HIPAA, HITECH & HIT :: Fox Rothschild LLP

Confused about EHR certification? You’re not alone. In a post to the federal HealthIT Buzz blog entitled Perpetually Perplexed by Regulatory Interpretations? Separate the Fact from Fiction,  Steven Posnack , the Director of the Federal Policy Division of  the Office of the National Coordinator for Health Information Technology (ONC) has debunked five common misunderstandings related to EHR certification:

• If an eligible professional or eligible hospital combines multiple certified electronic health record (EHR) Modules together (or a certified EHR Module[s] with a certified Complete EHR), that combination also needs to be separately certified in order for it to meet the definition of Certified EHR Technology – *FICTION*
• The ONC-Authorized Testing and Certification Bodies (ONC-ATCBs) operate under contract with and receive funding from ONC – *FICTION*
• The ONC-ATCBs favor big EHR technology developers – *FICTION*
• As an EP or EH, you need to demonstrate meaningful use in the exact way that EHR technology was tested and certified – *FICTION* (mostly)  See the jointly posted ONC and CMS FAQs (#24 or 10473) 
• Certifications “expire” every two years – *FICTION*

Posnack’s article confirmed two additional frequently-heard statements as factual:

• Testing and certification under the Temporary Certification Program does not examine whether two randomly combined EHR Modules will be compatible or work together – *FACT*  
• Certification doesn’t require that an EHR technology designed by one EHR developer make its data accessible or “portable” to another EHR technology designed by a different developer – *FACT*

• Print
• Comments
• Trackbacks
• Share Link

 The American Hospital Association (AHA) weighed in with a 16-page comment letter requesting changes and delays in the standards for certification and implementation of electronic health records published by the Office of the National Coordinator for Health Information Technology on December 30, 2009. 

In the comment letter, AHA asked ONC to

• clarify the allocation of responsibilities of providers and IT vendors;
• provide a lead time of one year between finalization of the certification criteria and certification of vendor systems and an additional two years between the time when certified products are available in the market and when providers nationwide are expected to implement and begin using them;
• streamline the certification process;
• recognize that hospitals may customize and make modifications to EHR technology that was certified by a vendor without needing additional certifications; and
• delay  the certification criteria and standard for the accounting of disclosures at least until the updated rule for accounting of disclosures is issued by the HHS Secretary.

They also asked ONC to expressly clarify that the encryption and hashing standards contained within the IFR do not impose any obligations upon HIPAA-covered entities beyond that which is already required by the HIPAA Security Rule, and asked that the audit alerting criterion be eliminated from the final rule.

• Print
• Comments
• Trackbacks
• Share Link