§170.315(d)(6) Emergency access
Version # | Description of Change | Version Date |
---|---|---|
1.0 |
Final Test Procedure |
01-08-2016
|
1.1 |
As of September 21, 2017, Test Procedure has been moved to Attestation/Developer self-declaration only. |
09-21-2017
|
1.2 |
Changed language from self-declaration to attestation |
08-25-2021
|
§ 170.315 (d)(6) Emergency access—
Permit an identified set of users to access electronic health information during an emergency.
None
- Resource Documents
- Revision History
-
Version # Description of Change Version Date 1.0 Final Test Procedure
01-08-20161.1 As of September 21, 2017, Test Procedure has been moved to Attestation/Developer self-declaration only.
09-21-20171.2 Changed language from self-declaration to attestation
08-25-2021 - Regulation Text
-
Regulation Text
§ 170.315 (d)(6) Emergency access—
Permit an identified set of users to access electronic health information during an emergency.
- Standard(s) Referenced
-
None
Testing components
Attestation: As of September 21, 2017, the testing approach for this criterion is satisfied by attestation.
The archived version of the Test Procedure is attached below for reference.
System Under Test |
ONC-ACB Verification |
---|---|
The health IT developer will attest directly to the ONC-ACB to conformance with the §170.315(d)(6) Emergency access requirements. |
The ONC-ACB verifies the health IT developer attests conformance with the §170.315(d)(6) Emergency access requirements. |
Version # | Description of Change | Version Date |
---|---|---|
1.0 |
Initial Publication |
10-22-2015
|
1.1 |
Added clarification that emergency access capabilities must be provided electronically. |
12-18-2015
|
1.2 |
Clarification added to explain the scope of emergency access. Clarification and guidance also provided for demonstrating compliance with the criterion. |
07-20-2016
|
§ 170.315 (d)(6) Emergency access—
Permit an identified set of users to access electronic health information during an emergency.
None
- Resource Documents
- Revision History
-
Version # Description of Change Version Date 1.0 Initial Publication
10-22-20151.1 Added clarification that emergency access capabilities must be provided electronically.
12-18-20151.2 Clarification added to explain the scope of emergency access. Clarification and guidance also provided for demonstrating compliance with the criterion.
07-20-2016 - Regulation Text
-
Regulation Text
§ 170.315 (d)(6) Emergency access—
Permit an identified set of users to access electronic health information during an emergency.
- Standard(s) Referenced
-
None
Certification Companion Guide: Emergency access
This Certification Companion Guide (CCG) is an informative document designed to assist with health IT product development. The CCG is not a substitute for the 2015 Edition final regulation. It extracts key portions of the rule’s preamble and includes subsequent clarifying interpretations. To access the full context of regulatory intent please consult the 2015 Edition final rule or other included regulatory reference. The CCG is for public use and should not be sold or redistributed.
Base EHR Definition | In Scope for CEHRT Definition | Real World Testing | USCDI | SVAP |
---|---|---|---|---|
Not Included | No | No | No | No |
Quality management system (§ 170.315(g)(4)) and accessibility-centered design (§ 170.315(g)(5)) must be certified as part of the overall scope of the certificate issued to the product.
- When a single quality management system (QMS) is used, the QMS only needs to be identified once. Otherwise, the QMS’ need to be identified for every capability to which it was applied.
- When a single accessibility-centered design standard is used, the standard only needs to be identified once. Otherwise, the accessibility-centered design standards need to be identified for every capability to which they were applied; or, alternatively, the developer must state that no accessibility-centered design was used.
Quality management system (§ 170.315(g)(4)) and accessibility-centered design (§ 170.315(g)(5)) must be certified as part of the overall scope of the certificate issued to the product.
- When a single quality management system (QMS) is used, the QMS only needs to be identified once. Otherwise, the QMS’ need to be identified for every capability to which it was applied.
- When a single accessibility-centered design standard is used, the standard only needs to be identified once. Otherwise, the accessibility-centered design standards need to be identified for every capability to which they were applied; or, alternatively, the developer must state that no accessibility-centered design was used.
Applies to entire criterion
Technical outcome – The health IT must be able to grant access to an identified set of users during an emergency.
Clarifications:
- There is no standard associated with this criterion.
- The criterion is not intended to specify what constitutes an emergency or who would be authorized to access electronic health information in an emergency. Those determinations should be made with applicable state and federal laws, organizational policies and procedures, and the relevant standard of care. Likewise, an “emergency” is not limited to clinical or life threatening emergencies but could include other scenarios such as those related to normal patient care when timely access to electronic health information becomes critical. [see also 75 FR 44617]
- ONC believes this criterion is consistent with the HIPAA Security Final Rule (68 FR 8355), which states “We believe that emergency access is a necessary part of access controls and, therefore, is properly a required implementation specification of the “Access controls” standard. Access controls will still be necessary under emergency conditions, although they may be very different from those used in normal operational circumstances. For example, in a situation when normal environmental systems, including electrical power, have been severely damaged or rendered inoperative due to a natural or manmade disaster, procedures should be established beforehand to provide guidance on possible ways to gain access to needed electronic protected health information.” [see also 75 FR 44617]
- Emergency access is intended to cover a broad range of scenarios, including life threatening emergencies related to the patient as well as normal patient care where timely access to electronic health information becomes critical. [see also 75 FR 44617]
- Emergency access is part of a Health IT' Module's general access control and should be established before the emergency, potentially as a “pre-set” function. [see also 75 FR 44617] The goal of the capability is to ensure that there is a way for identified users to have access (e.g., by elevating their access privileges) in an emergency to gain or maintain access to patient health information, which should be an auditable event. [see also 80 FR 62655] In sum, the "emergency access" functionality should be demonstrated based on the access rules already built into the Health IT Module.
Applies to entire criterion
Technical outcome – The health IT must be able to grant access to an identified set of users during an emergency. Clarifications:
|