ONC Health IT Certification Program Updates (05/30/2017)

ONC Health IT Certification Program Updates (05/30/2017) § 170.315(f)(7) Transmission to public health agencies – health care surveys In support of the Centers for Disease Control National Center for Health Care Statistics mission and in response to industry feedback, ONC will permit testing and certification for § 170.315(f)(7) to conformance of HL7 CDA® R2 Implementation Guide (IG): National Health Care Surveys (NHCS), R1 DSTU Release 1.2 - US Realm as part of the 2015 Edition certification. The Release 1.2 test tool is currently being developed and expected to be completed summer 2017. We encourage developers to work with their ONC-Approved Testing Laboratories (ONC-ATL) for pilot testing and to provide feedback of the Release 1.2 beta test tool which is currently available at http://cda-validation.nist.gov/cda-validation/muNHCS12.html. Products already certified to IG Release 1.0 prior to the availability and switch over to the Release 1.2 test tool will not be required to retest or recertify to release 1.2. The updated Certification Companion Guide (CCG) with additional details is now available and can be accessed via the 2015 Edition Test Method page at https://www.healthit.gov/policy-researchers-implementers/2015-edition-test-method. Next Cypress & Bonnie Release to Accommodate 2017 eCQM Annual Update The Centers for Medicare & Medicaid Services have posted the 2017 annual update for electronic clinical quality measures (eCQMs) for calendar year (CY) 2018 reporting for Eligible Hospitals and Critical Access Hospitals, and CY 2018 performance for Eligible Professionals and Eligible Clinicians. We continue to work on updating Cypress and Bonnie to accommodate this update, as well as other enhancements. The Cypress 3.2 Beta release is scheduled to be available on June 16, 2017 and the Cypress 3.2 Final release is scheduled for July 27, 2017. Cypress 3.2 will support the updated eCQM specifications for CY2018 available on the eCQI Resource Center website (ecqi.healthit.gov). Additionally, the Cypress test bundles have been enhanced to cover > 95% of eCQM Measure Logic. Cypress 3.2 will also include bug and performance updates to improve testing and certification workflows. Disclaimer for Google Groups of Test Tools ONC will be appending the following disclaimer to each of the Google Groups that are leveraged for the technical support of test tools used in ONC Health IT Certification Program: "This group is solely for the technical support of the . The feedback to any post is strictly limited to the proper use of the lt and do not reflect official policy interpretations from the Office of the National Coordinator for Health IT. Questions about the ONC Health IT Certification Program should be sent to: ONC.Certification@hhs.gov." Test Method Updates Recently Updated Test Procedures (TPs) 2015 Edition Test Procedures (TPs) Criterion Number Criterion Title Details § 170.315(a)(5) Demographics Added regulation text detail specifying the demographic details including aggregation requirements. Updated the referenced standards to provide links and download instructions for the enumerated race and ethnicities and a pointer to the aggregation mapping table for race and ethnicity. § 170.315(c)(1) Clinical quality measures – record and export In section (ii) system under test (SUT) step 2 and Test Lab Verification step 3, clarification was added that the SUT must be able to supply both single patient and multiple patient QRDA files. § 170.315(d)(2) Auditable events and tamper-resistance (i)(A) “changes to user privilege” was moved to be grouped with “change” to make clear that they can be separately recorded actions or that this more specific change can be labeled first as a “change” and then with more specificity as to the type of change. § 170.315(d)(3) Audit report(s) Step 2 for SUT and TLV were both clarified and changed to reflect that multiple audit reports can also be created to meet the criterion. The data references in the SUT column were also re-ordered to make the required data clearer. § 170.315(g)(2) Automated measure calculation Modified the numerator for Required Test 3 Advancing Care Information (ACI) English Statement to reflect that action must occur during the performance period. § 170.315(h)(1) Direct Project Corrected Reject Receive of Direct Messages in Section (i): Removed Invalid Trust Anchor from the list of test. This is considered a duplicate of Invalid Trust Relationship (Different Trust Anchor) Reformatted the test procedures for readability. The System Under Test aligns closer to the to the Test Lab section. Several numbering and narrative formatting changes Removed the Link for DCDT; provided navigation instructions instead § 170.315(h)(2) Direct Project, Edge Protocol, and XDR/XDM Removed the link to the independent Direct Certificate Discovery Tool (DCDT). Added navigation to the 2015 DCDT within the Edge Testing Tool. Changed the sub-titles for (i)(B) Send/Receive using SOAP+XDR to Send/Receive conversion using XDR to better reflect the action of the translation which occurs through the HISP. Moved the C-CDA Samples to the Documents tab. Addition of alternative SUT Connection – Systems may not be connected using Transport Layer Security (TLS and) and Simple Authentication and Security Layer (SASL) or a “secure network”. Additional updates were made to indicate which tests were required only for the TLS and SASL alternative throughout the Test Procedure (See updated Test Case decoupling below). As part of this update the ordering of the test steps were altered to make them consistent throughout the test procedure. Updates to Test Procedure were made to reflect decoupling of the TSL and SASL from the send/receive test cases corresponding to the changes made in the Edge Testing Tool (ETT). This includes the following changes: SMTP Test (1-8, 14) included TLS and SMTP Send. The new test cases are SMTP Test 8 StartTLS, and SMTP Test 14 SMTP Send. IMAP Test (4-8, 11, 15) included TLS, SASL and IMAP Receive. The new test cases are IMAP Test (8,11,15). Reorganized the test steps so that the TLS test steps are all under the SUT Connection for SUT using TLS. POP Test (3-5,11,15) included TLS, SASL and IMAP Receive. The new test cases are POP 5,11,15). Reorganized the test steps so that the TLS test steps are all under the SUT Connection for SUT using TLS. PSMTP Test (9, 16, 20) included TLS, SASL and SMTP Receive. The new test cases are SMTP Test 9 StartTLS, SMTP Test 16 SASL and SMTP Test 20 SMTP Receive. 2014 Edition Test Procedures (TPs) § 170.315(h)(1) Optional - Transmit - Applicability Statement for Secure Health Removed DCDT link and provided information to access the DCDT information from the Edge Testing Tool. § 170.315(h)(2) Optional - Transmit - Applicability Statement for Secure Health Transport and XDR/XDM for Direct Messaging Removed DCDT link and provided information to access the DCDT information from the Edge Testing Tool. Recently Updated Test Data 2014 Edition Test Data Criterion Number Criterion Title Details § 170.315(g)(2) Automated measure calculation (Eligible Hospital/Critical Access Hospital) Updated test notes in Required Tests 2a, b, c; 3, 4a, b, c; 5; 6; 7; and 8. Corrected data errors in Required Tests 1 and 2a. Modified test data in Required Tests 4a, 4b, and 4c. § 170.315(g)(2) Automated measure calculation (Eligible Provider/Eligible Clinician) Updated test notes in Required Tests 4a and 4c. Removed the reference to the CCG from Required Tests 4a, 4b, and 4c. Fixed test data for Required Tests 1, 2a and 5. Recently Updated Certification Companion Guides (CCGs) 2015 Edition Certification Companion Guides (CCGs) Criterion Number Criterion Title Details § 170.315(a)(5) Demographics Provided link instructions for both the detailed CDC Race and Ethnicity coded values and the CDCREC Roll-up codes. § 170.315(a)(13) Patient-specific education resources Revised to include clarification that the criterion is focused on supporting a health care professional or his or her office staff; or a software program or service that would interact directly with the certified health IT. § 170.315(d)(2) Auditable events and tamper-resistance Clarifications added for the application of this criterion to relied upon software and Health Information Service Providers (HISPs). In addition, clarified the meaning of the term “user,” the requirements for recording changes to user privileges, the timing of logging changes is dependent on Health IT design or workflow, and that either a single audit log or multiple audit logs may be used to meet the requirements of this criterion. § 170.315(d)(3) Audit report(s) Added clarifications for the application of this criterion to relied upon software and HISPs. In addition, clarified the meaning of the term “user” and that either a single audit log or multiple audit logs may be used to meet the requirements of this criterion. § 170.315(d)(9) Trusted connection Clarification added for transport level encryption. § 170.315(e)(1) View, download, and transmit to 3rd party Added clarification related to the acceptable transmission capabilities. § 170.315(f)(7) Transmission to public health agencies – health care surveys Clarified that ONC will permit and provide testing and certification for conformance to National Health Care Surveys (NCHS) IG Release 1.2 to meet this criterion; and will not require the retesting and certification of health IT previously certified to NHCS Release 1.0. § 170.315(g)(1) Automated numerator recording Added clarification for patient education materials, Meaningful Use 3 Objective 5 Measure 2 numerator eligibility. For additional information on the 2015 Edition requirements, please visit https://www.healthit.gov/policy-researchers-implementers/2015-edition-final-rule Questions may be directed to the ONC Health IT Certification Program via email at: ONC.Certification@hhs.gov