Health Information Technology: Initial Set of Standards, Implementation Specifications, and Certification Criteria for Electronic Health Record Technology, 44590-44654 [2010-17210]

Agencies

• DEPARTMENT OF HEALTH AND HUMAN SERVICES
• Office of the Secretary

[Federal Register Volume 75, Number 144 (Wednesday, July 28, 2010)]
[Rules and Regulations]
[Pages 44590-44654]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: 2010-17210]



[[Page 44589]]

-----------------------------------------------------------------------

Part III





Department of Health and Human Services





-----------------------------------------------------------------------



45 CFR Part 170



Health Information Technology: Initial Set of Standards, Implementation 
Specifications, and Certification Criteria for Electronic Health Record 
Technology; Final Rule

Federal Register / Vol. 75 , No. 144 / Wednesday, July 28, 2010 / 
Rules and Regulations

[[Page 44590]]


-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Office of the Secretary

45 CFR Part 170

RIN 0991-AB58


Health Information Technology: Initial Set of Standards, 
Implementation Specifications, and Certification Criteria for 
Electronic Health Record Technology

AGENCY: Office of the National Coordinator for Health Information 
Technology (ONC), Department of Health and Human Services.

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: The Department of Health and Human Services (HHS) is issuing 
this final rule to complete the adoption of an initial set of 
standards, implementation specifications, and certification criteria, 
and to more closely align such standards, implementation 
specifications, and certification criteria with final meaningful use 
Stage 1 objectives and measures. Adopted certification criteria 
establish the required capabilities and specify the related standards 
and implementation specifications that certified electronic health 
record (EHR) technology will need to include to, at a minimum, support 
the achievement of meaningful use Stage 1 by eligible professionals, 
eligible hospitals, and/or critical access hospitals (hereafter, 
references to ``eligible hospitals'' in this final rule shall mean 
``eligible hospitals and/or critical access hospitals'') under the 
Medicare and Medicaid EHR Incentive Programs. Complete EHRs and EHR 
Modules will be tested and certified according to adopted certification 
criteria to ensure that they have properly implemented adopted 
standards and implementation specifications and otherwise comply with 
the adopted certification criteria.

DATES: Effective Date: This final rule is effective August 27, 2010. 
The incorporation by reference of certain publications listed in the 
rule is approved by the Director of the Federal Register as of August 
27, 2010.

FOR FURTHER INFORMATION CONTACT: Steven Posnack, Director, Federal 
Policy Division, Office of Policy and Planning, Office of the National 
Coordinator for Health Information Technology, 202-690-7151.

SUPPLEMENTARY INFORMATION:

Acronyms

ANSI American National Standards Institute
CAH Critical Access Hospital
CCD Continuity of Care Document
CCHIT Certification Commission for Health Information Technology
CCR Continuity of Care Record
CDA Clinical Document Architecture
CDC Centers for Disease Control and Prevention
CFR Code of Federal Regulations
CGD Certification Guidance Document
CMS Centers for Medicare & Medicaid Services
CPOE Computerized Provider Order Entry
EHR Electronic Health Record
FIPS Federal Information Processing Standards
HHS Department of Health and Human Services
HIPAA Health Insurance Portability and Accountability Act of 1996
HIT Health Information Technology
HITECH Health Information Technology for Economic and Clinical 
Health
HITSP Healthcare Information Technology Standards Panel
HL7 Health Level Seven
ICD International Classification of Diseases
ICD-9-CM International Classification of Diseases, 9th Revision, 
Clinical Modification
ICD-10-PCS International Classification of Diseases, 10th Revision, 
Procedure Coding System
ICD-10-CM International Classification of Diseases, 10th Revision, 
Clinical Modification
IHS Indian Health Service
LOINC Logical Observation Identifiers Names and Codes
NCPDP National Council for Prescription Drug Programs
NLM National Library of Medicine
OCR Office for Civil Rights
OMB Office of Management and Budget
ONC Office of the National Coordinator for Health Information 
Technology
PHSA Public Health Service Act
PQRI Physician Quality Reporting Initiative
REST Representational state transfer
RFA Regulatory Flexibility Act
SNOMED-CT Systematized Nomenclature of Medicine Clinical Terms
SOAP Simple Object Access Protocol
UCUM Unified Code for Units of Measure
UMLS Unified Medical Language System
XML eXtensible Markup Language

Table of Contents

I. Background
    A. Legislative History
    B. Regulatory History
    1. Initial Set of Standards, Implementation Specifications, and 
Certification Criteria for EHR Technology Interim Final Rule
    2. Interdependencies With Other HITECH Provisions and 
Relationship to Other Regulatory Requirements
II. Overview of the Final Rule
III. Section-by-Section Discussion of the Final Rule and Response to 
Comments
    A. Introduction
    B. General Comments
    C. Definitions--Sec.  170.102
    1. Definition of Disclosure
    2. Definition of Standard
    3. Definition of Implementation Specification
    4. Definition of Certification Criteria
    5. Definition of Qualified EHR
    6. Definition of Complete EHR
    7. Definition of EHR Module
    8. Definition of Certified EHR Technology
    9. Definition of Human Readable Format
    10. Definition of User
    D. Final Rule Amendments to Adopted Standards, Implementation 
Specifications, and Certification Criteria Sec. Sec.  170.202, 
170.205, 170.207, 170.210, 170.302, 170.304, 170.306
    1. Flexibility and Innovation
    2. Transport Standards
    3. Certification Criteria and Associated Standards and 
Implementation Specifications
    a. General Certification for Complete EHRs or EHR Modules--Sec.  
170.302
    b. Specific Certification for Complete EHRs or EHR Modules 
Designed for an Ambulatory Setting--Sec.  170.304
    c. Specific Certification for Complete EHRs or EHR Modules 
Designed for an Inpatient Setting--Sec.  170.306
    d. Adoption and Realignment of Certification Criteria to Support 
the Final Requirements for Meaningful Use Stage 1.
    E. Additional Comments
    F. Comments Beyond the Scope of This Final Rule
IV. Collection of Information Requirements
V. Regulatory Impact Analysis
    A. Introduction
    B. Why is this rule needed?
    C. Executive Order 12866--Regulatory Planning and Review 
Analysis
    1. Comment and Response
    2. Executive Order 12866 Final Analysis
    a. Costs
    b. Benefits
    D. Regulatory Flexibility Act Analysis
    1. Comment and Response
    2. Final RFA Analysis
    E. Executive Order 13132--Federalism Regulation Text

I. Background

A. Legislative History

    The Health Information Technology for Economic and Clinical Health 
(HITECH) Act, Title XIII of Division A and Title IV of Division B of 
the American Recovery and Reinvestment Act of 2009 (ARRA) (Pub. L. 111-
5), was enacted on February 17, 2009. The HITECH Act amended the Public 
Health Service Act (PHSA) and established ``Title XXX--Health 
Information Technology and Quality'' to improve health care quality, 
safety, and efficiency through the promotion of health information 
technology (HIT) and the electronic exchange of health information. 
Section 3004(b)(1) of the PHSA requires the Secretary of Health and 
Human Services (the Secretary) to adopt an initial set of standards, 
implementation specifications, and certification criteria by December 
31, 2009 to enhance the interoperability, functionality, utility, and 
security of

[[Page 44591]]

health information technology. Section 3004(b)(1) of the PHSA also 
permits the Secretary to adopt the initial set of standards, 
implementation specifications, and certification criteria on an 
interim, final basis.

B. Regulatory History

1. Initial Set of Standards, Implementation Specifications, and 
Certification Criteria for EHR Technology Interim Final Rule
    On December 30, 2009, the Federal Register made available for 
public inspection, an interim final rule (the Interim Final Rule) with 
a request for comments, which adopted an initial set of standards, 
implementation specifications, and certification criteria. As noted in 
this rulemaking (75 FR 2014), we described how Congress fundamentally 
tied the adopted standards, implementation specifications, and 
certification criteria to the incentives available under the Medicare 
and Medicaid EHR Incentive Programs by requiring the meaningful use of 
Certified EHR Technology. Congress outlined several goals for 
meaningful use, one of which included the ``use of certified EHR 
technology in a meaningful manner.'' This means that to qualify for 
incentives, an eligible professional or eligible hospital must both 
adopt Certified EHR Technology and demonstrate meaningful use of this 
technology.
    The initial set of standards, implementation specifications, and 
certification criteria adopted in the Interim Final Rule established 
the capabilities that Certified EHR Technology would need to include 
to, at a minimum, support eligible professionals' and eligible 
hospitals' efforts to achieve what had been proposed for meaningful use 
Stage 1 under the Medicare and Medicaid EHR Incentive Programs proposed 
rule.
2. Interdependencies With Other HITECH Provisions and Relationship to 
Other Regulatory Requirements
    In addition to our discussion of how the standards, implementation 
specifications, and certification criteria adopted in the Interim Final 
Rule correlated with the Medicare and Medicaid EHR Incentive Programs 
proposed rule, we also discussed our approach to align adopted 
standards, implementation specifications, and certification criteria 
with new and pending HITECH Act regulatory actions and with other 
already established regulatory requirements. We also explained our 
approach for aligning these standards, implementation specifications, 
and certification criteria with: the adopted standard and certification 
criterion related to the Health Insurance Portability and 
Accountability Act of 1996 (HIPAA) Privacy Rule Accounting of 
Disclosures Regulation under the HITECH Act; alignment with the HIPAA 
Privacy and Security Regulations; the Medicare Part D Electronic 
Prescribing Regulations; and the HIPAA Transactions and Code Sets 
Standards Regulations.

II. Overview of the Final Rule

    We are amending part 170 of title 45 of the Code of Federal 
Regulations (CFR) to complete the adoption of the initial set of 
standards, implementation specifications, and certification criteria as 
required by section 3004(b)(1) of the PHSA and realign them with the 
final objectives and measures established for meaningful use Stage 1. 
After reviewing and considering public comments on our adopted 
standards, implementation specifications, and certification criteria, 
we have made several revisions to support the final meaningful use 
objectives and measures, clarify certain certification criteria to 
resolve identified technical challenges related to some of the 
standards and implementation specifications we adopted, and to provide 
for additional flexibility.

III. Section-by-Section Discussion of the Final Rule and Response to 
Comments

A. Introduction

    This section summarizes the nearly 400 timely comments received by 
ONC related to the Interim Final Rule. In some cases, due to the 
simultaneous publication and topical similarity of the notice of 
proposed rulemaking for meaningful use Stage 1, commenters 
inadvertently submitted comments to our regulation docket on 
regulations.gov instead of the Centers for Medicare & Medicaid Services 
(CMS) regulation docket, and vice versa. Recognizing this oversight, 
CMS and ONC shared misplaced comments between the offices and we 
included within our review all comments that could be reasonably 
identified as comments on the Interim Final Rule.
    We have organized the preamble of this final rule along the 
following lines. First, we respond to general comments, including those 
related to the scope and applicability of the final rule that we 
believe are necessary to clarify upfront. Next, we respond to comments 
regarding the definitions of certain defined terms. We then respond to 
public comments on each certification criterion, and where an adopted 
certification criterion also references standards and implementation 
specifications, we include our response to public comments on the 
related standards and implementation specifications. These concepts 
were separately discussed in the Interim Final Rule and we believe that 
discussing the certification criteria together with associated 
standards and implementation specifications will improve the clarity of 
the final rule and will allow us to more fully address public comments 
in a broader context. We include the following table at the beginning 
of the discussion of each certification criterion section to illustrate 
the final meaningful use Stage 1 objectives for eligible professionals 
and eligible hospitals and to show how we have revised adopted 
certification criteria in response to the revised meaningful use 
objectives and measures and public comments.

------------------------------------------------------------------------
    Meaningful use Stage 1        Meaningful use       Certification
           objective             Stage 1 measure         criterion
------------------------------------------------------------------------
Eligible Professional and/or    Eligible           Interim Final Rule
 Eligible Hospital & Critical    Professional and/  Text: Certification
 Access Hospital Objective.      or Eligible        Criterion.
                                 Hospital &        Final Rule Text:
                                 Critical Access    Certification
                                 Hospital Measure.  Criterion.
------------------------------------------------------------------------

    Finally, in considering public comments on the Interim Final Rule, 
we analyzed whether we had structured the regulation text in an optimal 
and understandable manner. For several provisions, we received comments 
requesting additional clarification and we felt that the original 
regulatory structure contributed to the commenters' confusion. Because 
of those comments and in an effort to better structure the regulation 
text for future revisions, we have revised the structure conceptually 
to group content exchange standards and associated

[[Page 44592]]

implementation specifications and vocabulary standards, and separated 
them into different sections. In line with this ``conceptual'' 
restructuring, we have determined that specifying how a Complete EHR or 
EHR Module must comply with an adopted standard should be solely 
reflected in the certification criteria. As a result, several 
certification criteria have been revised to more clearly reflect how a 
Complete EHR or EHR Module must comply with adopted standards and, 
where applicable, the relevant adopted implementation specifications.

B. General Comments

    Some commenters appear to have misinterpreted or misunderstood the 
scope of the Interim Final Rule and the applicability of the adopted 
standards, implementation specifications, and certification criteria. 
We would therefore like to clarify these concepts at the beginning of 
this final rule and are providing the following responses to the 
relevant comments.
    Comments. Some commenters seem to have construed the adoption of 
standards, implementation specifications, and certification criteria as 
including requirements that apply to the health care providers that 
will use the Certified EHR Technology, rather than as required 
capabilities of the Certified EHR Technology itself. These commenters, 
for instance, questioned whether entities using Certified EHR 
Technology must comply with adopted standards and implementation 
specifications when electronically using or transmitting health 
information within or among components of the legal entity or 
alternatively whether the standards apply solely to transmissions 
between legal entities. Other commenters specifically requested 
clarification regarding the adopted standards that are required to be 
used internally within each provider's office, institution, or closed 
system and which standards are required for purposes of electronically 
exchanging health information among such entities. Some comments 
implied that the Interim Final Rule should have specified when an 
eligible professional or eligible hospital would be required to use 
adopted standards. One commenter specifically requested that the 
adopted standards apply only to the electronic exchange of health 
information between legal entities.
    Response. As stated in Sec.  170.101, we specify that ``[t]he 
standards, implementation specifications, and certification criteria 
adopted in this part apply to Complete EHRs and EHR Modules and the 
testing and certification of such Complete EHRs and EHR Modules.'' In 
Sec. Sec.  170.200 and 170.300, we further specify that ``[t]he 
standards and implementation specifications adopted in this part apply 
with respect to Complete EHRs and EHR Modules'' and that ``[t]he 
certification criteria adopted in this subpart apply to the testing and 
certification of Complete EHRs and EHR Modules.''
    The purpose of this final rule, therefore, is to adopt standards, 
implementation specifications, and certification criteria to test and 
certify that a Complete EHR or EHR Module provides certain 
capabilities, and where applicable, to require that those capabilities 
be implemented in accordance with adopted standards and implementation 
specifications. The adopted standards, implementation specifications, 
and certification criteria were not intended to impose independent 
requirements on the entities using Certified EHR Technology. Unlike 
certain other regulatory requirements to which eligible professionals 
or eligible hospitals may be subject, it is not within the intended 
scope of this final rule to specify the requirements for entities using 
Certified EHR Technology.
    We understand the commenters' point though that an adopted standard 
and implementation specification could apply equally to electronic 
transactions between legal entities as well as to transmissions within 
an entity. This final rule, however, is not intended to specify the 
conditions under which adopted standards and implementation 
specifications must be used, only that a Complete EHR or EHR Module, in 
order to be certified, must include specified capabilities that are 
implemented in accordance with those standards, implementation 
specifications, and certification criteria. We anticipate that other 
regulations, as well as the clinical and business needs of HIT users, 
anticipated efficiencies and desired quality improvements, and 
technical, architectural, and enterprise limitations will determine 
when entities will utilize the capabilities required of Certified EHR 
Technology. Additionally, we would note that Complete EHRs and EHR 
Modules will, in many cases, be tested and certified independent of the 
environment within which they will be implemented. Consequently, 
specifying when an entity that implements Certified EHR Technology must 
utilize a particular capability in its operating environment exceeds 
the scope of this rule.
    To further demonstrate this point, Certified EHR Technology 
implemented by an eligible professional will need to possess the 
capability to generate an electronic prescription according to one of 
the standards we have adopted. To specify the contexts in which an 
electronic prescription (generated according to the adopted standard) 
must be transmitted would go beyond the scope of certification. 
Moreover, it would raise a more serious and practical consideration. 
Attempting to specify when entities must utilize the capabilities of 
Certified EHR Technology would add an unnecessary level of complexity 
to this rule and create the potential for conflicts with other 
regulations promulgated by the HHS. For instance, HHS has already 
promulgated at least two sets of regulations identifying when health 
care providers need to use specific standards and the contexts in which 
those standards must be used. Under the HIPAA Transactions and Code 
Sets Standards regulations, HHS specifies at 45 CFR 162.923(a) that 
``[e]xcept as otherwise provided in this part, if a covered entity 
conducts with another covered entity (or within the same covered 
entity), using electronic media, a transaction for which the Secretary 
has adopted a standard under this part, the covered entity must conduct 
the transaction as a standard transaction.'' (Emphasis added.) 
Consequently, in the HIPAA context, covered entities must use adopted 
transaction standards for covered transactions both within the covered 
entities and with outside entities. The Medicare Part D electronic-
prescribing (e-prescribing) regulations implement a different approach 
for certain e-prescribing transactions. Health care providers that 
electronically prescribe Part D drugs for Part D eligible individuals 
under 42 CFR 423.160(a)(3)(iii), ``may use either HL7 messages or the 
NCPDP SCRIPT Standard to transmit prescriptions or prescription-related 
information internally when the sender and the recipient are part of 
the same legal entity. If an entity sends prescriptions outside the 
entity (for example, from an HMO to a non-HMO pharmacy), it must use 
the adopted NCPDP SCRIPT Standard or other applicable adopted 
standards.'' Therefore, we believe that it is unnecessary and outside 
of the intended scope of this rule to specify the contexts or 
circumstances under which adopted standards and implementation 
specifications must be utilized.
    Moreover, we anticipate that future meaningful use objectives and 
measures will specify, as necessary and appropriate, the conditions 
under which certain health care providers will need

[[Page 44593]]

to use adopted standards and implementation specifications. The 
context, for instance, governing when a standard must be used will, in 
some cases, be directly related to whether and how an eligible 
professional or eligible hospital must meaningfully use Certified EHR 
Technology. For example, a final meaningful use Stage 1 objective 
requires that eligible professionals and eligible hospitals use 
Certified EHR Technology to record demographics including, among other 
fields, race and ethnicity. While we have adopted the race and 
ethnicity codes published by the Office of Management and Budget (OMB), 
in the context Medicare and Medicaid EHR incentive programs, the 
meaningful use of Certified EHR Technology will dictate whether such 
codes must be used ``inside'' an organization. Another example of when 
a meaningful use objective establishes the context in which a standard 
must be used is the objective that requires eligible professionals and 
eligible hospitals to use Certified EHR Technology to maintain an up-
to-date problem list of current and active diagnoses. The measure 
associated with this objective requires that entries be recorded in 
``structured data'' and in this context we adopted ICD-9 or SNOMED-
CT[reg] to provide that structure. As a result, Certified EHR 
Technology must be capable of using ICD-9 or SNOMED-CT[reg] when an 
eligible professional or eligible hospital seeks to maintain an up-to-
date problem list.
    In other instances, the Department does not specify explicitly in 
regulation the context for certain meaningful use objectives and 
whether meaningful use of Certified EHR Technology would require the 
use of a standard for electronic transactions solely between two 
different legal entities, or for all transactions, or for most 
transactions with certain exemptions.
    Comments. Several commenters requested that we provide more 
information about the standards we expect the Secretary to adopt in 
order to support future stages of meaningful use. These commenters 
noted, along with referencing the timelines for making changes to HIT, 
that it would benefit the HIT industry if we could provide a roadmap, 
framework, or more descriptive ``glide path'' for future standards 
adoption activities.
    Response. We anticipate that future stages of meaningful use will 
require us to adopt additional standards, implementation 
specifications, and certification criteria. We also expect that 
standards we have adopted will continue to be revised and updated over 
time, to reflect current technology, changing medical practice and 
regulatory requirements. We will therefore need to continue to 
harmonize those adopted standards with other standards to support 
interoperability. We anticipate that the standards required to support 
future stages of meaningful use will need a framework that supports 
harmonization across different meaningful use scenarios and that 
supports early real world testing. We plan to work closely with the HIT 
Standards Committee to develop a forward looking agenda and to make 
known in advance the types of standards, implementation specifications, 
and certification criteria on which we will seek recommendations from 
the HIT Standards Committee. We believe this will benefit the HIT 
industry by providing greater transparency of the standards adoption 
activities and will serve as an early indication for the public of 
candidate standards that are being identified for possible adoption.

C. Definitions--Sec.  170.102

    In this section, we respond to public comment on the definitions 
adopted in the Interim Final Rule. We address the definition of 
Certified EHR Technology last after we provide clarifications related 
to the definitions of Complete EHR and EHR Module.
1. Definition of Disclosure
    Comments. A few commenters noted that the definition of disclosure 
was too broad or asked that we refine the adopted definition to be more 
limited and to only apply in certain circumstances. One commenter noted 
that this was a new definition.
    Response. As we explained in the preamble of the Interim Final 
Rule, this definition repeated the text specified at 45 CFR 160.103 
(the General Provisions section for the HIPAA regulations). Because the 
Interim Final Rule created a new part in Title 45 of the CFR, the 
definition of disclosure as it is used in the HIPAA regulations would 
not necessarily have applied to our use of the term in this rule. 
Therefore, to prevent unnecessary ambiguity for the regulated 
community, we adopted the definition of the term as it is defined at 45 
CFR 160.103.
    In light of public comment and to prevent any future regulatory 
inconsistency that would require rulemaking to correct, we have 
revisited our approach of repeating the text of the definition of 
disclosure from 45 CFR 160.103 and have decided to cross reference 45 
CFR 160.103 in the definition of disclosure. The final definition will 
read: disclosure is defined as it is in 45 CFR 160.103.
2. Definition of Standard
    Comment. A commenter stated that our definition of standard was 
comprehensive from a technical perspective, but believed the definition 
was incomplete from a policy perspective. The commenter argued that for 
interoperability to be successful, it was essential that standards be 
created through collaborative, consensus-based processes that take into 
consideration the needs and concerns of all interested stakeholders. 
For that reason, the commenter suggested, in order for the definition 
to be whole from both a technical and policy perspective, we should add 
to the definition the phrase ``developed through the use of open, 
collaborative, consensus-based processes.''
    Response. While we appreciate the commenter's point, we believe 
that the proposed language is unnecessary and potentially problematic. 
Federal agencies are already required under the National Technology 
Transfer and Advancement Act of 1995 (NTTAA) (15 U.S.C. 3701 et seq.) 
and OMB Circular A-119 \1\ to use, wherever practical, technical 
standards that are developed or adopted by voluntary consensus 
standards bodies to carry out policy objectives or activities, with 
certain exceptions. In drafting the Interim Final Rule, we briefly 
discussed relevant provisions of the NTTAA and OMB Circular A-119, our 
compliance with the statute and the Circular, and we requested comments 
on our approach to the selection of standards. We also explained that 
both the NTTAA and OMB Circular A-119 provide for certain exceptions to 
selecting only standards developed or adopted by voluntary consensus 
standards bodies, namely when doing so would be ``inconsistent with 
applicable law or otherwise impractical.'' In the Interim Final Rule, 
we identified those instances in which we had and had not adopted 
voluntary consensus standards. In the instances in which we had not 
adopted voluntary consensus standards, we provided two principal 
reasons: first, that in most cases a voluntary consensus standard that 
could meet the requisite technical goals was simply unavailable; and 
second, that to the extent a potentially equivalent voluntary consensus 
standard was available, the standard was too limiting and did not meet 
our policy goals, including allowing for greater innovation by the 
industry. In

[[Page 44594]]

this final rule, we have adopted only voluntary consensus standards, 
except for two government-unique standards (CMS Physician Quality 
Reporting Initiative (PQRI) 2009 Registry XML Specification and the 
Office of Management and Budget Standards for Maintaining, Collecting, 
and Presenting Federal Data on Race and Ethnicity), a functional 
standard relating to vocabularies included in RxNorm, and the specified 
standards to protect electronic health information. We are aware of no 
voluntary consensus standards that would serve as alternatives to these 
standards for the purposes that we have identified. We encourage the 
HIT Standards Committee to obtain public input, hold hearings on, and 
recommend to the National Coordinator standards that have been 
developed or adopted by voluntary consensus standards bodies.
---------------------------------------------------------------------------

    \1\  https://www.whitehouse.gov/omb/circulars_a119.
---------------------------------------------------------------------------

3. Definition of Implementation Specification
    We did not receive any comments applicable to the definition of 
implementation specification and consequently did not make any changes 
to the definition.
4. Definition of Certification Criteria
    Comments. One commenter expressly stated its support for our 
definition of certification criteria.
    Response. We appreciate the commenter's support for our definition 
of certification criteria and have not made any changes to the 
definition in this final rule.
5. Definition of Qualified EHR
    Comments. A couple of commenters asserted that there is uncertainty 
in the industry with respect to what constitutes an EHR due both to the 
seemingly inconsistent definitions of terms in the HITECH Act and to 
the alternative definitions published by different organizations and 
associations. The commenters made specific reference to the definition 
of ``Qualified Electronic Health Record'' (``Qualified EHR'') at 
section 3000 of the PHSA and to the term ``EHR'' found in the HITECH 
Act at section 13400 of Subtitle D. The latter defines EHR as ``an 
electronic record of health-related information on an individual that 
is created, gathered, managed, and consulted by authorized clinicians 
and staff.'' The former defines Qualified EHR as ``an electronic record 
of health-related information on an individual that: (1) Includes 
patient demographic and clinical health information, such as medical 
history and problem lists; and (2) has the capacity: (i) to provide 
clinical decision support; (ii) to support physician order entry; (iii) 
to capture and query information relevant to health care quality; and 
(iv) to exchange electronic health information with, and integrate such 
information from other sources.'' Both commenters recommended that the 
definition of Qualified EHR be clarified with one commenter suggesting 
that the definition should follow the definition of EHR as it relates 
to health care providers.
    Response. We appreciate these comments and recognize that the 
existence of multiple terms that include the word ``EHR'' can be 
confusing. However, we believe that Congress intended for HHS to apply 
the definition of a Qualified EHR found in section 3000 of the PHSA to 
this regulation for specific reasons that cannot be overlooked. As a 
result, we have decided not to adopt the recommendation to follow the 
definition of the term EHR that is found in Subtitle D of the HITECH 
Act. We discuss additional responses to comments on the definition of 
Qualified EHR below.
    Comments. A few commenters requested that we expand the definition 
of Qualified EHR to include a variety of additional functionality and 
that a Qualified EHR be able to comply with business or legal 
requirements. These comments requested that we add required elements 
for an EHR to constitute a Qualified EHR, including that the EHR: Have 
a record-keeping capability for legal purposes; include certain 
requirements for usability; enable health care providers to perform 
several other actions not specified in the definition; and that certain 
elements of patient demographic information be specified.
    Response. We understand the rationale behind these commenters' 
suggestions, but we do not believe that it is necessary to add more 
prerequisite capabilities to the definition of Qualified EHR. We 
believe Congress defined Qualified EHR to include a minimum level of 
capabilities. Furthermore, to meet the definition of Certified EHR 
Technology, a Qualified EHR must be certified in accordance with a 
certification program established by the National Coordinator. As a 
result, we believe that any additional capabilities a Qualified EHR 
would need to possess to allow an eligible professional or eligible 
hospital to be in a position to qualify for incentive payments under 
the Medicare and Medicaid EHR incentive programs will be more 
appropriately addressed through the Secretary's adoption of additional 
standards, implementation specifications, and certification criteria.
    Comments. Some commenters requested that we clarify some of the 
terms in the definition of Qualified EHR such as ``capture,'' 
``query,'' ``other sources,'' and ``relevant to health care quality'' 
with respect to how they related to Certified EHR Technology. Another 
commenter expressly stated that if we only intended to repeat the 
statutory definition of Qualified EHR without modification, we should 
at least clarify the meaning of demographic information.
    Response. We do not believe that additional clarity is needed or 
desirable for such terms because the meanings are context specific. The 
intended meanings of these terms will depend significantly on the 
contexts in which the terms are used and the associated capabilities of 
the Certified EHR Technology. The terms' meanings may also be affected 
by any standards and implementation specifications that are associated 
with those capabilities and adopted. In certain circumstances, for 
instance, the meaning of the phrase ``other sources'' as used in the 
definition of Qualified EHR will depend on the specific context in 
which electronic health information is being integrated or exchanged, 
and perhaps on whether the source is external to or internal within the 
Complete EHR or the EHR Module. Similarly, the meanings of the terms or 
phrases ``capture,'' ``query,'' ``relevant to health care quality'' and 
``demographic'' information may vary according the context of the 
required capabilities of the EHR technology. In each of these 
instances, we believe that the adopted certification criteria and 
meaningful use objectives and measures will provide these contexts, 
identify the associated required capabilities, and consequently clarify 
the intended meanings of these terms.
6. Definition of Complete EHR
    Comments. Some commenters supported our definition of Complete EHR 
and believed that it was understandable, sufficient, and reasonable. 
Other commenters, however, suggested that the definition of Complete 
EHR was too narrow, because the term is tied to only those 
certification criteria adopted by the Secretary. These commenters 
argued that the Complete EHR and the adopted certification criteria 
should be more comprehensive and should include functionality that is 
not presently required for a Complete EHR to achieve certification. 
Many of these commenters referenced the Health Level Seven (HL7) EHR 
System Functional Model (EHR-S

[[Page 44595]]

FM) and contended that what we had defined as a Complete EHR did not 
align with or include all of the functionality specified in the EHR-S 
FM. One commenter requested that we clarify what we meant by ``we fully 
expect some EHRs to have capabilities beyond those addressed by 
certification criteria'' when we made this point during our discussion 
of the definition of Complete EHR in the preamble of the Interim Final 
Rule. Other commenters recommended specific wording changes to the 
definition.
    Response. In the Interim Final Rule we defined Complete EHR to mean 
``EHR technology that has been developed to meet all applicable 
certification criteria adopted by the Secretary.'' We clarified that 
the term Complete EHR is ``meant to encompass EHR technology that can 
perform all of the applicable capabilities required by certification 
criteria adopted by the Secretary and distinguish it from EHR 
technology that cannot perform those capabilities.'' We believe that 
commenters misunderstood the scope and purpose of the regulatory 
definition and believe that the definition effectively fulfills its 
regulatory purpose. We intend for the definition of Complete EHR to be 
used to clearly identify EHR technology as being able to perform, at a 
minimum, all of the applicable capabilities required by certification 
criteria adopted by the Secretary, and thereby, as providing eligible 
professionals or eligible hospitals with the technical capabilities 
they need to support their achievement of meaningful use of Certified 
EHR Technology. It is in this context that we view such EHR technology 
as ``complete.''
    We recognize that many commenters recommended a definition of 
``Complete EHR'' that would be more comprehensive than the definition 
we provided. Many commenters contended that HIT exists and is available 
for eligible professionals and eligible hospitals to implement, and 
much of it includes a myriad of capabilities far surpassing the 
capabilities required to meet the definition of Complete EHR. We do not 
dispute that point. We also understand that the capabilities included 
in a Complete EHR, as defined for the purposes of this regulation, may 
not encompass all of the capabilities a specific eligible professional 
or eligible hospital or for that matter any health care provider, may 
deem essential to meet their unique business needs and use cases.
    This definition, however, does not in any way preclude any 
additional capabilities from being included in a Complete EHR or 
implemented in a complementary fashion. The definition sets forth a 
floor, not a ceiling, and serves to signify that once tested and 
certified to all applicable certification criteria, a Complete EHR 
meets the definition of Certified EHR Technology. For this reason, we 
did not seek to craft this definition in a way that signified that a 
Complete EHR would be able to provide all of the capabilities a health 
care provider desired or deemed necessary, or that the entity's EHR 
could only include the capabilities for which the Secretary has adopted 
certification criteria. Nor did we define Complete EHR according to a 
particular functional model, because doing so would have been 
inconsistent with the regulatory purpose of the definition.
    In light of public comment and to further clarify the regulatory 
purpose of the definition of Complete EHR as well as make clear that a 
Complete EHR should not be misinterpreted to mean EHR technology that 
is any more comprehensive than the certification criteria to which it 
was tested and certified, we have added the phrase ``at a minimum'' to 
the definition. The final definition of Complete EHR will therefore 
read ``EHR technology that has been developed to meet, at a minimum, 
all applicable certification criteria adopted by the Secretary.''
    As a related point, we would also note that an eligible 
professional or eligible hospital would need to use a capability that 
is included among the adopted certification criteria to meet the 
associated meaningful use objective or measure. The eligible 
professional or eligible hospital therefore could not attempt to use a 
capability that is superfluous to certification to demonstrate the 
meaningful use of ``Certified EHR Technology.'' We understand that the 
Medicare and Medicaid EHR Incentive Programs final rule discusses this 
issue more fully in several places, and we defer to those discussions 
concerning the requirements for achieving meaningful use of Certified 
EHR Technology.
    Comment. In the context of the definition of Complete EHR, one 
commenter asked for clarification regarding how many certification 
criteria a Complete EHR must be developed to meet.
    Response. For the purposes of meeting the definition of Complete 
EHR, EHR technology designed for an ambulatory setting (to be used by 
eligible professionals) must be certified to all of the certification 
criteria adopted at 45 CFR 170.302 and 45 CFR 170.304, and EHR 
technology designed for an inpatient setting (to be used by eligible 
hospitals) must be certified to all of the certification criteria 
adopted at 45 CFR 170.302 and 45 CFR 170.306.
7. Definition of EHR Module
    Comments. Numerous commenters strongly supported our inclusion of a 
modular approach to meet the definition of Certified EHR Technology. 
Many of these commenters saw this approach as a way to spur greater 
innovation in the HIT marketplace, provide more choices for health care 
providers, and generally broaden the appeal of HIT and expedite its 
adoption. Some commenters noted, however, that they believed the 
definition needed further clarification with respect to what would 
constitute an EHR Module. In most cases, these commenters provided 
examples of technologies that they believed should meet the definition 
of EHR Module and they sought confirmation that these technologies 
would meet the definition. Included among these technologies were 
radiology information systems (RIS), picture archiving and 
communication systems (PACS), PHRs, speech recognition software, 
electrocardiogram systems, remote patient monitoring (RPM) devices, and 
other electronic devices including non-health care devices.
    Response. In the Interim Final Rule, we defined an EHR Module to 
mean ``any service, component, or combination thereof that can meet the 
requirements of at least one certification criterion adopted by the 
Secretary.'' Consequently, EHR Modules, by definition, must provide a 
capability that can be tested and certified in accordance with at least 
one certification criterion adopted by the Secretary. Therefore, if an 
EHR Module does not provide a capability that can be tested and 
certified at the present time, it is not HIT that would meet the 
definition of EHR Module. We stress ``at the present time,'' because as 
new certification criteria are adopted by the Secretary, other HIT 
could be developed and then tested and certified in accordance with the 
new certification criteria as EHR Modules.
    We encourage eligible professionals and eligible hospitals to use 
any and all HIT they believe will help make the health care they 
deliver more effective and efficient. However, unless the HIT is tested 
and certified to at least one certification criterion for use as part 
of Certified EHR Technology, it does not constitute an EHR Module for 
the purposes of this regulation. Eligible professionals and eligible 
hospitals are not prohibited from using or implementing this HIT, but 
again, at the present time, such HIT cannot

[[Page 44596]]

constitute an EHR Module and serve as a necessary component of 
Certified EHR Technology for eligible professionals or eligible 
hospitals to use when seeking to achieve meaningful use as defined in 
the Medicare and Medicaid EHR Incentive Programs final rule.
    In response to these comments, we would also like to clarify our 
conceptualization of an EHR Module. An EHR Module could provide a 
single capability required by one certification criterion or it could 
provide all capabilities but one, required by the certification 
criteria for a Complete EHR. In other words, we would call HIT tested 
and certified to one certification criterion an ``EHR Module'' and HIT 
tested and certified to nine certification criteria an ``EHR Module,'' 
where ten certification criteria are required for a Complete EHR. We 
have not made any changes to the definition of EHR Module as a result 
of these comments or the comments addressed below.
    Comment. One commenter asked whether we meant to include in the 
definition of EHR Module ``interfaces'' that perform data mapping or 
transformation. The commenter raised this question while noting that 
some organizations use multiple interfaces to interconnect their HIT 
systems and that it would be an arduous task for these organizations to 
ensure that all individual interfaces are certified. Another commenter 
sought clarification regarding what we meant when we stated as an 
example in the Interim Final Rule that EHR Modules could be ``an 
interface or other software program that provides the capability to 
exchange electronic health information.''
    Response. As discussed above, to meet the definition of EHR Module, 
HIT would need to provide a capability that could be tested and 
certified to at least one certification criterion. If a certification 
criterion has therefore been adopted that requires a particular 
capability for exchanging electronic health information, an interface 
or other software program that provides that capability could be tested 
and certified as an EHR Module. In many circumstances, an interface or 
program may provide valuable functionality, but not a capability for 
which a certification criterion has been adopted. For example, software 
implemented by an eligible professional that performs data translation 
or mapping between two databases or data sets may provide critical 
functionality, yet that software would not constitute an EHR Module. 
Similarly, interfaces between ``HIT systems'' may be critical to the 
functionality of the separate systems, but they themselves would not be 
EHR Modules.
    In those circumstances in which an interface or other software 
program is an integral component of an EHR Module without which it 
would not be able to be tested and certified, then such interface or 
other software program, though not itself an EHR Module, would function 
as a critical piece of the overall EHR Module presented for testing and 
certification. For example, a software program that would permit an 
eligible professional or eligible hospital to electronically exchange 
health information with other eligible professionals or eligible 
hospitals could be tested and certified as an EHR Module, if it 
provides the capability to electronically exchange health information 
according to standards adopted by the Secretary. In this example, 
whatever comprises the software program would be considered part of the 
EHR Module that is tested and certified.
    Finally, in situations where an eligible professional or eligible 
hospital believes that it has multiple HIT systems that would each meet 
the definition of EHR Module, we suggest that the eligible professional 
or eligible hospital evaluate whether these systems could be combined 
with other systems to constitute a Complete EHR. If they are capable of 
being combined to form a Complete EHR, it may be more expeditious and 
beneficial for an eligible professional or eligible hospital to simply 
seek Complete EHR testing and certification.
    Comments. A few commenters requested that we clarify how EHR 
Modules would be tested and certified to adopted privacy and security 
certification criteria. Other commenters asked whether we meant to 
allow for there to be EHR Modules that provided only privacy and 
security capabilities.
    Response. These comments pertain to the certification programs 
rule, and are outside of the scope of this rule. We therefore respond 
to these comments in the Temporary Certification Program final rule (75 
FR 36158).
8. Definition of Certified EHR Technology
    Comments. Multiple commenters commended ONC for recognizing the 
need to certify EHR Modules and enabling certified EHR Modules to be 
used in combination to meet the definition of Certified EHR Technology. 
These commenters noted that this approach makes it clear that eligible 
professionals and eligible hospitals will have the flexibility to 
select certified EHR modules that are the most useful to them, and can 
achieve meaningful use either with combinations of certified HIT or a 
single EHR system. However, some commenters mentioned that the 
definition is unnecessarily ambiguous, and subject to possible 
alternative interpretations. Some commenters also commented on certain 
statements in the preamble regarding EHR Modules and queried how a 
proper combination of EHR Modules could be used to meet the definition 
of Certified EHR Technology. Other commenters, while acknowledging that 
adopted certification criteria will determine in part what constitutes 
Certified EHR Technology, urged ONC to revise the definition to include 
only patient care functionality. Finally, a few commenters offered 
specific word changes for the definition to improve its clarity.
    Response. In the Interim Final Rule, we defined Certified EHR 
Technology to mean ``a Complete EHR or a combination of EHR Modules, 
each of which: (1) Meets the requirements included in the definition of 
a Qualified EHR; and (2) Has been tested and certified in accordance 
with the certification program established by the National Coordinator 
as having met all applicable certification criteria adopted by the 
Secretary.'' With respect to a combination of EHR Modules, we clarified 
in the preamble of the Interim Final Rule that:

    As long as each EHR Module has been separately tested and 
certified in accordance with the certification program established 
by the National Coordinator * * * to all of the applicable 
certification criteria adopted by the Secretary, a proper 
combination of certified EHR Modules could meet the definition of 
Certified EHR Technology. To clarify, we are not requiring the 
certification of combinations of certified EHR Modules, just that 
the individual EHR Modules combined have each been certified to all 
applicable certification criteria in order for such a 
``combination'' to meet the definition of Certified EHR Technology.

    Many commenters appeared to be confused by the inclusion of ``each 
of which'' in the definition of Certified EHR Technology. Other 
commenters also stated that ``each of which'' was awkwardly placed, 
making it difficult to interpret how the combination of EHR Modules 
must satisfy the subsequent requirements of the definition. This 
confusion also made it difficult to understand the clarifying remarks 
reiterated above regarding our intention to avoid implying that a 
combination of certified EHR Modules had to be certified a second time 
when a proper combination had been created. We generally agree with 
these comments and are revising the definition slightly

[[Page 44597]]

to avoid this ambiguity and to clarify that the definition of Certified 
EHR Technology can be met in either of two ways.
    The first way that the definition of Certified EHR Technology can 
be met is for a Complete EHR to: (1) Meet the requirements included in 
the definition of a Qualified EHR, and (2) be tested and certified in 
accordance with the certification program established by the National 
Coordinator as having met all applicable certification criteria adopted 
by the Secretary. The second way that the definition of Certified EHR 
Technology can be met is if each constituent EHR Module of a 
combination of EHR Modules has been tested and certified in accordance 
with the certification program established by the National Coordinator 
as having met all applicable certification criteria adopted by the 
Secretary and the resultant combination also meets the requirements 
included in the definition of a Qualified EHR.
    As previously written, it was unclear to many commenters that the 
comma preceding ``each of which'' was meant to separately apply a 
Complete EHR and ``combination of EHR Modules'' to the subsequent 
requirements. Our intention was that a combination of EHR Modules would 
have to provide the capabilities necessary to meet the definition of a 
Qualified EHR and that the EHR Modules combined would have each been 
tested and certified in accordance with the certification criteria 
applicable to each EHR Module.
    In response to commenters, we have decided to revise the definition 
of Certified EHR Technology to state explicitly the two distinct ways 
the definition can be met. The revised definition will read as follows. 
Certified EHR Technology means:
    (1) A Complete EHR that meets the requirements included in the 
definition of a Qualified EHR and has been tested and certified in 
accordance with the certification program established by the National 
Coordinator as having met all applicable certification criteria adopted 
by the Secretary; or
    (2) A combination of EHR Modules in which each constituent EHR 
Module of the combination has been tested and certified in accordance 
with the certification program established by the National Coordinator 
as having met all applicable certification criteria adopted by the 
Secretary, and the resultant combination also meets the requirements 
included in the definition of a Qualified EHR.
    As discussed in the Temporary Certification Program final rule, a 
pre-coordinated integrated bundle of EHR Modules would fall under the 
second definition of Certified EHR Technology, although each EHR Module 
of the bundle would be tested and certified at the same time rather 
than separately. Therefore, provided that a proper combination of EHR 
Modules has been created, combinations of EHR Modules could be tested 
and certified either at the same time or at separate times, to meet the 
definition of Certified EHR Technology.
    Finally, we believe that commenter suggestions to revise the 
definition of Certified EHR Technology to reference specific 
certification criteria are misguided. The definition, regardless of the 
certification criteria that must be included in a Complete EHR or 
combination of EHR Modules, must be able to accommodate changes in 
certification criteria over time. Accordingly we believe that the final 
definition meets this intended goal and conveys a clear meaning.
    Comments. Some commenters appeared to interpret our definition as 
providing that EHR Modules must be used to meet the definition of 
Certified EHR Technology. Of these commenters, some requested that we 
clarify whether health care providers would be required to obtain 
certification of EHR Modules that no vendors support. Other commenters 
asked whether non-certified ``EHR modules'' could be used in 
combination with a Complete EHR or in combination with EHR Modules that 
are used to meet the definition of Certified EHR Technology.
    Response. We would like to make clear that eligible professionals 
and eligible hospitals are not required to use EHR Modules in order to 
meet the definition of Certified EHR Technology. The use of EHR Modules 
is completely voluntary and provides an alternate avenue for eligible 
professionals and eligible hospitals who seek to implement more 
customized HIT solutions while still meeting the definition of 
Certified EHR Technology. Commenters who expressed concerns about their 
responsibility for seeking certification for EHR Modules for which no 
vendor supports did not provide specific examples, and we are uncertain 
as to the basis for their concerns. Regardless, we reiterate that the 
use of EHR Modules is voluntary and we believe that most eligible 
professionals and eligible hospitals that are adopting HIT for the 
first time will have a variety of Complete EHRs available from which to 
choose.
    We also clarify that only those EHR Modules that provide 
capabilities necessary to meet the definition of Certified EHR 
Technology will need to be tested and certified. That being said, 
eligible professionals and eligible hospitals are free to utilize any 
other type of HIT to complement or in combination with Certified EHR 
Technology, including HIT that provides capabilities for other purposes 
not related to meaningful use.
    Comments. Some commenters suggested that our definition was too 
broad. Most of these commenters argued that we should permit eligible 
professionals to adopt only Complete EHRs and EHR Modules that were 
certified as including only those capabilities applicable to their 
specialty or practice. In other words, these commenters sought for the 
definition of Certified EHR Technology to be interpreted in such a way 
as to permit different specialty-oriented variations of Certified EHR 
Technology to exist.
    Response. At the present time, we believe that the definition of 
Certified EHR Technology already includes some of the flexibility these 
commenters request. We permit, for example, a Complete EHR designed for 
an ambulatory setting and a Complete EHR designed for an inpatient 
setting both to meet the definition of Certified EHR Technology, even 
though each is compliant with a slightly different set of applicable 
certification criteria. In that regard, we believe we have integrated a 
balanced and appropriate amount of flexibility into the definition of 
Certified EHR Technology, which will also allow us to make additional 
refinements over time. We believe that it is possible based on industry 
need for us to specify in a future rulemaking sets of applicable 
certification criteria for Complete EHRs and EHR Modules designed for 
particular clinical settings.
9. Definition of Human Readable Format
    Comments. A number of commenters across several certification 
criteria requested that we clarify the meaning of ``human readable 
format.'' These commenters questioned what human readable format meant 
when it was used in the certification criteria and offered examples of 
what they thought would constitute human readable format such as, style 
sheets and PDFs. A couple of commenters suggested that human readable 
format should consider patients' linguistic needs. A commenter 
requested we discuss the compliance requirements associated with the 
Americans with Disabilities Act and the relevant sections of the 
Rehabilitation Act of 1973 to ensure human readable format was meant to 
include an obligation to provide people with disabilities alternative 
formats such as large print or Braille.

[[Page 44598]]

    Response. In the Interim Final Rule, we discussed the meaning of 
human readable format and provided examples of what we believe would 
constitute human readable format. We reiterate that discussion below.

    We believe that in order to recognize the enormous potential of 
HIT, greater standardization in future years is necessary. In that 
regard, we recognize that more advanced interoperability requires 
health information to be represented by specific vocabularies and 
code sets that can be interpreted by EHR technology as well as 
converted and presented in a readable format to the users of such 
technology. At the present time we recognize that implementing 
certain vocabularies and code sets in EHR technology is a difficult, 
technical undertaking. For that reason, we have not adopted specific 
vocabularies and code sets for a number of the exchange purposes * * 
* We have, however, as a transitional step, adopted certification 
criteria that require Certified EHR Technology to be capable of 
presenting health information received in human readable format. By 
human readable format, we mean a format that enables a human to read 
and easily comprehend the information presented to them regardless 
of the method of presentation (e.g., computer screen, handheld 
device, electronic document). This would likely require information 
in coded or machine readable format to be converted to, for example, 
its narrative English language description. In an effort to further 
the transition to, and prevalence of, more specific vocabularies and 
code sets, we are interested in public comment regarding industry 
readiness if we were to adopt certification criteria requiring the 
use of additional vocabularies and code sets in parallel with 
meaningful use Stage 2. Such certification criteria could include 
not only that Certified EHR Technology be capable of presenting 
information in human readable format but also that it be capable of 
automatically incorporating certain vocabulary or code sets (i.e., 
machine readable information).

    The term human readable format is used in two contexts, when coded 
health information should be displayed to an eligible professional or 
(to a health care professional within) an eligible hospital using 
Certified EHR Technology and in the circumstances where Certified EHR 
Technology must be capable of generating an electronic copy of health 
information for individuals. Each context may dictate a different human 
readable format. For example, the use of a style sheet may be 
appropriate for both health care professionals that are interacting 
with Certified EHR Technology as well as individuals who receive an 
electronic copy of their health information to access at a later time. 
In other circumstances it may be more appropriate for a health care 
professional to view health information in human readable format on 
their handheld device while an individual may seek an electronic 
document, such as a PDF. Given the requests for additional clarity 
regarding the meaning of human readable format, we have decided to 
define the term in this final rule as follows: Human readable format 
means a format that enables a human to read and easily comprehend the 
information presented to him or her regardless of the method of 
presentation (e.g., computer screen, handheld device, electronic 
document).
    We noted in the Interim Final Rule that the standards, 
implementation specifications, and certification criteria adopted by 
the Secretary applied to Complete EHRs and EHR Modules, not to persons 
or entities. We also stated that nothing required by the Interim Final 
Rule should be construed as affecting existing legal requirements under 
other Federal laws. Accordingly, this final rule does not affect an 
eligible professional or eligible hospital's requirements to comply 
with other Federal laws in the event health information is provided in 
human readable format and persons with disabilities require reasonable 
accommodations.
10. Definition of User
    Comments. A number of commenters commenting on several 
certification criteria requested that we clarify the meaning of the 
term ``user.''
    Response. We recognize that the term user is referenced in the 
certification criteria and at times could be interpreted differently. 
We believe this flexibility is necessary because a user may be 
different depending on the certification criterion and the context 
within which the capability it specifies is used. Accordingly, we 
believe a user could be a health care professional or office staff, 
someone who might interact directly with Certified EHR Technology or 
that it could also be software program or service.

D. Final Rule Amendments to Adopted Standards, Implementation 
Specifications, and Certification Criteria Sec. Sec.  170.202, 170.205, 
170.207, 170.210, 170.302, 170.304, 170.306

1. Flexibility and Innovation
    Comments. Many commenters requested that we provide more 
flexibility in the final rule to accommodate new developments in HIT. 
These commenters agreed with our approach to identify minimum standards 
for certain