ehr onc final certification - Department of Health Care Services
ehr onc final certification - Department of Health Care Services ehr onc final certification - Department of Health Care Services
intensive process and too administratively, technically, and financially burdensome. A large portion of commenters further conveyed specific challenges including: the ability to differentiate between a “use” and a “disclosure” (as these terms are defined at 45 CFR 160.103); storing three years worth of disclosures, which many noted could be voluminous; that health care providers, especially hospitals, have decentralized systems, which today are manually accessed to create an accounting of disclosures; the development time for such a capability would take more time than is available before the meaningful use Stage 1 effective date; that it would be difficult to account for these types of disclosures in real-time without a code set for disclosures; that this requirement could affect workflow; and the scope of electronic exchanges that the term “disclosure” would encompass is unclear. A majority of commenters also echoed that the Secretary should use discretion provided by the HITECH Act to delay the compliance date for accounting of disclosures for treatment, payment, and health care operations. Commenters supported this suggestion by pointing out that the Secretary has not yet formally established the policies for accounting of disclosures. They explained that the HITECH Act requires the Secretary to promulgate a rule no later than six months after the Secretary has adopted a standard for accounting of disclosures, which has not yet occurred. Many of these commenters suggested that the certification criterion and standard should be removed or their adoption delayed until after the technical specifications for accounting of disclosures can be harmonized with the Secretary’s forthcoming promulgation of a regulation on this issue. Other commenters noted that the HIT Policy Committee included accounting of disclosures in its suggestions as a meaningful use Stage 3 objective. In response to the questions we posed, several commenters noted that to whom Page 122 of 228
the disclosure was made (recipient) should be an important element included in an accounting of disclosures. One commenter noted that the standard should be the same as what is currently applicable to disclosures that are not for treatment, payment, and health care operations and cited the requirements at 45 CFR 164.528(b)(2). Other commenters stated that the adopted certification criterion should be an audit log. Response. We appreciate the thoroughness, specificity, and detail provided by many of those who commented on this certification criterion. We recognize that significant technical and policy challenges remain unresolved. Accordingly, we do not believe that the capability to account for disclosures should be a condition of certification at the present time. As discussed in the beginning of the preamble of this final rule, we have decided to make this certification criterion “optional” instead of removing it. Additionally, the standard will remain unchanged as currently worded and as applicable to the certification criterion to provide guidance to Complete EHR and EHR Module developers that choose to adopt this capability at this time. As an optional certification criterion, though, Complete EHR or EHR Module will not be required to possess the capability for certification. As we stated previously in the Interim Final Rule, we plan to work collaboratively with the Office for Civil Rights (OCR) as it develops the regulatory policy related to this requirement. We anticipate updating this certification criterion and the related standard in a future rulemaking to reflect OCR’s final policies regarding accounting of disclosures. Comment. Several commenters requested that we clarify what is meant by a “description of the disclosure.” Some commenters noted that it would not be possible to include these descriptions in an accounting without code sets for the various types of Page 123 of 228
- Page 71 and 72: commenters reasoned that because a
- Page 73 and 74: laboratory test results to be elect
- Page 75 and 76: or outreach Generate patient lists.
- Page 77 and 78: months). We believe that these revi
- Page 79 and 80: that the PQRI 2009 Registry XML spe
- Page 81 and 82: To better align this certification
- Page 83 and 84: the capability specified by the cer
- Page 85 and 86: vendors were unwilling or unable to
- Page 87 and 88: the concerns expressed by some comm
- Page 89 and 90: Page 89 of 228 electronically compa
- Page 91 and 92: (1) The standard (and applicable im
- Page 93 and 94: for the purposes of demonstrating c
- Page 95 and 96: Guide for Immunization Messaging Re
- Page 97 and 98: Response. We clarify for commenters
- Page 99 and 100: serve as a limiting factor, however
- Page 101 and 102: Page 101 of 228 Unchanged Comment.
- Page 103 and 104: Comment. One commenter suggested th
- Page 105 and 106: Response. We appreciate the thought
- Page 107 and 108: Complete EHRs or EHR Modules design
- Page 109 and 110: Response. We disagree. As stated ab
- Page 111 and 112: Response. As discussed above, we ha
- Page 113 and 114: SHA-1 and other secure hash algorit
- Page 115 and 116: misinterpreted our example and stat
- Page 117 and 118: Other commenters also expressed con
- Page 119 and 120: eferenced in FIPS 140-2 Annex A, wh
- Page 121: of the most secure encryption algor
- Page 125 and 126: Use CPOE for medication orders dire
- Page 127 and 128: equire EHRs to build custom interfa
- Page 129 and 130: esult, we do not believe that this
- Page 131 and 132: was needed before RxNorm could be a
- Page 133 and 134: • MDDB - Medi-Span Master Drug Da
- Page 135 and 136: Response. We do not believe that it
- Page 137 and 138: Send reminders to patients per pati
- Page 139 and 140: specified data elements and CMS’s
- Page 141 and 142: what would qualify as a "response."
- Page 143 and 144: Comment. A commenter recommended th
- Page 145 and 146: in accordance with one of the adopt
- Page 147 and 148: Comments. Many commenters suggested
- Page 149 and 150: flexibility in this certification c
- Page 151 and 152: productive, confusing, time-consumi
- Page 153 and 154: include in this initial set. Accord
- Page 155 and 156: to the HITSP C32 implementation spe
- Page 157 and 158: Response. Again, we do not believe
- Page 159 and 160: e achieved without these and recomm
- Page 161 and 162: electronically record, store, retri
- Page 163 and 164: EHRs and EHR Modules designed for a
- Page 165 and 166: §170.205(a)(2)(iii); and (v) The s
- Page 167 and 168: Response. We disagree, as doing so
- Page 169 and 170: Dental Terminology as a condition o
- Page 171 and 172: However, we do not preclude Complet
the disclosure was made (recipient) should be an important element included in an<br />
accounting <strong>of</strong> disclosures. One commenter noted that the standard should be the same as<br />
what is currently applicable to disclosures that are not for treatment, payment, and health<br />
care operations and cited the requirements at 45 CFR 164.528(b)(2). Other commenters<br />
stated that the adopted <strong>certification</strong> criterion should be an audit log.<br />
Response. We appreciate the thoroughness, specificity, and detail provided by<br />
many <strong>of</strong> those who commented on this <strong>certification</strong> criterion. We recognize that<br />
significant technical and policy challenges remain unresolved. Accordingly, we do not<br />
believe that the capability to account for disclosures should be a condition <strong>of</strong> <strong>certification</strong><br />
at the present time. As discussed in the beginning <strong>of</strong> the preamble <strong>of</strong> this <strong>final</strong> rule, we<br />
have decided to make this <strong>certification</strong> criterion “optional” instead <strong>of</strong> removing it.<br />
Additionally, the standard will remain unchanged as currently worded and as applicable<br />
to the <strong>certification</strong> criterion to provide guidance to Complete EHR and EHR Module<br />
developers that choose to adopt this capability at this time. As an optional <strong>certification</strong><br />
criterion, though, Complete EHR or EHR Module will not be required to possess the<br />
capability for <strong>certification</strong>. As we stated previously in the Interim Final Rule, we plan to<br />
work collaboratively with the Office for Civil Rights (OCR) as it develops the regulatory<br />
policy related to this requirement. We anticipate updating this <strong>certification</strong> criterion and<br />
the related standard in a future rulemaking to reflect OCR’s <strong>final</strong> policies regarding<br />
accounting <strong>of</strong> disclosures.<br />
Comment. Several commenters requested that we clarify what is meant by a<br />
“description <strong>of</strong> the disclosure.” Some commenters noted that it would not be possible to<br />
include these descriptions in an accounting without code sets for the various types <strong>of</strong><br />
Page 123 <strong>of</strong> 228
Change language