[Federal Register Volume 75, Number 197 (Wednesday, October 13, 2010)]
[Rules and Regulations]
[Pages 62686-62690]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2010-25683]


-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Office of the Secretary

45 CFR Part 170

RIN 0991-AB76


Health Information Technology: Revisions to Initial Set of 
Standards, Implementation Specifications, and Certification Criteria 
for Electronic Health Record Technology

AGENCY: Office of the National Coordinator for Health Information 
Technology (ONC), Department of Health and Human Services.

ACTION: Interim final rule with request for comments.

-----------------------------------------------------------------------

SUMMARY: The Department of Health and Human Services (HHS) is issuing 
this interim final rule with a request for comment to remove the 
implementation specifications related to public health surveillance.

DATES: Effective Date: This interim final rule is effective October 13, 
2010.
    Comment Date: To be assured consideration, written or electronic 
comments must be received at one of the addresses provided below, no 
later than 5 p.m. on November 12, 2010.

ADDRESSES: Because of staff and resource limitations, we cannot accept 
comments by facsimile (FAX) transmission. You may submit comments, 
identified by RIN 0991-AB76, by any of the following methods (please do 
not submit duplicate comments).
    <bullet> Federal eRulemaking Portal: Follow the instructions for 
submitting comments. Attachments should be in Microsoft Word, 
WordPerfect, or Excel; however, we prefer Microsoft Word. http://www.regulations.gov.
    <bullet> Regular, Express, or Overnight Mail: Department of Health 
and Human Services, Office of the National Coordinator for Health 
Information Technology, Attention: Steven Posnack, Hubert H. Humphrey 
Building, Suite 729D, 200 Independence Ave., SW., Washington, DC 20201. 
Please submit one original and two copies.
    <bullet> Hand Delivery or Courier: Office of the National 
Coordinator for Health Information Technology, Attention: Steven 
Posnack, Hubert H. Humphrey Building, Suite 729D, 200 Independence 
Ave., SW., Washington, DC 20201. Please submit one original and two 
copies. (Because access to the interior of the Hubert H. Humphrey 
Building is not readily available to persons without federal government 
identification, commenters are encouraged to leave their comments in 
the mail drop slots located in the main lobby of the building.)
    Inspection of Public Comments: All comments received before the 
close of the comment period will be available for public inspection, 
including any personally identifiable or confidential business 
information that is included in a comment. Please do not include 
anything in your comment submission that you do not wish to share with 
the general public. Such information includes, but is not limited to: A 
person's social security number; date of birth; driver's license 
number; state identification number or foreign country equivalent; 
passport number; financial account number; credit or debit card number; 
any personal health information; or any business information that could 
be considered to be proprietary. We will post all comments received 
before the close of the comment period at http://www.regulations.gov.
    Docket: For access to the docket to read background documents or 
comments received, go to http://www.regulations.gov or U.S. Department 
of Health and Human Services, Office of the National Coordinator for 
Health Information Technology, Hubert H. Humphrey Building, Suite 729D, 
200 Independence Ave., SW., Washington, DC 20201 (call ahead to the 
contact listed below to arrange for inspection).

FOR FURTHER INFORMATION CONTACT: Steven Posnack, Director, Federal 
Policy Division, Office of Policy and Planning, Office of the National 
Coordinator for Health Information Technology, 202-690-7151.

SUPPLEMENTARY INFORMATION:

Acronyms

ARRA American Recovery and Reinvestment Act of 2009
CDC Centers for Disease Control and Prevention
CFR Code of Federal Regulations
EHR Electronic Health Record
HHS Department of Health and Human Services
HIT Health Information Technology
HITECH Health Information Technology for Economic and Clinical 
Health
HL7 Health Level Seven
NAICS North American Industry Classification System
OMB Office of Management and Budget
ONC Office of the National Coordinator for Health Information 
Technology
ONC-ATCB ONC-Authorized Testing and Certification Body
PHSA Public Health Service Act
RFA Regulatory Flexibility Act
RIA Regulatory Impact Analysis
UMRA Unfunded Mandates Reform Act of 1995

[[Page 62687]]

Table of Contents

I. Background
    A. Legislative History
    B. Regulatory History
    1. Initial Set of Standards, Implementation Specifications, and 
Certification Criteria for EHR Technology; Interim Final Rule
    2. Initial Set of Standards, Implementation Specifications, and 
Certification Criteria for EHR Technology; Final Rule
    3. Proposed Establishment of Certification Programs for Health 
Information Technology; Proposed Rule
    4. Temporary Certification Program; Final Rule
II. Discussion of the Interim Final Rule
    A. Public Health Surveillance Implementation Specifications
    B. Waiver of Proposed Rulemaking and Delay in Effective Date
III. Response to Comments
IV. Collection of Information Requirements
V. Regulatory Impact Statement
    Regulation Text

I. Background

A. Legislative History

    The Health Information Technology for Economic and Clinical Health 
(HITECH) Act, Title XIII of Division A and Title IV of Division B of 
the American Recovery and Reinvestment Act of 2009 (ARRA) (Pub. L. 111-
5), was enacted on February 17, 2009. The HITECH Act amended the Public 
Health Service Act (PHSA) and established ``Title XXX--Health 
Information Technology and Quality'' to improve health care quality, 
safety, and efficiency through the promotion of health information 
technology (HIT) and the electronic exchange of health information. 
Section 3004 of the PHSA, as added by the HITECH Act, authorizes the 
Secretary of Health and Human Services (the Secretary) to adopt 
standards, implementation specifications, and certification criteria to 
enhance the interoperability, functionality, utility, and security of 
health information technology. Section 3004(b)(1) of the PHSA more 
specifically directs the Secretary to adopt an initial set of 
standards, implementation specifications, and certification criteria, 
and permits their adoption through an interim final rule.

B. Regulatory History

1. Initial Set of Standards, Implementation Specifications, and 
Certification Criteria for EHR Technology; Interim Final Rule
    On January 13, 2010, HHS published in the Federal Register an 
interim final rule with a request for comment, which adopted an initial 
set of standards, implementation specifications, and certification 
criteria (75 FR 2014). The certification criteria adopted in that 
interim final rule established the required capabilities and specified 
the related standards and implementation specifications that certified 
electronic health record (EHR) technology would need to include to, at 
a minimum, support the achievement of meaningful use Stage 1 as 
proposed by CMS for eligible professionals and eligible hospitals under 
the Medicare and Medicaid EHR Incentive Programs. (For consistency with 
subsequent regulatory changes, hereafter, references to ``eligible 
hospitals'' shall mean ``eligible hospitals and/or critical access 
hospitals''.)
2. Initial Set of Standards, Implementation Specifications, and 
Certification Criteria for EHR Technology; Final Rule
    On July 28, 2010, HHS published in the Federal Register a final 
rule (75 FR 44590) to complete the Secretary's adoption of the initial 
set of standards, implementation specifications, and certification 
criteria, and to more closely align such standards, implementation 
specifications, and certification criteria with final meaningful use 
Stage 1 objectives and measures (the ``Standards and Certification 
Criteria Final Rule''). The certification criteria adopted in that 
final rule establish the required capabilities and specify the related 
standards and implementation specifications that certified EHR 
technology will need to include to, at a minimum, support the 
achievement of meaningful use Stage 1 by eligible professionals and 
eligible hospitals under the Medicare and Medicaid EHR Incentive 
Programs. Complete EHRs and EHR Modules will be tested and certified 
according to adopted certification criteria to ensure that they have 
properly implemented adopted standards and implementation 
specifications and otherwise comply with the adopted certification 
criteria.
3. Proposed Establishment of Certification Programs for Health 
Information Technology; Proposed Rule
    On March 10, 2010, under the authority granted to the National 
Coordinator for Health Information Technology (the National 
Coordinator) by section 3001(c)(5) of the PHSA as added by the HITECH 
Act, HHS published in the Federal Register (75 FR 11328) a rule 
proposing the establishment of two certification programs for purposes 
of testing and certifying health information technology. The first 
proposal would establish a temporary certification program whereby the 
National Coordinator would authorize organizations to test and certify 
Complete EHRs and/or EHR Modules. The second proposal would establish a 
permanent certification program to replace the temporary certification 
program. The permanent certification program included proposals that 
would separate the responsibilities for performing testing and 
certification, introduce accreditation requirements, establish 
requirements for certification bodies authorized by the National 
Coordinator related to the surveillance of Certified EHR Technology, 
and would include the potential for certification bodies authorized by 
the National Coordinator to certify other types of health information 
technology besides Complete EHRs and EHR Modules.
4. Temporary Certification Program; Final Rule
    On June 24, 2010, HHS published in the Federal Register a final 
rule (75 FR 36158) establishing the temporary certification program for 
HIT (Temporary Certification Program). The Temporary Certification 
Program, established under the authority granted to the National 
Coordinator by section 3001(c)(5) of the PHSA, sets forth the process 
the National Coordinator will utilize to authorize organizations (ONC-
Authorized Testing and Certification Bodies (ONC-ATCBs)) to test and 
certify Complete EHRs and/or EHR Modules to the certification criteria 
adopted by the Secretary in the Standards and Certification Criteria 
Final Rule. Once tested and certified, a Complete EHR or a combination 
of EHR Modules can be adopted by an eligible professional or eligible 
hospital to meet the definition of Certified EHR Technology as 
specified at 45 CFR 170.102 and used to help qualify for incentive 
payments under the Medicare and Medicaid EHR Incentive Programs.

II. Discussion of the Interim Final Rule

A. Public Health Surveillance Implementation Specifications

    In the Standards and Certification Criteria Final Rule, we adopted 
two content exchange standards for electronic submission to public 
health agencies for surveillance and reporting, Health Level Seven 
(HL7) versions 2.3.1 and 2.5.1. (45 CFR 170.205(d)) Additionally, in 
response to public comment on the interim final rule published January, 
2010, we adopted in the Standards and Certification Criteria Final Rule 
the following implementation specifications for HL7 2.5.1: Public 
Health Information Network HL7 Version 2.5 Message

[[Page 62688]]

Structure Specification for National Condition Reporting Final Version 
1.0 and the Errata and Clarifications National Notification Message 
Structural Specification. (45 CFR 170.205(d)(2)) We did not, however, 
adopt at that time implementation specifications for HL7 2.3.1.
    Since the publication of the Standards and Certification Criteria 
Final Rule, various stakeholders and state public health agencies have 
made numerous inquiries and expressed concerns about the 
appropriateness of these implementation specifications. Some 
stakeholder representatives indicated that they thought these 
implementation specifications may have been adopted in error. They 
noted that these implementation specifications do not appear to be 
appropriate for implementing the adopted standard, HL7 2.5.1 for public 
health surveillance (syndromic surveillance) purposes.
    After further review of the implementation specifications and 
consultation with the Centers for Disease Control and Prevention (CDC), 
we have determined that these implementation specifications were 
adopted in error. The adopted implementation specifications provide 
direction to public health agencies on the structure and methodology 
for using HL7 2.5.1 to report ``Nationally Notifiable Conditions'' to 
CDC and do not provide additional clarity for how EHR technology would 
need to be designed to implement the adopted standard (HL7 2.5.1) or 
enable compliance with the capability identified in the certification 
criterion adopted at 45 CFR 170.302(l). Therefore, their adoption 
neither provides the appropriate or requisite implementation capability 
for the adopted standard, HL7 2.5.1, nor, more importantly, would 
enable the user to ``electronically record, modify, retrieve, and 
submit syndrome-based public health surveillance information * * *,'' 
as required by the adopted certification criterion, 45 CFR 170.302(l).
    We have also heard from ONC-ATCBs as well as EHR technology 
developers that the erroneous adoption of these implementation 
specifications creates significant ambiguity and concern regarding 
whether these implementation specifications must be used for testing 
and certification. They correctly point out that because these 
implementation specifications are inappropriate for the adopted 
standard and would likely frustrate achieving the capability specified 
in the adopted certification criterion at 45 CFR 170.302(l), testing 
and certifying in accordance with them would be wasteful and 
unproductive. We understand further that while the erroneously adopted 
implementation specifications could be used to specify the structure 
and methodology for using HL7 2.5.1, their purpose is to facilitate the 
electronic exchange of de-identified Nationally Notifiable Conditions 
for notifiable disease reporting, which would not fulfill the 
fundamental requirements of syndromic surveillance. In contrast to 
notifiable disease reporting, where only data on patients with a 
notifiable disease diagnosis is sent to a public health agency, 
syndromic surveillance requires data from all patients that were seen 
in a health care setting. Moreover, syndromic surveillance requires 
data elements that the adopted implementation specifications do not 
address including: A patient's chief complaint; date/time of visit; 
severity of illness (e.g., patient's disposition status), specific 
indicators (e.g., pulse oximetry, measured temperature), and age.
    The adoption of these implementation specifications also presents 
an unnecessary obstacle for EHR technology developers, who are 
currently faced with the dilemma of implementing HL7 2.3.1 (even though 
their customers may need HL7 2.5.1 to report to their state public 
health agency), or alternatively, HL7 2.5.1 according to the 
inappropriate implementation specifications, or unnecessarily to both 
standards, in order to seek certification. We believe that each of 
these alternatives places an unnecessary and unwarranted burden on EHR 
technology developers.
    For all of these reasons, we are revising 45 CFR 170.205(d)(2) to 
remove these particular adopted implementation specifications. We are 
also removing from 45 CFR 170.302(l) the text ``(and applicable 
implementation specifications)'' to provide additional clarity and to 
remove the unnecessary and unwarranted burden on ONC-ATCBs and perhaps 
ONC-ACBs. In addition, we are removing the reference to the 
implementation specifications in 45 CFR 170.299(g) where it is 
incorporated by reference.

B. Waiver of Proposed Rulemaking and Delay in Effective Date

    We ordinarily publish a notice of proposed rulemaking in the 
Federal Register to provide a period for public comment before the 
provisions of the rule take effect in accordance with section 553(b) of 
the Administrative Procedure Act (APA) (5 U.S.C.553(b)). We also 
ordinarily provide a 30-day delay in the effective date of the 
provisions of a rule in accordance with section 553(d) of the APA (5 
U.S.C. 553(d)). However, we can waive both the notice and comment 
procedure and the 30-day delay in effective date if the Secretary finds 
for good cause that a notice and comment procedure and a 30-day delay 
are impracticable, unnecessary, or contrary to the public interest, and 
incorporates a statement of the finding and the reasons in the final 
notice or rule that is issued.
    In this case, we find that notice and comment rulemaking is 
contrary to the public interest because it would unnecessarily delay 
the implementation of a complex statutory scheme and prevent the 
realization of certain legislative goals within the statutory 
timeframe. Under the HITECH Act, ONC and CMS promulgated several rules 
that establish a regulatory framework through which eligible 
professionals and eligible hospitals may seek to qualify for certain 
Medicare and Medicaid programs incentive payments. The Medicare and 
Medicaid EHR Incentive Programs final rule established the initial 
criteria eligible professionals and eligible hospitals must meet in 
order to qualify for an incentive payment, along with other program 
participation requirements. The HIT Standards and Certification 
Criteria interim final and final rules provided for the adoption of an 
initial set of standards, implementation, specifications, and 
certification criteria for electronic health record technology. In a 
separate final rule, ONC established a temporary certification program 
that allows Complete EHRs and EHR Modules to be tested and certified to 
the adopted certification criteria.
    In this regulatory framework, private organizations are provided 
the opportunity to apply to the National Coordinator for authorization 
as an ONC-Authorized Testing and Certification Body (ONC-ATCB). Once an 
organization is granted ONC-ATCB status and obtains authorization from 
the National Coordinator to test and certify Complete EHRs and/or EHR 
Modules, it will be subject, depending on the scope of its 
authorization, to the requirements specified at 45 CFR 170.445 
(Complete EHR testing and certification) and/or 45 CFR 170.450 (EHR 
Module testing and certification). These provisions require ONC-ATCBs 
to test and certify Complete EHRs and/or EHR Modules to all applicable 
certification criteria adopted by the Secretary at subpart C of part 
170. Consequently, an ONC-ATCB's failure to adhere to the testing and 
certification requirements of 170.445 and/or 170.450 could subject that 
ONC-ATCB to adverse action by

[[Page 62689]]

the National Coordinator in accordance with 45 CFR 170.465 (Revocation 
of authorized testing and certification body status). Because ONC-ATCBs 
are required to test and certify Complete EHRs and/or EHR Modules in 
accordance with all applicable certification criteria, including 45 CFR 
170.302(l), and 45 CFR 170.302(l) requires that a Complete EHR or EHR 
Module would need to perform the specified capabilities in accordance 
with, in certain scenarios, the erroneously adopted implementation 
specification, the Complete EHR or EHR Module certified in accordance 
with those provisions would not be capable of fulfilling the 
fundamental requirements of syndromic surveillance, as explained above. 
Consequently, a Complete EHR or EHR Module that was developed in 
accordance with HL7 Version 2.5.1 and would otherwise meet all other 
applicable certification criteria could not be successfully certified 
until the removal of the implementation specifications adopted in 
error. We therefore believe that if left unchanged the erroneous 
adoption of these implementation specifications would significantly and 
adversely impact the ability of ONC-ATCBs from issuing, and EHR 
technology developers from receiving, certifications in a timely 
manner.
    For all of the reasons stated, we believe that a notice and comment 
period would be contrary to the public interest. We therefore find good 
cause for waiving the notice and comment period for the removal of the 
erroneously adopted implementation specifications.
    We also believe that a 30-day delay in the effective date is 
contrary to the public interest for the reasons stated above and 
because this interim final rule with comment would alleviate an 
unnecessary burden on the health IT industry and impose no additional 
legal requirements upon the regulated community. We therefore find good 
cause for waiving the 30-day delay in the effective date for the 
removal of the relevant implementation specifications. We note, 
however, that we are providing the public with a 30-day period 
following publication of this interim final rule to submit comments.

III. Response to Comments

    Because of the number of public comments we normally receive on 
Federal Register documents, we are not able to acknowledge or respond 
to them individually. We will consider all comments we receive by the 
date and time specified in the DATES section of this preamble, and, 
when we proceed with a subsequent document, we will respond to the 
comments in the preamble to that document.

IV. Collection of Information Requirements

    This document does not impose information collection and 
recordkeeping requirements. Consequently, it need not be reviewed by 
the Office of Management and Budget under the authority of the 
Paperwork Reduction Act of 1995 (44 U.S.C. 35).

V. Regulatory Impact Statement

    We have examined the impacts of this interim final rule with 
comment as required by Executive Order 12866 on Regulatory Planning and 
Review (September 30, 1993, as further amended), the Regulatory 
Flexibility Act (RFA) (5 U.S.C. 601 et seq.), section 202 of the 
Unfunded Mandates Reform Act of 1995 (2 U.S.C. 1532) (UMRA), Executive 
Order 13132 on Federalism (August 4, 1999), and the Congressional 
Review Act (5 U.S.C. 804(2)).
    Executive Order 12866 (as amended by Executive Orders 13258 and 
13422) directs agencies to assess all costs and benefits of available 
regulatory alternatives and, if regulation is necessary, to select 
regulatory approaches that maximize net benefits (including potential 
economic, environmental, public health and safety effects, distributive 
impacts, and equity). A regulatory impact analysis (RIA) must be 
prepared for major rules with economically significant effects ($100 
million or more in any 1 year). This interim final rule with comment 
does not reach the economic threshold and, thus, is not considered a 
major rule. Therefore, an RIA has not been prepared.
    The RFA requires agencies to analyze options for regulatory relief 
of small businesses. For purposes of the RFA, small entities include 
small businesses, nonprofit organizations, and small governmental 
jurisdictions. Individuals and States are not included in the 
definition of a small entity. The entities impacted by this interim 
final rule most likely fall under the North American Industry 
Classification System (NAICS) code 541511 ``Custom Computer Programming 
Services'' specified at 13 CFR 121.201 where the SBA publishes ``Small 
Business-Size Standards by NAICS Industry.'' The size standard 
associated with this NAICS code is set at $25 million in annual 
receipts which ``indicates the maximum allowed for a concern and its 
affiliates to be considered small entities.'' We are not preparing an 
analysis for the RFA because we have determined, and the Secretary 
certifies, that this interim final rule with comment imposes no new 
requirements on small entities and, as such, will not have a 
significant impact on a substantial number of small entities.
    Section 202 of the Unfunded Mandates Reform Act of 1995 requires 
that agencies assess anticipated costs and benefits before issuing any 
rule whose mandates require spending in any 1 year of $100 million in 
1995 dollars, updated annually for inflation. In 2010, that threshold 
level is currently approximately $135 million. This interim final rule 
with comment will not impose an unfunded mandate on States, tribal 
government or the private sector of more than $135 million annually.
    Executive Order 13132 establishes certain requirements that an 
agency must meet when it promulgates a proposed rule (and subsequent 
final rule) that imposes substantial direct requirement costs on State 
and local governments, preempts State law, or otherwise has Federalism 
implications. Since this interim final rule with comment does not 
impose any costs on State or local governments, the requirements of 
Executive Order 13132 are not applicable.
    In accordance with the provisions of Executive Order 12866, this 
interim final rule with comment was reviewed by the Office of 
Management and Budget.

List of Subjects in 45 CFR Part 170

    Computer technology, Electronic health record, Electronic 
information system, Electronic transactions, Health, Health care, 
Health information technology, Health insurance, Health records, 
Hospitals, Incorporation by reference, Laboratories, Medicaid, 
Medicare, Privacy, Reporting and recordkeeping requirements, Public 
health, Security.

0
For the reasons set forth in the preamble, 45 CFR subtitle A, 
subchapter D, part 170, is amended as follows:

PART 170--HEALTH INFORMATION TECHNOLOGY STANDARDS IMPLEMENTATION 
SPECIFICATIONS, AND CERTIFICATION CRITERIA AND CERTIFICATION 
PROGRAMS FOR HEALTH INFORMATION TECHNOLOGY

0
1. The authority citation for part 170 continues to read as follows:

    Authority:  42 U.S.C. 300jj-11; 42 U.S.C. 300jj-14; 5 U.S.C. 
552.


[[Page 62690]]



0
2. Section 170.205 is amended by revising paragraph (d)(2) to read as 
follows:


Sec.  170.205  Content exchange standards and implementation 
specifications for exchanging electronic health information.

* * * * *
    (d) * * *
    (2) Standard. HL7 2.5.1 (incorporated by reference in Sec.  
170.299).
* * * * *


0
3. Section 170.299 is amended by revising paragraph (g) to read as 
follows:


Sec.  170.299  Incorporation by reference.

* * * * *
    (g) Centers for Disease Control and Prevention, National Centers 
for Immunization and Respiratory Diseases Immunization Information 
System Support Branch--Informatics 1600 Clifton Road Mailstop: E-62 
Atlanta, GA 30333.
    (1) HL7 Standard Code Set CVX--Vaccines Administered, July 30, 
2009, IBR approved for Sec.  170.207.
    (2) Implementation Guide for Immunization Data Transactions using 
Version 2.3.1 of the Health Level Seven (HL7) Standard Protocol 
Implementation Guide Version 2.2, June 2006, IBR approved for Sec.  
170.205.
    (3) HL7 2.5.1 Implementation Guide for Immunization Messaging 
Release 1.0, May 1, 2010, IBR approved for Sec.  170.205.
    (4) [Reserved]


0
4. Section 170.302 is amended by revising paragraph (l) to read as 
follows:


Sec.  170.302  General certification criteria for Complete EHRs or EHR 
Modules.

* * * * *
    (l) Public health surveillance. Electronically record, modify, 
retrieve, and submit syndrome-based public health surveillance 
information in accordance with the standard specified in Sec.  
170.205(d)(1) or Sec.  170.205(d)(2).
* * * * *

    Dated: October 6, 2010.
Kathleen Sebelius,
Secretary.
[FR Doc. 2010-25683 Filed 10-8-10; 11:15 am]
BILLING CODE 4150-45-P