ONC Health IT Certification Program Updates (08/25/2017)

NIST Handbook 150-31 Update

National Institute of Standards and Technology (NIST) Handbook 150-31 has been revised. Handbook 150-31 is a requirement for laboratories testing health IT under the ONC Health IT Certification Program and presents the technical requirements and guidance for the accreditation of laboratories under the National Voluntary Laboratory Accreditation Program (NVLAP) Healthcare Information Technology (HIT) Laboratory Accreditation Program (LAP).

The 2017 edition of NIST Handbook 150-31 supersedes and replaces the 2011 edition. The Handbook is available for download (PDF format) from the NVLAP website at: https://www.nist.gov/sites/default/files/documents/2017/08/15/nist.hb_.150-31-2017.pdf.

Relied Upon Software Guidance Update

ONC has issued an updated Relied Upon Software Guidance document. Health IT developers that can pair their Health IT Module with more than one relied upon software product to demonstrate compliance for the same capability must be tested with at least one such product to demonstrate compliance with the certification criterion’s requirements. Afterwards, the Health IT Module developer is permitted to list all additional relied upon software products for the same capability paired with the Health IT Module without having to test with the ONC-Authorized Testing Laboratory (ONC-ATL) to each one.

Test Method Updates

Recently Updated Test Procedures (TPs)

2015 Edition Test Procedures
Criterion Number	Criterion Title	Details
§ 170.315(c)(1)	Clinical quality measures (CQMs) – record and export	In section (ii), added TLV clarification that the tester can choose at their discretion which individual patient will be tested to exporting the QRDA Category I file.
§ 170.315(f)(2)	Transmission to public health agencies – syndromic surveillance	Updated the PHIN Messaging Guide for Syndromic Surveillance and the Erratum links
§ 170.315(g)(1)	Automated numerator recording	Modified language on the options systems have for testing the different calculation methods. Added an attestation requirement around documentation provided to end users around systems ability to calculate the different methods.
§ 170.315(g)(2)	Automated measure calculation	Modified language on the options systems have for testing the different calculation methods. Added an attestation requirement around documentation provided to end users around systems ability to calculate the different methods.
§ 170.315(h)(2)	Direct Project, Edge Protocol, and XDR/XDM	Clarified the behavior of the HISP in the case of an invalid certificate when initiating a TLS Session for (i)(C) – Send Using Edge Protocol for IHE XDR profile for Limited Metadata Document Sources (step 2).

Recently Updated Test Data

2015 Edition Test Data
Criterion Number	Criterion Title	Details
§ 170.315(g)(1)	Automated numerator recording (Eligible Hospital / Critical Access Hospital)	Updated test notes in Required Test 3 and 5.
§ 170.315(g)(1)	Automated numerator recording (Eligible Provider / Eligible Clinician)	Updated General Notes. Updated test notes in Required Test 3 and 5.
§ 170.315(g)(2)	Automated measure calculation (Eligible Hospital / Critical Access Hospital)	Updated test notes in Required Test 3 and 5.
§ 170.315(g)(2)	Automated measure calculation (Eligible Provider / Eligible Clinician)	Updated General Notes. Updated test notes in Required Test 3, 4a, 4b, 4c, and 5.

Recently Updated Certification Companion Guides (CCGs)

2015 Edition Certification Companion Guides (CCGs)
Criterion Number	Criterion Title	Details
§ 170.315(e)(1)	View, download, and transmit to 3rd party	Removed “activity history log” from the “content required” table on page 4 – this text was included in error and is a separate conformance requirement. Added a first bullet in (i)(B) technical outcome section make explicit that as part of “Download” health IT presented for certification must be capable of creating CCD documents. Added a clarification in (i)(B) regarding the ways in which CCD documents could be created for the purposes of meeting the certification criterion’s conformance requirement. Revised the “Approach” subheading’s clarification to more explicitly include how the time frame filtering in (i)(D) aligns with and corresponds to other conformance requirements within the certification criterion.
§ 170.315(f)(2)	Transmission to public health agencies – syndromic surveillance	Clarified that testing and certification does not require compliance with ICD-9-CM and permits testing and certification to ICD-10-CM or SNOMED CT® to meet the implementation guide’s requirements for submitted messages; and updated links to the Implementation Guide and Errata.
§ 170.315(g)(1)	Automated numerator recording	Provided additional clarification for the patient-specific education measure regarding provider ability to configure systems based on patient information.
§ 170.315(g)(2)	Automated measure calculation	Provided additional clarification for the patient-specific education measure regarding provider ability to configure systems based on patient information.
§ 170.315(g)(7)	Application access – patient selection	Added clarification that documentation must be available to the public via a hyperlink without any additional access requirements.
§ 170.315(g)(8)	Application access – data category request	Added clarification that documentation must be available to the public via a hyperlink without any additional access requirements.
§ 170.315(g)(9)	Application access – all data request	Added clarification that documentation must be available to the public via a hyperlink without any additional access requirements.
Privacy & Security		Clarification of system documentation requirements for testing and certification under Approach 2.

For additional information on the 2015 Edition requirements, please visit https://www.healthit.gov/policy-researchers-implementers/2015-edition-final-rule

Questions may be directed to the ONC Health IT Certification Program via email at: ONC.Certification@hhs.gov