Establishment of the Temporary Certification Program for Health Information Technology, 36158-36209 [2010-14999]

Agencies

• DEPARTMENT OF HEALTH AND HUMAN SERVICES

[Federal Register Volume 75, Number 121 (Thursday, June 24, 2010)]
[Rules and Regulations]
[Pages 36158-36209]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: 2010-14999]



[[Page 36157]]

-----------------------------------------------------------------------

Part II





Department of Health and Human Services





-----------------------------------------------------------------------



45 CFR Part 170



Establishment of the Temporary Certification Program for Health 
Information Technology; Final Rule

Federal Register / Vol. 75 , No. 121 / Thursday, June 24, 2010 / 
Rules and Regulations

[[Page 36158]]


-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

45 CFR Part 170

RIN 0991-AB59


Establishment of the Temporary Certification Program for Health 
Information Technology

AGENCY: Office of the National Coordinator for Health Information 
Technology, Department of Health and Human Services.

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: This final rule establishes a temporary certification program 
for the purposes of testing and certifying health information 
technology. This final rule is established under the authority granted 
to the National Coordinator for Health Information Technology (the 
National Coordinator) by section 3001(c)(5) of the Public Health 
Service Act (PHSA), as added by the Health Information Technology for 
Economic and Clinical Health (HITECH) Act. The National Coordinator 
will utilize the temporary certification program to authorize 
organizations to test and certify Complete Electronic Health Records 
(EHRs) and/or EHR Modules, thereby making Certified EHR Technology 
available prior to the date on which health care providers seeking 
incentive payments available under the Medicare and Medicaid EHR 
Incentive Programs may begin demonstrating meaningful use of Certified 
EHR Technology.

DATES: These regulations are effective June 24, 2010. The incorporation 
by reference of certain publications listed in the rule is approved by 
the Director of the Federal Register as of June 24, 2010.

FOR FURTHER INFORMATION CONTACT: Steven Posnack, Director, Federal 
Policy Division, Office of Policy and Planning, Office of the National 
Coordinator for Health Information Technology, 202-690-7151.

SUPPLEMENTARY INFORMATION: 

Acronyms

APA Administrative Procedure Act
ARRA American Recovery and Reinvestment Act of 2009
CAH Critical Access Hospital
CCHIT Certification Commission for Health Information Technology
CGD Certification Guidance Document
CHPL Certified Health Information Technology Products List
CMS Centers for Medicare & Medicaid Services
CORE Committee on Operating Rules for Information Exchange[reg]
EHR Electronic Health Record
FACA Federal Advisory Committee Act
FFP Federal Financial Participation
FFS Fee for Service (Medicare Program)
HHS Department of Health and Human Services
HIPAA Health Insurance Portability and Accountability Act
HIT Health Information Technology
HITECH Health Information Technology for Economic and Clinical 
Health
ISO International Organization for Standardization
IT Information Technology
MA Medicare Advantage
NHIN Nationwide Health Information Network
NIST National Institute of Standards and Technology
OIG Office of Inspector General
OMB Office of Management and Budget
ONC Office of the National Coordinator for Health Information 
Technology
ONC-ACB ONC-Authorized Certification Body
ONC-ATCB ONC-Authorized Testing and Certification Body
OPM Office of Personnel Management
PHSA Public Health Service Act
RFA Regulatory Flexibility Act
RIA Regulatory Impact Analysis
SDO Standards Development Organization
SSA Social Security Act

Table of Contents

I. Background
    A. Previously Defined Terminology
    B. Legislative and Regulatory History
    1. Legislative History
    a. Standards, Implementation Specifications, and Certification 
Criteria
    b. Medicare and Medicaid EHR Incentive Programs
    i. Medicare EHR Incentive Program
    ii. Medicaid EHR Incentive Program
    c. HIT Certification Programs
    2. Regulatory History and Related Guidance
    a. Initial Set of Standards, Implementation Specifications, and 
Certification Criteria Interim Final Rule
    b. Medicare and Medicaid EHR Incentive Programs Proposed Rule
    c. HIT Certification Programs Proposed Rule and the Temporary 
Certification Program Final Rule
    d. Recognized Certification Bodies as Related to the Physician 
Self-Referral Prohibition and Anti-Kickback EHR Exception and Safe 
Harbor Final Rules
II. Overview of the Temporary Certification Program
III. Provisions of the Temporary Certification Program; Analysis and 
Response to Public Comments on the Proposed Rule
    A. Overview
    B. Scope and Applicability
    C. Definitions and Correspondence
    1. Definitions
    a. Days
    b. Applicant
    c. ONC-ATCB
    2. Correspondence
    D. Testing and Certification
    1. Distinction Between Testing and Certification
    2. Types of Testing and Certification
    a. Complete EHRs and EHR Modules
    b. Complete EHRs for Ambulatory or Inpatient Settings
    c. Integrated Testing and Certification of EHR Modules
    E. Application Process
    1. Application Prerequisite
    2. Application
    a. Part 1
    b. Part 2
    3. Principles of Proper Conduct for ONC-ATCBs
    a. Operation in Accordance With Guide 65 and ISO 17025 Including 
Developing a Quality Management System
    b. Use of NIST Test Tools and Test Procedures
    i. Establishment of Test Tools and Test Procedures
    ii. Public Feedback Process
    c. ONC Visits to ONC-ATCB Sites
    d. Lists of Tested and Certified Complete EHRs and EHR Modules
    i. ONC-ATCB Lists
    ii. Certified HIT Products List
    e. Records Retention
    f. Refunds
    g. Suggested New Principles of Proper Conduct
    4. Application Submission
    5. Overall Application Process
    F. Application Review, Application Reconsideration and ONC-ATCB 
Status
    1. Review of Application
    2. ONC-ATCB Application Reconsideration
    3. ONC-ATCB Status
    G. Testing and Certification of Complete EHRs and EHR Modules
    1. Complete EHRs
    2. EHR Modules
    a. Applicable Certification Criteria or Criterion
    b. Privacy and Security Testing and Certification
    c. Identification of Certified Status
    H. The Testing and Certification of ``Minimum Standards''
    I. Authorized Testing and Certification Methods
    J. Good Standing as an ONC-ATCB, Revocation of ONC-ATCB Status 
and Effect of Revocation on Certifications Issued by a Former ONC-
ATCB
    1. Good Standing as an ONC-ATCB
    2. Revocation of ONC-ATCB Status
    3. Effect of Revocation on Certifications Issued by a Former 
ONC-ATCB
    K. Sunset of the Temporary Certification Program
    L. Recognized Certification Bodies as Related to the Physician 
Self-Referral Prohibition and Anti-Kickback EHR Exception and Safe 
Harbor Final Rules
    M. Grandfathering
    N. Concept of ``Self-Developed''
    O. Validity of Complete EHR and EHR Module Certification and 
Expiration of Certified Status
    P. General Comments
    Q. Comments Beyond the Scope of this Final Rule
IV. Provisions of the Final Regulation
V. Technical Correction to Sec.  170.100
VI. Waiver of 30-day Delay in the Effective Date

[[Page 36159]]

VII. Collection of Information Requirements
    A. Collection of Information: Application for ONC-ATCB Status 
Under the Temporary Certification Program
    B. Collection of Information: ONC-ATCB Collection and Reporting 
of Information Related to Complete EHR and/or EHR Module 
Certifications
    C. Collection of Information: ONC-ATCB Retention of Testing and 
Certification Records and the Submission of Copies of Records to ONC
VIII. Regulatory Impact Analysis
    A. Introduction
    B. Why is this Rule needed?
    C. Executive Order 12866--Regulatory Planning and Review 
Analysis
    1. Comment and Response
    2. Executive Order 12866 Final Analysis
    a. Temporary Certification Program Estimated Costs
    i. Application Process for ONC-ATCB Status
    ii. Testing and Certification of Complete EHRs and EHR Modules
    iii. Costs for Collecting, Storing, and Reporting Certification 
Results
    iv. Costs for Retaining Records and Providing Copies to ONC
    b. Temporary Certification Program Benefits
    D. Regulatory Flexibility Act
    E. Executive Order 13132--Federalism
    F. Unfunded Mandates Reform Act of 1995

I. Background

A. Previously Defined Terminology

    In addition to new terms and definitions created by this rule, the 
following terms have the same meaning as provided at 45 CFR 170.102.

     Certification criteria
     Certified EHR Technology
     Complete EHR
     Disclosure
     EHR Module
     Implementation specification
     Qualified EHR
     Standard

B. Legislative and Regulatory History

1. Legislative History
    The Health Information Technology for Economic and Clinical Health 
(HITECH) Act, Title XIII of Division A and Title IV of Division B of 
the American Recovery and Reinvestment Act of 2009 (ARRA) (Pub. L. 111-
5), was enacted on February 17, 2009. The HITECH Act amended the Public 
Health Service Act (PHSA) and created ``Title XXX--Health Information 
Technology and Quality'' (Title XXX) to improve health care quality, 
safety, and efficiency through the promotion of health information 
technology (HIT) and electronic health information exchange. Section 
3001 of the PHSA establishes the Office of the National Coordinator for 
Health Information Technology (ONC). Title XXX of the PHSA provides the 
National Coordinator for Health Information Technology (the National 
Coordinator) and the Secretary of Health and Human Services (the 
Secretary) with new responsibilities and authorities related to HIT. 
The HITECH Act also amended several sections of the Social Security Act 
(SSA) and in doing so established the availability of incentive 
payments to eligible professionals and eligible hospitals to promote 
the adoption and meaningful use of interoperable HIT.
a. Standards, Implementation Specifications, and Certification Criteria
    With the passage of the HITECH Act, two new Federal advisory 
committees were established, the HIT Policy Committee and the HIT 
Standards Committee (sections 3002 and 3003 of the PHSA, respectively). 
Each is responsible for advising the National Coordinator on different 
aspects of standards, implementation specifications, and certification 
criteria. The HIT Policy Committee is responsible for, among other 
duties, recommending priorities for the development, harmonization, and 
recognition of standards, implementation specifications, and 
certification criteria, while the HIT Standards Committee is 
responsible for recommending standards, implementation specifications, 
and certification criteria for adoption by the Secretary under section 
3004 of the PHSA consistent with the ONC-coordinated Federal Health IT 
Strategic Plan (the ``strategic plan'').
    Section 3004 of the PHSA defines how the Secretary adopts 
standards, implementation specifications, and certification criteria. 
Section 3004(a) of the PHSA defines a process whereby an obligation is 
imposed on the Secretary to review standards, implementation 
specifications, and certification criteria and identifies the 
procedures for the Secretary to follow to determine whether to adopt 
any group of standards, implementation specifications, or certification 
criteria included among National Coordinator-endorsed recommendations.
b. Medicare and Medicaid EHR Incentive Programs
    Title IV, Division B of the HITECH Act establishes incentive 
payments under the Medicare and Medicaid programs for eligible 
professionals and eligible hospitals that meaningfully use Certified 
Electronic Health Record (EHR) Technology. The Centers for Medicare & 
Medicaid Services (CMS) is charged with developing the Medicare and 
Medicaid EHR incentive programs.
i. Medicare EHR Incentive Program
    Section 4101 of the HITECH Act added new subsections to section 
1848 of the SSA to establish incentive payments for the meaningful use 
of Certified EHR Technology by eligible professionals participating in 
the Medicare Fee-for-Service (FFS) program beginning in calendar year 
(CY) 2011 and beginning in CY 2015, downward payment adjustments for 
covered professional services provided by eligible professionals who 
are not meaningful users of Certified EHR Technology. Section 4101(c) 
of the HITECH Act added a new subsection to section 1853 of the SSA 
that provides incentive payments to Medicare Advantage (MA) 
organizations for their affiliated eligible professionals who 
meaningfully use Certified EHR Technology beginning in CY 2011 and 
beginning in CY 2015, downward payment adjustments to MA organizations 
to account for certain affiliated eligible professionals who are not 
meaningful users of Certified EHR Technology.
    Section 4102 of the HITECH Act added new subsections to section 
1886 of the SSA that establish incentive payments for the meaningful 
use of Certified EHR Technology by subsection (d) hospitals (defined 
under section 1886(d)(1)(B) of the SSA) that participate in the 
Medicare FFS program beginning in Federal fiscal year (FY) 2011 and 
beginning in FY 2015, downward payment adjustments to the market basket 
updates for inpatient hospital services provided by such hospitals that 
are not meaningful users of Certified EHR Technology. Section 4102(b) 
of the HITECH Act amends section 1814 of the SSA to provide an 
incentive payment to critical access hospitals that meaningfully use 
Certified EHR Technology based on the hospitals' reasonable costs 
beginning in FY 2011 and downward payment adjustments for inpatient 
hospital services provided by such hospitals that are not meaningful 
users of Certified EHR Technology for cost reporting periods beginning 
in FY 2015. Section 4102(c) of the HITECH Act adds a new subsection to 
section 1853 of the SSA to provide incentive payments to MA 
organizations for certain affiliated eligible hospitals that 
meaningfully use Certified EHR Technology and beginning in FY 2015, 
downward payment adjustments to MA organizations for those affiliated 
hospitals that are not meaningful users of Certified EHR Technology.

[[Page 36160]]

ii. Medicaid EHR Incentive Program
    Section 4201 of the HITECH Act amends section 1903 of the SSA to 
provide 100 percent Federal financial participation (FFP) to States for 
incentive payments to eligible health care providers participating in 
the Medicaid program and 90 percent FFP for State administrative 
expenses related to the incentive program.
c. HIT Certification Programs
    Section 3001(c)(5) of the PHSA provides the National Coordinator 
with the authority to establish a certification program or programs for 
the voluntary certification of HIT. Specifically, section 3001(c)(5)(A) 
specifies that the ``National Coordinator, in consultation with the 
Director of the National Institute of Standards and Technology, shall 
keep or recognize a program or programs for the voluntary certification 
of health information technology as being in compliance with applicable 
certification criteria adopted under this subtitle'' (i.e., 
certification criteria adopted by the Secretary under section 3004 of 
the PHSA). The certification program(s) must also ``include, as 
appropriate, testing of the technology in accordance with section 
13201(b) of the [HITECH] Act.''
    Section 13201(b) of the HITECH Act requires that with respect to 
the development of standards and implementation specifications, the 
Director of the National Institute of Standards and Technology (NIST), 
in coordination with the HIT Standards Committee, ``shall support the 
establishment of a conformance testing infrastructure, including the 
development of technical test beds.'' The United States Congress also 
indicated that ``[t]he development of this conformance testing 
infrastructure may include a program to accredit independent, non-
Federal laboratories to perform testing.''
2. Regulatory History and Related Guidance
a. Initial Set of Standards, Implementation Specifications, and 
Certification Criteria Interim Final Rule
    In accordance with section 3004(b)(1) of the PHSA, the Secretary 
issued an interim final rule with request for comments entitled 
``Health Information Technology: Initial Set of Standards, 
Implementation Specifications, and Certification Criteria for 
Electronic Health Record Technology'' (HIT Standards and Certification 
Criteria interim final rule) (75 FR 2014), which adopted an initial set 
of standards, implementation specifications, and certification 
criteria. The standards, implementation specifications, and 
certification criteria adopted by the Secretary establish the 
capabilities that Certified EHR Technology must include in order to, at 
a minimum, support the achievement of what has been proposed for 
meaningful use Stage 1 by eligible professionals and eligible hospitals 
under the Medicare and Medicaid EHR Incentive Programs proposed rule 
(see 75 FR 1844 for more information about meaningful use and the 
proposed Stage 1 requirements).
b. Medicare and Medicaid EHR Incentive Programs Proposed Rule
    On January 13, 2010, CMS published in the Federal Register (75 FR 
1844) the Medicare and Medicaid EHR Incentive Programs proposed rule. 
The rule proposes a definition for meaningful use Stage 1 and 
regulations associated with the incentive payments made available under 
Division B, Title IV of the HITECH Act. CMS has proposed that 
meaningful use Stage 1 would begin in 2011 and has proposed that Stage 
1 would focus on ``electronically capturing health information in a 
coded format; using that information to track key clinical conditions 
and communicating that information for care coordination purposes 
(whether that information is structured or unstructured), but in 
structured format whenever feasible; consistent with other provisions 
of Medicare and Medicaid law, implementing clinical decision support 
tools to facilitate disease and medication management; and reporting 
clinical quality measures and public health information.''
c. HIT Certification Programs Proposed Rule and the Temporary 
Certification Program Final Rule
    Section 3001(c)(5) of the PHSA, specifies that the National 
Coordinator ``shall keep or recognize a program or programs for the 
voluntary certification of health information technology as being in 
compliance with applicable certification criteria adopted [by the 
Secretary] under this subtitle.'' Based on this authority, we proposed 
both a temporary and permanent certification program for HIT in a 
notice of proposed rulemaking entitled ``Proposed Establishment of 
Certification Programs for Health Information Technology'' (75 FR 
11328, March 10, 2010) (RIN 0991-AB59) (the ``Proposed Rule''). In the 
Proposed Rule, we proposed to use the certification programs for the 
purposes of testing and certifying HIT. We also specified the processes 
the National Coordinator would follow to authorize organizations to 
perform the certification of HIT.
    We stated in the Proposed Rule that we expected to issue separate 
final rules for each of the certification programs. This final rule 
establishes a temporary certification program whereby the National 
Coordinator will authorize organizations to test and certify Complete 
EHRs and/or EHR Modules, thereby assuring the availability of Certified 
EHR Technology prior to the date on which health care providers seeking 
the incentive payments available under the Medicare and Medicaid EHR 
Incentive Programs may begin demonstrating meaningful use of Certified 
EHR Technology.
d. Recognized Certification Bodies as Related to the Physician Self-
Referral Prohibition and Anti-Kickback EHR Exception and Safe Harbor 
Final Rules
    In August 2006, HHS published two final rules in which CMS and the 
Office of Inspector General (OIG) promulgated an exception to the 
physician self-referral prohibition and a safe harbor under the anti-
kickback statute, respectively, for certain arrangements involving the 
donation of interoperable EHR software to physicians and other health 
care practitioners or entities (71 FR 45140 and 71 FR 45110, 
respectively). The exception and safe harbor provide that EHR software 
will be ``deemed to be interoperable if a certifying body recognized by 
the Secretary has certified the software no more than 12 months prior 
to the date it is provided to the [physician/recipient].'' ONC 
published separately a Certification Guidance Document (CGD) (71 FR 
44296) to explain the factors ONC would use to determine whether to 
recommend to the Secretary a body for ``recognized certification body'' 
status. The CGD serves as a guide for ONC to evaluate applications for 
``recognized certification body'' status and provides the information a 
body would need to apply for and obtain such status. To date, the 
Certification Commission for Health Information Technology (CCHIT) has 
been the only organization that has both applied for and been granted 
``recognized certification body'' status under the CGD.
    In section VI of the CGD, ONC notified the public, including 
potential applicants, that the recognition process explained in the CGD 
would be formalized through notice and comment rulemaking and that when 
a final rule has been promulgated to govern the process by which a 
``recognized certification body'' is determined, certification bodies 
recognized under the CGD would be required to complete

[[Page 36161]]

new applications and successfully demonstrate compliance with all 
requirements of the final rule.
    In the Proposed Rule, we began the formal notice and comment 
rulemaking described in the CGD. We stated that the processes we 
proposed for the temporary certification program and permanent 
certification program, once finalized, would supersede the CGD, and the 
authorization process would constitute the new established method for 
``recognizing'' certification bodies, as referenced in the physician 
self-referral prohibition and anti-kickback EHR exception and safe 
harbor final rules. As a result of our proposal, certifications issued 
by a certification body ``authorized'' by the National Coordinator 
would constitute certification by ``a certifying body recognized by the 
Secretary'' in the context of the physician self-referral EHR exception 
and anti-kickback EHR safe harbor. We requested public comment on this 
proposal and have responded to those comments in Section III of this 
final rule.

II. Overview of the Temporary Certification Program

    The temporary certification program provides a process by which an 
organization or organizations may become an ONC-Authorized Testing and 
Certification Body (ONC-ATCB) and be authorized by the National 
Coordinator to perform the testing and certification of Complete EHRs 
and/or EHR Modules.
    Under the temporary certification program, the National Coordinator 
will accept applications for ONC-ATCB status at any time. In order to 
become an ONC-ATCB, an organization or organizations must submit an 
application to the National Coordinator to demonstrate its competency 
and ability to test and certify Complete EHRs and/or EHR Modules. An 
applicant will need to be able to both test and certify Complete EHRs 
and/or EHR Modules. We anticipate that only a few organizations will 
qualify and become ONC-ATCBs under the temporary certification program. 
These organizations will be required to remain in good standing by 
adhering to the Principles of Proper Conduct for ONC-ATCBs. ONC-ATCBs 
will also be required to follow the conditions and requirements 
applicable to the testing and certification of Complete EHRs and/or EHR 
Modules as specified in this final rule. The temporary certification 
program will sunset on December 31, 2011, or if the permanent 
certification program is not fully constituted at that time, then upon 
a subsequent date that is determined to be appropriate by the National 
Coordinator.

III. Provisions of the Temporary Certification Program; Analysis and 
Response to Public Comments on the Proposed Rule

A. Overview

    This section discusses the 84 timely received comments on the 
Proposed Rule's proposed temporary certification program and our 
responses. We have structured this section of the final rule based on 
the proposed regulatory sections of the temporary certification program 
and discuss each regulatory section sequentially. For each discussion 
of the regulatory provision, we first restate or paraphrase the 
provision as proposed in the Proposed Rule as well as identify any 
correlated issues for which we sought public comment. Second, we 
summarize the comments received. Lastly, we provide our response to the 
comments, including stating whether we will finalize the provision as 
proposed in the Proposed Rule or modify the proposed provision in 
response to public comment. Comments on the incorporation of the 
``recognized certification body'' process, ``grandfathering'' of 
certifications, the concept of ``self-developed,'' validity and 
expiration of certifications, general comments, and comments beyond the 
scope of this final rule are discussed towards the end of the preamble.

B. Scope and Applicability

    In the Proposed Rule, we indicated in section 170.400 that the 
temporary certification program would serve to implement section 
3001(c)(5) of the Public Health Service Act, and that subpart D would 
also set forth the rules and procedures related to the temporary 
certification program for HIT administered by the National Coordinator. 
Under section 170.401, we proposed that subpart D would establish the 
processes that applicants for ONC-ATCB status must follow to be granted 
ONC-ATCB status by the National Coordinator, the processes the National 
Coordinator would follow when assessing applicants and granting ONC-
ATCB status, and the requirements of ONC-ATCBs for testing and 
certifying Complete EHRs and/or EHR Modules in accordance with the 
applicable certification criteria adopted by the Secretary in subpart C 
of this part.
    Comments. We received many comments that expressed support for our 
proposal for a temporary certification program that would provide the 
opportunity for Complete EHRs and EHR Modules to be tested and 
certified in advance of meaningful use Stage 1. The commenters 
expressed an understanding of the rationale we provided for proposing a 
temporary certification program and the urgency we associated with 
establishing the temporary certification program.
    Some commenters suggested that we use the terms ``interim,'' 
``transitional'' or ``provisional'' to describe the temporary 
certification program. One commenter asserted that the term ``interim'' 
is particularly appropriate because it is used in Federal rulemaking to 
denote regulatory actions that are fully in effect but will be replaced 
with more refined versions in the future. Other commenters contended 
that using the term ``temporary'' to describe the short-term program 
and its associated certifications may cause confusion in the market and 
prolong, instead of reduce, uncertainty among eligible professionals 
and eligible hospitals. One commenter recommended that we establish a 
comprehensive educational program about our proposed certification 
programs.
    Some commenters stated that the certification programs should not 
be vague and expansive by encompassing various, unidentified areas of 
HIT, but instead should be targeted to the objectives of achieving 
meaningful use of Certified EHR Technology. One commenter also 
mentioned the need for the certification programs to focus on the 
implementation of the Nationwide Health Information Network (NHIN).
    Response. We appreciate the commenters' expressions of support for 
the temporary certification program. We also appreciate the commenters' 
suggestions and rationale for renaming the temporary certification 
program. We believe, however, that we have described the temporary 
certification program in the Proposed Rule and this final rule in a 
manner that clearly conveys its purpose and scope such that renaming 
the program is not necessary. Furthermore, as generally recommended by 
a commenter, we will continue to communicate with and educate 
stakeholders about the temporary certification program and the eventual 
transition to the proposed permanent certification program.
    We believe that we clearly indicated in the Proposed Rule's 
preamble and the proposed temporary certification program's scope and 
applicability provisions that one of the goals of the temporary 
certification program is to support the achievement of meaningful use 
by testing and certifying Complete EHRs and EHR Modules to the 
certification criteria adopted by the

[[Page 36162]]

Secretary in subpart C of part 170. Therefore, we do not believe that 
the programs are overly vague or expansive. We believe that the 
commenters who expressed these concerns focused on our proposals to 
permit other types of HIT to be certified under the permanent 
certification program. We plan to address this issue in the final rule 
for the permanent certification program, but in the interim, we remind 
these commenters of a fact we stated in the Proposed Rule. The 
Secretary would first need to adopt certification criteria for other 
types of HIT before we would consider authorizing, in this case, ONC-
ACBs to certify those other types of HIT.
    We are revising Sec.  170.401 to clearly state that this subpart 
includes requirements that ONC-ATCBs must follow to maintain good 
standing under the temporary certification program. This reference was 
inadvertently left out of Sec.  170.401 in the Proposed Rule.

C. Definitions and Correspondence

    We proposed in the Proposed Rule to define three terms related to 
the temporary certification program and to establish a process for 
applicants for ONC-ATCB status and ONC-ATCBs to correspond with the 
National Coordinator.
1. Definitions
a. Days
    We proposed in the Proposed Rule to add the definition of ``day or 
days'' to section 170.102. We proposed to define ``day or days'' to 
mean a calendar day or calendar days. We did not receive any comments 
on this provision. Therefore, we are finalizing this definition without 
modification.
b. Applicant
    We proposed in section 170.402 to define applicant to mean a single 
organization or a consortium of organizations that seeks to become an 
ONC-ATCB by requesting and subsequently submitting an application for 
ONC-ATCB status to the National Coordinator.
    Comments. One commenter recommended that we encourage and support 
the establishment of coalitions or partnerships for testing and 
certification that leverage specialized expertise. Another commenter 
asked whether third-party organizations will be allowed to become 
testing laboratories for the temporary and permanent certification 
programs.
    Response. We agree with the commenter that coalitions or 
partnerships for testing and certification are capable of leveraging 
specialized expertise and we continue to support such an approach. We 
noted in the Proposed Rule that single organizations and consortia 
would be eligible to apply for ONC-ATCB status under the temporary 
certification program. We also stated that we would expect a consortium 
to be comprised of one organization that would serve as a testing 
laboratory and a separate organization that would serve as a 
certification body. We further stated that, as long as such an 
applicant could perform all of the required responsibilities of an ONC-
ATCB, we would fully support the approach. Accordingly, we are 
finalizing this provision without modification.
    Although we are unclear as to what the commenter meant by a 
``third-party organization,'' we can state that a testing laboratory 
could apply to become an ONC-ATCB in a manner described above (i.e., as 
a member or component of a consortium) or the laboratory could apply 
independently to become an ONC-ATCB, but it would need to meet all the 
application requirements, including the requisite certification body 
qualifications as specified in ISO/IEC Guide 65:1996 (Guide 65). In the 
Proposed Rule, we proposed that a testing laboratory would need to 
become accredited by the testing laboratory accreditor under the 
permanent certification program. This process and whether an 
organization that becomes an ONC-ACB under the permanent certification 
program can be affiliated with an accredited testing laboratory are 
matters we requested the public to comment on in the Proposed Rule and 
will be more fully discussed when we finalize the permanent 
certification program.
c. ONC-ATCB
    We proposed in section 170.402 to define an ONC-Authorized Testing 
and Certification Body (ONC-ATCB) to mean an organization or a 
consortium of organizations that has applied to and been authorized by 
the National Coordinator pursuant to subpart D to perform the testing 
and certification of Complete EHRs and/or EHR Modules under the 
temporary certification program. We did not receive any comments on 
this provision. Therefore, we are finalizing this definition without 
modification.
2. Correspondence
    We proposed in section 170.405 to require applicants for ONC-ATCB 
status and ONC-ATCBs to correspond and communicate with the National 
Coordinator by e-mail, unless otherwise necessary. We proposed that the 
official date of receipt of any e-mail between the National Coordinator 
and an applicant for ONC-ATCB status or an ONC-ATCB would be the day 
the e-mail was sent. We further proposed that in circumstances where it 
was necessary for an applicant for ONC-ATCB status or ONC-ATCB to 
correspond or communicate with the National Coordinator by regular or 
express mail, the official date of receipt would be the date of the 
delivery confirmation. We did not receive any comments on these 
proposals. We are, however, revising this section to include ``or ONC-
ATCB'' in paragraph (b) to clarify that either an applicant for ONC-
ATCB status or an ONC-ATCB may, when necessary, utilize the specified 
correspondence methods. This reference was inadvertently left out of 
Sec.  170.405(b) in the Proposed Rule.

D. Testing and Certification

1. Distinction Between Testing and Certification
    We stated in the Proposed Rule that there is a distinct difference 
between the ``testing'' and ``certification'' of a Complete EHR and/or 
EHR Module. We described ``testing'' as the process used to determine 
the degree to which a Complete EHR or EHR Module can meet specific, 
predefined, measurable, and quantitative requirements. We noted that 
such results would be able to be compared to and evaluated in 
accordance with predefined measures. In contrast, we described 
``certification'' as the assessment (and subsequent assertion) made by 
an organization, once it has analyzed the quantitative results rendered 
from testing along with other qualitative factors, that a Complete EHR 
or EHR Module has met all of the applicable certification criteria 
adopted by the Secretary. We noted that qualitative factors could 
include whether a Complete EHR or EHR Module developer has a quality 
management system in place, or whether the Complete EHR or EHR Module 
developer has agreed to the policies and conditions associated with 
being certified (e.g., proper logo usage). We further stated that the 
act of certification typically promotes confidence in the quality of a 
product (and the Complete EHR or EHR Module developer that produced 
it), offers assurance that the product will perform as described, and 
helps consumers to differentiate which products have met specific 
criteria from others that have not.
    To further clarify, we stated that a fundamental difference between 
testing and certification is that testing is intended to result in 
objective,

[[Page 36163]]

unanalyzed data. In contrast, certification is expected to result in an 
overall assessment of the test results, consideration of their 
significance, and consideration of other factors to determine whether 
the prerequisites for certification have been achieved. To illustrate 
an important difference between testing and certification, we provided 
the example that we recite below.
    An e-prescribing EHR Module developer that seeks to have its EHR 
Module certified would first submit the EHR Module to be tested. To 
successfully pass the established testing requirements, the e-
prescribing EHR Module would, among other functions, need to transmit 
an electronic prescription using mock patient data according to the 
standards adopted by the Secretary. Provided that the e-prescribing EHR 
Module successfully passed this test it would next be evaluated for 
certification. Certification could require that the EHR Module 
developer agree to a number of provisions, including, for example, 
displaying the EHR Module's version and revision number so potential 
purchasers could discern when the EHR Module was last updated or 
certified. If the EHR Module developer agreed to all of the applicable 
certification requirements and the EHR Module achieved a passing test 
result, the e-prescribing EHR Module would be certified. In these 
situations, both the EHR Module passing the technical requirements 
tests and the EHR Module vendor meeting the other certification 
requirements would be required for the EHR Module to achieve 
certification.
    Comments. Multiple commenters asked for additional clarification 
for the distinction between testing and certification. Commenters were 
concerned that ONC-ATCBs would have too much discretion related to 
certification. The commenters asserted that ONC-ATCBs should only be 
empowered to assess whether adopted certification criteria have been 
met or whether other applicable policies adopted by the National 
Coordinator through regulation, such as ``labeling'' policies, have 
been complied with. Commenters expressed specific concern with one of 
our examples of potential qualitative factors, which was the need to 
have ``a quality management system in place.'' The commenters suggested 
that a requirement to have a quality management system in place is 
vague and gave too much discretion to an ONC-ATCB.
    Response. We require as a Principle of Proper Conduct that ONC-
ATCBs shall operate their certification programs in accordance with 
Guide 65. Guide 65 specifies the requirements that an organization must 
follow to operate a certification program. Moreover, because Guide 65 
states in section 4.6.1 that a ``certification body shall specify the 
conditions for granting, maintaining and extending certification,'' we 
believe that it would be inappropriate to dictate every specific aspect 
related to an ONC-ATCB's certification program operations. We 
understand the concerns expressed by commenters over our example of a 
``quality management system'' as another factor that ONC-ATCBs may 
choose to include, in accordance with Guide 65, as part of their 
certification requirements for assessing Complete EHRs and/or EHR 
Modules and have considered how to best address such concerns.
    With respect to those commenters who requested that we clarify the 
purview of ONC-ATCBs related to certification and expressed concerns 
about the discretion afforded to ONC-ATCBs, we agree that additional 
clarity is necessary regarding our intent and expectations of ONC-ATCBs 
in our discussion of the differences between testing and certification 
in the Proposed Rule. We believe commenters were expressing a concern 
that certification could include other factors beyond the certification 
criteria adopted by the Secretary in subpart C of part 170, which could 
prevent them from receiving a certification in a timely manner if they 
were not aware of those factors. We agree with commenters that this is 
a legitimate concern and did not intend to convey, through our 
examples, that we would adopt additional requirements for certification 
in this final rule beyond the certification criteria adopted by the 
Secretary in subpart C of part 170 and the other responsibilities 
specified in subpart D of part 170 that we require an ONC-ATCB to 
fulfill in order to perform the testing and certification of Complete 
EHRs and/or EHR Modules.
    We seek to make clear that the primary responsibility of ONC-ATCBs 
under the temporary certification program is to test and certify 
Complete EHRs and/or EHR Modules in accordance with the certification 
criteria adopted by the Secretary. In consideration of the comments and 
the preceding discussion, we have revised Sec.  170.445 and Sec.  
170.450 to make it explicitly clear that an ONC-ATCB must offer the 
option of testing and certification of a Complete EHR or EHR Module 
solely to the certification criteria adopted by the Secretary and no 
other certification criteria. In other words, an ONC-ATCB must comply 
with a request made by a Complete EHR or EHR Module developer to have 
its Complete EHR or EHR Module tested and certified solely to the 
certification criteria adopted by the Secretary and not to any other 
factors beyond those we require ONC-ATCBs to follow when issuing a 
certification as discussed above (i.e., responsibilities specified in 
subpart D of part 170). However, this does not preclude an ONC-ATCB 
from also offering testing and certification options that include 
additional requirements beyond the certification criteria adopted by 
the Secretary. If an ONC-ATCB chooses to offer testing and 
certification options that specify additional requirements as a matter 
of its own business practices, we expect that in accordance with Guide 
65, section 6, the ONC-ATCB would ``give due notice of any changes it 
intends to make in its requirements for certification'' and ``take 
account of views expressed by interested parties before deciding on the 
precise form and effective date of the changes.''
    We note, however, that while we do not preclude an ONC-ATCB from 
certifying HIT in accordance with its own requirements that may be 
unrelated to and potentially exceed the certification criteria adopted 
by the Secretary, such activities are not within the scope of an ONC-
ATCB's authority granted under the temporary certification program and 
are not endorsed or approved by the National Coordinator or the 
Secretary. Accordingly, we have added as a component of a new principle 
in the Principles of Proper Conduct for ONC-ATCBs (discussed in more 
detail in section O. Validity of Complete EHR and EHR Module 
Certification and Expiration of Certified Status) that any 
certifications issued to HIT that would constitute a Complete EHR or 
EHR Module and based on the applicable certification criteria adopted 
by the Secretary at subpart C must be separate and distinct from any 
other certification(s) that are based on other criteria or 
requirements. To further clarify, HIT which constitutes a Complete EHR 
or EHR Module that is tested and certified to the certification 
criteria adopted by the Secretary as well as an ONC-ATCB's own 
certification criteria would need to have its certified status as a 
Complete EHR or EHR Module noted separately and distinctly from any 
other certification the ONC-ATCB may issue based on the successful 
demonstration of compliance with its own certification criteria. For 
example, an ONC-ATCB should indicate that the HIT has been certified as 
a ``Complete

[[Page 36164]]

EHR in accordance with the applicable certification criteria adopted by 
the Secretary of Health and Human Services'' and, if applicable, 
separately indicate that the HIT meets ``XYZ certification criteria as 
developed and/or required by [specify certification body].''
2. Types of Testing and Certification
    We proposed in section 170.410 that applicants for ONC-ATCB status 
may seek authorization from the National Coordinator to perform 
Complete EHR testing and certification and/or EHR Module testing and 
certification.
    We received multiple comments on the types of testing and 
certification that ONC-ATCBs can and should perform. Many of these 
comments were in response to our requests for public comments on 
whether ONC-ATCBs should test and certify the integration of EHR 
Modules and on whether applicants should be permitted to apply to 
either test and certify only Complete EHRs designed for an ambulatory 
setting or Complete EHRs designed for an inpatient setting.
a. Complete EHRs and EHR Modules
    We proposed that potential applicants have the option of seeking 
authorization from the National Coordinator to perform Complete EHR 
testing and certification and/or EHR Module testing and certification.
    Comments. We received comments expressing support for our proposal 
because of the flexibility it would provide to applicants and the 
industry. We also received a few comments expressing positions contrary 
to our proposal. One commenter recommended that we add more flexibility 
by allowing applicants, similar to our proposals for the proposed 
permanent certification program, to either do only testing or 
certification. Conversely, a few commenters recommended that we not 
give applicants the option to select, but instead require ONC-ATCBs to 
perform testing and certification for both Complete EHRs and EHR 
Modules. One commenter wanted us to ensure that there were at least two 
ONC-ATCBs for both Complete EHR and EHR Module testing and 
certification.
    Response. We have attempted to create a temporary certification 
program that allows for as many qualified applicants to apply and 
become authorized as possible in the limited time allotted under the 
temporary certification program. We do not agree with the commenters 
that recommended that we pattern the applicant requirements after the 
proposed permanent certification program or that we ensure that there 
will be at least two ONC-ATCBs for both Complete EHR and EHR Module 
testing and certification. As discussed in the Proposed Rule, the 
temporary certification program's processes and requirements are 
different than the permanent certification program because of the 
urgency with which the temporary certification program must be 
established. We are also unable to ensure that there will be any 
specific number of ONC-ATCBs. We believe it is best to let the 
marketplace dictate the amount of qualified applicants that will apply 
for ONC-ATCB status. We are, however, confident that there are 
sufficient incentives for applicants to apply and that the program is 
structured in a manner that will maximize the number of qualified 
applicants.
b. Complete EHRs for Ambulatory or Inpatient Settings
    We requested public comment in the Proposed Rule on whether the 
National Coordinator should permit applicants to seek authorization to 
test and certify only Complete EHRs designed for an ambulatory setting 
or, alternatively, Complete EHRs designed for an inpatient setting. 
Under our proposal, an applicant seeking authorization to perform 
Complete EHR testing and certification would be required to test and 
certify Complete EHRs designed for both ambulatory and inpatient 
settings.
    Comments. We received comments ranging from support for providing 
the option for applicants to test and certify Complete EHRs for either 
ambulatory or inpatient settings to support for our proposal to require 
an ONC-ATCB to perform testing and certification for both settings. 
Some commenters thought that our proposal could stifle competition and 
expressed concern that there may not be enough entities capable of 
performing Complete EHR testing and certification for both settings. 
These commenters stated that allowing for Complete EHR testing and 
certification for either an ambulatory or inpatient setting could add 
competition and expedite certifications. Conversely, a few commenters 
stated that providing the option would multiply the National 
Coordinator's application workload and slow the authorization of ONC-
ATCBs. One commenter also thought that the option may lead to 
applicants for ONC-ATCB status competing for limited resources, such as 
specialized staff for conducting testing and certification.
    Some commenters expressed concern that if the National Coordinator 
were to allow applicants to test and certify Complete EHRs for either 
ambulatory or inpatient settings, there would not be enough ONC-ATCBs 
to test and certify Complete EHRs for each setting. Therefore, these 
commenters' support for the option was conditioned on the National 
Coordinator ensuring that there were an adequate number of ONC-ATCBs 
for each setting. One commenter only supported giving ONC-ATCBs an 
option to test and certify Complete EHRs for either ambulatory or 
inpatient settings if the option included testing and certification of 
EHR Module level interactions necessary for the exchange of data 
between ambulatory and inpatient Complete EHRs.
    Some commenters stated that the option could lead to ``almost 
complete'' EHRs, which could then lead to eligible professionals and 
eligible hospitals paying large sums for niche EHR Modules based on 
complicated certification criteria such as biosurveillance or quality 
reporting. One commenter asserted that under our current proposal an 
applicant for ONC-ATCB status could seek authorization to test and 
certify EHR Modules that together would essentially constitute a 
Complete EHR for an ambulatory setting (or an inpatient setting). 
Therefore, the commenter contended that we should allow an applicant 
for ONC-ATCB status the option to seek authorization to test and 
certify Complete EHRs for either ambulatory or inpatient settings 
because an applicant for ONC-ATCB status could essentially choose that 
option by seeking all the necessary EHR Module authorizations for 
either ambulatory or inpatient settings.
    Response. We believe that based on the concerns expressed by the 
commenters that it would be inappropriate at this time to allow 
applicants for ONC-ATCB status to seek authorization for the testing 
and certification of Complete EHRs for either ambulatory settings or 
inpatient settings. We will, however, reconsider this option for the 
permanent certification program based on the comments received on the 
proposed permanent certification program.
    To address the commenters' concerns about ``almost complete'' EHRs, 
we want to reiterate that for EHR technology to be considered a 
Complete EHR it would have to meet all applicable certification 
criteria adopted by the Secretary. For example, a Complete EHR for an 
ambulatory setting would have to meet all certification criteria 
adopted at Sec.  170.302 and Sec.  170.304. Therefore, if we had 
provided the option for ONC-ATCBs to seek authorization to test and 
certify Complete EHRs for either ambulatory or inpatient settings, the 
Complete EHRs that ONC-ATCBs tested

[[Page 36165]]

and certified would have had to meet all the applicable certification 
criteria adopted by the Secretary.
    We agree with the one commenter that an applicant for ONC-ATCB 
status could seek authorization to test and certify EHR Modules that 
together would potentially cover all the applicable certification 
criteria for an ambulatory setting. In fact, in relation to the privacy 
and security testing and certification of EHR Modules, we state in this 
final rule that if EHR Modules are presented for testing and 
certification as an integrated bundle that would otherwise constitute a 
Complete EHR we would consider them a Complete EHR for the purposes of 
being certified by an ONC-ATCB. The important distinction between the 
commenter's suggested approach and the option we proposed is that under 
the commenter's approach the ONC-ATCB would not be able to issue a 
``Complete EHR certification'' for a combination of EHR Modules because 
the ONC-ATCB had not received authorization to test and certify 
Complete EHRs. Consequently, if a Complete EHR developer wanted to 
obtain Complete EHR certification, they could not seek such 
certification from an ONC-ATCB that did not have authorization to grant 
Complete EHR certifications. We would assume that a potential applicant 
for ONC-ATCB status would consider this impact on its customer base 
when determining what type of authorization to seek.
c. Integrated Testing and Certification of EHR Modules
    In the Proposed Rule, we requested public comment on whether ONC-
ATCBs should be required to test and certify that any EHR Module 
presented by one EHR Module developer for testing and certification 
would properly work (i.e., integrate or be compatible) with other EHR 
Modules presented by different EHR Module developers.
    Comments. Multiple commenters stated that testing and certifying 
EHR Modules to determine whether they can integrate with one another is 
a worthwhile endeavor. These commenters stated that such testing and 
certification would make it easier for eligible professionals and 
eligible hospitals to purchase certified EHR Modules that are 
compatible and could be used together to achieve meaningful use and 
could increase or improve interoperability among HIT in general. 
Conversely, many other commenters strongly disagreed with requiring EHR 
Modules to be tested and certified for compatibility. Overall, these 
commenters asserted that it would be technically infeasible as well as 
both logistically (e.g., multiple testing and certification sites and 
multiple EHR Module developers) and financially impractical to attempt 
to test and certify for integration given the huge and shifting numbers 
of possible combinations. Some commenters, however, suggested that EHR 
Modules could be tested and certified as integrated bundles. One 
commenter recommended that if we were to pursue any type of EHR Module-
to-EHR Module integration, it should be no earlier than when we adopt 
the next set of standards, implementation specifications, and 
certification criteria, and then it should only be done selectively 
based on meaningful use requirements. Another commenter suggested that 
ONC-ATCBs be given the option, but not be required, to determine if EHR 
Modules are compatible.
    Response. We believe that the testing and certification of EHR 
Modules for the purposes of integration is inappropriate for the 
temporary certification program due to various impracticalities. We 
believe that EHR Module-to-EHR Module integration is inappropriate 
primarily because of the impracticalities pointed out by commenters 
related to the numerous combinations of EHR Modules that will likely 
exist and the associated technical, logistical, and financial costs of 
determining EHR Module-to-EHR Module integration. To the extent that an 
EHR Module developer or developers present EHR Modules together as an 
integrated bundle for testing and certification, we would allow the 
testing and certification of the bundle only if it was capable of 
meeting all the applicable certification criteria and would otherwise 
constitute a Complete EHR. In all other circumstances, we would not 
require testing and certification for EHR Module-to-EHR Module 
integration as part of the temporary certification program. Nothing in 
this final rule precludes an ONC-ATCB or other entity from offering a 
service to test and certify EHR Module-to-EHR Module integration. 
However, to be clear, although we do not require or specifically 
preclude an ONC-ATCB from testing and certifying EHR Module-to-EHR 
Module integration, any EHR Module-to-EHR Module testing and 
certification done by an ONC-ATCB or other entity will be done so 
without specific authorization from the National Coordinator and will 
not be considered part of the temporary certification program. We 
understand that testing and certification for EHR Module-to-EHR Module 
integration may be advantageous in certain instances, but we do not 
believe, for the reasons discussed above, that we could set all the 
necessary parameters for testing EHR Module-to-EHR Module integration 
within the allotted timeframe of the temporary certification program.

E. Application Process

    As outlined in greater detail below, the proposed application 
process consisted of an applicant abiding by certain prerequisites 
before receiving an application, adhering to the application 
requirements and submitting the application by one of the proposed 
methods.
1. Application Prerequisite
    We proposed in section 170.415 that applicants would be required to 
request, in writing, an application for ONC-ATCB status from the 
National Coordinator. We further proposed that applicants must indicate 
the type of authorization sought pursuant to Sec.  170.410, and if 
seeking authorization to perform EHR Module testing and certification, 
the specific type(s) of EHR Module(s) they seek authorization to test 
and certify. Finally, we proposed that applicants would only be 
authorized to test and certify the types of EHR Modules for which the 
applicants sought and received authorization.
    Comments. A commenter expressed agreement with our proposal to 
limit an applicant's authorization to test and certify EHR Modules to 
the EHR Modules specified in the applicant's application. The commenter 
requested, however, that we establish a process for allowing ONC-ATCBs 
to apply for additional authorization to test and certify additional 
EHR Modules and to allow for the expansion of authorization over time. 
Another commenter asked that we clarify that ONC-ATCBs that choose to 
only test and certify EHR Modules be allowed to limit their testing and 
certification to one health care setting, such as testing and 
certifying a ``laboratory'' EHR Module solely for an ambulatory 
setting.
    Response. The only process that we intend to use to authorize ONC-
ATCBs under the temporary certification program is the application 
process that we have proposed. Therefore, if an ONC-ATCB authorized to 
test and certify a certain type(s) of EHR Module(s) wanted to seek 
additional authorization for the testing and certification of other 
types of EHR Modules, it would need to submit another application 
requesting that specific authorization. We would

[[Page 36166]]

anticipate in that situation, however, that the application process and 
review would proceed fairly quickly. In addition, we will consider 
whether an alternative method would be appropriate for such a situation 
under the proposed permanent certification program. Lastly, we note, in 
response to a commenter's question about whether an ONC-ATCB authorized 
to test and certify a certain type of EHR Module is required to test 
and certify for both ambulatory and inpatient settings, that the answer 
would depend on what type of EHR Module authorization the applicant for 
ONC-ATCB status sought. As previously noted, it is possible to seek 
authorization to test and certify EHR Modules that address only an 
ambulatory or inpatient setting. Accordingly, we are finalizing this 
provision without modification.
2. Application
    We proposed in section 170.420 that the application for ONC-ATCB 
status would consist of two parts. We further proposed that applicants 
would be required to complete both parts of the application and submit 
them to the National Coordinator for the application to be considered 
complete.
a. Part 1
    In Part 1 of the application, we proposed that an applicant provide 
general identifying information including the applicant's name, 
address, city, state, zip code, and Web site. We proposed that an 
applicant also designate an authorized representative and provide the 
name, title, phone number, and e-mail address of the person who would 
serve as the applicant's point of contact. We proposed that an 
applicant complete and submit self audits to all sections of Guide 65 
and ISO/IEC 17025:2005 (ISO 17025) as well as submit additional 
documentation related to Guide 65 and ISO 17025. We also proposed that 
an applicant had to agree to adhere to the Principles of Proper Conduct 
for ONC-ATCBs.
    Comments. We received several comments expressing agreement with 
the application requirements, including the use of Guide 65 and ISO 
17025. One commenter specifically stated that requiring applicants for 
ONC-ATCB status to demonstrate their conformance to both Guide 65 and 
ISO 17025 is an appropriate and effective means to demonstrate an 
applicant's competency and ability to test and certify Complete EHRs 
and/or EHR Modules and, therefore, an appropriate means for initiating 
our proposed testing and certification program. However, we also 
received multiple comments requesting that we provide more explanation 
about Guide 65 and ISO 17025. The commenters requested information 
about how Guide 65 and ISO 17025 are related to Complete EHRs and EHR 
Modules, why we selected Guide 65 and ISO 17025 as conformance 
requirements for the temporary certification program, and how Guide 65 
and ISO 17025 are related to one another, including explaining why ISO 
17025 is appropriate for the temporary certification program but not 
for the permanent certification program. Commenters also recommended 
that we consult with NIST to develop an ``information paper'' or other 
supplemental guidance document to assist the industry with 
understanding Guide 65 and ISO 17025 and how they will apply to the 
certification programs.
    One commenter stated that conformance to ISO 17025 was not a 
barrier to entry because there are at least two commercial laboratories 
currently accredited to ISO 17025 and performing testing in a similar 
government program (USGv6 Testing Program). Conversely, other 
commenters expressed concern that Guide 65 and ISO 17025 were possible 
barriers to entry. Some commenters thought that the documentation 
requirements would be too high an administrative burden for applicants, 
while others thought there was not enough time for applicants to 
demonstrate compliance with Guide 65 and ISO 17025 in time to apply 
for, and receive authorization, under the temporary certification 
program.
    The commenters offered various recommendations for addressing their 
stated concerns. One commenter suggested that we delay compliance with 
Guide 65 and ISO 17025 until the permanent certification program is 
implemented. A second option recommended by commenters was to not 
require strict compliance with Guide 65 and ISO 17025, but rather allow 
for material compliance. In support of this recommendation, one 
commenter contended that certain provisions of ISO 10725 (i.e., 
provisions on uncertainty of measurements, sampling, calibration 
methods, and environmental conditions that impact results) do not 
appropriately address HIT testing and therefore should not apply. A 
third option presented by commenters was for us to embrace a glide path 
that would allow qualified organizations to move towards compliance in 
a systematic way. A more specific recommendation illustrating this 
sentiment was to allow applicants for ONC-ATCB status to meet certain 
requirements on a timeline that would enable a new entrant to build and 
demonstrate their capabilities throughout the application process while 
still requiring full adherence to the application requirements before 
an applicant is granted ONC-ATCB status.
    Response. With respect to those comments that requested further 
explanation about Guide 65 and ISO 17025, we would note that the 
International Organization for Standardization (ISO) developed both 
standards. As explained in the Introduction of Guide 65, the observance 
of the Guide's specifies requirements is intended to ensure that 
certification bodies operate third-party certification systems in a 
consistent and reliable manner, which will facilitate their acceptance 
on a national and international basis. ISO 17025 is also an 
international standard intended to serve as a basis for accreditation, 
which accreditation bodies use when assessing the competence of testing 
and calibration laboratories. We note that both standards have been 
developed by a voluntary consensus standards body, as required by the 
National Technology Transfer and Advancement Act of 1995 and the Office 
of Management and Budget (OMB) Circular A-119, and we are aware of no 
alternative voluntary consensus standards that would serve the purpose 
for which these standards are intended to serve.
    Guide 65 will be utilized to determine if an applicant for ONC-ATCB 
status is capable of conducting an appropriate certification program 
for certifying Complete EHRs and/or EHR Modules. ISO 17025 will be 
utilized to determine if an applicant for ONC-ATCB status is capable of 
conducting an appropriate testing program for testing Complete EHRs 
and/or EHR Modules. We