On March 7th 2012 a draft for comment on the new Stage 2 rules was published in the Federal
Register. Actually there were two separate parts to the rules. They are;

1. The CMS part that is aimed at provider requirements necessary to meet
Meaningful Use, and,
2. The ONC piece that addressed proposed changes to the certification process
for EHR vendors.

On the provider side there are innumerable blogs and web sites that are covering the provider
issues which deal mostly with a few added MU criteria such as electronic medication
administration records, menu options in Stage 1 that are now mandatory in Stage 2, greater
emphasis on exchanging patent care information across care levels and greater patient access
to care information.

This article will focus on the ‘second side’ of the regulations the elements that most impact the
system suppliers, and particularly the impact on niche or best of bred (BoB) vendors.

The full text of the new ONC Certification proposed rules can be found at here.  

Before we hit the high (and low) points of the rules keep in mind these are ‘proposed’ rules. If
there is anything you don’t like about them, have suggestions for improvements, etc. you have
from now till May 7th to post comments on the federal web site. Speak now or forever hold your
price! (No that is not a typo…see the ‘Ugly’).

Here’s the Good, the Bad, and the Ugly of proposed certification changes for vendors.

The Good News

1) Privacy and Security, will it go away?
EHR Module certification gets a little easier for niche and best of breed vendors (BoB). The big
change here is that Module certification no longer requires you to address any of the Privacy and
Security criteria. In the past there were eight P&S criteria (number nine was always optional), and
in our working through many ACTB tests if you said the right phrase you could get a waiver on
three others (Integrity, General Encryption, and HIE). Proposed under the Stage 2 as a
niche/BoB vendor you can ignore all the P&S criteria. To get certified under Stage 2 it would
seem all you will need to do is pass any one Inpatient, Ambulatory or General criteria, just ignore
the P&S criteria and your home free!

ONC said they made this change because many of the smaller firms complained that the P&S
criteria did not apply or were too burdensome. This may sound too good to be true…and maybe
it is. Read what ONC says in other parts of the document:

“Finally, we propose to require that test results used for the certification of
EHR technology be available to the public in an effort to increase transparency around the
certification process.

“We believe that there will be market pressures to have certified Complete EHRs and certified
EHR Modules ready and available prior to when EPs, EHs, and CAHs must meet the proposed
revised definition of CEHRT for FY/CY 2014. We
assume this factor will cause a greater number of developers to prepare EHR technology for
testing and certification towards the end of 2012 and throughout 2013, rather than in 2014.”

This is classic ONC. They say you don’t have to get certified, there is no law that says any
vendor MUST – even a full EMR vendor. They believe the market will tell you, and by the way,
ONC will be publishing the details of your certification so the world can compare you against your

As we tell our clients, the MU criteria you choose to test on is dictated more by your competition
and clients, not by the ONC.

2) Gap Certification for Stage 2.
A question that we have heard frequently was if I was certified on twenty criteria for Stage 1
under Stage 2 would I have to be tested again for those same criteria?  Under the proposed
Stage 2 rules you would not need to get re-certified on Stage 1 criteria. You will only have to be
tested on new criteria you select, and tested on Stage1 criteria that has changed or been revised
by ONC.

A good example is the encryption P&S test. The focus now will be on encryption for data at rest,
they state:

EHR technology presented for certification must be able to encrypt the electronic health
information that remains on end user devices. And, to comply with paragraph (d)(7)(i), this
capability must be enabled (i.e., turned on) by default and only be permitted to be disabled (and
re-enabled) by a limited set of identified users.

So if you tested out on encryption under Stage 1, and want to carry it forward into Stage 2 you’ll
probably have to show how you default encryption for user devices.

3) Component EHR vs. Complete EHR
A typical misunderstanding we came across many times during past year taking our clients
through the certification process was a CIO at a hospital would say to the vendor that he/she
believed they had to install a full EMR from a single vendor to meet all the MU criteria. In the
proposed regulations ONC has clearly addressed this question. On page 104 they say:

Certified EHR technology means:
1. For any Federal fiscal year (FY) or calendar year (CY) up to and including 2013:
i. A Complete EHR that meets the requirements included in the definition of a
Qualified EHR and has been tested and certified in accordance with the
certification program established by the National Coordinator as having met all
applicable certification criteria adopted by the Secretary for the 2011 Edition
EHR certification criteria or the equivalent 2014 Edition EHR certification
criteria; or
ii. A combination of EHR Modules in which each constituent EHR Module of the
combination has been tested and certified in accordance with the certification
program established by the National Coordinator as having met all applicable
certification criteria adopted by the Secretary for the 2011 Edition EHR
certification criteria or the equivalent 2014 Edition EHR certification criteria, and
the resultant combination also meets the requirements included in the definition of a Qualified

In effect a provider could meet the MU criteria using as many ‘suite’ of BoB systems as they
believe necessary, they do not have to be from one or the same vendor.

Now some Bad news:

Criteria Components:
Many BoBs struggled with the make up of the criteria for Vitals and Demographics and several
other clinical criteria. On the surface they seemed easy to pass, the problem was they contained
some data elements that were not typically found in BoB systems. For vitals the hurdle was
growth charts, for demographics the hurdle is ‘date and time of death’. To pass these criteria
some vendors would use user defined fields, or create new inputs that they knew their clients
would never use.  Repeatedly I was asked by niche and BoB clients - Why would you ask a
patient during a registration process - ‘When did you die’?? Now there’s a comforting dialog!

Keep in mind several or the participants in building the HiTech/MU program were
academics and researchers, who would find that piece of information very critical to their
retrospective medical data analyses. Also vendors of full EMR systems would easily have that
piece of data readily available in their medical record abstract system, but for an ancillary or
niche vendor not likely. As far as I know there were no niche or BoB vendors represented on any
of the HiTech Policy or Standard Committees.

You may wonder why any firm would go through the trouble of adding a ‘useless’ data element.
Again keep in mind what ONC said above…the market will require certification. It can be virtually
impossible to sell an ancillary system such as surgery, ICU monitoring, therapy, anesthesia, etc. if
you had to tell your prospect your product was not certified for vitals.

Unfortunately this issue is still there for BoBs. The big change is on the provider side. ONC has
greatly liberalized the granting of exceptions to providers for MU attestation if the MU criteria, or
element of the criteria, do not apply to their practice of facility.  As and example, a psychiatrist
does not have to do growth charts for his patients an exemption will be readily available, but the
vendor who sold him the system still must!

Continuing of this topic, in a recent interview Dr. Mostashari, ONC Director chided EHR vendors
who "aren't making meaningful use of meaningful use." Instead of attempting to seamlessly
incorporate MU standards into their interfaces, Mostashari said "vendors did what vendors do—
they slammed in the criteria and got certified”.

I submit that ONC ‘slammed” these regulations into being as fast as they could due to
Congressional and Executive pressure…so one good slam deserves another! Maybe if ONC took
a moment to look at the impact of certification on niche and BoBs, which are mostly the smaller
more innovative developers and adjusted the criteria, we all could stop “slamming”.

…And Now the Ugly:
As I mentioned in an earlier HISTalk blog ONC wants comments on vendor product price
transparency. Here’s the ONC statement:

During implementation of the temporary certification program, we have received feedback from
stakeholders that some EHR technology developers do not provide clear price transparency
related to the full cost of a certified Complete EHR or certified EHR Module. Instead, some EHR
technology developers identify prices for multiple groupings of capabilities even though the
groupings do not correlate to the capabilities of the entire certified Complete EHR or certified
EHR Module. Thus, with the transparency already required by §170.523(k)(3) in mind, we believe
that the EHR technology market could benefit from transparency related to the price associated
with a certified Complete EHR or certified EHR Module. We believe price transparency could be
achieved through a requirement that ONC ACBs ensure that EHR technology developers include
clear pricing of the full cost of their certified Complete EHR and/or certified EHR Module on their
websites and in all marketing materials, communications, statements, and other assertions
related to a Complete EHR’s or EHR Module’s certification.

Put simply, this provision would require EHR technology developers to disclose only the full cost
of a certified Complete EHR or certified EHR Module. As a former CFO I know that a complete
definition of ‘full cost’ would take at least another 500 pages in the Federal Register. After the
vendors in the audience come down off the ceiling you’d probably like to share your reaction with
ONC. Too bad the comment period closed May 7th.  
Stage 2 and You - The Vendor View
May 2012

Frank Poggio
The Kelzon Group
All rights reserved