ehr onc final certification - Department of Health Care Services

Meaningful Use
Stage 1
Objective
Protect electronic
health information
created or
maintained by the
certified EHR
technology through
the implementation
of appropriate
technical
capabilities
Meaningful Use
Stage 1 Measure
Conduct or review
a security risk
analysis per 45
CFR 164.308 (a)(1)
and implement
security updates as
necessary and
correct identified
security
deficiencies as part
of its risk
management
process
Page 104 of 228
Certification Criterion
Interim Final Rule Text:
(1) Record actions. Record actions related to electronic health
information in accordance with the standard specified in
§170.210(b).
(2) Alerts. Provide alerts based on user-defined events.
(3) Display and print. Electronically display and print all or a
specified set of recorded information upon request or at a set
period of time.
Final Rule Text:
§170.302(r)
(1) Record actions. Record actions related to electronic health
information in accordance with the standard specified in
§170.210(b).
(2) Generate audit log. Enable a user to generate an audit log
for a specific time period and to sort entries in the audit log
according to any of the elements specified in the standard at
170.210(b).
Comments. Several commenters recommended that we add to the standard
specified at §170.210(b) “access,” “reading,” or “viewing” as triggers for when actions
needed to be recorded as part of an audit log. One commenter recommended expanding
the audit content to include maintaining the before-access content of the information
accessed as well as the after-access content. Some commenters requested clarification of
the intended meaning of the reference to recording the action of “printing.” Commenters
recommended expanding or replacing “print” in the standard with other types of output
methods such as extraction, copy, exchange, report, and export. Some commenter stated
that the print function in many operating systems and software products is a multiple step
process that is difficult for any system to audit. Other commenters expressed concerns
that the requirement to audit all printing would be difficult because there were numerous
ways to circumvent the specific action of printing, such as using the print screen function
and printing out the image of the screen shot. One commenter stated that auditing of the
print function would be possible, but complete auditing of all possible ways of printing
would be impracticable.