ehr onc final certification - Department of Health Care Services

Comment. One commenter suggested that adverse events be reported to public
health agencies.
Response. Our certification criterion does not preclude other types of reportable
events from occurring. Presently, we do not believe that it is appropriate to modify the
certification criterion to explicitly refer to adverse events.
Comment. One commenter recommended that because some public health
agencies do not have the ability to receive public health surveillance information in
electronic format, we should clarify that this certification criterion is limited to verifying
the ability of the system to record, modify, retrieve, and submit such information based
on at least one test of these capabilities.
Response. We reiterate, that the purpose of certification is to verify that a
Complete EHR or EHR Module can perform these capabilities. That should not be
construed to mean that an eligible professional or eligible hospital is exempt from using
Certified EHR Technology to meet the meaningful use objective and measure.
Comment. A commenter recommended including the word “modify” in the
certification criterion.
Response. Consistent with our rationale above, we have added the word modify to
the certification criterion.
§170.302(o) - Access control
Meaningful Use Stage 1
Objective
Protect electronic health
information created or
maintained by the
certified EHR technology
through the
implementation of
appropriate technical
capabilities
Meaningful Use Stage 1
Measure
Conduct or review a
security risk analysis per 45
CFR 164.308 (a)(1) and
implement security updates
as necessary and correct
identified security
deficiencies as part of its
risk management process
Page 100 of 228
Certification Criterion
Interim Final Rule Text:
Access control. Assign a unique name and/or
number for identifying and tracking user
identity and establish controls that permit only
authorized users to access electronic health
information.
Final Rule Text:
§170.302(o)