§170.315(a)(9) Clinical decision support (CDS)
Version # | Description of Change | Version Date |
---|---|---|
1.0 |
Final Test Procedure |
01-08-2016
|
1.1 |
Updated the section referenced in paragraph (a)(9)(v)(A) from (iv) to the paragraph (a)(9)(i), and reference in paragraph (a)(9)(v)(B) from paragraph (a)(9)(ii) to paragraph (a)(9)(iv). Added reference resources to the verification for step 3 of paragraph (a)(9)(ii)(A) in the test lab verification section. |
03-08-2016
|
1.2 |
Add transition of care/referral summary configuration step for paragraph (a)(9)(ii)(B)(2). Corrected small typos throughout:
|
06-10-2016
|
1.3 |
As of September 21, 2017, Test Procedure has been moved to Attestation/Developer self-declaration only. |
09-21-2017
|
1.4 |
Changes language from self-declaration to attestation |
08-25-2021
|
§ 170.315 (a)(9) Clinical decision support (CDS)—
- CDS intervention interaction. Interventions provided to a user must occur when a user is interacting with technology.
- CDS configuration.
- Enable interventions and reference resources specified in paragraphs (a)(9)(iii) and (iv) of this section to be configured by a limited set of identified users (e.g., system administrator) based on a user's role.
- Enable interventions:
- Based on the following data:
- Problem list;
- Medication list;
- Medication allergy list;
- At least one demographic specified in paragraph (a)(5)(i) of this section;
- Laboratory tests; and
- Vital signs.
- When a patient's medications, medication allergies, and problems are incorporated from a transition of care/referral summary received and pursuant to paragraph (b)(2)(iii)(D) of this section.
- Based on the following data:
- Evidence-based decision support interventions. Enable a limited set of identified users to select (i.e., activate) electronic CDS interventions (in addition to drug-drug and drug-allergy contraindication checking) based on each one and at least one combination of the data referenced in paragraphs (a)(9)(ii)(B)(1)(i) through (vi) of this section.
- Linked referential CDS.
- Identify for a user diagnostic and therapeutic reference information in accordance at least one of the following standards and implementation specifications:
- The standard and implementation specifications specified in §170.204(b)(3).
- The standard and implementation specifications specified in §170.204(b)(4).
- For paragraph (a)(9)(iv)(A) of this section, technology must be able to identify for a user diagnostic or therapeutic reference information based on each one and at least one combination of the data referenced in paragraphs (a)(9)(ii)(B)(1)(i), (ii), and (iv) of this section.
- Identify for a user diagnostic and therapeutic reference information in accordance at least one of the following standards and implementation specifications:
- Source attributes. Enable a user to review the attributes as indicated for all CDS resources:
- For evidence-based decision support interventions under paragraph (a)(9)(iii) of this section:
- Bibliographic citation of the intervention (clinical research/guideline);
- Developer of the intervention (translation from clinical research/guideline);
- Funding source of the intervention development technical implementation; and
- Release and, if applicable, revision date(s) of the intervention or reference source.
- For linked referential CDS in paragraph (a)(9)(iv) of this section and drug-drug, drug-allergy interaction checks in paragraph (a)(4) of this section, the developer of the intervention, and where clinically indicated, the bibliographic citation of the intervention (clinical research/guideline).
- For evidence-based decision support interventions under paragraph (a)(9)(iii) of this section:
Cross Reference Criteria
§ 170.315(a)(5) (i) Enable a user to record, change, and access patient demographic data including race, ethnicity, preferred language, sex, sexual orientation, gender identity, and date of birth
§ 170.315(b)(2) (iii)(D) Upon a user's confirmation, automatically update the list, and incorporate the following data expressed according to the specified standard(s):
- Medications. At a minimum, the version of the standard specified in §170.207(d)(3);
- Medication allergies. At a minimum, the version of the standard specified in §170.207(d)(3); and
- Problems. At a minimum, the version of the standard specified in §170.207(a)(4).
Paragraph (a)(9)(iv)
§ 170.204(b)(3) Health Level 7 (HL7®) Version 3 Standard: Context Aware Knowledge Retrieval Application. (“Infobutton”), Knowledge Request, Release 2
HL7® Implementation Guide: Service-Oriented Architecture Implementations of the Context-aware Knowledge Retrieval (Infobutton) Domain, Release 1
§ 170.204(b)(4) HL7® Version 3 Standard: Context Aware Knowledge Retrieval Application. (“Infobutton”), Knowledge Request, Release 2
HL7® Version 3 Implementation Guide: Context-Aware Knowledge Retrieval (Infobutton), Release 4
Additional Resources
§ 170.205(a)(3) HL7® Implementation Guide for CDA® Release 2: IHE Health Story Consolidation, DSTU Release 1.1 (US Realm) Draft Standard for Trial Use July 2012
- Resource Documents
- Revision History
-
Version # Description of Change Version Date 1.0 Final Test Procedure
01-08-20161.1 Updated the section referenced in paragraph (a)(9)(v)(A) from (iv) to the paragraph (a)(9)(i), and reference in paragraph (a)(9)(v)(B) from paragraph (a)(9)(ii) to paragraph (a)(9)(iv).
Added reference resources to the verification for step 3 of paragraph (a)(9)(ii)(A) in the test lab verification section.
03-08-20161.2 Add transition of care/referral summary configuration step for paragraph (a)(9)(ii)(B)(2).
Corrected small typos throughout:
- TLV step 1.
- (A) SUT step 3.
- (B)(1) SUT
- (B) SUT and TLV
- (A)(1-4) TLV
- Standard §170.207(n)(1) to UNK
06-10-20161.3 As of September 21, 2017, Test Procedure has been moved to Attestation/Developer self-declaration only.
09-21-20171.4 Changes language from self-declaration to attestation
08-25-2021 - Regulation Text
-
Regulation Text
§ 170.315 (a)(9) Clinical decision support (CDS)—
- CDS intervention interaction. Interventions provided to a user must occur when a user is interacting with technology.
- CDS configuration.
- Enable interventions and reference resources specified in paragraphs (a)(9)(iii) and (iv) of this section to be configured by a limited set of identified users (e.g., system administrator) based on a user's role.
- Enable interventions:
- Based on the following data:
- Problem list;
- Medication list;
- Medication allergy list;
- At least one demographic specified in paragraph (a)(5)(i) of this section;
- Laboratory tests; and
- Vital signs.
- When a patient's medications, medication allergies, and problems are incorporated from a transition of care/referral summary received and pursuant to paragraph (b)(2)(iii)(D) of this section.
- Based on the following data:
- Evidence-based decision support interventions. Enable a limited set of identified users to select (i.e., activate) electronic CDS interventions (in addition to drug-drug and drug-allergy contraindication checking) based on each one and at least one combination of the data referenced in paragraphs (a)(9)(ii)(B)(1)(i) through (vi) of this section.
- Linked referential CDS.
- Identify for a user diagnostic and therapeutic reference information in accordance at least one of the following standards and implementation specifications:
- The standard and implementation specifications specified in §170.204(b)(3).
- The standard and implementation specifications specified in §170.204(b)(4).
- For paragraph (a)(9)(iv)(A) of this section, technology must be able to identify for a user diagnostic or therapeutic reference information based on each one and at least one combination of the data referenced in paragraphs (a)(9)(ii)(B)(1)(i), (ii), and (iv) of this section.
- Identify for a user diagnostic and therapeutic reference information in accordance at least one of the following standards and implementation specifications:
- Source attributes. Enable a user to review the attributes as indicated for all CDS resources:
- For evidence-based decision support interventions under paragraph (a)(9)(iii) of this section:
- Bibliographic citation of the intervention (clinical research/guideline);
- Developer of the intervention (translation from clinical research/guideline);
- Funding source of the intervention development technical implementation; and
- Release and, if applicable, revision date(s) of the intervention or reference source.
- For linked referential CDS in paragraph (a)(9)(iv) of this section and drug-drug, drug-allergy interaction checks in paragraph (a)(4) of this section, the developer of the intervention, and where clinically indicated, the bibliographic citation of the intervention (clinical research/guideline).
- For evidence-based decision support interventions under paragraph (a)(9)(iii) of this section:
- Standard(s) Referenced
-
Cross Reference Criteria
§ 170.315(a)(5) (i) Enable a user to record, change, and access patient demographic data including race, ethnicity, preferred language, sex, sexual orientation, gender identity, and date of birth
§ 170.315(b)(2) (iii)(D) Upon a user's confirmation, automatically update the list, and incorporate the following data expressed according to the specified standard(s):
- Medications. At a minimum, the version of the standard specified in §170.207(d)(3);
- Medication allergies. At a minimum, the version of the standard specified in §170.207(d)(3); and
- Problems. At a minimum, the version of the standard specified in §170.207(a)(4).
Paragraph (a)(9)(iv)§ 170.204(b)(3) Health Level 7 (HL7®) Version 3 Standard: Context Aware Knowledge Retrieval Application. (“Infobutton”), Knowledge Request, Release 2
HL7® Implementation Guide: Service-Oriented Architecture Implementations of the Context-aware Knowledge Retrieval (Infobutton) Domain, Release 1§ 170.204(b)(4) HL7® Version 3 Standard: Context Aware Knowledge Retrieval Application. (“Infobutton”), Knowledge Request, Release 2
HL7® Version 3 Implementation Guide: Context-Aware Knowledge Retrieval (Infobutton), Release 4Additional Resources
§ 170.205(a)(3) HL7® Implementation Guide for CDA® Release 2: IHE Health Story Consolidation, DSTU Release 1.1 (US Realm) Draft Standard for Trial Use July 2012
Testing components
Attestation: As of September 21, 2017, the testing approach for this criterion is satisfied by attestation.
The archived version of the Test Procedure is attached below for reference.
System Under Test |
ONC-ACB Verification |
---|---|
The health IT developer will attest directly to the ONC-ACB to conformance with the §170.315(a)(9) Clinical decision support requirements. |
The ONC-ACB verifies the health IT developer attests conformance to the §170.315(a)(9) Clinical decision support requirements. |
Version # | Description of Change | Version Date |
---|---|---|
1.0 |
Initial Publication |
10-22-2015
|
1.1 |
Made copy edits and fixed hyperlinks. |
12-18-2015
|
1.2 |
Clarification added to paragraph (a)(9)(ii)(B) related to content exchange standard. Clarification added to paragraph (a)(9)(iv)(A) related to Infobutton conformance. Clarification added to paragraph (a)(9)(iv)(B) related to demographic data. |
11-07-2016
|
1.3 |
Revised as a result of further analysis of the applicability of the 2015 Edition “amendments” certification criterion (§ 170.315(d)(4)) to health IT capabilities that would not necessarily have any patient data for which a request for an amendment would be relevant. |
04-24-2017
|
1.4 |
Removal of Amendments (§ 170.315(d)(4)) under Approach 1 in the Privacy and Security section of the table. |
05-08-2017
|
1.5 |
Updated the Security requirements per 21st Century Cures Act. |
06-15-2020
|
§ 170.315 (a)(9) Clinical decision support (CDS)—
- CDS intervention interaction. Interventions provided to a user must occur when a user is interacting with technology.
- CDS configuration.
- Enable interventions and reference resources specified in paragraphs (a)(9)(iii) and (iv) of this section to be configured by a limited set of identified users (e.g., system administrator) based on a user's role.
- Enable interventions:
- Based on the following data:
- Problem list;
- Medication list;
- Medication allergy list;
- At least one demographic specified in paragraph (a)(5)(i) of this section;
- Laboratory tests; and
- Vital signs.
- When a patient's medications, medication allergies, and problems are incorporated from a transition of care/referral summary received and pursuant to paragraph (b)(2)(iii)(D) of this section.
- Based on the following data:
- Evidence-based decision support interventions. Enable a limited set of identified users to select (i.e., activate) electronic CDS interventions (in addition to drug-drug and drug-allergy contraindication checking) based on each one and at least one combination of the data referenced in paragraphs (a)(9)(ii)(B)(1)(i) through (vi) of this section.
- Linked referential CDS.
- Identify for a user diagnostic and therapeutic reference information in accordance at least one of the following standards and implementation specifications:
- The standard and implementation specifications specified in §170.204(b)(3).
- The standard and implementation specifications specified in §170.204(b)(4).
- For paragraph (a)(9)(iv)(A) of this section, technology must be able to identify for a user diagnostic or therapeutic reference information based on each one and at least one combination of the data referenced in paragraphs (a)(9)(ii)(B)(1)(i), (ii), and (iv) of this section.
- Identify for a user diagnostic and therapeutic reference information in accordance at least one of the following standards and implementation specifications:
- Source attributes. Enable a user to review the attributes as indicated for all CDS resources:
- For evidence-based decision support interventions under paragraph (a)(9)(iii) of this section:
- Bibliographic citation of the intervention (clinical research/guideline);
- Developer of the intervention (translation from clinical research/guideline);
- Funding source of the intervention development technical implementation; and
- Release and, if applicable, revision date(s) of the intervention or reference source.
- For linked referential CDS in paragraph (a)(9)(iv) of this section and drug-drug, drug-allergy interaction checks in paragraph (a)(4) of this section, the developer of the intervention, and where clinically indicated, the bibliographic citation of the intervention (clinical research/guideline).
- For evidence-based decision support interventions under paragraph (a)(9)(iii) of this section:
Cross Reference Criteria
§ 170.315(a)(5) (i) Enable a user to record, change, and access patient demographic data including race, ethnicity, preferred language, sex, sexual orientation, gender identity, and date of birth
§ 170.315(b)(2) (iii)(D) Upon a user's confirmation, automatically update the list, and incorporate the following data expressed according to the specified standard(s):
- Medications. At a minimum, the version of the standard specified in §170.207(d)(3);
- Medication allergies. At a minimum, the version of the standard specified in §170.207(d)(3); and
- Problems. At a minimum, the version of the standard specified in §170.207(a)(4).
Paragraph (a)(9)(iv)
§ 170.204(b)(3) Health Level 7 (HL7®) Version 3 Standard: Context Aware Knowledge Retrieval Application. (“Infobutton”), Knowledge Request, Release 2
HL7® Implementation Guide: Service-Oriented Architecture Implementations of the Context-aware Knowledge Retrieval (Infobutton) Domain, Release 1
§ 170.204(b)(4) HL7® Version 3 Standard: Context Aware Knowledge Retrieval Application. (“Infobutton”), Knowledge Request, Release 2
HL7® Version 3 Implementation Guide: Context-Aware Knowledge Retrieval (Infobutton), Release 4
Additional Resources
§ 170.205(a)(3) HL7® Implementation Guide for CDA® Release 2: IHE Health Story Consolidation, DSTU Release 1.1 (US Realm) Draft Standard for Trial Use July 2012
- Resource Documents
- Revision History
-
Version # Description of Change Version Date 1.0 Initial Publication
10-22-20151.1 Made copy edits and fixed hyperlinks.
12-18-20151.2 Clarification added to paragraph (a)(9)(ii)(B) related to content exchange standard.
Clarification added to paragraph (a)(9)(iv)(A) related to Infobutton conformance.
Clarification added to paragraph (a)(9)(iv)(B) related to demographic data.
11-07-20161.3 Revised as a result of further analysis of the applicability of the 2015 Edition “amendments” certification criterion (§ 170.315(d)(4)) to health IT capabilities that would not necessarily have any patient data for which a request for an amendment would be relevant.
04-24-20171.4 Removal of Amendments (§ 170.315(d)(4)) under Approach 1 in the Privacy and Security section of the table.
05-08-20171.5 Updated the Security requirements per 21st Century Cures Act.
06-15-2020 - Regulation Text
-
Regulation Text
§ 170.315 (a)(9) Clinical decision support (CDS)—
- CDS intervention interaction. Interventions provided to a user must occur when a user is interacting with technology.
- CDS configuration.
- Enable interventions and reference resources specified in paragraphs (a)(9)(iii) and (iv) of this section to be configured by a limited set of identified users (e.g., system administrator) based on a user's role.
- Enable interventions:
- Based on the following data:
- Problem list;
- Medication list;
- Medication allergy list;
- At least one demographic specified in paragraph (a)(5)(i) of this section;
- Laboratory tests; and
- Vital signs.
- When a patient's medications, medication allergies, and problems are incorporated from a transition of care/referral summary received and pursuant to paragraph (b)(2)(iii)(D) of this section.
- Based on the following data:
- Evidence-based decision support interventions. Enable a limited set of identified users to select (i.e., activate) electronic CDS interventions (in addition to drug-drug and drug-allergy contraindication checking) based on each one and at least one combination of the data referenced in paragraphs (a)(9)(ii)(B)(1)(i) through (vi) of this section.
- Linked referential CDS.
- Identify for a user diagnostic and therapeutic reference information in accordance at least one of the following standards and implementation specifications:
- The standard and implementation specifications specified in §170.204(b)(3).
- The standard and implementation specifications specified in §170.204(b)(4).
- For paragraph (a)(9)(iv)(A) of this section, technology must be able to identify for a user diagnostic or therapeutic reference information based on each one and at least one combination of the data referenced in paragraphs (a)(9)(ii)(B)(1)(i), (ii), and (iv) of this section.
- Identify for a user diagnostic and therapeutic reference information in accordance at least one of the following standards and implementation specifications:
- Source attributes. Enable a user to review the attributes as indicated for all CDS resources:
- For evidence-based decision support interventions under paragraph (a)(9)(iii) of this section:
- Bibliographic citation of the intervention (clinical research/guideline);
- Developer of the intervention (translation from clinical research/guideline);
- Funding source of the intervention development technical implementation; and
- Release and, if applicable, revision date(s) of the intervention or reference source.
- For linked referential CDS in paragraph (a)(9)(iv) of this section and drug-drug, drug-allergy interaction checks in paragraph (a)(4) of this section, the developer of the intervention, and where clinically indicated, the bibliographic citation of the intervention (clinical research/guideline).
- For evidence-based decision support interventions under paragraph (a)(9)(iii) of this section:
- Standard(s) Referenced
-
Cross Reference Criteria
§ 170.315(a)(5) (i) Enable a user to record, change, and access patient demographic data including race, ethnicity, preferred language, sex, sexual orientation, gender identity, and date of birth
§ 170.315(b)(2) (iii)(D) Upon a user's confirmation, automatically update the list, and incorporate the following data expressed according to the specified standard(s):
- Medications. At a minimum, the version of the standard specified in §170.207(d)(3);
- Medication allergies. At a minimum, the version of the standard specified in §170.207(d)(3); and
- Problems. At a minimum, the version of the standard specified in §170.207(a)(4).
Paragraph (a)(9)(iv)§ 170.204(b)(3) Health Level 7 (HL7®) Version 3 Standard: Context Aware Knowledge Retrieval Application. (“Infobutton”), Knowledge Request, Release 2
HL7® Implementation Guide: Service-Oriented Architecture Implementations of the Context-aware Knowledge Retrieval (Infobutton) Domain, Release 1§ 170.204(b)(4) HL7® Version 3 Standard: Context Aware Knowledge Retrieval Application. (“Infobutton”), Knowledge Request, Release 2
HL7® Version 3 Implementation Guide: Context-Aware Knowledge Retrieval (Infobutton), Release 4Additional Resources
§ 170.205(a)(3) HL7® Implementation Guide for CDA® Release 2: IHE Health Story Consolidation, DSTU Release 1.1 (US Realm) Draft Standard for Trial Use July 2012
Certification Companion Guide: Clinical decision support (CDS)
This Certification Companion Guide (CCG) is an informative document designed to assist with health IT product development. The CCG is not a substitute for the 2015 Edition final regulation. It extracts key portions of the rule’s preamble and includes subsequent clarifying interpretations. To access the full context of regulatory intent please consult the 2015 Edition final rule or other included regulatory reference. The CCG is for public use and should not be sold or redistributed.
Base EHR Definition | In Scope for CEHRT Definition | Real World Testing | USCDI | SVAP |
---|---|---|---|---|
Included | Yes | No | No | No |
Privacy and Security: This certification criterion was adopted at § 170.315(a)(9). As a result, an ONC Authorized Certification Body (ONC-ACB) must ensure that a product presented for certification to a § 170.315(a) criterion includes the privacy and security criteria (adopted in § 170.315(d)) within the overall scope of the certificate issued to the product.
- The privacy and security criteria (adopted in § 170.315(d)) do not need to be explicitly tested with this specific paragraph (a) criterion unless it is the only criterion for which certification is requested.
- As a general rule, a product presented for certification only needs to be presented once to each applicable privacy and security criterion (adopted in § 170.315(d)) so long as the health IT developer attests that such privacy and security capabilities apply to the full scope of capabilities included in the requested certification. However, exceptions exist for § 170.315(e)(1) “View, download, and transmit to 3rd party (VDT)” and (e)(2) “Secure messaging,” which are explicitly stated.
- Health IT presented for certification to this criterion would not have to demonstrate the capabilities required by the 2015 Edition “Amendments” certification criterion (§ 170.315(d)(4)), unless the health IT is presented for certification to another criterion that requires certification to the 2015 Edition “Amendments” criterion under the privacy and security certification framework.
- § 170.315(d)(2)(i)(C) is not required if the scope of the Health IT Module does not have end-user device encryption features.
- If choosing Approach 1:
- Authentication, access control, and authorization (§ 170.315(d)(1))
- Auditable events and tamper-resistance (§ 170.315(d)(2))
- Audit reports (§ 170.315(d)(3))
- Automatic access time-out (§ 170.315(d)(5))
- Emergency access (§ 170.315(d)(6))
- End-user device encryption (§ 170.315(d)(7))
- Encrypt authentication credentials (§ 170.315(d)(12))
- Multi-factor authentication (MFA) (§ 170.315(d)(13))
- If choosing Approach 2:
- For each applicable privacy and security certification criterion not certified for Approach 1, the health IT developer may certify using system documentation which is sufficiently detailed to enable integration such that the Health IT Module has implemented service interfaces the Health IT Module to access external services necessary to meet the requirements of the privacy and security certification criterion. Please see the 21st Century Cures Act: Interoperability, Information Blocking, and the ONC Health IT Certification Program Final Rule at 85 FR 25710 for additional clarification.
Design and Performance: The following design and performance certification criteria (adopted in § 170.315(g)) must also be certified in order for the product to be certified.
- Safety-enhanced design (§ 170.315(g)(3)) must be explicitly demonstrated for this criterion.
- When a single quality management system (QMS) is used, the QMS only needs to be identified once. Otherwise, the QMS’ need to be identified for every capability to which it was applied.
- When a single accessibility-centered design standard is used, the standard only needs to be identified once. Otherwise, the accessibility-centered design standards need to be identified for every capability to which they were applied; or, alternatively, the developer must state that no accessibility-centered design was used.
Privacy and Security: This certification criterion was adopted at § 170.315(a)(9). As a result, an ONC Authorized Certification Body (ONC-ACB) must ensure that a product presented for certification to a § 170.315(a) criterion includes the privacy and security criteria (adopted in § 170.315(d)) within the overall scope of the certificate issued to the product.
- The privacy and security criteria (adopted in § 170.315(d)) do not need to be explicitly tested with this specific paragraph (a) criterion unless it is the only criterion for which certification is requested.
- As a general rule, a product presented for certification only needs to be presented once to each applicable privacy and security criterion (adopted in § 170.315(d)) so long as the health IT developer attests that such privacy and security capabilities apply to the full scope of capabilities included in the requested certification. However, exceptions exist for § 170.315(e)(1) “View, download, and transmit to 3rd party (VDT)” and (e)(2) “Secure messaging,” which are explicitly stated.
- Health IT presented for certification to this criterion would not have to demonstrate the capabilities required by the 2015 Edition “Amendments” certification criterion (§ 170.315(d)(4)), unless the health IT is presented for certification to another criterion that requires certification to the 2015 Edition “Amendments” criterion under the privacy and security certification framework.
- § 170.315(d)(2)(i)(C) is not required if the scope of the Health IT Module does not have end-user device encryption features.
Design and Performance: The following design and performance certification criteria (adopted in § 170.315(g)) must also be certified in order for the product to be certified.
- Safety-enhanced design (§ 170.315(g)(3)) must be explicitly demonstrated for this criterion.
- When a single quality management system (QMS) is used, the QMS only needs to be identified once. Otherwise, the QMS’ need to be identified for every capability to which it was applied.
- When a single accessibility-centered design standard is used, the standard only needs to be identified once. Otherwise, the accessibility-centered design standards need to be identified for every capability to which they were applied; or, alternatively, the developer must state that no accessibility-centered design was used.
- If choosing Approach 1:
- Authentication, access control, and authorization (§ 170.315(d)(1))
- Auditable events and tamper-resistance (§ 170.315(d)(2))
- Audit reports (§ 170.315(d)(3))
- Automatic access time-out (§ 170.315(d)(5))
- Emergency access (§ 170.315(d)(6))
- End-user device encryption (§ 170.315(d)(7))
- Encrypt authentication credentials (§ 170.315(d)(12))
- Multi-factor authentication (MFA) (§ 170.315(d)(13))
- If choosing Approach 2:
- For each applicable privacy and security certification criterion not certified for Approach 1, the health IT developer may certify using system documentation which is sufficiently detailed to enable integration such that the Health IT Module has implemented service interfaces the Health IT Module to access external services necessary to meet the requirements of the privacy and security certification criterion. Please see the 21st Century Cures Act: Interoperability, Information Blocking, and the ONC Health IT Certification Program Final Rule at 85 FR 25710 for additional clarification.
Applies to entire criterion
Clarifications:
- The terms “automatically” and “trigger” in the 2015 Edition Clinical decision support (CDS) criterion have not been included in order to clarify that our intent is to encompass all types of CDS interventions without being prescriptive on how the interventions are deployed. [see also 80 FR 62622]
- A CDS intervention is not simply an alert, notification, or explicit care suggestion. Rather, it should be more broadly interpreted as the user-facing representation of evidence-based clinical guidance based on relevant patient data. [see also 77 FR 54212]
- Health IT developers are encouraged to use standards to retrieve CDS content from external sources rather than “hard coding” CDS interventions to static data in the system. [see also 77 FR 54213]
- The National Library of Medicine hosts a publicly available repository of value sets for use in CDS and clinical quality measures that are available as a resource to developers. Please see: https://vsac.nlm.nih.gov/. [see also 77 FR 54213]
Applies to entire criterion
Clarifications:
|
Paragraph (a)(9)(i)
Technical outcome – CDS configuration (per provision (a)(9)(ii)), CDS activation (per provision (a)(9)(iii)), and reference information (per provision (a)(9)(iv)), occur when a user is interacting with health IT.
Clarifications:
- No additional clarifications.
Paragraph (a)(9)(i)
Technical outcome – CDS configuration (per provision (a)(9)(ii)), CDS activation (per provision (a)(9)(iii)), and reference information (per provision (a)(9)(iv)), occur when a user is interacting with health IT. Clarifications:
|
Paragraph (a)(9)(ii)(A)
Technical outcome – A limited set of identified users can configure interventions per provision (a)(9)(iii) and reference information per provision (a)(9)(iv) based on a user’s role.
Clarifications:
- No additional clarifications.
Paragraph (a)(9)(ii)(A)
Technical outcome – A limited set of identified users can configure interventions per provision (a)(9)(iii) and reference information per provision (a)(9)(iv) based on a user’s role. Clarifications:
|
Paragraph (a)(9)(ii)(B)
Technical outcome – CDS interventions are based on the data named in (a)(9)(ii)(B)(1)(i)-(vi) and when a patient’s medication, medication allergies, and problems are incorporated from a transition of care/referral summary.
Clarifications:
- The demographic data specified at (a)(9)(ii)(B)(1)(iv) are: race, ethnicity, preferred language, sex, sexual orientation, gender identity, and date of birth. [see also § 170.315(a)(5) Demographics CCG]
- To meet the requirements of this provision, interventions based on demographics only need to be based on one of the demographics data types (e.g., sex or date of birth). [see also Health IT Certification Program Overview]
- The health IT does not need to “trigger” an intervention at the time of incorporation, only demonstrate that CDS interventions can be based on the data incorporated from a transition of care/referral summary. Thus, for the purposes of this certification criterion, ONC clarifies that the technology must be capable of demonstrating that it behaves differently in two states: before and after the incorporation of new information. [see also 77 FR 54214]
- For conformance to (a)(9)(ii)(B)(2), health IT must demonstrate that it can enable CDS interventions for incorporated medications, medication allergies, and problems (collectively "data"). The ability to incorporate the data from any content exchange standard is not relevant to conformance with this requirement (i.e., neither tested nor certified).
Paragraph (a)(9)(ii)(B)
Technical outcome – CDS interventions are based on the data named in (a)(9)(ii)(B)(1)(i)-(vi) and when a patient’s medication, medication allergies, and problems are incorporated from a transition of care/referral summary. Clarifications:
|
Paragraph (a)(9)(iii)
Technical outcome – A limited set of users can activate CDS interventions based on each data listed in (a)(9)(ii)(B)(1)(i)-(vi), and at least one combination of the data listed in (a)(9)(ii)(B)(1)(i)-(vi).
Clarifications:
- For this criterion, “select” means the same as “activate.” [see also 77 FR 54213]
- “User” is not constrained to mean just “licensed healthcare professional.” For example, a clerical user or patient user may interact with the certified health IT system. [see also 77 FR 54214]
Paragraph (a)(9)(iii)
Technical outcome – A limited set of users can activate CDS interventions based on each data listed in (a)(9)(ii)(B)(1)(i)-(vi), and at least one combination of the data listed in (a)(9)(ii)(B)(1)(i)-(vi). Clarifications:
|
Paragraph (a)(9)(iv)(A)
Technical outcome – Health IT can identify diagnostic and therapeutic reference information using the HL7® V3 Context Aware Knowledge Retrieval Application (“Infobutton”) standard in combination with one of the following implementation guides:
- HL7® Service-Oriented Architecture Implementations of Infobutton.
- HL7® V3 Context Aware Knowledge Retrieval.
Clarifications:
- ONC clarifies that our certification approach only focuses on capabilities that must be certified to meet this criterion, not that a provider must use these standards or functions. A health IT developer’s product could include other means for identifying diagnostic or therapeutic reference information, but there are no certification requirements for other means for this criterion. [see also 80 FR 62622] While ONC does not certify knowledge publishers, we encourage them to adopt the Infobutton standard to facilitate providing patient and/or provider facing clinical content to health IT products. [see also 77 FR 54214]
- This portion of the criterion focuses on Infobutton conformance and performance in relation to health IT’s ability to interact with an Infobutton-enabled source. Additionally, this portion of the criterion provides context as part of the CDS certification criterion as a whole that this specific capability is intended to enable “diagnostic and therapeutic reference information” to be provided to a user via an Infobutton conformant capability. For the purposes of testing and certification, a health IT developer may demonstrate its product’s Infobutton conformance with any Infobutton-enabled content source so long as the capabilities specified in paragraph (a)(9)(iv) and respective data referenced are fully demonstrated (or documented) as part of testing.
Paragraph (a)(9)(iv)(A)
Technical outcome – Health IT can identify diagnostic and therapeutic reference information using the HL7® V3 Context Aware Knowledge Retrieval Application (“Infobutton”) standard in combination with one of the following implementation guides:
Clarifications:
|
Paragraph (a)(9)(iv)(B)
Technical outcome – For the diagnostic or therapeutic reference information identified in provision (a)(9)(iv)(A), technology must be able to base the reference information on each of the following: problem list, medication list, and demographics. Technology must also be able to identify reference information on at least one combination of problem list, medication list, and demographics.
Clarifications:
- The demographic data specified at paragraph (a)(9)(ii)(B)(1)(iv) are: race, ethnicity, preferred language, sex, sexual orientation, gender identity, and date of birth. [see also § 170.315(a)(5) Demographics CCG]
- ONC does not intend for demographic data to be individually tested or required for certification as part of the “each one” requirement of this specific capability. ONC also understands and clarifies that with respect to demographics data that certain demographic data (e.g., age) can and should be used as a modifier. ONC intends for testing and certification to evaluate this specific capability in that way. [see also Health IT Certification Program Overview]
Paragraph (a)(9)(iv)(B)
Technical outcome – For the diagnostic or therapeutic reference information identified in provision (a)(9)(iv)(A), technology must be able to base the reference information on each of the following: problem list, medication list, and demographics. Technology must also be able to identify reference information on at least one combination of problem list, medication list, and demographics. Clarifications:
|
Paragraph (a)(9)(v)(A)
Technical outcome – A user can review the source attributes for all CDS interventions provided in provision (a)(9)(i).
Clarifications:
- ONC does not require the automatic display of the source attributes, just the availability of the information to the end-user.
- For example, additional action may be required for a user to “drill down” or “link out” to view the source attributes of CDS. [see also 77 FR 54215]
- ONC also does not require that the EHR technology create the content for the source attributes. [see also 77 FR 54215]
- “Bibliographic citation” is a reference (if available) to a publication of clinical research that documents the clinical value of the intervention. If no such reference exists (e.g., locally developed intervention), the health IT product should indicate so. [see also 77 FR 54215]
- “Developer of the intervention (translation from clinical research/guideline)” is the team, person, organization, department or other entity that interpreted the clinical research and translated it into computable form (sometimes the knowledge vendor). [see also 77 FR 54215]
- “Funding source of the intervention development technical implementation” is the source of funding for the work performed by the “developer of the intervention.” If this information is unknown, the user should have access to know that it is unknown. [see also 77 FR 54215]
Paragraph (a)(9)(v)(A)
Technical outcome – A user can review the source attributes for all CDS interventions provided in provision (a)(9)(i). Clarifications:
|
Paragraph (a)(9)(v)(B)
Technical outcome – A user can review the source attributes (specifically the developer of the intervention, and where clinically indicated, the bibliographic citation of the intervention) for all reference information provided in provision (a)(9)(iv) and all drug-drug, drug-allergy interaction checks.
Clarifications:
- Please refer to the CCG for the § 170.315(a)(4) Drug-drug, drug-allergy interaction checks for CPOE certification criterion for more information.
- For drug-drug, drug-allergy interaction checks, global citations are permitted in cases where all interventions of a given type are provided by the same reference. [see also 77 FR 54215]
Paragraph (a)(9)(v)(B)
Technical outcome – A user can review the source attributes (specifically the developer of the intervention, and where clinically indicated, the bibliographic citation of the intervention) for all reference information provided in provision (a)(9)(iv) and all drug-drug, drug-allergy interaction checks. Clarifications:
|