Permanent Certification Program for Health Information Technology; Revisions to ONC-Approved Accreditor Processes, 72636-72643 [2011-30177]

Agencies

• DEPARTMENT OF HEALTH AND HUMAN SERVICES
• Office of the Secretary

[Federal Register Volume 76, Number 227 (Friday, November 25, 2011)]
[Rules and Regulations]
[Pages 72636-72643]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: 2011-30177]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Office of the Secretary

45 CFR Part 170

RIN 0991-AB77


Permanent Certification Program for Health Information 
Technology; Revisions to ONC-Approved Accreditor Processes

AGENCY: Office of the National Coordinator for Health Information 
Technology (ONC), Department of Health and Human Services.

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: Under the authority granted to the National Coordinator for 
Health Information Technology by section 3001(c)(5) of the Public 
Health Service Act (PHSA) as added by the Health Information Technology 
for Economic and Clinical Health (HITECH) Act, this final rule 
establishes a process for addressing instances where the ONC-Approved 
Accreditor (ONC-AA) engages in improper conduct or does not perform its 
responsibilities under the permanent certification program. This rule 
also addresses the status of ONC-Authorized Certification Bodies (ONC-
ACBs) in instances where there may be a change in the accreditation 
organization serving as the ONC-AA and clarifies the responsibilities 
of the new ONC-AA.

DATES: These regulations are effective December 27, 2011.

FOR FURTHER INFORMATION CONTACT: Steven Posnack, Director, Federal 
Policy Division, Office of Policy and Planning, Office of the National 
Coordinator for Health Information Technology, (202) 690-7151.

SUPPLEMENTARY INFORMATION:

Acronyms

CMS Centers for Medicare & Medicaid Services.
EHR Electronic Health Record.
HHS Department of Health and Human Services.
HIT Health Information Technology.
HITECH Health Information Technology for Economic and Clinical 
Health.
ONC Office of the National Coordinator for Health Information 
Technology.
ONC-AA ONC-Approved Accreditor.
ONC-ACB ONC-Authorized Certification Body.
ONC-ATCB ONC-Authorized Testing and Certification Body.
PHSA Public Health Service Act.
RFA Regulatory Flexibility Act.
SBA Small Business Administration.

Table of Contents

I. Background
    A. Statutory Basis for the Permanent Certification Program
    B. Regulatory Background of the Permanent Certification Program
    1. Initial Set of Standards, Implementation Specifications, and 
Certification Criteria for EHR Technology; Interim Final and Final 
Rules
    2. Medicare and Medicaid EHR Incentive Programs Proposed and 
Final Rules
    3. HIT Certification Programs Proposed Rule and the Temporary 
and Permanent Certification Programs Final Rules
    4. ONC-AA Processes Proposed Rule
    C. Overview of the Permanent Certification Program
II. Summary of the Proposed Rule and Provisions of the Final Rule
    A. Removal of the ONC-AA for Improper Conduct or Failure to 
Perform Its Responsibilities
    1. Conduct Violations
    2. Performance Violations
    3. Proposed Removal of the ONC-AA
    4. Opportunity To Respond to a Proposed Removal Notice
    5. Removal of the ONC-AA
    6. Extent and Duration of Removal Under the Permanent 
Certification Program
    B. Effects of Removing and/or Replacing the ONC-AA
    1. ONC-ACB Status
    2. New ONC-AA
III. Collection of Information Requirements
IV. Regulatory Impact Statement
Regulation Text

I. Background

A. Statutory Basis for the Permanent Certification Program

    The Health Information Technology for Economic and Clinical Health 
(HITECH) Act, Title XIII of Division A and Title IV of Division B of 
the American Recovery and Reinvestment Act of 2009 (ARRA) (Pub. L. 111-
5), amended the Public Health Service Act (PHSA) to add a new ``Title 
XXX--Health Information Technology and Quality.'' Section 3001(c)(5) of 
the PHSA, as added by section 13101 of the HITECH Act, provides the 
National Coordinator for Health Information Technology (National 
Coordinator) with the authority to establish a certification program or 
programs for the voluntary certification of health information 
technology (HIT). Specifically, section 3001(c)(5)(A) states that the 
``National Coordinator, in consultation with the Director of the 
National Institute of Standards and Technology, shall keep or recognize 
a program or programs for the voluntary certification of health 
information technology as being in compliance with applicable 
certification criteria adopted under [section 3004 of the PHSA].''

B. Regulatory Background of the Permanent Certification Program

1. Initial Set of Standards, Implementation Specifications, and 
Certification Criteria for EHR Technology; Interim Final and Final 
Rules
    In accordance with section 3004(b)(1) of the PHSA, the Secretary of 
Health and Human Services (the Secretary) issued an interim final rule 
with a request for comment entitled ``Health Information Technology: 
Initial Set of Standards, Implementation Specifications, and 
Certification Criteria for Electronic Health Record Technology'' (75 FR 
2014, Jan. 13, 2010) (the ``HIT Standards and Certification Criteria 
interim final rule''), which adopted an initial set of standards, 
implementation specifications, and certification criteria. After 
consideration of the public comments received on the interim final 
rule, a final rule entitled ``Health Information Technology: Initial 
Set of Standards, Implementation Specifications, and Certification 
Criteria for Electronic Health Record Technology'' (75 FR 44590) (the 
``HIT Standards and Certification Criteria final rule'') was issued on 
July 28, 2010 to complete the adoption of the initial set of standards, 
implementation specifications, and certification criteria and realign 
them with the final objectives and measures established for meaningful 
use Stage 1. On October 13, 2010, an interim final rule (75 FR 62686) 
was issued to remove certain implementation specifications related to 
public health surveillance that had been previously adopted in the HIT 
Standards and Certification Criteria final rule.
    The standards, implementation specifications, and certification 
criteria adopted by the Secretary establish the capabilities that 
Certified Electronic Health Record (EHR) Technology must include in 
order to, at a minimum, support the achievement of meaningful use Stage 
1 by eligible professionals and eligible hospitals \1\ under the 
Medicare and Medicaid EHR Incentive Programs.
---------------------------------------------------------------------------

    \1\ References to ``eligible hospitals'' in this rule shall mean 
``eligible hospitals and/or critical access hospitals, as defined in 
42 CFR 495.4'' unless otherwise indicated.

---------------------------------------------------------------------------

[[Page 72637]]

2. Medicare and Medicaid EHR Incentive Programs Proposed and Final 
Rules
    Associated with the HIT Standards and Certification Criteria 
interim final rule, the Centers for Medicare & Medicaid Services (CMS) 
concurrently published in the Federal Register (75 FR 1844, Jan. 13, 
2010) the Medicare and Medicaid Electronic Health Record Incentive 
Programs proposed rule. The rule proposed a definition for Stage 1 
meaningful use of Certified EHR Technology and regulations associated 
with the incentive payments made available under Division B, Title IV 
of the HITECH Act. Subsequently, CMS published a final rule for the 
Medicare and Medicaid EHR Incentive Programs in the Federal Register 
(75 FR 44314) on July 28, 2010, simultaneously with the publication of 
the HIT Standards and Certification Criteria final rule. The final 
rule, published by CMS, established the objectives and associated 
measures that eligible professionals and eligible hospitals must 
satisfy in order to demonstrate ``meaningful use'' during Stage 1.
3. HIT Certification Programs Proposed Rule and the Temporary and 
Permanent Certification Programs Final Rules
    Based on the authority provided in section 3001(c)(5) of the PHSA, 
we proposed both a temporary and permanent certification program for 
HIT in a notice of proposed rulemaking entitled ``Proposed 
Establishment of Certification Programs for Health Information 
Technology'' (75 FR 11328, Mar. 10, 2010). We proposed to use the 
certification programs for the purposes of testing and certifying HIT 
and specified the processes the National Coordinator would follow to 
authorize organizations to perform the testing and/or certification of 
HIT. Notably, we issued two final rules to implement our proposals. On 
June 24, 2010, a final rule was published in the Federal Register (75 
FR 36158) to establish a temporary certification program (the 
``Temporary Certification Program final rule''). On January 7, 2011, a 
final rule was published in the Federal Register (76 FR 1262) to 
establish the permanent certification program (the ``Permanent 
Certification Program final rule''). The permanent certification 
program will eventually replace the temporary certification program, 
which included a sunset provision (45 CFR 170.490) that specified it 
would sunset on December 31, 2011 or on a subsequent date if the 
permanent certification program is not fully constituted at that time.
    EHR technology that is tested and certified under the certification 
programs currently must be tested and certified in accordance with all 
applicable certification criteria adopted by the Secretary under 
section 3004(b)(1) of the PHSA and could potentially be used to satisfy 
the definition of Certified EHR Technology. Eligible professionals and 
eligible hospitals that successfully demonstrate meaningful use of 
Certified EHR Technology may receive incentive payments under the 
Medicare and Medicaid EHR Incentive Programs.
4. ONC-AA Processes Proposed Rule
    On May 31, 2011, a proposed rule entitled ``Permanent Certification 
Program for Health Information Technology; Revisions to ONC-Approved 
Accreditor Processes'' was published in the Federal Register (76 FR 
31272) (the ``Proposed Rule''). As described further in the section of 
this final rule entitled ``Summary of the Proposed Rule and Provisions 
of the Final Rule,'' we proposed a removal process for addressing 
instances where the ONC-AA engages in improper conduct or does not 
perform its responsibilities under the permanent certification program. 
We also made proposals and clarifications concerning instances where 
the accreditation organization serving as the ONC-AA changes, the 
effect that such a change would have on the status of ONC-ACBs, and the 
responsibilities of the new ONC-AA.

C. Overview of the Permanent Certification Program

    Key facets of the permanent certification program are summarized as 
follows. The permanent certification program provides a process by 
which an organization or organizations may become authorized by the 
National Coordinator to perform the certification of Complete EHRs and/
or EHR Modules as an ONC-Authorized Certification Body (ONC-ACB). ONC-
ACBs may also be authorized under the permanent certification program 
to perform the certification of other types of HIT in the event that 
the Secretary adopts applicable certification criteria. We note, 
however, that the certification of Complete EHRs, EHR Modules, or 
potentially other types of HIT under the permanent certification 
program would not constitute a replacement or substitution for other 
Federal requirements that may be applicable.
    An organization that seeks to become an ONC-ACB must, among other 
requirements, successfully obtain accreditation from the accreditation 
organization that has been approved by the National Coordinator as the 
ONC-Approved Accreditor (ONC-AA). Only one accreditation organization 
at a time may be approved to serve as the ONC-AA. An accreditation 
organization that wishes to be considered for ONC-AA status must submit 
a written request to the National Coordinator during the specified 
submission period and include certain information to demonstrate its 
ability to serve as the ONC-AA. The National Coordinator will determine 
which accreditation organization is best qualified to serve as the ONC-
AA, and the organization that is approved on a final basis will be 
expected to serve a three-year term. The ONC-AA must fulfill certain 
on-going responsibilities for the permanent certification program, 
which include: Maintaining conformance with ISO/IEC 17011:2004 (ISO 
17011); in accrediting certification bodies, verifying that they 
conform to ISO/IEC Guide 65:1996 (Guide 65) at a minimum; and 
performing certain activities related to surveillance that will be 
conducted by ONC-ACBs.
    On February 8, 2011, ONC published a notice in the Federal Register 
(76 FR 6794) announcing a 30-day period for the submission of requests 
for ONC-AA status. After the close of the submission period, the 
National Coordinator reviewed all timely submissions that were received 
and determined which accreditation organization was best qualified to 
serve as the ONC-AA based on the information provided, the completeness 
of each accreditation organization's description of the elements listed 
in Sec.  170.503(b), and each accreditation organization's overall 
accreditation experience. On June 9, 2011, ONC announced through our 
listserv and Web site that the American National Standards Institute 
(ANSI) had been approved by the National Coordinator as the ONC-AA for 
the permanent certification program.
    The National Coordinator will accept applications for ONC-ACB 
status at any time, which must include the type of authorization 
sought, general identifying information, documentation that confirms 
that the applicant has been accredited by the ONC-AA, and an executed 
agreement that it will adhere to the Principles of Proper Conduct for 
ONC-ACBs in 45 CFR 170.523. ONC-ACBs will be required to remain in good 
standing by, among other things, adhering to the Principles of Proper 
Conduct for ONC-ACBs, which include a requirement that an ONC-ACB must 
maintain its accreditation that was

[[Page 72638]]

granted by the ONC-AA. An ONC-ACB's status will expire in three years, 
unless its status is renewed. The National Coordinator may revoke an 
ONC-ACB's status and/or suspend an ONC-ACB's operations under the 
permanent certification program, based on Type-1 and Type-2 violations.

II. Summary of the Proposed Rule and Provisions of the Final Rule

    The public comment period for the Proposed Rule ended on August 1, 
2011. We received no comments on the Proposed Rule during that period. 
In this section, we summarize the proposals that we made in the 
Proposed Rule and discuss the provisions that we are finalizing in this 
final rule.

A. Removal of the ONC-AA for Improper Conduct or Failure to Perform Its 
Responsibilities

    In the proposed rule to establish the temporary and permanent 
certification programs (75 FR 11328), we did not propose a formal 
process for the National Coordinator to remove or take other corrective 
action against an accreditation organization serving as the ONC-AA 
based on misconduct or failure to perform its responsibilities. We did 
propose and finalize a process through which the National Coordinator 
could revoke the status and/or suspend the operations of an ONC-
Authorized Testing and Certification Body (ONC-ATCB) under the 
temporary certification program and an ONC-ACB under the permanent 
certification program. Some of the comments we received asked how we 
would address concerns with an ONC-AA's operations and remove or 
replace an ineffective ONC-AA. We responded to those comments in the 
Permanent Certification Program final rule (76 FR 1269) by stating our 
intentions to issue a notice of proposed rulemaking that would address 
improper conduct by an ONC-AA, the potential consequences for engaging 
in such conduct, and a process by which the National Coordinator may 
take ``corrective action'' against an ONC-AA. We followed through with 
our intentions by issuing the Proposed Rule.
    In the Proposed Rule, we proposed a process for removing the ONC-AA 
for improper conduct or failure to perform its responsibilities under 
the permanent certification program. The process we proposed is similar 
to the process established in the Permanent Certification Program final 
rule for suspending and/or revoking an ONC-ACB's status. We recognize 
that an ONC-AA has significant responsibilities under the permanent 
certification program that are inextricably linked to the success of 
the program. Furthermore, a removal process would protect the integrity 
of the permanent certification program and maintain public confidence 
in the program by removing an ONC-AA that engages in misconduct or 
fails to satisfy its performance obligations under the program. We are 
finalizing our proposal to establish a process for removing the ONC-AA 
for conduct and performance violations, as explained below.
1. Conduct Violations
    We proposed that the National Coordinator could remove an ONC-AA 
for committing a conduct violation. We proposed that conduct violations 
would include violations of law or permanent certification program 
policies that threaten or significantly undermine the integrity of the 
permanent certification program, such as false, fraudulent, or abusive 
activities that affect the permanent certification program, a program 
administered by the Department of Health and Human Services (HHS), or 
any program administered by the Federal government.
    We gave the following examples of conduct violations in the 
Proposed Rule: the ONC-AA (or a principal employee, owner, or agent of 
the ONC-AA) being charged with or convicted of fraud, embezzlement or 
extortion, or of violating similar Federal or State securities laws 
while participating in the permanent certification program; falsifying 
accreditations; or withholding, destroying, or altering information 
that would indicate false or fraudulent activity had occurred within 
the permanent certification program.
    We proposed these types of violations as conduct violations 
because, as the definition of conduct violations specifies, they 
threaten or significantly undermine the integrity of the permanent 
certification program, which can negatively impact the overall success 
of the program. These violations are also consistent with the ``Type-1 
violations'' we previously established for ONC-ACBs under the permanent 
certification program. Because our approach establishes consistency 
within the permanent certification program in terms of comparable 
conduct requirements for the ONC-AA and ONC-ACBs, we believe that it 
will ensure that all of the entities approved and authorized by ONC are 
held accountable for their conduct. Accordingly, we are finalizing the 
conduct violations as proposed at Sec.  170.575(a).
2. Performance Violations
    We proposed that the National Coordinator could remove an ONC-AA 
for failing to timely or adequately correct a performance violation. We 
proposed that performance violations would include the ONC-AA's failure 
to properly fulfill one or more of its responsibilities in Sec.  
170.503(e). These responsibilities include the following: maintaining 
conformance with ISO 17011; in accrediting certification bodies, 
verifying conformance to, at a minimum, Guide 65 and ensuring the 
surveillance approaches used by ONC-ACBs include the use of consistent, 
objective, valid, and reliable methods; verifying that ONC-ACBs are 
performing surveillance in accordance with their respective annual 
plans; and reviewing ONC-ACB surveillance results to determine if the 
results indicate any substantive non-conformance by the ONC-ACBs with 
the conditions of their respective accreditations.
    We noted in the Proposed Rule that opportunities to assess an ONC-
AA's performance of its responsibilities will be available at certain 
junctures during the permanent certification program. For example, our 
review of an ONC-ACB's surveillance results should give an indication 
of whether the ONC-AA is performing its responsibilities to review ONC-
ACB surveillance results and verify that ONC-ACBs are performing 
surveillance in accordance with their surveillance plans. Further, we 
expect that our review and analysis of surveillance plans and results 
will not only include feedback from the ONC-ACBs but also feedback from 
the ONC-AA. The ONC-AA feedback will provide us with additional 
information on the ONC-AA's performance of its responsibilities to 
monitor and review ONC-ACBs' surveillance activities.
    We also indicated in the Proposed Rule that the National 
Coordinator could obtain information about the ONC-AA from other 
sources as well. For example, the National Coordinator could 
potentially receive information from an organization that sought 
accreditation by the ONC-AA and was denied, or from an ONC-ACB that had 
its accreditation withdrawn by the ONC-AA. Such information could 
provide reliable evidence that the ONC-AA was not in compliance with 
ISO 17011, as required by Sec.  170.503(e)(1). To illustrate, section 7 
(Accreditation process) of ISO 17011 requires the ONC-AA to establish a 
proper assessment process for accrediting conformance assessment bodies 
(i.e., certification bodies or ONC-ACBs),

[[Page 72639]]

which includes establishing procedures to address appeals by such 
bodies. Information from a certification body that sought accreditation 
or an ONC-ACB could indicate whether the ONC-AA had a sufficient 
assessment or appeals processes in place.
    We proposed that if the National Coordinator obtains reliable 
evidence from fact-gathering, requesting information from the ONC-AA, 
contacting the ONC-AA's customer(s), and/or complaints that the ONC-AA 
is not properly performing its responsibilities under Sec.  170.503(e), 
the National Coordinator would notify the ONC-AA of an alleged 
performance violation. We proposed that the notification would include 
all pertinent information regarding the National Coordinator's 
assessment. We proposed that, unless otherwise specified by the 
National Coordinator, the ONC-AA would be permitted up to 30 days from 
the date it is notified about the alleged performance violation(s) to 
submit a written response and any accompanying documentation that could 
demonstrate no violation(s) occurred or validate that violation(s) 
occurred and were corrected. We proposed that if the ONC-AA fails to 
submit a response to the National Coordinator within 30 days, the 
National Coordinator may issue the ONC-AA a notice proposing to remove 
it as the ONC-AA under the permanent certification program.
    We further proposed that if the ONC-AA submits a response, the 
National Coordinator would be permitted up to 60 days to evaluate the 
ONC-AA's response (and request additional information, if necessary). 
If the National Coordinator determines that the ONC-AA did not commit a 
performance violation, or may have committed a performance violation 
but satisfactorily corrected any violation(s) that may have occurred, 
we proposed that a memo would be issued to the ONC-AA to confirm this 
determination. If the National Coordinator determines that the ONC-AA's 
response is insufficient and that a performance violation had occurred 
and had not been adequately corrected, then the National Coordinator 
may propose to remove the ONC-AA.
    As previously mentioned, the ONC-AA has significant 
responsibilities under the permanent certification program. The failure 
of the ONC-AA to perform any of its responsibilities could not only 
affect the success of the permanent certification program but, if left 
unchecked, could cause the public to lose faith in the ONC-ACBs 
accredited by the ONC-AA and ultimately the certifications issued by 
those ONC-ACBs. For example, if the ONC-AA does not fulfill its 
responsibilities to verify that ONC-ACBs are performing surveillance in 
accordance with their respective annual plans or does not review ONC-
ACBs' surveillance results to determine if the results indicate any 
substantive non-conformance by ONC-ACBs with the conditions of their 
respective accreditations, then the public may not have faith in the 
validity of the surveillance results, including the reliability of the 
certifications issued to EHR technology by ONC-ACBs.
    Although the ONC-AA's failure to perform its responsibilities 
could, if left unchecked, have negative consequences as illustrated 
above, the ONC-AA should be given the opportunity to either correct its 
performance shortcomings or demonstrate that it did not fail to perform 
its responsibilities within a reasonable period of time that does not 
jeopardize the success of the permanent certification program. The 
opportunity to respond to a noncompliance notification provides such an 
opportunity and does so within a timeframe that permits the National 
Coordinator to reach a timely and reasoned determination on whether to 
propose the removal of the ONC-AA. If the National Coordinator 
determines that the ONC-AA is not properly performing its 
responsibilities under Sec.  170.503(e), then we continue to believe 
that proposing the removal of the ONC-AA is the best course of action 
to take to protect the integrity of the permanent certification program 
and maintain public trust in the program. We are finalizing the 
proposed performance violations at Sec.  170.575(b) and the processes 
related to noncompliance notification as proposed at Sec.  
170.575(b)(1) and (2).
3. Proposed Removal of the ONC-AA
    We proposed that if the National Coordinator has reliable evidence 
that the ONC-AA committed one or more conduct violations, or if the 
ONC-AA fails to successfully rebut or submit a response to a 
noncompliance notification of an alleged-performance violation, then 
the National Coordinator may issue the ONC-AA a notice proposing to 
remove it as the ONC-AA under the permanent certification program. In 
the Proposed Rule, we noted our opinion that proposing to remove the 
ONC-AA would be more appropriate than suspending the ONC-AA's 
activities under the permanent certification program. Any form of 
suspension would prevent the ONC-AA from performing its 
responsibilities under Sec.  170.503(e), which would not benefit the 
permanent certification program because these ongoing responsibilities 
are an integral part of the program. Having received no comments to the 
contrary, we continue to believe that proposing removal under the 
circumstances described in the Proposed Rule and this final rule would 
be preferable to suspension. We are finalizing the proposed removal 
process in Sec.  170.575(c) as proposed.
4. Opportunity To Respond to a Proposed Removal Notice
    We proposed that if the National Coordinator issues a proposed 
removal notice to the ONC-AA, the ONC-AA must respond within 20 days of 
receipt of the removal notice in order to contest the proposed removal 
and must provide sufficient documentation to support its explanation 
for why it should not be removed. Upon receipt of the ONC-AA's response 
to a proposed removal notice, we proposed that the National Coordinator 
would be permitted up to 60 days to review the information submitted by 
the ONC-AA and make a determination. We conveyed our expectations that 
during the time period provided for the ONC-AA to respond to the 
proposed removal notice and the National Coordinator's review period, 
the ONC-AA would continue to perform its responsibilities under the 
permanent certification program. We proposed that the National 
Coordinator would consider the ONC-AA's performance of its duties 
during this timeframe as a factor in reaching any final decision to 
remove the ONC-AA.
    We believe that our proposed process and timeframes provide an 
appropriate opportunity for the ONC-AA to respond to a proposed removal 
notice. In a situation where removal is proposed, an ONC-AA will have 
been issued a proposed removal notice that sets forth the conduct 
violations committed by the ONC-AA or specifies that the ONC-AA failed 
to respond to a non-compliance notification or correct performance 
violations. At such a juncture, the ONC-AA would already be 
jeopardizing the integrity of the permanent certification program if it 
had committed conduct violations and would be doing the same if it had 
failed to timely reply to a non-compliance notification or address 
performance violations after receiving a non-compliance notification. 
Therefore, 20 days provides the ONC-AA sufficient opportunity to 
respond to the proposed removal notice, while also bringing about a 
timely resolution in the interest of the permanent certification 
program. The National Coordinator will have up to 60 days to issue a 
final decision. This timeframe gives the

[[Page 72640]]

National Coordinator the ability to issue a timely decision where the 
information is clear that the ONC-AA committed a conduct violation and 
the permanent certification program's integrity is increasingly at risk 
the longer the accreditation organization serving as the ONC-AA is 
allowed to remain in its position. The timeframe also provides the 
National Coordinator sufficient time to address complications or 
complexities related to reaching a final decision on whether to remove 
the ONC-AA. Therefore, we are finalizing this process and the 
associated timeframes in Sec.  170.575(d) as proposed.
5. Removal of the ONC-AA
    We proposed that the ONC-AA may be removed by the National 
Coordinator if it is determined that removal is appropriate after 
considering the information provided by the ONC-AA in response to the 
proposed removal notice or if the ONC-AA does not respond to a proposed 
removal notice within the specified timeframe. We proposed that a 
decision to remove the ONC-AA would be final and would not be subject 
to further review unless the National Coordinator chooses to reconsider 
the removal.
    We further proposed that if the National Coordinator determines 
that the ONC-AA should not be removed, the National Coordinator would 
notify the ONC-AA in writing to express this determination.
    We received no comments on this proposal and thus continue to 
believe that removing the ONC-AA from the permanent certification 
program would be an appropriate course of action in response to the 
conduct and performance violations that we are establishing in this 
final rule. Accordingly, we are finalizing the standard for removing 
the ONC-AA as proposed at Sec.  170.575(f). We are also finalizing 
Sec.  170.575(e) as proposed such that the ONC-AA will be notified if 
the National Coordinator determines that the ONC-AA should not be 
removed.
6. Extent and Duration of Removal Under the Permanent Certification 
Program
    We proposed that the removal of the ONC-AA would become effective 
upon the date specified in the removal notice and that the affected 
accreditation organization would be required to cease all activities 
under the permanent certification program, including accepting new 
requests for accreditation associated with the permanent certification 
program. We further proposed that an accreditation organization that 
has been removed as the ONC-AA will be prohibited from being considered 
for ONC-AA status for a period of 1 year from the effective date of 
removal.
    Violation(s) committed by the accreditation organization serving as 
the ONC-AA which result in its removal demonstrate that it cannot 
conduct itself properly or perform its responsibilities under the 
permanent certification program. Accordingly, we believe it would be 
inappropriate to permit an accreditation organization that has been 
removed from the permanent certification program as the ONC-AA to 
reapply immediately to become the new ONC-AA. We, therefore, proposed a 
1-year waiting period to prevent the accreditation organization that 
has been removed from being considered when ONC goes through the 
process in Sec.  170.503 to approve its replacement. Having received no 
comments to the contrary, we continue to believe that removal should be 
effective upon the date specified in the removal notice, that the 
removed ONC-AA should cease all activities under the permanent 
certification program, and that, for the reason noted, one year is a 
reasonable period of time for an accreditation organization to wait 
before it may reapply to become the ONC-AA. We are finalizing these 
provisions in Sec.  170.575(g) as proposed.

B. Effects of Removing and/or Replacing the ONC-AA

1. ONC-ACB Status
    In Sec.  170.523(a) we require that an ONC-ACB ``[m]aintain its 
accreditation.'' As we indicated in the Proposed Rule, it is possible 
that during the course of an ONC-ACB's three-year term, there could be 
a change in accreditation organizations serving as the ONC-AA. In other 
words, the accreditation organization serving as the ONC-AA that 
initially accredited an ONC-ACB could be replaced by a different 
accreditation organization that is subsequently approved to serve as 
the ONC-AA. A change in ONC-AAs could occur under different scenarios, 
such as if the accreditation organization serving as the ONC-AA resigns 
before the end of its term, is replaced at the end of its term through 
the selection process under Sec.  170.503, or is removed by the 
National Coordinator before the end of its term. We proposed that if 
there is a change in accreditation organizations serving as the ONC-AA, 
such as in the scenarios described above, an ONC-ACB would retain its 
status under the permanent certification program, but only for a 
reasonable period of time to allow it to obtain accreditation from the 
accreditation organization that is approved as the new ONC-AA. This 
would support our primary goal of ensuring stability among ONC-ACBs and 
within the HIT marketplace, which would include the uninterrupted 
certification of HIT.
    We proposed that an ONC-ACB must obtain accreditation from the new 
ONC-AA within 12 months after the effective date of the new ONC-AA's 
status or within a reasonable period specified by the National 
Coordinator. We use the term ``effective date'' because although an 
accreditation organization could be approved as the ONC-AA pursuant to 
the process in Sec.  170.503, its status as the ONC-AA may not become 
effective until a later date (e.g., its status may not take effect 
until the then-current ONC-AA's term expires). Based on our 
consultations with subject matter experts at the National Institute for 
Standards and Technology (NIST), we stated our belief in the Proposed 
Rule that a new ONC-AA could complete the accreditation process for up 
to 6 ONC-ACBs within 6 to 9 months. We noted that this could possibly 
be an appropriate timeframe and could be sufficient to meet the demand 
for accreditation considering that we estimated in the Permanent 
Certification Program final rule that only 6 ONC-ACBs will be operating 
under the permanent certification program and only 6 ONC-Authorized 
Testing and Certification Bodies (ONC-ATCBs) are currently operating 
under the temporary certification program. However, considering that 
there may be more ONC-ACBs than we anticipated and that accreditation 
to the requirements of a new ONC-AA may require more time than 
anticipated, we proposed that 12 months would be a more reasonable 
timeframe for ONC-ACBs to obtain accreditation from the new ONC-AA.
    We emphasized that our proposal permits the National Coordinator to 
specify a reasonable period of time for ONC-ACBs to obtain 
accreditation from the new ONC-AA as an alternative to the 12-month 
timeframe. We noted that it would be prudent for the National 
Coordinator to have the flexibility to grant an extension to an ONC-ACB 
if it had filed a request for accreditation with the new ONC-AA before 
the 12-month timeframe had elapsed and the new ONC-AA had not yet 
completed its accreditation of the ONC-ACB. Alternatively, there may be 
a need for the National Coordinator to require that ONC-ACBs obtain 
accreditation from the new ONC-AA in less than 12 months to protect the 
integrity of the permanent certification program. This situation could 
occur if the

[[Page 72641]]

accreditation organization removed as the ONC-AA engaged in conduct 
that called into question the legitimacy of the accreditations granted 
to ONC-ACBs.
    The 12-month period provides sufficient time for the orderly yet 
timely accreditation of the ONC-ACBs by the new ONC-AA. It also ensures 
that ONC-ACBs are treated fairly. Such as the case where an ONC-ACB, in 
good faith and without sufficient notice of a possible change in the 
ONC-AA, recently paid for and obtained accreditation from an ONC-AA 
that is subsequently removed or replaced. The discretion provided to 
the National Coordinator ensures the program's stability by permitting 
the 12-month period to be extended if needed to complete ONC-ACBs' 
accreditations. It also ensures the program's stability and integrity 
by providing the option to require ONC-ACBs to be accredited in less 
than 12 months if, for instance, the veracity of the ONC-ACBs' prior 
accreditations are called into question. As proposed, we are revising 
Sec.  170.523(a) to require an ONC-ACB to ``[m]aintain its 
accreditation, or if a new ONC-AA is approved by the National 
Coordinator, obtain accreditation from the new ONC-AA within 12 months 
or a reasonable period specified by the National Coordinator and 
maintain such accreditation.''
2. New ONC-AA
    As noted above, the National Coordinator may approve a new 
accreditation organization as the ONC-AA for reasons such as the former 
ONC-AA resigning, another accreditation organization being selected 
when the former ONC-AA's term expires, or the former ONC-AA being 
removed for conduct or performance violations. The selection and 
approval of a new ONC-AA would be conducted as soon as possible and 
consistent with the processes and timeframes in Sec.  170.503. Doing so 
would permit the new ONC-AA to begin fulfilling its responsibilities 
under Sec.  170.503(e) when its status as the ONC-AA becomes effective. 
In the Proposed Rule, we explained that a new ONC-AA would be expected 
to fulfill its responsibilities under Sec.  170.503(e) with respect to 
the ONC-ACBs that it accredited, as well as those ONC-ACBs that were 
accredited by the former ONC-AA and are not yet accredited by the new 
ONC-AA. The new ONC-AA would be responsible for verifying that all ONC-
ACBs are performing surveillance in accordance with their respective 
annual plans, as required by Sec.  170.503(e)(3). In addition, 
consistent with Sec.  170.503(e)(4), the new ONC-AA would review all 
ONC-ACB surveillance results to determine if the results indicate any 
substantive non-conformance by the ONC-ACBs with the conditions of 
their respective accreditations (even if an ONC-ACB was accredited by 
the former ONC-AA).
    Section 170.503(e)(2) requires the ONC-AA, ``[i]n accrediting 
certification bodies, [to] verify conformance to, at a minimum, [Guide 
65] and ensure the surveillance approaches used by ONC-ACBs include the 
use of consistent, objective, valid, and reliable methods.'' In the 
Permanent Certification Program final rule (76 FR 1270), we explained 
this ongoing responsibility would require the ONC-AA to verify that 
ONC-ACBs continue to conform to the provisions of Guide 65 at a minimum 
as a condition of continued accreditation. We explained in the Proposed 
Rule that, similar to 170.503(e)(3) and (e)(4), we would expect a new 
ONC-AA to fulfill the responsibilities in Sec.  170.503(e)(2) for the 
certification bodies it accredits and all ONC-ACBs, including those 
ONC-ACBs that it has not yet had an opportunity to accredit. To clarify 
this expectation, we proposed to revise Sec.  170.503(e)(2) to require 
the ONC-AA to ensure that all ONC-ACBs continue to conform to Guide 65 
at a minimum. We made similar clarifying revisions to Sec.  
170.503(e)(4) in the Permanent Certification Program final rule (76 FR 
1270), where we explained that we were revising Sec.  170.503(e)(4) to 
account for the possibility that different accreditation organizations 
may be approved to serve as the ONC-AA. We revised that section to 
clarify that the ONC-AA would be responsible for reviewing ONC-ACB 
surveillance results to determine if the results indicated any 
substantive non-conformance by ONC-ACBs with the conditions of ``their 
respective accreditations'' rather than ``with the terms set by the 
ONC-AA when it granted the ONC-ACB accreditation'' as we had proposed.
    Although our proposals would require a new ONC-AA to become 
familiar with ONC-ACBs that may not yet have been accredited by the new 
ONC-AA, we believe the responsibilities in Sec.  170.503(e) would still 
be achievable. A new ONC-AA would be required by Sec.  170.503(e)(3) to 
verify that the ONC-ACBs are performing surveillance in accordance with 
their respective annual plans, which ONC could make available to the 
new ONC-AA. As for a new ONC-AA's responsibilities under Sec.  
170.503(e)(4), we believe that the former ONC-AA's accreditation 
requirements would be publicly available, consistent with section 7.1.2 
of ISO 17011, or ONC could provide them to the new ONC-AA along with 
any surveillance results of the ONC-ACBs. We expect that a new ONC-AA 
would fulfill these responsibilities in the manner we have described 
until it has the opportunity to accredit the ONC-ACBs according to 
Guide 65 at a minimum and its own additional accreditation requirements 
if applicable. By fulfilling these duties, a new ONC-AA would 
contribute to the success of the permanent certification program by 
ensuring that activities under the permanent certification program 
continue uninterrupted.
    For the reasons discussed above, and because we did not receive any 
comments on our proposals, we are finalizing our proposed revisions to 
Sec.  170.503(e). Paragraphs (e)(3) and (e)(4) are redesignated as 
paragraphs (e)(4) and (e)(5), respectively. Paragraph (e)(2) is revised 
to state that the ONC-AA shall ``[v]erify that the certification bodies 
it accredits and ONC-ACBs conform to, at a minimum, ISO/IEC Guide 
65:1996 (incorporated by reference in Sec.  170.599).'' The second part 
of paragraph (e)(2) is now a separate new paragraph, which is numbered 
as (e)(3) and states that the ONC-AA shall ``ensure that the 
surveillance approaches used by ONC-ACBs include the use of consistent, 
objective, valid, and reliable methods.''

III. Collection of Information Requirements

    This final rule, specifically Sec.  170.575, would only require the 
collection of information from the ONC-AA if we took an action against 
the ONC-AA under the provisions of this final rule and the ONC-AA 
submitted information to ONC in response to the action as provided for 
under the provisions of this final rule. The Paperwork Reduction Act of 
1995, however, exempts the information collection activities referenced 
in this final rule. Specifically, 44 U.S.C. 3518(c)(1)(B)(ii) excludes 
collection activities during the conduct of administrative actions or 
investigations involving the agency against specific individuals or 
entities.

IV. Regulatory Impact Statement

    We have examined the impact of this final rule as required by 
Executive Order 12866 on Regulatory Planning and Review (September 30, 
1993), Executive Order 13563 on Improving Regulation and Regulatory 
Review (February 2, 2011), the Regulatory Flexibility Act (5 U.S.C. 601 
et seq.), section 202 of the Unfunded Mandates Reform Act of 1995 (2 
U.S.C. 1532), Executive Order 13132 on Federalism

[[Page 72642]]

(August 4, 1999), and the Congressional Review Act (5 U.S.C. 804(2)).
    Executive Orders 12866 and 13563 direct agencies to assess all 
costs and benefits of available regulatory alternatives and, if 
regulation is necessary, to select regulatory approaches that maximize 
net benefits (including potential economic, environmental, public 
health and safety effects, distributive impacts, and equity). A 
regulatory impact analysis must be prepared for major rules with 
economically significant effects ($100 million or more in any 1 year). 
This final rule does not reach the economic threshold and thus is not 
considered a major rule. Therefore, a regulatory impact analysis has 
not been prepared.
    The Regulatory Flexibility Act (RFA) requires agencies to prepare 
an initial regulatory flexibility analysis to describe the impact of 
the final rule on small entities, unless the head of the agency can 
certify that the rule will not have a significant economic impact on a 
substantial number of small entities. For purposes of the RFA, small 
entities include small businesses, small organizations, and small 
governmental jurisdictions. Individuals and States are not included in 
the definition of a small entity. The entities that will be directly 
affected by this final rule are likely small businesses in the form of 
accreditation organizations interested in becoming the ONC-AA, the ONC-
AA, potential applicants for ONC-ACB status, and ONC-ACBs. We believe 
that these entities would either be classified under the North American 
Industry Classification System (NAICS) codes 541380 (Testing 
Laboratories) or 541990 (Professional, Scientific and Technical 
Services).\2\ According to the NAICS codes identified above, this would 
mean Small Business Administration (SBA) size standards of $12 million 
and $7 million in annual receipts, respectively.\3\
---------------------------------------------------------------------------

    \2\ See 13 CFR 121.201
    \3\ The SBA references that annual receipts means ``total 
income'' (or in the case of a sole proprietorship, ``gross income'') 
plus ``cost of goods sold'' as these terms are defined and reported 
on Internal Revenue Service tax return forms. For more information 
on the SBA's size standards, see the SBA's Web site at: https://www.sba.gov/content/small-business-size-regulations.
---------------------------------------------------------------------------

    We do not believe that this final rule imposes requirements for the 
ONC-AA that would be unexpected by accreditation organizations 
interested in serving as the ONC-AA. An accreditation organization 
serving as the ONC-AA would expect to be required to properly fulfill 
its responsibilities and exhibit proper conduct or be subject to 
consequences. Moreover, as noted above, we indicated in prior 
rulemaking concerning the permanent certification program that we 
expected to issue a notice of proposed rulemaking and gave a general 
overview of the topics it would likely address. We believe the 
processes that we have established constitute the minimum amount of 
requirements necessary to accomplish our policy goals and that no 
appropriate regulatory alternatives could be developed to lessen the 
compliance burden for the ONC-AA. As for ONC-ACBs, this final rule 
mitigates any potential negative consequences of removing and replacing 
the ONC-AA, if required. Should the ONC-AA be replaced, this final rule 
permits ONC-ACBs to retain their status and provides ONC-ACBs up to 12 
months or a reasonable period specified by the National Coordinator to 
obtain accreditation from the new ONC-AA. Furthermore, the established 
process for addressing instances where the ONC-AA engages in improper 
conduct or fails to perform its responsibilities under the permanent 
certification program could create positive effects for program 
participants by increasing the accountability of the ONC-AA and 
protecting the integrity of the permanent certification program. We 
examined the implications of this final rule and have concluded, and 
the Secretary certifies, that this final rule will not have a 
significant economic impact on a substantial number of small entities.
    Section 202 of the Unfunded Mandates Reform Act of 1995 requires 
that agencies assess anticipated costs and benefits before issuing any 
rule whose mandates require spending in any 1 year of $100 million in 
1995 dollars, updated annually for inflation. In 2011, that threshold 
level is approximately $136 million. This final rule will not impose an 
unfunded mandate on State, local, and Tribal governments or on the 
private sector that will reach the threshold level.
    Executive Order 13132 establishes certain requirements that an 
agency must meet when it promulgates a rule that imposes substantial 
direct requirement costs on State and local governments, preempts State 
law, or otherwise has Federalism implications. Since this final rule 
does not impose any costs on State or local governments, the 
requirements of Executive Order 13132 are not applicable.
    In accordance with the provisions of Executive Order 12866, this 
final rule was not reviewed by the Office of Management and Budget.

List of Subjects in 45 CFR Part 170

    Computer technology, Electronic health record, Electronic 
information system, Electronic transactions, Health, Health care, 
Health information technology, Health insurance, Health records, 
Hospitals, Incorporation by reference, Laboratories, Medicaid, 
Medicare, Privacy, Reporting and recordkeeping requirements, Public 
health, Security.

    For the reasons set forth in the preamble, 45 CFR subtitle A, 
subchapter D, part 170, is amended as follows:

PART 170--HEALTH INFORMATION TECHNOLOGY STANDARDS, IMPLEMENTATION 
SPECIFICATIONS, AND CERTIFICATION CRITERIA AND CERTIFICATION 
PROGRAMS FOR HEALTH INFORMATION TECHNOLOGY

0
1. The authority citation for part 170 continues to read as follows:

    Authority: 42 U.S.C. 300jj-11; 42 U.S.C. 300jj-14; 5 U.S.C. 552.

0
2. In Sec.  170.503, redesignate and republish paragraphs (e)(3) and 
(e)(4) as paragraphs (e)(4) and (e)(5), revise paragraph (e)(2), and 
add new paragraph (e)(3) to read as follows:


Sec.  170.503  Requests for ONC-AA status and ONC-AA ongoing 
responsibilities.

* * * * *
    (e) * * *
    (2) Verify that the certification bodies it accredits and ONC-ACBs 
conform to, at a minimum, ISO/IEC Guide 65:1996 (incorporated by 
reference in Sec.  170.599);
    (3) Ensure the surveillance approaches used by ONC-ACBs include the 
use of consistent, objective, valid, and reliable methods;
    (4) Verify that ONC-ACBs are performing surveillance in accordance 
with their respective annual plans; and
    (5) Review ONC-ACB surveillance results to determine if the results 
indicate any substantive non-conformance by ONC-ACBs with the 
conditions of their respective accreditations.
* * * * *
0
3. In Sec.  170.523, republish the introductory text and revise 
paragraph (a) to read as follows:


Sec.  170.523  Principles of proper conduct for ONC-ACBs.

    An ONC-ACB shall:
    (a) Maintain its accreditation, or if a new ONC-AA is approved by 
the National Coordinator, obtain accreditation from the new ONC-AA 
within 12 months or a reasonable period

[[Page 72643]]

specified by the National Coordinator and maintain such accreditation;
* * * * *

0
4. Add Sec.  170.575 to read as follows:


Sec.  170.575  Removal of the ONC-AA.

    (a) Conduct violations. The National Coordinator may remove the 
ONC-AA for committing a conduct violation. Conduct violations include 
violations of law or permanent certification program policies that 
threaten or significantly undermine the integrity of the permanent 
certification program. These violations include, but are not limited 
to: false, fraudulent, or abusive activities that affect the permanent 
certification program, a program administered by HHS, or any program 
administered by the Federal government.
    (b) Performance violations. The National Coordinator may remove the 
ONC-AA for failing to timely or adequately correct a performance 
violation. Performance violations constitute a failure to adequately 
perform the ONC-AA's responsibilities as specified in Sec.  170.503(e).
    (1) Noncompliance notification. If the National Coordinator obtains 
reliable evidence that the ONC-AA may no longer be adequately 
performing its responsibilities specified in Sec.  170.503(e), the 
National Coordinator will issue a noncompliance notification with 
reasons for the notification to the ONC-AA requesting that the ONC-AA 
respond to the alleged violation and correct the violation, if 
applicable.
    (2) Opportunity to become compliant. The ONC-AA is permitted up to 
30 days from receipt of a noncompliance notification to submit a 
written response and accompanying documentation that demonstrates that 
no violation occurred or that the alleged violation has been corrected.
    (i) If the ONC-AA submits a response, the National Coordinator is 
permitted up to 60 days from the time the response is received to 
evaluate the response and reach a decision. The National Coordinator 
may, if necessary, request additional information from the ONC-AA 
during this time period.
    (ii) If the National Coordinator determines that no violation 
occurred or that the violation has been sufficiently corrected, the 
National Coordinator will issue a memo to the ONC-AA confirming this 
determination. Otherwise, the National Coordinator may propose to 
remove the ONC-AA in accordance with paragraph (c) of this section.
    (c) Proposed removal.
    (1) The National Coordinator may propose to remove the ONC-AA if 
the National Coordinator has reliable evidence that the ONC-AA has 
committed a conduct violation; or
    (2) The National Coordinator may propose to remove the ONC-AA if, 
after the ONC-AA has been notified of an alleged performance violation, 
the ONC-AA fails to:
    (i) Rebut the alleged violation with sufficient evidence showing 
that the violation did not occur or that the violation has been 
corrected; or
    (ii) Submit to the National Coordinator a written response to the 
noncompliance notification within the specified timeframe under 
paragraph (b)(2) of this section.
    (d) Opportunity to respond to a proposed removal notice.
    (1) The ONC-AA may respond to a proposed removal notice, but must 
do so within 20 days of receiving the proposed removal notice and 
include appropriate documentation explaining in writing why it should 
not be removed as the ONC-AA.
    (2) Upon receipt of the ONC-AA's response to a proposed removal 
notice, the National Coordinator is permitted up to 60 days to review 
the information submitted by the ONC-AA and reach a decision.
    (e) Retention of ONC-AA status. If the National Coordinator 
determines that the ONC-AA should not be removed, the National 
Coordinator will notify the ONC-AA in writing of this determination.
    (f) Removal.
    (1) The National Coordinator may remove the ONC-AA if:
    (i) A determination is made that removal is appropriate after 
considering the information provided by the ONC-AA in response to the 
proposed removal notice; or
    (ii) The ONC-AA does not respond to a proposed removal notice 
within the specified timeframe in paragraph (d)(1) of this section.
    (2) A decision to remove the ONC-AA is final and not subject to 
further review unless the National Coordinator chooses to reconsider 
the removal.
    (g) Extent and duration of removal.
    (1) The removal of the ONC-AA is effective upon the date specified 
in the removal notice provided to the ONC-AA.
    (2) An accreditation organization that is removed as the ONC-AA 
must cease all activities under the permanent certification program, 
including accepting new requests for accreditation under the permanent 
certification program.
    (3) An accreditation organization that is removed as the ONC-AA is 
prohibited from being considered for ONC-AA status for a period of 1 
year from the effective date of its removal as the ONC-AA.

    Dated: November 15, 2011.
Kathleen Sebelius,
Secretary.
[FR Doc. 2011-30177 Filed 11-23-11; 8:45 am]
BILLING CODE 4150-45-P