ehr onc final certification - Department of Health Care Services

Page 101 of 228
Unchanged
Comment. One commenter explicitly noted its support for this certification
criterion. We received other comments that included some mention of “access” but did
not expressly focus on the certification criterion or provide any related suggestions or
recommendations.
Response. We appreciate the comment supporting this certification criterion.
This certification criterion remains unchanged from the certification criterion adopted in
the Interim Final Rule.
§170.302(p) - Emergency access
Meaningful Use Stage 1
Objective
Protect electronic health
information created or
maintained by the
certified EHR technology
through the
implementation of
appropriate technical
capabilities
Meaningful Use Stage 1
Measure
Conduct or review a security
risk analysis per 45 CFR
164.308 (a)(1) and
implement security updates
as necessary and correct
identified security
deficiencies as part of its risk
management process
Certification Criterion
Interim Final Rule Text:
Emergency access. Permit authorized users
(who are authorized for emergency
situations) to access electronic health
information during an emergency.
Final Rule Text:
§170.302(p)
Unchanged
Comment. One commenter asked that we clarify the circumstances that would
qualify as an “emergency” and further clarify whether compliance with this certification
criterion is intended to pre-empt conflicting or stricter state laws that may limit this type
of access or require patient consent. Further, the commenter questioned whether we were
implying that some authorized users of Certified EHR Technology would not be
authorized for emergency situations or whether we intended for any authorized user to be
entitled to access in an emergency situation. Finally, another commenter requested
clarification as to whether emergency access is driven by organizational policies and
whether capturing such access in an audit log is appropriate.