Permanent Certification Program for Health Information Technology; Revisions to ONC-Approved Accreditor Processes, 31272-31279 [2011-13372]

Agencies

• DEPARTMENT OF HEALTH AND HUMAN SERVICES
• Office of the Secretary

[Federal Register Volume 76, Number 104 (Tuesday, May 31, 2011)]
[Proposed Rules]
[Pages 31272-31279]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: 2011-13372]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Office of the Secretary

45 CFR Part 170

RIN 0991-AB77


Permanent Certification Program for Health Information 
Technology; Revisions to ONC-Approved Accreditor Processes

AGENCY: Office of the National Coordinator for Health Information 
Technology (ONC), Department of Health and Human Services.

ACTION: Proposed rule.

-----------------------------------------------------------------------

SUMMARY: Under the authority granted to the National Coordinator for 
Health Information Technology (the National Coordinator) by section 
3001(c)(5) of the Public Health Service Act (PHSA) as added by the 
Health Information Technology for Economic and Clinical Health (HITECH) 
Act, this rule proposes a process for addressing instances where the 
ONC-Approved Accreditor (ONC-AA) engages in improper conduct or does 
not perform its responsibilities under the permanent certification 
program. This rule also proposes to address the status of ONC-
Authorized Certification Bodies (ONC-ACBs) in instances where there may 
be a change in the accreditation organization serving as the ONC-AA and 
clarifies the responsibilities of the new ONC-AA.

DATES: To be assured consideration, written or electronic comments must 
be received at one of the addresses provided below, no later than 5 
p.m. on August 1, 2011.

ADDRESSES: Because of staff and resource limitations, we cannot accept 
comments by facsimile (FAX) transmission. You may submit comments, 
identified by RIN 0991-AB77, by any of the following methods (please do 
not submit duplicate comments).
     Federal eRulemaking Portal: Follow the instructions for 
submitting comments. Attachments should be in Microsoft Word or Excel, 
Adobe PDF; however, we prefer Microsoft Word. https://www.regulations.gov.
     Regular, Express, or Overnight Mail: Department of Health 
and Human Services, Office of the National Coordinator for Health 
Information Technology, Attention: Revisions to ONC-AA Processes 
Proposed Rule, Hubert H. Humphrey Building, Suite 729D, 200 
Independence Ave., SW., Washington, DC 20201. Please submit one 
original and two copies.
     Hand Delivery or Courier: Office of the National 
Coordinator for Health Information Technology, Attention: Revisions to 
ONC-AA Processes Proposed Rule, Hubert H. Humphrey Building, Suite 
729D, 200 Independence Ave., SW., Washington, DC 20201. Please submit 
one original and two copies. (Because access to the interior of the 
Hubert H. Humphrey Building is not readily available to persons without 
Federal government identification, commenters are encouraged to leave 
their comments in the mail drop slots located in the main lobby of the 
building.)
    Inspection of Public Comments: All comments received before the 
close of the comment period will be available for public inspection, 
including any personally identifiable or confidential business 
information that is included in a comment. Please do not include 
anything in your comment submission that you do not wish to share with 
the general public. Such information includes, but is not limited to: a 
person's social security number; date of birth; driver's license 
number; state identification number or foreign country equivalent; 
passport number; financial account number; credit or debit card number; 
any personal health information; or any business information that could 
be considered to be proprietary. We will post all comments received 
before the close of the comment period at https://www.regulations.gov.
    Docket: For access to the docket to read background documents or 
comments received, go to https://www.regulations.gov or the Department 
of Health and Human Services, Office of the National Coordinator for 
Health Information Technology, Hubert H. Humphrey Building, Suite 729D, 
200 Independence Ave., SW., Washington, DC 20201 (call ahead to the 
contact listed below to arrange for inspection).

FOR FURTHER INFORMATION CONTACT: Steven Posnack, Director, Federal 
Policy Division, Office of Policy and Planning, Office of the National 
Coordinator for Health Information Technology, 202-690-7151.

SUPPLEMENTARY INFORMATION:

Acronyms

EHR Electronic Health Record
HHS Department of Health and Human Services
HIT Health Information Technology
HITECH Health Information Technology for Economic and Clinical 
Health
ONC Office of the National Coordinator for Health Information 
Technology
ONC-AA ONC-Approved Accreditor
ONC-ACB ONC-Authorized Certification Body
ONC-ATCB ONC-Authorized Testing and Certification Body
PHSA Public Health Service Act
RFA Regulatory Flexibility Act
SBA Small Business Administration

Table of Contents

I. Background
    A. Statutory Basis for the Permanent Certification Program
    B. Regulatory Background of the Permanent Certification Program
    1. Initial Set of Standards, Implementation Specifications, and 
Certification Criteria Interim Final and Final Rules
    2. Medicare and Medicaid EHR Incentive Programs Proposed and 
Final Rules
    3. HIT Certification Programs Proposed Rule and the Temporary 
and Permanent Certification Programs Final Rules
    C. Overview of the Permanent Certification Program
II. Provisions of the Proposed Rule
    A. Removal of the ONC-AA for Improper Conduct or Failure To 
Perform Its Responsibilities
    1. Conduct Violations
    2. Performance Violations
    3. Proposed Removal of the ONC-AA
    4. Opportunity To Respond to a Proposed Removal Notice
    5. Removal of the ONC-AA
    6. Extent and Duration of Removal Under the Permanent 
Certification Program
    B. Effects of Removing and/or Replacing the ONC-AA
    1. ONC-ACB Status
    2. New ONC-AA
III. Response to Comments
IV. Collection of Information Requirements
V. Regulatory Impact Statement

I. Background

    [If you choose to comment on the background section, please include 
at the beginning of your comment the caption ``Background'' and any 
additional information to clearly identify the information about which 
you are commenting.]

A. Statutory Basis for the Permanent Certification Program

    The Health Information Technology for Economic and Clinical Health 
(HITECH) Act, Title XIII of Division A

[[Page 31273]]

and Title IV of Division B of the American Recovery and Reinvestment 
Act of 2009 (ARRA) (Pub. L. 111-5), amended the Public Health Service 
Act (PHSA) to add a new ``Title XXX--Health Information Technology and 
Quality.'' Section 3001(c)(5) of the PHSA, as added by section 13101 of 
the HITECH Act, provides the National Coordinator for Health 
Information Technology (National Coordinator) with the authority to 
establish a certification program or programs for the voluntary 
certification of health information technology (HIT). Specifically, 
section 3001(c)(5)(A) states that the ``National Coordinator, in 
consultation with the Director of the National Institute of Standards 
and Technology, shall keep or recognize a program or programs for the 
voluntary certification of health information technology as being in 
compliance with applicable certification criteria adopted under 
[section 3004 of the PHSA].''

B. Regulatory Background of the Permanent Certification Program

1. Initial Set of Standards, Implementation Specifications, and 
Certification Criteria Interim Final and Final Rules
    In accordance with section 3004(b)(1) of the PHSA, the Secretary 
issued an interim final rule with request for comments entitled 
``Health Information Technology: Initial Set of Standards, 
Implementation Specifications, and Certification Criteria for 
Electronic Health Record Technology'' (75 FR 2014, Jan. 13, 2010) (the 
``HIT Standards and Certification Criteria interim final rule''), which 
adopted an initial set of standards, implementation specifications, and 
certification criteria. After consideration of the public comments 
received on the interim final rule, a final rule was issued to complete 
the adoption of the initial set of standards, implementation 
specifications, and certification criteria and realign them with the 
final objectives and measures established for meaningful use Stage 1. 
Health Information Technology: Initial Set of Standards, Implementation 
Specifications, and Certification Criteria for Electronic Health Record 
Technology; Final Rule, 75 FR 44590 (July 28, 2010) (the ``HIT 
Standards and Certification Criteria final rule''). On October 13, 
2010, an interim final rule was issued to remove certain implementation 
specifications related to public health surveillance that had been 
previously adopted in the HIT Standards and Certification Criteria 
final rule (75 FR 62686).
    The standards, implementation specifications, and certification 
criteria adopted by the Secretary establish the capabilities that 
Certified Electronic Health Record (EHR) Technology must include in 
order to, at a minimum, support the achievement of meaningful use Stage 
1 by eligible professionals and eligible hospitals \1\ under the 
Medicare and Medicaid EHR Incentive Programs.
---------------------------------------------------------------------------

    \1\ References to ``eligible hospitals'' in this rule shall mean 
``eligible hospitals and/or critical access hospitals, as defined in 
42 CFR 495.4'' unless otherwise indicated.
---------------------------------------------------------------------------

2. Medicare and Medicaid EHR Incentive Programs Proposed and Final 
Rules
    Associated with the HIT Standards and Certification Criteria 
interim final rule, CMS concurrently published in the Federal Register 
(75 FR 1844, Jan. 13, 2010) the Medicare and Medicaid EHR Incentive 
Programs proposed rule. The rule proposed a definition for Stage 1 
meaningful use of Certified EHR Technology and regulations associated 
with the incentive payments made available under Division B, Title IV 
of the HITECH Act.
    Subsequently, CMS published a final rule for the Medicare and 
Medicaid EHR Incentive Programs in the Federal Register (75 FR 44314) 
on July 28, 2010 (the ``Medicare and Medicaid EHR Incentive Programs 
final rule''), simultaneously with the publication of the HIT Standards 
and Certification Criteria final rule. The final rule published by CMS 
established the objectives and associated measures that eligible 
professionals and eligible hospitals must satisfy in order to 
demonstrate ``meaningful use'' during Stage 1.
3. HIT Certification Programs Proposed Rule and the Temporary and 
Permanent Certification Programs Final Rules
    Based on the authority provided in section 3001(c)(5) of the PHSA, 
we proposed both a temporary and permanent certification program for 
HIT in a notice of proposed rulemaking entitled ``Proposed 
Establishment of Certification Programs for Health Information 
Technology'' (75 FR 11328, Mar. 10, 2010). We proposed to use the 
certification programs for the purposes of testing and certifying HIT 
and specified the processes the National Coordinator would follow to 
authorize organizations to perform the testing and/or certification of 
HIT. Notably, we issued two final rules to implement our proposals. On 
June 24, 2010, a final rule was published in the Federal Register (75 
FR 36158) to establish a temporary certification program (the 
``Temporary Certification Program final rule''). On January 7, 2011, a 
final rule was published in the Federal Register (76 FR 1262) to 
establish the permanent certification program (the ``Permanent 
Certification Program final rule''). The permanent certification 
program will eventually replace the temporary certification program, 
which will sunset on December 31, 2011, or on a subsequent date if the 
permanent certification program is not fully constituted at that time.
    EHR technology that is tested and certified through the 
certification programs currently must be tested and certified in 
accordance with all applicable certification criteria adopted by the 
Secretary under section 3004(b)(1) of the PHSA and could potentially be 
used to satisfy the definition of Certified EHR Technology. Eligible 
professionals and eligible hospitals that successfully demonstrate 
meaningful use of Certified EHR Technology may receive incentive 
payments under the Medicare and Medicaid EHR Incentive Programs.

C. Overview of the Permanent Certification Program

    Key facets of the permanent certification program are summarized as 
follows. The permanent certification program provides a process by 
which an organization or organizations may become an Office of the 
National Coordinator for Health Information Technology-Authorized 
Certification Body (ONC-ACB) authorized by the National Coordinator to 
perform the certification of Complete EHRs and/or EHR Modules. ONC-ACBs 
may also be authorized under the permanent certification program to 
perform the certification of other types of HIT in the event that 
applicable certification criteria are adopted by the Secretary. We 
note, however, that the certification of Complete EHRs, EHR Modules, or 
potentially other types of HIT under the permanent certification 
program would not constitute a replacement or substitution for other 
Federal requirements that may be applicable.
    An organization that seeks to become an ONC-ACB must, among other 
requirements, successfully obtain accreditation from the accreditation 
organization that has been approved by the National Coordinator as the 
ONC-Approved Accreditor (ONC-AA). Only one accreditation organization 
at a time may be approved to serve as the ONC-AA. An accreditation 
organization that wishes to be considered for ONC-AA status must submit 
a written request to the National Coordinator during the specified 
submission period and

[[Page 31274]]

include certain information to demonstrate its ability to serve as the 
ONC-AA. The National Coordinator will determine which accreditation 
organization is best qualified to serve as the ONC-AA, and the 
organization that is approved on a final basis will be expected to 
serve a three-year term. The ONC-AA must fulfill certain on-going 
responsibilities for the permanent certification program, which 
include: maintaining conformance with ISO/IEC 17011:2004 (ISO 17011); 
in accrediting certification bodies, verifying that they conform to 
ISO/IEC Guide 65:1996 (Guide 65) at a minimum; and performing certain 
activities related to surveillance that will be conducted by ONC-ACBs.
    The National Coordinator will accept applications for ONC-ACB 
status at any time, which must include the type of authorization 
sought, general identifying information, documentation that confirms 
that the applicant has been accredited by the ONC-AA, and an executed 
agreement that it will adhere to the Principles of Proper Conduct for 
ONC-ACBs. ONC-ACBs will be required to remain in good standing by, 
among other things, adhering to the Principles of Proper Conduct for 
ONC-ACBs, which include a requirement that an ONC-ACB must maintain its 
accreditation that was granted by the ONC-AA. An ONC-ACB's status will 
expire in three years, unless its status is renewed. The National 
Coordinator may revoke an ONC-ACB's status and/or suspend an ONC-ACB's 
operations under permanent certification program, based on Type-1 and 
Type-2 violations.
    Testing and certification under the permanent certification program 
is expected to begin on January 1, 2012, or upon a subsequent date when 
the National Coordinator determines that the permanent certification 
program is fully constituted. The permanent certification program has 
no anticipated sunset date.

II. Provisions of the Proposed Rule

    [If you choose to comment on the provisions of the proposed rule 
section, please include at the beginning of your comment the section 
title to which your comments apply and any additional information to 
clearly identify the proposals about which you are commenting.]

A. Removal of the ONC-AA for Improper Conduct or Failure To Perform Its 
Responsibilities

    In the proposed rule to establish the temporary and permanent 
certification programs (75 FR 11328), we did not propose a formal 
process for the National Coordinator to remove or take other corrective 
action against an accreditation organization serving as the ONC-AA 
based on misconduct or failure to perform its responsibilities. We did 
propose and finalize a process through which the National Coordinator 
could revoke the status and/or suspend the operations of an ONC-
Authorized Testing and Certification Body (ONC-ATCB) under the 
temporary certification program and an ONC-ACB under the permanent 
certification program. Some of the comments we received asked how we 
would address concerns with an ONC-AA's operations and remove or 
replace an ineffective ONC-AA. We responded to those comments in the 
Permanent Certification Program final rule (76 FR 1269) by stating our 
intentions to issue a notice of proposed rulemaking that would address 
improper conduct by an ONC-AA, the potential consequences for engaging 
in such conduct, and a process by which the National Coordinator may 
take ``corrective action'' against an ONC-AA. We recognized that an 
ONC-AA has significant responsibilities under the permanent 
certification program that are inextricably linked to the success of 
the program. We believe that a removal process, similar to the 
revocation and suspension processes we have established for ONC-ATCBs 
under the temporary certification program and ONC-ACBs under the 
permanent certification program, would protect the integrity of the 
permanent certification program and maintain public confidence in the 
program by removing an ONC-AA that engages in misconduct or fails to 
satisfy its performance obligations under the program.
    To address improper conduct by the ONC-AA or its failure to perform 
its responsibilities under the permanent certification program, we are 
proposing a process for removing the ONC-AA that is similar to the 
process established in the Permanent Certification Program final rule 
for suspending and/or revoking an ONC-ACB's status. We propose that the 
National Coordinator may remove the ONC-AA under the permanent 
certification program based on either a conduct or performance 
violation by the ONC-AA. We describe these violations and the removal 
process below and in the provisions of proposed Sec.  170.575. We 
welcome comments on our proposals discussed below.
1. Conduct Violations
    The types of violations we would consider conduct violations 
include violations of law or permanent certification program policies 
that threaten or significantly undermine the integrity of the permanent 
certification program. Conduct violations would include, but are not 
limited to, false, fraudulent, or abusive activities that affect: the 
permanent certification program; a program administered by the 
Department of Health and Human Services (HHS); or any program 
administered by the Federal government. These violations could 
jeopardize the integrity of the permanent certification program and 
would include examples such as: the ONC-AA, or a principal employee, 
owner, or agent of the ONC-AA, being charged with or convicted of 
fraud, embezzlement or extortion, or of violating similar Federal or 
State securities laws while participating in the permanent 
certification program; falsifying accreditations; or withholding, 
destroying, or altering information that would indicate false or 
fraudulent activity had occurred within the permanent certification 
program.
    For the public to maintain faith in the integrity of permanent 
certification program, the program's participants must properly fulfill 
their responsibilities. Therefore, we propose that if the National 
Coordinator has reliable evidence that the ONC-AA committed one or more 
conduct violations, the National Coordinator may issue the ONC-AA a 
notice proposing to remove it as the ONC-AA under the permanent 
certification program.
2. Performance Violations
    The types of violations we would consider performance violations 
include the ONC-AA failing to properly fulfill one or more of its 
responsibilities specified in Sec.  170.503(e). These responsibilities 
include: maintaining conformance with ISO 17011; in accrediting 
certification bodies, verifying conformance to, at a minimum, Guide 65 
and ensuring the surveillance approaches used by ONC-ACBs include the 
use of consistent, objective, valid, and reliable methods; verifying 
that ONC-ACBs are performing surveillance in accordance with their 
respective annual plans; and reviewing ONC-ACB surveillance results to 
determine if the results indicate any substantive non-conformance by 
the ONC-ACBs with the conditions of their respective accreditations.
    Opportunities to assess an ONC-AA's performance of its 
responsibilities will be available at certain junctures during the 
permanent certification program. As an example in the Permanent 
Certification Program final rule (76 FR 1270), we noted that the 
Principles of

[[Page 31275]]

Proper Conduct for ONC-ACBs require ONC-ACBs to submit annual 
surveillance plans and to annually report surveillance results to the 
National Coordinator. Our review of an ONC-ACB's surveillance results 
should give an indication of whether the ONC-AA is performing its 
responsibilities to review ONC-ACB surveillance results and verify that 
ONC-ACBs are performing surveillance in accordance with their 
surveillance plans. We also noted that we expect that our review and 
analysis of surveillance plans and results will not only include 
feedback from the ONC-ACBs but also feedback from the ONC-AA. The ONC-
AA feedback will provide us with additional information on the ONC-AA's 
performance of its responsibilities to monitor and review ONC-ACBs' 
surveillance activities.
    The National Coordinator could obtain information about the ONC-AA 
from other sources as well. For example, we could potentially receive 
information from an organization that sought accreditation by the ONC-
AA and was denied, or from an ONC-ACB that had its accreditation 
withdrawn by the ONC-AA. Such information could provide reliable 
evidence that the ONC-AA was not in compliance with ISO 17011, as 
required by Sec.  170.503(e)(1). For example, section 7 (Accreditation 
process) of ISO 17011 requires the ONC-AA to establish a proper 
assessment process for accrediting conformance assessment bodies (i.e., 
certification bodies or ONC-ACBs), which includes establishing 
procedures to address appeals by such bodies. Information from a 
certification body that sought accreditation or an ONC-ACB could 
indicate whether the ONC-AA had a sufficient assessment or appeals 
processes in place. We propose that if the National Coordinator obtains 
reliable evidence from fact-gathering, requesting information from the 
ONC-AA, contacting the ONC-AA's customer(s), and/or complaints that the 
ONC-AA is not properly performing its responsibilities under Sec.  
170.503(e), the National Coordinator would notify the ONC-AA of an 
alleged performance violation. The notification would include all 
pertinent information regarding the National Coordinator's assessment. 
Unless otherwise specified by the National Coordinator, the ONC-AA 
would be permitted up to 30 days from the date it is notified about the 
alleged performance violation(s) to submit a written response and any 
accompanying documentation that could demonstrate no violation(s) 
occurred or validate that violation(s) occurred and were corrected. If 
the ONC-AA fails to submit a response to the National Coordinator 
within 30 days, the National Coordinator may issue the ONC-AA a notice 
proposing to remove it as the ONC-AA under the permanent certification 
program.
    If the ONC-AA submits a response, the National Coordinator would be 
permitted up to 60 days to evaluate the ONC-AA's response (and request 
additional information, if necessary). If the National Coordinator 
determines that the ONC-AA did not commit a performance violation, or 
may have committed a performance violation but satisfactorily corrected 
any violation(s) that may have occurred, a memo will be issued to the 
ONC-AA to confirm this determination. If the National Coordinator 
determines that the ONC-AA's response is insufficient and that a 
performance violation had occurred and had not been adequately 
corrected, then the National Coordinator may propose to remove the ONC-
AA.
3. Proposed Removal of the ONC-AA
    Under our removal process, the National Coordinator may propose the 
removal of the ONC-AA for alleged conduct violations and for failing to 
respond to, or satisfactorily address, a notification related to a 
performance violation. Based on our assessment, the option to propose 
removal is more appropriate than the option to suspend the ONC-AA's 
activities under the permanent certification program. Any form of 
suspension would prevent the ONC-AA from performing its 
responsibilities under Sec.  170.503(e), which would not benefit the 
permanent certification program because these ongoing responsibilities 
are an integral part of the program. We welcome comments on these 
options and whether certain circumstances may warrant the suspension of 
the ONC-AA.
4. Opportunity To Respond to a Proposed Removal Notice
    If the National Coordinator issues a proposed removal notice to the 
ONC-AA, we propose that the ONC-AA must respond within 20 days of 
receipt of the removal notice in order to contest the proposed removal 
and must provide sufficient documentation to support its explanation 
for why it should not be removed. Upon receipt of the ONC-AA's response 
to a proposed removal notice, the National Coordinator would be 
permitted up to 60 days to review the information submitted by the ONC-
AA and make a decision.
    During the time period provided for the ONC-AA to respond to the 
proposed removal notice and the National Coordinator's review period, 
we would expect that the ONC-AA would continue to perform its 
responsibilities under the permanent certification program and propose 
that the National Coordinator would consider the ONC-AA's performance 
of its duties during this timeframe as a factor in reaching any final 
decision to remove the ONC-AA. We welcome comments on this proposal and 
whether it would be more appropriate for the National Coordinator to 
proceed in a different manner, including providing less time for the 
ONC-AA to respond to a proposed removal notice based on a conduct 
violation.
5. Removal of the ONC-AA
    According to our proposal, the ONC-AA may be removed by the 
National Coordinator if it is determined that removal is appropriate 
after considering the information provided by the ONC-AA in response to 
the proposed removal notice or if the ONC-AA does not respond to a 
proposed removal notice within the specified timeframe. We propose that 
a decision to remove the ONC-AA would be final and would not be subject 
to further review unless the National Coordinator chooses to reconsider 
the removal.
    If the National Coordinator determines that the ONC-AA should not 
be removed, the National Coordinator would notify the ONC-AA in writing 
to express this determination.
6. Extent and Duration of Removal Under the Permanent Certification 
Program
    We propose that the removal of the ONC-AA would become effective 
upon the date specified in the removal notice and that the affected 
accreditation organization would be required to cease all activities 
under the permanent certification program, including accepting new 
requests for accreditation associated with the permanent certification 
program. We propose that an accreditation organization that has been 
removed as the ONC-AA will be prohibited from being considered for ONC-
AA status for a period of 1 year from the effective date of removal. 
Violation(s) committed by the accreditation organization serving as the 
ONC-AA that result in its removal demonstrate that it cannot conduct 
itself properly or perform its responsibilities under the permanent 
certification program. Accordingly, we believe that if an accreditation 
organization has its ONC-AA status removed, it would be inappropriate 
to permit the accreditation organization to immediately reapply to 
become the

[[Page 31276]]

ONC-AA. We therefore propose a 1-year waiting period to prevent the 
affected accreditation organization from being considered when ONC goes 
through the process in Sec.  170.503 to approve its replacement. We 
request public comment on alternatives for the treatment of an 
accreditation organization that is removed as the ONC-AA under the 
permanent certification program.

B. Effects of Removing and/or Replacing the ONC-AA

1. ONC-ACB Status
    In Sec.  170.523(a) we require that an ONC-ACB ``[m]aintain its 
accreditation.'' During the course of an ONC-ACB's three-year term, it 
is possible that there could be a change in accreditation organizations 
serving as the ONC-AA. In other words, the accreditation organization 
serving as the ONC-AA that initially accredited an ONC-ACB could be 
replaced by a different accreditation organization that is subsequently 
selected to serve as the ONC-AA. A change in ONC-AAs could occur under 
different scenarios, such as if the accreditation organization serving 
as the ONC-AA resigns before the end of its term, is replaced at the 
end of its term through the selection process under Sec.  170.503, or 
is removed by the National Coordinator before the end of its term. If a 
different accreditation organization were to be approved as the ONC-AA, 
our primary goal would be to ensure stability among ONC-ACBs and within 
the HIT marketplace, which would include the uninterrupted 
certification of HIT. Therefore, we propose that if there is a change 
in accreditation organizations serving as the ONC-AA, such as in the 
scenarios described above, an ONC-ACB will retain its status under the 
permanent certification program, but only for a reasonable period of 
time to allow it to obtain accreditation from the accreditation 
organization that is approved as the new ONC-AA.
    We propose that an ONC-ACB must obtain accreditation from the new 
ONC-AA within 12 months after the effective date of the new ONC-AA's 
status or within a reasonable period specified by the National 
Coordinator. We use the term ``effective date'' because although an 
accreditation organization could be approved as the ONC-AA pursuant to 
the process in Sec.  170.503, its status as the ONC-AA may not become 
effective until a later date (e.g., its status may not take effect 
until the then-current ONC-AA's term expires). Based on our 
consultations with subject matter experts at the National Institute for 
Standards and Technology (NIST), we believe that a new ONC-AA could 
complete the accreditation process for up to 6 ONC-ACBs within 6 to 9 
months. We believe this could possibly be an appropriate timeframe and 
could be sufficient to meet the demand for accreditation considering 
that we estimated in the Permanent Certification Program final rule 
that only 6 ONC-ACBs will be operating under the permanent 
certification program and that only 6 ONC-Authorized Testing and 
Certification Bodies (ONC-ATCBs) are currently operating under the 
temporary certification program. However, considering that there may be 
more ONC-ACBs than we anticipate and that accreditation to the 
requirements of a new ONC-AA may require more time than anticipated, we 
believe 12 months would be a more reasonable timeframe for ONC-ACBs to 
obtain accreditation from the new ONC-AA. We believe the 12-month grace 
period provides for equitable treatment of ONC-ACBs, especially those 
that in good faith and without sufficient notice of a possible change 
in the ONC-AA recently paid for and obtained accreditation from an ONC-
AA that is subsequently removed or replaced. We welcome comments on 
whether we should consider a shorter or longer period of time than 12 
months.
    Our proposal permits the National Coordinator to specify a 
reasonable period of time for ONC-ACBs to obtain accreditation from the 
new ONC-AA as an alternative to the 12-month timeframe. We believe this 
discretion is necessary to address unanticipated events, including but 
not limited to the following examples. For example, the new ONC-AA may 
be unable to offer accreditation within the 12-month timeframe for 
various reasons, such as unexpected demand for its accreditation 
services. It would be prudent for the National Coordinator to have the 
flexibility to grant an extension to an ONC-ACB if it had filed a 
request for accreditation with the new ONC-AA before the 12-month 
timeframe had elapsed and the new ONC-AA had not yet completed its 
accreditation of the ONC-ACB. Alternatively, there may be a need for 
the National Coordinator to require that ONC-ACBs obtain accreditation 
from the new ONC-AA in less than 12 months to protect the integrity of 
the permanent certification program. This situation could occur if the 
accreditation organization removed as the ONC-AA engaged in conduct 
that called into question the legitimacy of the accreditations granted 
to ONC-ACBs. We welcome comments on these examples and whether there 
may be additional circumstances that would warrant the National 
Coordinator's exercise of discretion to specify a different period of 
time for obtaining accreditation from the new ONC-AA. We also welcome 
comments on whether there should be a maximum period of time beyond 12 
months in which an ONC-ACB must obtain accreditation from the new ONC-
AA no matter the circumstances.
    We propose to revise Sec.  170.523(a) to state that an ONC-ACB 
shall ``maintain its accreditation, or if a new ONC-AA is approved by 
the National Coordinator, obtain accreditation from the new ONC-AA 
within 12 months or a reasonable period specified by the National 
Coordinator and maintain such accreditation.''
2. New ONC-AA
    As noted in our prior discussion, the National Coordinator may 
approve a new accreditation organization as the ONC-AA for reasons such 
as the former ONC-AA resigning, another accreditation organization 
being selected when the former ONC-AA's term expires, or the former 
ONC-AA being removed for conduct or performance violations as described 
above. The selection and approval of the new ONC-AA will be conducted 
as soon as possible and consistent with the processes and timeframes 
outlined in Sec.  170.503. Doing so permits the new ONC-AA to begin 
fulfilling its responsibilities as specified under Sec.  170.503(e) 
when its status as the ONC-AA becomes effective. This means that the 
new ONC-AA will be expected to fulfill its responsibilities under Sec.  
170.503(e) with respect to the ONC-ACBs that it accredited, as well as 
those ONC-ACBs that were accredited by the former ONC-AA and are not 
yet accredited by the new ONC-AA. The new ONC-AA would be responsible 
for verifying that all ONC-ACBs are performing surveillance in 
accordance with their respective annual plans, as required by Sec.  
170.503(e)(3). In addition, consistent with Sec.  170.503(e)(4), the 
new ONC-AA would review all ONC-ACB surveillance results to determine 
if the results indicate any substantive non-conformance by the ONC-ACBs 
with the conditions of their respective accreditations (even if an ONC-
ACB was accredited by the former ONC-AA).
    Section 170.503(e)(2) requires the ONC-AA, ``[i]n accrediting 
certification bodies, [to] verify conformance to, at a minimum, [Guide 
65] and ensure the surveillance approaches used by ONC-ACBs include the 
use of consistent, objective, valid, and reliable methods.'' In the 
Permanent Certification Program

[[Page 31277]]

final rule (76 FR 1270), we explained this ongoing responsibility would 
require the ONC-AA to verify that ONC-ACBs continue to conform to the 
provisions of Guide 65 at a minimum as a condition of continued 
accreditation. Similar to 170.503(e)(3) and (e)(4), we expect the new 
ONC-AA to fulfill the responsibilities outlined in Sec.  170.503(e)(2) 
for the certification bodies it accredits and all ONC-ACBs, including 
those ONC-ACBs it has not yet had an opportunity to accredit. To 
clarify this expectation, we propose to revise Sec.  170.503(e)(2) to 
require the ONC-AA to ensure that all ONC-ACBs continue to conform to 
Guide 65 at a minimum, as indicated below. We made similar clarifying 
revisions to Sec.  170.503(e)(4) in the Permanent Certification Program 
final rule. In that final rule (76 FR 1270), we explained that we were 
revising Sec.  170.503(e)(4) to account for the possibility that 
different accreditation organizations may be approved to serve as the 
ONC-AA. Specifically, we revised that section to clarify that the ONC-
AA would be responsible for reviewing ONC-ACB surveillance results to 
determine if the results indicated any substantive non-conformance by 
ONC-ACBs with the conditions of ``their respective accreditations'' 
rather than ``with the terms set by the ONC-AA when it granted the ONC-
ACB accreditation'' as we had proposed.
    We propose to revise Sec.  170.503(e) as follows. Paragraphs (e)(3) 
and (e)(4) would be redesignated as paragraphs (e)(4) and (e)(5), 
respectively. Paragraph (e)(2) would be revised to state that the ONC-
AA shall ``[v]erify that the certification bodies it accredits and ONC-
ACBs conform to, at a minimum, ISO/IEC Guide 65:1996 (incorporated by 
reference in Sec.  170.599).'' This revision removes the second part of 
paragraph (e)(2), which we propose to make a separate new paragraph. We 
propose to number this new paragraph as (e)(3) and for it to state that 
the ONC-AA shall ``ensure that the surveillance approaches used by ONC-
ACBs include the use of consistent, objective, valid, and reliable 
methods.''
    Although these proposals will require the new ONC-AA to become 
familiar with the ONC-ACBs, many of which may not yet have been 
accredited by the new ONC-AA, we believe the proposed responsibilities 
are still achievable. With respect to the responsibilities under Sec.  
170.503(e)(3) and (4), ONC can make the ONC-ACBs' surveillance plans 
available to the new ONC-AA and the former ONC-AA's accreditation 
requirements should be publicly available, consistent with section 
7.1.2 of ISO 17011, or they can be provided to the new ONC-AA by ONC. 
We expect that the new ONC-AA will fulfill these responsibilities in 
the manner we have described until it has the opportunity to accredit 
the ONC-ACBs according to its own accreditation requirements if 
applicable and to Guide 65 as required. As noted in the previous 
section's discussion, we propose to give ONC-ACBs 12 months or another 
reasonable period to obtain accreditation from the new ONC-AA. In 
considering the appropriateness of our proposed timeframe for ONC-ACBs 
to be accredited by the new ONC-AA, we ask that commenters also 
consider our expectations for the new ONC-AA during this timeframe. We 
also welcome additional comments on our expectations and proposals.

III. Response to Comments

    Because of the large number of public comments normally received in 
response to Federal Register documents, we are not able to acknowledge 
or respond to them individually. We will consider all comments we 
receive by the date and time specified in the DATES section of this 
preamble, and, when we proceed with a subsequent document, we will 
respond to the comments in the preamble of that document.

IV. Collection of Information Requirements

    [If you choose to comment on the collection of information 
requirements section, please include at the beginning of your comment 
the caption ``Collection of Information Requirements'' and any 
additional information to clearly identify the information about which 
you are commenting.]
    This proposed rule would only require the collection of information 
from the ONC-AA if we took an action against the ONC-AA under the 
provisions of this proposed rule and the ONC-AA submitted information 
to ONC in response to the action as provided for under the provisions 
of this proposed rule. The Paperwork Reduction Act of 1995, however, 
exempts the information collection activities referenced in this 
proposed rule. Specifically, 44 U.S.C. 3518(c)(1)(B)(ii) excludes 
collection activities during the conduct of administrative actions or 
investigations involving the agency against specific individuals or 
entities.

V. Regulatory Impact Statement

    [If you choose to comment on the regulatory impact statement 
section, please include at the beginning of your comment the caption 
``Regulatory Impact Statement'' and any additional information to 
clearly identify the information about which you are commenting.]
    We have examined the impact of this proposed rule as required by 
Executive Order 12866 on Regulatory Planning and Review (September 30, 
1993), Executive Order 13563 on Improving Regulation and Regulatory 
Review (February 2, 2011), the Regulatory Flexibility Act (5 U.S.C. 601 
et seq.), section 202 of the Unfunded Mandates Reform Act of 1995 (2 
U.S.C. 1532), Executive Order 13132 on Federalism (August 4, 1999), and 
the Congressional Review Act (5 U.S.C. 804(2)).
    Executive Orders 12866 and 13563 direct agencies to assess all 
costs and benefits of available regulatory alternatives and, if 
regulation is necessary, to select regulatory approaches that maximize 
net benefits (including potential economic, environmental, public 
health and safety effects, distributive impacts, and equity). A 
regulatory impact analysis must be prepared for major rules with 
economically significant effects ($100 million or more in any 1 year). 
This proposed rule does not reach the economic threshold and thus is 
not considered a major rule. Therefore, a regulatory impact analysis 
has not been prepared.
    The Regulatory Flexibility Act (RFA) requires agencies to prepare 
an initial regulatory flexibility analysis to describe the impact of 
the proposed rule on small entities, unless the head of the agency can 
certify that the rule will not have a significant economic impact on a 
substantial number of small entities. For purposes of the RFA, small 
entities include small businesses, small organizations, and small 
governmental jurisdictions. Individuals and States are not included in 
the definition of a small entity. The entities that will be directly 
affected by this proposed rule are likely small businesses in the form 
of accreditation organizations interested in becoming the ONC-AA, the 
ONC-AA, potential applicants for ONC-ACB status, and ONC-ACBs. We 
believe that these entities would either be classified under the North 
American Industry Classification System (NAICS) codes 541380 (Testing 
Laboratories) or 541990 (Professional, Scientific and Technical 
Services).\2\ According to the NAICS codes identified above, this would 
mean Small Business Administration (SBA) size standards of $12 million 
and $7

[[Page 31278]]

million in annual receipts, respectively.\3\
---------------------------------------------------------------------------

    \2\ See 13 CFR 121.201.
    \3\ The SBA references that annual receipts means ``total 
income'' (or in the case of a sole proprietorship, ``gross income'') 
plus ``cost of goods sold'' as these terms are defined and reported 
on Internal Revenue Service tax return forms. For more information 
on the SBA's size standards, see the SBA's Web site at: https://www.sba.gov/content/small-business-size-regulations.
---------------------------------------------------------------------------

    We do not believe that this rule proposes requirements for the ONC-
AA that would be unexpected by accreditation organizations interested 
in serving as the ONC-AA. An accreditation organization serving as the 
ONC-AA would expect to be required to properly fulfill its 
responsibilities and exhibit proper conduct or be subject to 
consequences. Moreover, as noted above, we indicated in prior 
rulemaking concerning the permanent certification program that we 
expected to issue this proposed rule and gave a general overview of the 
topics it would likely address. We believe the processes that we have 
proposed constitute the minimum amount of requirements necessary to 
accomplish our policy goals and that no appropriate regulatory 
alternatives could be developed to lessen the compliance burden for the 
ONC-AA. As for ONC-ACBs, this proposed rule mitigates any potential 
negative consequences of removing and replacing the ONC-AA if required. 
Should the ONC-AA be replaced, this proposed rule permits ONC-ACBs to 
retain their status and provides ONC-ACBs up to 12 months or a 
reasonable period specified by the National Coordinator to obtain 
accreditation from the new ONC-AA. Furthermore, the proposed process 
for addressing instances where the ONC-AA engages in improper conduct 
or fails to perform its responsibilities under the permanent 
certification program could create positive effects for program 
participants by increasing the accountability of the ONC-AA and 
protecting the integrity of the permanent certification program. We 
examined the implications of this proposed rule and have concluded, and 
the Secretary certifies, that this proposed rule will not have a 
significant economic impact on a substantial number of small entities.
    Section 202 of the Unfunded Mandates Reform Act of 1995 requires 
that agencies assess anticipated costs and benefits before issuing any 
rule whose mandates require spending in any 1 year of $100 million in 
1995 dollars, updated annually for inflation. In 2011, that threshold 
level is approximately $136 million. This proposed rule will not impose 
an unfunded mandate on State, local, and Tribal governments or on the 
private sector of more than $135 million annually.
    Executive Order 13132 establishes certain requirements that an 
agency must meet when it promulgates a proposed rule (and subsequent 
final rule) that imposes substantial direct requirement costs on State 
and local governments, preempts State law, or otherwise has Federalism 
implications. Since this proposed rule does not impose any costs on 
State or local governments, the requirements of Executive Order 13132 
are not applicable.
    In accordance with the provisions of Executive Order 12866, this 
proposed rule was not reviewed by the Office of Management and Budget.

List of Subjects in 45 CFR Part 170

    Computer technology, Electronic health record, Electronic 
information system, Electronic transactions, Health, Health care, 
Health information technology, Health insurance, Health records, 
Hospitals, Incorporation by reference, Laboratories, Medicaid, 
Medicare, Privacy, Reporting and recordkeeping requirements, Public 
health, Security.

    For the reasons set forth in the preamble, 45 CFR subtitle A, 
subchapter D, part 170, is amended as follows:

PART 170--HEALTH INFORMATION TECHNOLOGY STANDARDS, IMPLEMENTATION 
SPECIFICATIONS, AND CERTIFICATION CRITERIA AND CERTIFICATION 
PROGRAMS FOR HEALTH INFORMATION TECHNOLOGY

    1. The authority citation for part 170 continues to read as 
follows:

    Authority:  42 U.S.C. 300jj-11; 42 U.S.C. 300jj-14; 5 U.S.C. 
552.

    2. In Sec.  170.503, revise paragraph (e)(2), redesignate and 
republish paragraphs (e)(3) and (e)(4) as paragraphs (e)(4) and (e)(5), 
and add new paragraph (e)(3) to read as follows:


Sec.  170.503  Requests for ONC-AA status and ONC-AA ongoing 
responsibilities.

* * * * *
    (e) * * *
    (2) Verify that the certification bodies it accredits and ONC-ACBs 
conform to, at a minimum, ISO/IEC Guide 65:1996 (incorporated by 
reference in Sec.  170.599);
    (3) Ensure the surveillance approaches used by ONC-ACBs include the 
use of consistent, objective, valid, and reliable methods;
    (4) Verify that ONC-ACBs are performing surveillance in accordance 
with their respective annual plans; and
    (5) Review ONC-ACB surveillance results to determine if the results 
indicate any substantive non-conformance by ONC-ACBs with the 
conditions of their respective accreditations.
* * * * *
    3. In Sec.  170.523, republish the introductory text and revise 
paragraph (a) to read as follows:


Sec.  170.523  Principles of proper conduct for ONC-ACBs.

    An ONC-ACB shall:
    (a) Maintain its accreditation, or if a new ONC-AA is approved by 
the National Coordinator, obtain accreditation from the new ONC-AA 
within 12 months or a reasonable period specified by the National 
Coordinator and maintain such accreditation;
* * * * *
    4. Add Sec.  170.575 to read as follows:


Sec.  170.575  Removal of the ONC-AA.

    (a) Conduct violations. The National Coordinator may remove the 
ONC-AA for committing a conduct violation. Conduct violations include 
violations of law or permanent certification program policies that 
threaten or significantly undermine the integrity of the permanent 
certification program. These violations include, but are not limited 
to: false, fraudulent, or abusive activities that affect the permanent 
certification program, a program administered by HHS or any program 
administered by the Federal government.
    (b) Performance violations. The National Coordinator may remove the 
ONC-AA for failing to timely or adequately correct a performance 
violation. Performance violations constitute a failure to adequately 
perform the ONC-AA's responsibilities as specified in Sec.  170.503(e).
    (1) Noncompliance notification. If the National Coordinator obtains 
reliable evidence that the ONC-AA may no longer be adequately 
performing its responsibilities specified in Sec.  170.503(e), the 
National Coordinator will issue a noncompliance notification with 
reasons for the notification to the ONC-AA requesting that the ONC-AA 
respond to the alleged violation and correct the violation, if 
applicable.
    (2) Opportunity to become compliant. The ONC-AA is permitted up to 
30 days from receipt of a noncompliance notification to submit a 
written response and accompanying documentation that demonstrates that 
no violation occurred or that the alleged violation has been corrected.
    (i) If the ONC-AA submits a response, the National Coordinator is 
permitted up to 60 days from the time the

[[Page 31279]]

response is received to evaluate the response and reach a decision. The 
National Coordinator may, if necessary, request additional information 
from the ONC-AA during this time period.
    (ii) If the National Coordinator determines that no violation 
occurred or that the violation has been sufficiently corrected, the 
National Coordinator will issue a memo to the ONC-AA confirming this 
determination. Otherwise, the National Coordinator may propose to 
remove the ONC-AA in accordance with paragraph (c) of this section.
    (c) Proposed removal. (1) The National Coordinator may propose to 
remove the ONC-AA if the National Coordinator has reliable evidence 
that the ONC-AA has committed a conduct violation; or
    (2) The National Coordinator may propose to remove the ONC-AA if, 
after the ONC-AA has been notified of an alleged performance violation, 
the ONC-AA fails to:
    (i) Rebut the alleged violation with sufficient evidence showing 
that the violation did not occur or that the violation has been 
corrected; or
    (ii) Submit to the National Coordinator a written response to the 
noncompliance notification within the specified timeframe under 
paragraph (b)(2) of this section.
    (d) Opportunity to respond to a proposed removal notice. (1) The 
ONC-AA may respond to a proposed removal notice, but must do so within 
20 days of receiving the proposed removal notice and include 
appropriate documentation explaining in writing why it should not be 
removed as the ONC-AA.
    (2) Upon receipt of the ONC-AA's response to a proposed removal 
notice, the National Coordinator is permitted up to 60 days to review 
the information submitted by the ONC-AA and reach a decision.
    (e) Retention of ONC-AA status. If the National Coordinator 
determines that the ONC-AA should not be removed, the National 
Coordinator will notify the ONC-AA in writing of this determination.
    (f) Removal. (1) The National Coordinator may remove the ONC-AA if:
    (i) A determination is made that removal is appropriate after 
considering the information provided by the ONC-AA in response to the 
proposed removal notice; or
    (ii) The ONC-AA does not respond to a proposed removal notice 
within the specified timeframe in paragraph (d)(1) of this section.
    (2) A decision to remove the ONC-AA is final and not subject to 
further review unless the National Coordinator chooses to reconsider 
the removal.
    (g) Extent and duration of removal. (1) The removal of the ONC-AA 
is effective upon the date specified in the removal notice provided to 
the ONC-AA.
    (2) An accreditation organization that is removed as the ONC-AA 
must cease all activities under the permanent certification program, 
including accepting new requests for accreditation under the permanent 
certification program.
    (3) An accreditation organization that is removed as the ONC-AA is 
prohibited from being considered for ONC-AA status for a period of 1 
year from the effective date of its removal as the ONC-AA.

    Dated: May 24, 2011.
Kathleen Sebelius,
Secretary.
[FR Doc. 2011-13372 Filed 5-27-11; 8:45 am]
BILLING CODE 4150-45-P