Health Information Technology Standards, Implementation Specifications, and Certification Criteria and Certification Programs for Health Information Technology

Statutory basis and purpose.

This provision identifies the statutory authority under the Public Health Service Act for the health information technology regulations.

Applicability.

This provision defines the scope of health IT standards and certification criteria and includes a severability clause.

Definitions.

This provision provides definitions for key terms used in health information technology standards, including base EHR, interoperability, and common clinical data sets.

Applicability.

This provision states that the standards and implementation specifications adopted in the part apply to health information technology.

Transport standards and other protocols.

The Secretary adopts the following transport standards:

Functional standards.

The Secretary adopts the following functional standards:

Content exchange standards and implementation specifications for exchanging electronic health information.

The Secretary adopts the following content exchange standards and associated implementation specifications:

Vocabulary standards for representing electronic health information.

The Secretary adopts the following code sets, terminology, and nomenclature as the vocabulary standards for the purpose of representing electronic health information:

Standards for health information technology to protect electronic health information created, maintained, and exchanged.

The Secretary adopts the following standards to protect electronic health information created, maintained, and exchanged:

United States Core Data for Interoperability.

The Secretary adopts the following versions of the United States Core Data for Interoperability standard:

Application Programming Interface Standards.

The Secretary adopts the following standards and associated implementation specifications as the available standards for application programming interfaces (API):

Incorporation by reference.

This provision lists the technical standards, implementation guides, and specifications incorporated by reference into the health information technology certification regulations.

Applicability.

This provision establishes the applicability of certification criteria for Health IT Modules and clarifies the use of alternative standards and optional capabilities.

§§ 170.302-170.306 [Reserved]

This section is reserved and contains no substantive regulatory requirements.

[Reserved]

This section is reserved and contains no substantive regulatory requirements.

ONC certification criteria for Health IT.

The Secretary adopts the following certification criteria for health IT.

Basis and scope.

This provision outlines the basis and scope for Conditions and Maintenance of Certification requirements for health IT developers participating in the ONC Health IT Certification Program.

Information blocking.

This provision prohibits health IT developers from engaging in actions that constitute information blocking as defined by federal law.

Assurances.

This provision mandates that health IT developers provide assurances regarding information blocking, certification criteria conformance, and record retention for compliance demonstration.

Communications.

This provision restricts health IT developers from prohibiting or restricting communications regarding the usability, interoperability, security, and business practices of their health IT products.

Application programming interfaces.

This provision establishes conditions and maintenance requirements for certified health IT developers regarding API transparency, fee structures, openness, and interoperability standards for electronic health information access.

Real world testing.

Health IT developers must conduct and report real-world testing for interoperability of certified Health IT Modules in the settings where they are marketed.

Attestations.

Health IT developers must provide semiannual attestations of compliance with specific conditions and maintenance of certification requirements.

Insights Condition and Maintenance of Certification.

Health IT developers must submit annual reports on specific measures regarding the use and performance of their certified health IT products.

Basis and scope.

This section defines the legal basis and scope of the ONC Health IT Certification Program for health information technology.

Applicability.

This section establishes the processes and requirements for ONC-ACB and ONC-ATL status and the direct review of certified health IT.

Definitions.

Defines key terms such as applicant, deployment site, gap certification, and ONC-authorized entities for the health IT certification program.

§§ 170.503-170.504 [Reserved]

These sections are reserved and contain no regulatory content.

Correspondence.

Establishes requirements for official communication between ONC and applicants or certified entities, including email and mail protocols.

Authorization scope for ONC-ACB status.

Defines the scope of certification activities that an ONC-Authorized Certification Body is permitted to perform.

Authorization scope for ONC-ATL status.

Defines the scope of testing activities that an ONC-Authorized Testing Laboratory is permitted to perform.

Application.

Specifies the information and documentation required for organizations to apply for ONC-ACB or ONC-ATL status.

Principles of proper conduct for ONC-ACBs.

This provision establishes the operational, reporting, surveillance, and certification requirements for ONC-Authorized Certification Bodies (ONC-ACBs) under the ONC Health IT Certification Program.

Principles of proper conduct for ONC-ATLs.

This provision outlines the mandatory conduct, reporting, and record retention requirements for ONC-Authorized Testing Laboratories.

Application submission.

This provision specifies the submission methods and timing for entities applying for ONC-ACB or ONC-ATL status.

Review of application.

This provision establishes the timeline and process for the National Coordinator to review applications for ONC-ACB or ONC-ATL status, including deficiency notices.

ONC-ACB and ONC-ATL application reconsideration.

This provision defines the process for applicants to request reconsideration of a denial of ONC-ACB or ONC-ATL status based on factual errors.

ONC-ACB and ONC-ATL status.

This provision outlines the requirements for public representation, renewal, and expiration of ONC-ACB and ONC-ATL status.

[Reserved]

This provision is reserved.

Health IT Module certification.

This provision establishes the requirements for certifying Health IT Modules, including scope, privacy and security criteria, and inherited certification status.

[Reserved]

This provision is reserved.

Certification to newer versions of certain standards.

This provision outlines the requirements and conditions under which ONC-ACBs may certify Health IT Modules to newer versions of established standards.

In-the-field surveillance and maintenance of certification for Health IT.

This provision establishes the requirements for ONC-ACBs to conduct in-the-field surveillance of certified Health IT Modules and manage corrective action plans for non-conformities.

Authorized testing and certification methods.

This provision mandates that ONC-ATLs and ONC-ACBs must provide remote testing and certification capabilities for development and deployment sites.

Good standing as an ONC-ACB or ONC-ATL.

This provision defines the requirements for ONC-ACBs and ONC-ATLs to maintain good standing, including adherence to principles of conduct and compliance with applicable laws.

Revocation of ONC-ACB or ONC-ATL status.

This provision outlines the procedures and criteria for the National Coordinator to suspend or revoke the status of ONC-Authorized Certification Bodies and ONC-Authorized Testing Labs.

Effect of revocation on the certifications issued to Complete EHRs and EHR Module(s).

This provision defines the impact of an ONC-ACB or ONC-ATL status revocation on the certification status of previously certified health IT modules.

[Reserved]

This section is reserved and contains no regulatory content.

ONC review of certified health IT.

This provision establishes the authority and procedures for the Office of the National Coordinator for Health Information Technology (ONC) to review, suspend, or terminate the certification of health IT modules, including requirements for corrective action plans and developer appeals.

Certification ban.

This provision outlines the circumstances under which a health IT developer's certification may be banned and the process for reinstatement into the ONC Health IT Certification Program.

Incorporation by reference.

This provision lists the technical standards and conformity assessment guides incorporated by reference into the ONC health IT certification regulations.