 

applicant may request reconsideration 

of this decision in accordance with 

§ 170.535. 

(d) Satisfactory application. 

(1) An application will be deemed 

satisfactory if it meets all the 

application requirements. 

(2) The National Coordinator will 

notify the applicant’s authorized 

representative of its satisfactory 

application and its successful 

achievement of ONC–ACB status. 

(3) Once notified by the National 

Coordinator of its successful 

achievement of ONC–ACB status, the 

applicant may represent itself as an 

ONC–ACB and begin certifying health 

information technology consistent with 

its authorization. 

§ 170.535 ONC–ACB application 

reconsideration. 

(a) An applicant may request that the 

National Coordinator reconsider a 

denial notice only if the applicant can 

demonstrate that clear, factual errors 

were made in the review of its 

application and that the errors’ 

correction could lead to the applicant 

obtaining ONC–ACB status. 

(b) Submission requirement. An 

applicant is required to submit, within 

15 days of receipt of a denial notice, a 

written statement to the National 

Coordinator contesting the decision to 

deny its application and explaining 

with sufficient documentation what 

factual errors it believes can account for 

the denial. If the National Coordinator 

does not receive the applicant’s 

reconsideration request within the 

specified timeframe its reconsideration 

request may be rejected. 

(c) Reconsideration request review. If 

the National Coordinator receives a 

timely reconsideration request, the 

National Coordinator is permitted up to 

15 days from the date of receipt to 

review the information submitted by the 

applicant and issue a decision. 

(d) Decision. 

(1) If the National Coordinator 

determines that clear, factual errors 

were made during the review of the 

application and that correction of the 

errors would remove all identified 

deficiencies, the applicant’s authorized 

representative will be notified of the 

National Coordinator’s determination 

and the applicant’s successful 

achievement of ONC–ACB status. 

(2) If, after reviewing an applicant’s 

reconsideration request, the National 

Coordinator determines that the 

applicant did not identify any factual 

errors or that correction of those factual 

errors would not remove all identified 

deficiencies in the application, the 

National Coordinator may reject the 

applicant’s reconsideration request. 

(3) Final decision. A reconsideration 

decision issued by the National 

Coordinator is final and not subject to 

further review. 

§ 170.540 ONC–ACB Status. 

(a) Acknowledgement and 

publication. The National Coordinator 

will acknowledge and make publicly 

available the names of ONC–ACBs, 

including the date each was authorized 

and the type(s) of certification each has 

been authorized to perform. 

(b) Representation. Each ONC–ACB 

must prominently and unambiguously 

identify on its Web site and in all 

marketing and communications 

statements (written and oral) the scope 

of its authorization. 

(c) Renewal. An ONC–ACB is required 

to renew its status every two years. An 

ONC–ACB is required to submit a 

renewal request to the National 

Coordinator 60 days prior to the 

expiration of its status. 

(d) Expiration. An ONC–ACB’s status 

will expire two years from the date it 

was granted by the National Coordinator 

unless it is renewed in accordance with 

paragraph (c) of this section. 

§ 170.545 Complete EHR Certification. 

(a) To be authorized to certify 

Complete EHRs under the permanent 

certification program, an ONC–ACB 

must be capable of certifying Complete 

EHRs to all applicable certification 

criteria adopted by the Secretary at 

subpart C of this part. 

(b) An ONC–ACB that has been 

authorized to certify Complete EHRs is 

also authorized to certify all EHR 

Modules under the permanent 

certification program. 

§ 170.550 EHR module certification. 

(a) When certifying EHR Modules, an 

ONC–ACB must certify in accordance 

with the applicable certification 

criterion or certification criteria adopted 

by the Secretary at subpart C of this 

part. 

(b) EHR Modules are required to be 

certified to at least one certification 

criterion. 

(c) Privacy and security certification. 

EHR Modules shall be certified to all 

privacy and security certification 

criteria adopted by the Secretary unless 

the EHR Module(s) is/are presented for 

certification in one of the following 

manners: 

(1) The EHR Module(s) are presented 

for certification as a pre-coordinated, 

integrated ‘‘bundle’’ of EHR Modules, 

which could otherwise constitute a 

Complete EHR. In such instances, the 

EHR Module(s) shall be certified in the 

same manner as a Complete EHR. Precoordinated bundles of EHR Module(s) 

which include EHR Module(s) that 

would not be part of a local system and 

under the end user’s direct control are 

excluded from this exception. The 

constituent EHR Modules of such an 

integrated bundle must be separately 

certified to all privacy and security 

certification criteria. 

(2) An EHR Module is presented for 

certification, and the presenter can 


erowe on DSK5CLS3C1PROD with PROPOSALS2
11372 Federal Register / Vol. 75, No. 46 / Wednesday, March 10, 2010 / Proposed Rules 

demonstrate to the ONC–ACB that it 

would be technically infeasible for the 

EHR Module to be certified in 

accordance with some or all of the 

privacy and security certification 

criteria; or 

(3) An EHR Module is presented for 

certification, and the presenter can 

demonstrate to the ONC–ACB that the 

EHR Module is designed to perform a 

specific privacy and security capability. 

In such instances, the EHR Module may 

only be certified in accordance with the 

applicable privacy and security 

certification criterion/criteria. 

(d) ONC–ACBs authorized to certify 

EHR Modules must clearly indicate the 

certification criterion or certification 

criteria to which an EHR Module has 

been certified in its certification 

documentation. 

§ 170.553 Certification for health 

information technology other than complete 

EHRs and EHR modules. 

An ONC–ACB authorized to certify 

health information technology other 

than Complete EHRs and/or EHR 

Modules must certify such health 

information technology in accordance 

with the applicable certification 

criterion or certification criteria adopted 

by the Secretary at subpart C of this 

part. 

§ 170.555 Certification to newer versions 

of certain standards. 

(a) ONC–ACBs may test and certify 

Complete EHRs and EHR Modules to a 

newer version of certain identified 

minimum standards specified at subpart 

B of this part if the Secretary has 

accepted a newer version of an adopted 

minimum standard. 

(b) Applicability of an accepted new 

version of an adopted minimum 

standard. 

(1) ONC–ACBs are not required to test 

and certify Complete EHRs and/or EHR 

Modules according to newer versions of 

an adopted minimum standard accepted 

by the Secretary until the incorporation 

by reference provision of the adopted 

version is updated in the Federal 

Register with a newer version. 

(2) Certified EHR Technology may be 

upgraded to comply with newer 

versions of an adopted minimum 

standard accepted by the Secretary 

without adversely affecting the 

certification status of the Certified EHR 

Technology. 

§ 170.557 Authorized certification 

methods. 

(a) Primary method. An ONC–ACB 

must have the capacity to certify 

Complete EHRs and/or EHR Modules at 

their facility. 

(b) Secondary methods. An ONC–ACB 

must also have the capacity to certify 

Complete EHRs and/or EHR Modules 

through one of the following methods: 

(1) At the site where the Complete 

EHR or EHR Module has been 

developed; or 

(2) At the site where the Complete 

EHR or EHR Module resides; or 

(3) Remotely (i.e., through other 

means, such as through secure 

electronic transmissions and automated 

Web-based tools, or at a location other 

than the ONC–ACB’s facilities). 

§ 170.560 Good standing as an ONC–ACB. 

An ONC–ACB must maintain good 

standing by: 

(a) Adhering to the Principles of 

Proper Conduct for ONC–ACBs; 

(b) Refraining from engaging in other 

types of inappropriate behavior, 

including an ONC–ACB misrepresenting 

the scope of its authorization as well as 

an ONC–ACB testing and certifying 

Complete EHRs and/or EHR Modules for 

which it does not have authorization; 

and 

(c) Following all other applicable 

Federal and State laws. 

§ 170.565 Revocation of authorized 

certification body status. 

(a) Type-1 violations. The National 

Coordinator may revoke an ONC–ACB’s 

status for committing a Type-1 

violation. Type-1 violations include 

violations of law or permanent 

certification program policies that 

threaten or significantly undermine the 

integrity of the permanent certification 

program. These violations include, but 

are not limited to: False, fraudulent, or 

abusive activities that affect the 

permanent certification program, a 

program administered by HHS or any 

program administered by the Federal 

government. 

(b) Type-2 violations. The National 

Coordinator may revoke an ONC–ACB’s 

status for failing to timely or adequately 

correct a Type-2 violation. Type-2 

violations comprise noncompliance 

with § 170.560. 

(1) Noncompliance notification. If the 

National Coordinator obtains reliable 

evidence that an ONC–ACB may no 

longer be in compliance with § 170.560, 

the National Coordinator will issue a 

noncompliance notification with 

reasons for the notification to the ONC– 

ACB requesting that the ONC–ACB 

respond to the alleged violation and 

correct the violation, if applicable. 

(2) Opportunity to become compliant. 

After receipt of a noncompliance 

notification, an ONC–ACB is permitted 

to 30 days to submit a written response 

and accompanying documentation that 

demonstrates that no violation occurred 

or that the alleged violation has been 

corrected. 

(i) If the ONC–ACB submits a 

response, the National Coordinator is 

permitted up to 30 days from the time 

the response is received to evaluate the 

response and reach a decision. The 

National Coordinator may, if necessary, 

request additional information from the 

ONC–ACB during this time period. 

(ii) If the National Coordinator 

determines that no violation occurred or 

that the violation has been sufficiently 

corrected, the National Coordinator will 

issue a memo to the ONC–ACB 

confirming this determination. 

(iii) If the National Coordinator 

determines that the ONC–ACB failed to 

demonstrate that no violation occurred 

or to correct the area(s) of noncompliance identified under paragraph 

(b)(1) of this section within 30 days of 

receipt of the noncompliance 

notification, then the National 

Coordinator may propose to revoke the 

ONC–ACB’s status. 

(c) Proposed revocation. 

(1) The National Coordinator may 

propose to revoke an ONC–ACB’s status 

if the ONC–ACB has committed a Type1 violation; or 

(2) The National Coordinator may 

propose to revoke an ONC–ACB’s status 

if, after the ONC–ACB has been notified 

of a Type-2 violation, the ONC–ACB 

fails to: 

(i) To rebut the finding of a violation 

with sufficient evidence showing that 

the violation did not occur or that the 

violation has been corrected; or 

(ii) Submit to the National 

Coordinator a written response to the 

noncompliance notification within the 

specified timeframe under paragraph 

(b)(2). 

(3) ONC–ACB’s operations. An ONC– 

ACB may continue its operations under 

the permanent certification program 

during the time periods provided for an 

ONC–ACB to respond to a proposed 

revocation notice and the National 

Coordinator to review an ONC–ACB’s 

response to a proposed revocation. 

(d) Opportunity to respond to a 

proposed revocation notice. 

(1) An ONC–ACB may respond to a 

proposed revocation notice, but must do 

so within 10 days of receiving the 

proposed revocation notice and include 

appropriate documentation explaining 

in writing why its status should not be 

revoked. 

(2) Upon receipt of an ONC–ACB’s 

response to a proposed revocation 

notice, the National Coordinator is 

permitted up to 30 days to review the 

information submitted by the ONC–ACB 

and reach a decision. 


erowe on DSK5CLS3C1PROD with PROPOSALS2
Federal Register / Vol. 75, No. 46 / Wednesday, March 10, 2010 / Proposed Rules 11373 

(e) Good standing determination. If 

the National Coordinator determines 

that an ONC–ACB’s status should not be 

revoked, the National Coordinator will 

notify the ONC–ACB’s authorized 

representative in writing of this 

determination. 

(f) Revocation. 

(1) The National Coordinator may 

revoke an ONC–ACB’s status if: 

(i) A determination is made that 

revocation is appropriate after 

considering the information provided by 

the ONC–ACB in response to the 

proposed revocation notice; or 

(ii) The ONC–ACB does not respond 

to a proposed revocation notice within 

the specified timeframe in paragraph 

(d)(1) of this section. 

(2) A decision to revoke an ONC– 

ACB’s status is final and not subject to 

further review unless the National 

Coordinator chooses to reconsider the 

revocation. 

(g) Extent and duration of revocation. 

(1) The revocation of an ONC–ACB is 

effective as soon as the ONC–ACB 

receives the revocation notice. 

(2) A certification body that has had 

its ONC–ACB status revoked is 

prohibited from accepting new requests 

for certification and must cease its 

current certification operations under 

the permanent certification program. 

(3) A certification body that has had 

its ONC–ACB has its status revoked for 

a Type-1 violation, is not permitted to 

reapply for ONC–ACB status under the 

permanent certification program for a 

period of 1 year. 

(4) The failure of a certification body 

that has had its ONC–ACB status 

revoked to promptly refund any and all 

fees for certifications of Complete EHRs 

and EHR Modules not completed will be 

considered a violation of the Principles 

of Proper Conduct for ONC–ACBs and 

will be taken into account by the 

National Coordinator if the certification 

body reapplies for ONC–ACB status 

under the permanent certification 

program. 

§ 170.570 Effect of revocation on the 

certifications issued to complete EHRs and 

EHR modules. 

(a) The certified status of Complete 

EHRs and/or EHR Modules certified by 

an ONC–ACB that had it status revoked 

will remain intact unless a Type-1 

violation was committed that calls into 

question the legitimacy of the 

certifications issued by the former 

ONC–ACB. 

(b) If the National Coordinator 

determines that a Type-1 violation 

occurred that called into question the 

legitimacy of certifications conducted 

by the former ONC–ACB, then the 

National Coordinator would: 

(1) Review the facts surrounding the 

revocation of the ONC–ACB’s status; 

and 

(2) Publish a notice on ONC’s Web 

site if the National Coordinator believes 

that Complete EHRs and/or EHR 

Modules were improperly certified by 

the former ONC–ACB. 

(c) If the National Coordinator 

determines that Complete EHRs and/or 

EHR Modules were improperly certified, 

the certification status of affected 

Complete EHRs and/or EHR Modules 

would only remain intact for 120 days 

after the National Coordinator publishes 

the notice. The certification status of the 

Complete EHR and/or EHR Module can 

only be maintained thereafter by being 

re-certified by an ONC–ACB in good 

standing. 

Kathleen Sebelius, 

Secretary. 

[FR Doc. 2010–4991 Filed 3–4–10; 4:15 pm] 

BILLING CODE 4150–45–P 


erowe on DSK5CLS3C1PROD with PROPOSALS2