Stage2  – ‘You ain’t finished ‘till the paperwork is done’.

Many years ago I saw a cute little cartoon that pictured a three year old climbing off a
commode, while standing next to him was his mother instructing him that he wasn’t
finished until his paper work was done. Well, now the characters in that cute cartoon can
be replaced by a vendor and the ONC, respectively.

Two new Stage 2 test scripts for certification will require vendors to supply documentation
previously not needed under Stage 1, they are:

1.        Safety Enhanced Design - 170.314(g)(3), and
2.        Quality Management System – 170.314(g)(4)

Safety Enhanced Design (SED). In early drafts of Stage 2 this criteria was referred to as
User Centered Design. The primary impetus for SED came from the November 2011 IOM
report that lamented the lack of built in safety elements in many clinical software products.
The report is entitled
Health IT and Patient Safety: Building Safer Systems for Better Care.

An excerpt from the ONC test script describing SED follows:

This test evaluates the capability for a Complete EHR or EHR Module to apply user-
centered design for each EHR technology capability submitted for testing and specified in
the following certification criteria:

§ 170.314(a)(1) Computerized provider order entry
§ 170.314(a)(2) Drug-drug, drug-allergy interaction checks
§ 170.314(a)(6) Medication list
§ 170.314(a)(7) Medication allergy list
§ 170.314(a)(8) Clinical decision support
§ 170.314(a)(16) Inpatient only - electronic medication administration record
§ 170.314(b)(3) Electronic prescribing
§ 170.314(b)(4) Clinical information reconciliation

The Tester shall verify that for each EHR technology capability submitted for testing and
specified in the above-listed certification criteria, the Vendor has chosen a user-centered
design (UCD) process that is either:

 A) UCD industry standard (e.g.; ISO 9241-11, ISO 9241-210, ISO 13407, ISO 16982,
and ISO/IEC 62366); and submitted the name, description, and citation or,

 B)  Not considered an industry standard (i.e. may be based upon one or more industry
standard processes); and submitted the named the process(es) and provided an outline
and description of the process(es)

The Tester shall examine each Vendor-provided report to ensure the existence and
adequacy of the test report(s) submitted by the manufacturer. The Tester shall verify that
the report(s) conform to the information specified in NISTIR 7742 Customized Common
Industry Format Template for Electronic Health Record Usability Testing.

Full EHR vendors must address this new requirement, while EHR Module vendors can
skip it if your certification request does not include any of the above criteria, on the other
hand, if your EHR Module includes even one of the above you then must address the
SED for that criteria.

The second new criteria questions the use of a Quality Management System 170.314(g)
(4). The ONC published test script states the following:

For each capability that an EHR technology includes and for which that capability’s
certification is sought, the use of a Quality Management System (QMS) in the
development, testing, implementation and maintenance of that capability must be

 - The Vendor identifies the QMS used or indicates that no QMS was used in the
development, testing, implementation and maintenance of each capability being certified

 - The Tester verifies that for each capability for which certification is sought, the Vendor

1. Identified an industry-standard QMS by name (for example, ISO 9001, IEC 62304,
   ISO 13485, ISO 9001, and 21 CFR, Part 820…)
2. Identified a modified or “home-grown” QMS and an outline and short description
   of the QMS, which could include identifying any industry-standard QMS upon
   which it was based and modifications to that standard
3.  Indicated that no QMS was used for applicable capabilities for which
  certification is requested

Clearly ONC is interested in learning more about what QA tools vendor use (if any) for
each of the submitted Stage 2 criteria. Under Stage 2, per step 3 above, you do not have
to have a formal (or any) QA process available. No QMS is an acceptable answer. But,
you can easily guess what will happen in Stage 3. Words to the wise; if today you do not
incorporate in your systems development a formal and documented QA process better
get one soon.

Last year in a previous
HISTalk blog I referred to the FDA coming to EMR systems
through the back door. SED is a big step in. I fully expect the criteria covered to expand in
Stage 3, and expect the depth and extent of the documentation submission to expand as
the test agencies (ACB) gain more experience in 2013.
Lastly, if your staff is not familiar with the ISO and IEC standards, better do some
homework. I suspect that the best of breed /specialty and new HIT startup firms would
have a more difficult time in addressing SED than the large legacy firms. Documentation
and QA are typically not their strongest suits.

All the new Stage 2 criteria and test scripts can be found

Frank Poggio
The Kelzon Group
November 30, 2012
All Rights Reserved

This article first appeared in
HISTalk 12/10/2012