CCHIT and Drummond - Certifying bodies for EHR's

HHS announced today that the following organizations have been selected as ONC-Authorized Testing and Certification Bodies (ATCBs):

• Certification Commission for Health Information Technology (CCHIT) - Chicago, Ill.
• Drummond Group Inc. (DGI) - Austin, Texas

According to HHS, certification by an ATCB signifies "to eligible professionals, hospitals, and critical access hospitals that an EHR technology has the capabilities necessary to support their efforts to meet the goals and objectives of meaningful use".

EHR Certification and Transition Steps Defined

On September 3, the Certification Commission for Healthcare Information Technology (CCHIT) unveiled their plans for certification under ARRA. CCHIT plans two program concepts: 1) comprehensive certification which meets or exceeds federal standards and and 2) modular certification related to security, privacy and interoperability meeting federal standards.

Federal standards for HHS Certification will mean that a system meets the "minimum government requirements for security, privacy, and interoperability, and that the system is able to produce the Meaningful Use results that the government expects." HHS Certification will not be a 'seal of approval' nor an indication of the relative value of systems.

CCHIT's action were in response to ONC's Certification and Adoption Workgroup recommendations presented at the August 14 HIT Policy Committee meeting.

The Certification and Adoption Workgroup's recommendations include:

• Focus Certification on Meaningful Use
• Leverage Certification process to improve progress on Security, Privacy, and Interoperability
• Improve objectivity and transparency of the certification process
• Expand Certification to include a range of software sources: Open source, self-developed, etc.
• Develop a Short-Term Certification Transition plan

The Certification Workgroup emphasized the need for more explicit requirements for information exchange

Unlike CCHIT today, certification criteria should be established independently of the organizations performing the certification. Multiple certification organizations will be allowed to perform testing after they become accredited. Vendors need certification from any one testing organization.

Wes Rishel (Gartner) has argued that "when the choice of certifiers is made only by the vendor, not the organization that relies on the certificate, this creates an inevitable pressure to be the certifying organization that is the least thorough in its process"... "Arguably, if physicians could chose the certifying organization they would not pick the one with weakest accreditation. After all, they have to live with and use the product. But under the “any certifying organization will do” approach, this is not the option that will be presented to physicians. They will be asked to choose among products each of which is rated by several organizations, some of which are focused on the baseline requirements for certification and others of which use any number of criteria for judging products."

As such, accreditation is a lynch pin in the Workgroup's recommendations to "insure that multiple certification entities use identical criteria and provide a 'level playing field' so that all certification organizations offer the same level of scrutiny."

HHS Certification would also serve as qualification for the Stark exception.

Providers would be allowed to achieve meaningful use through use of certified components.

In one sure-to-be-controversial recommendation, the Workgroup recommended that the “lock down” requirements of EHR software should be removed to address concerns of the Open Source community.

Self-developed software may also be certified, on a site by site basis.

The transition

The certification transition "includes a concept of 'Preliminary HHS Certification' so that vendors, who take a risk on the content of the final regulations, can be ready as quickly as possible when final regulatory approval is obtained" which should be valid through 2011."

"This certification is called “preliminary” because the meaningful use criteria and the certification criteria will not yet have completed their paths through the regulatory process.
When the regulatory process is completed for Meaningful Use, presumably in early 2010, then, if necessary, establish a short “regulatory gap certification” for any necessary changes from preliminary certifications. After completing this “regulatory gap certification”, the National Coordinator should certify those products as qualifying under the statute, with a goal of having HHS Certified products in the marketplace in early 2010."

"For vendors who already completed CCHIT 2008 certification, we recommend providing an optional shorter, expedited process. Request that CCHIT submit, as soon as possible, a proposal for “2008 Gap Certification,” which will apply only to vendors who already completed 2008 Certification. The 2008 Gap Certification must cover any missing privacy capabilities (e.g., audit trails, consent) required by statute It must also cover capabilities for Meaningful Use, and expanded interoperability capabilities. Once approved by ONC, the completion of 2008 Gap Certification should also qualify products for “Preliminary HHS Certification.” Those products will be required to complete the “Regulatory Gap Certification Process” before the National Coordinator similarly certifies those products. Working with CCHIT and the Policy Committee, the ONC should investigate whether similar gap certifications are appropriate for products that achieved 2007 certification."

CCHIT To Provide 3 Certification Options

On June 18, the Certification Commission for Health Information Technology (CCHIT) announced that it is extending its certification options in response to concerns from open source developers and in an effort to better position itself to vie for appointment as the certification agency required under the HITECH provisions of the American Recovery and Reinvestment Act (ARRA).

The three options include:

• "A rigorous certification for comprehensive EHR systems that significantly exceed minimum Federal standards requirements. This certification (EHR-C) would be targeted to the needs of providers who want maximal assurance of EHR capabilities and compliance
• A new, modular certification program for electronic prescribing, personal health records, registries, and other technologies. Focusing on basic compliance with Federal standards and security, the EHR-M program would be offered at lower cost, and could accommodate a wide variety of specialties, settings, and technologies. It would appeal to providers who prefer to combine technologies from multiple certified sources.
• A simplified, low cost site-level certification. This program would enable providers who self-develop or assemble EHRs from noncertified sources to also qualify for the ARRA incentives."

These certification options are targeted to be available for 2011-2012 certifications which kick off in January 2010.

CCHIT has been criticized for too close a relationship to Health IT vendors, led most visibly by David Kibbe and Brian Klepper, who have asked "If the HITECH monies are spent on CCHIT certified EHRs that can't do any of these patient-centered tasks, or EHRs that don't come equipped with the features and functions to extend health IT capability to the patients and consumers, do we really think that the money will have been spent wisely? But that's the pathway we seem headed down, led by the vendors." Mark Leavitt, Chair of CCHIT, has responded forcefully to this criticism.

CCHIT's announcement addresses the concern that certification was previously only available to vendors able to deliver monolithic solutions covering all EHR requirements.

Making Sense of National Healthcare IT

Avance Health Analysis

Recent news of HITSP's submissions to The Community (AHIC) June meeting, prompted a reader to ask: How do the various national healthcare initiatives (AHIC, HITSP, HHS, CCHIT and NHIN) fit together?

Is the relationship between these organizations Rube Goldberg-esque? Or is there some more coherent design?



The mission of American Health Information Community ("The Community" or AHIC) is to provide "input and recommendations to the Department of Health and Human Services (HHS) on how to make health records digital and interoperable, and assure that the privacy and security of those records are protected in a smooth, market-led way." AHIC is presently reorganizing itself to ensure its viability beyond the term of the current administration, by establishing "AHIC 2.0" as a sustainable public-private organization. AHIC is the focal point for guidance to HHS on priorities for interoperability and develops the use cases for these priorities.

The Healthcare Information Technology Standards Panel (HITSP) mission is to "harmonize and integrate standards that will meet clinical and business needs for sharing information among organizations and systems." HITSP takes its guidance on priorities and use case definition from AHIC and proposes standards (like those to be presented today at the AHIC June 2008 meeting) to the HHS Secretary.

The HHS Secretary can accept the recommendations which starts the clock on a one year cycle of testing and implementation. At the end of this cycle, the HHS Secretary can choose to "recognize" these standards. Once standards are recognized, by Executive Order, they are incorporated into new Federal Systems and Healthcare Contracts.

Recognition of these standards also serves as input to the Certification Commission for Healthcare Information Technology (CCHIT). CCHIT is a recognized certification body (RCB) for Electronic Health Records (EHR) with the goal of accelerating EHR adoption. CCHIT establishes its roadmap and criteria for Electronic Health Records based in part on the recognized standards from the HHS Secretary.

These recognized interoperability standards are also incorporated by the Nationwide Health Information Network (NHIN), a network of networks promoting Health Information Exchange.