VIA ELCTRONIC SUBMISSION @ www.regulations.gov March 15, 2010
David Blumenthal, M.D., M.P.P.
National Coordinator for Health Information Technology
HHS/Office of the National Coordinator for Health Information Technology Hubert H. Humphrey Building, Suite 729D
200 Independence Avenue, S.W. Washington, D.C. 20201
Attention: HITECH Initial Set Interim Final Rule RIN 0991-AB58 Dear Dr. Blumenthal:
The Association of American Medical Colleges (AAMC) welcomes this opportunity to comment on the Office of the National Coordinator for Health Information Technology’s (ONC) interim final rule entitled “Health Information Technology: Initial Set of Standards, Implementation Specifications, and Certification Criteria for Electronic Health Record Technology,” 75 Fed. Reg. 2014 (January 13, 2010). The AAMC is a not-for-profit association representing all 131 accredited U.S. and 17 accredited Canadian medical schools; nearly 400 major teaching hospitals and health systems, including 68 Department of Veterans Affairs’ medical centers; and nearly 90 academic and scientific societies. Through these institutions and organizations, the AAMC represents nearly 110,000 clinical faculty members, 75,000 medical students, and 110,000 resident physicians.
The AAMC supports the goal of improving patient care through improved information capture, utilization and dissemination. Our members are committed to providing high-quality,
coordinated care with the aid of certified electronic health record (EHR) technology. Many of our members have been leaders in developing and deploying health information technology and have contributed their experiences through the HIT Policy Committee to help shape this rule. We recognize that creating a framework and process for moving organizations and the industry forward toward this common goal – while at the same time not overreaching - is a delicate balance.
The interim final rule (IFR) was developed to support meaningful use as defined in the Center for Medicare and Medicaid Services (CMS) “Medicare and Medicaid Programs: Electronic Health Record Incentive Program” Notice of Proposed Rule Making (NPRM) (75 Fed. Reg. 1844) through the adoption of standards, implementation specifications, and certification criteria that will enhance the interoperability, functionality, utility, and security of health information
technology. The rule identifies the certification criteria that must be present for an EHR or module to be certified and eligible for use in meeting the meaningful use objectives. The rule also identifies the standards and implementation specifications for data capture, use, transport, and protection.
The AAMC commends the ONC for scanning the environment and coordinating these standards with current standards implementation underway through previous rulemaking such as the HIPAA Transactions and Code Sets and the Medicare Prescription Drug Improvement and Modernization Act. Such coordination will reduce the burden and makes the transition more manageable.
Our comments focus on the following areas:
The ONC’s general approach to certifying “EHR Modules” and “Complete EHR”; Claims submission and eligibility;
The need to clarify the term “online access”;
Industry readiness to move to a single patient summary record; Encryption of data at rest;
Accounting for disclosures; and Release of implementation guidance.
DEFINITIONS OF EHR MODULES, COMPLETE EHRS, AND CERTIFIED EHR TECHNOLOGY (pages 2022-2023)
In the IFR, the ONC defines Certified EHR Technology to include both Complete EHRs and combinations of EHR Modules. We support allowing providers a variety of means to achieve certification, as many organizations use different applications to perform aspects of meaningful use, and it is not always feasible or desirable to move to a single platform. In stating that providers “that elect to adopt and implement certified EHR modules should take care to ensure that the certified EHR modules they select are interoperable and can properly perform in their expected operational environment,” however, the ONC has placed the burden of interoperability squarely on providers who choose to use a suite of certified EHR modules. The AAMC strongly encourages the ONC to remove much of this burden from the provider by clarifying the term “interoperability” in the context of meaningful use. It is not clear if “interoperability” refers to data portability of specific data elements from application to application, linking of patient identification numbers across systems and pulling patient information into a single user interface, or some other interpretation. We recommend that ONC provide guidance to providers on how to “ensure that the certified EHR modules they select are interoperable,” so they may meet the requirements of meaningful use.
CERTIFICATION CRITERIA FOR COMPLETE EHRS OR EHR MODULES: CLAIMS SUBMISSION AND ELIGIBILITY CRITERIA (page 2027)
We are concerned about the inclusion of administrative transactions, claims submission, and eligibility, as part of Certified EHR Technology. HIPAA explicitly enables an entity to use a clearinghouse to perform these transactions rather than performing them directly from its practice management systems or EHR, and organizations commonly use clearinghouses for this purpose. The ONC proposal would require providers to change business processes that have no impact on improving quality and safety. Also, most “Complete EHR” systems that exist today do not have the capability to perform HIPAA administrative transactions, and most stand-alone administrative systems do not have claims submission and eligibility modules that could be isolated and converted easily into “EHR Modules.” Integrating administrative capabilities into EHR systems would require not only technical changes, but also operational and workflow changes, which would be quite expensive for both vendors and providers. We recommend that electronic claims submission and eligibility be removed as a certification criterion for EHR technology.
SPECIFIC CERTIFICATION CRITERIA FOR COMPLETE EHRs OR EHR MODULES DESIGNED FOR AN AMBULATORY SETTING (page 2046)
The AAMC requests that the ONC clarify “online access,” as this term relates to providing patients with timely electronic access. At proposed 45 C.F.R. § 170.304(g), the ONC adopts the following certification criterion for EHRs or EHR modules designed for an ambulatory setting:
Timely Access. Enable a user to provider patients with online access to their clinical information, including, at a minimum, lab test results, problem list, medication list, medication allergy list, immunizations, and procedures.
It is unclear if this requirement means the eligible provider must have a patient portal, deliver clinical information to a personal health record (PHR), or use some other online presentation. The AAMC recommends that the term “electronic access” not be equated with “online access.” Only the most advanced EHR users are likely to have patient portals at this time, and we believe the ONC should allow other methods for patient access to clinical information. For example, electronic access could be achieved by using thumb drives and CDs, without burdening providers with the potentially more expensive and resource intensive “online access” approach. For these reasons, we recommend that ONC replace the term “online access” with the term “electronic access” in the definition of “Timely Access” at 45 C.F.R. § 170.304(g).
CONTENT EXCHANGE AND VOCABULARY STANDARDS: PATIENT SUMMARY RECORD (page 2031)
For the patient summary record content exchange standard, the ONC asked for comment on the industry readiness to move to a single standard. We believe the majority of the industry
currently uses the HL7 CDA and believe there is a strong desire to move in this direction. We appreciate ONC’s desire to allow market forces to play out and that the HL7 CDA and CCD
serve different purposes. Ideally, these two standards could be harmonized, although that does not appear to be likely in the near-term. The AAMC recommends that the ONC select the HL7 CDA as the applicable standard for patient summary content exchange. The HL7 CDA is more widely implemented and provides the meta-data needed for quality reporting. The use of a single standard will be welcomed by providers and vendors.
PRIVACY AND SECURITY STANDARDS: ENCRYTION AND DECRYPTION OF ELECTRONIC HEALTH INFORMATION (page 2035)
As a security standard in table 2B row 1, ONC indicates “a symmetric 128 bit fixed-block cipher algorithm capable of using a 128, 192 or 256 bit encryption key must be used.” It is not clear whether ONC intends for this requirement to apply to all electronic health information stored in EHRs and EHR Modules, or if it is meant to apply only to mobile devices. Since there is a separate requirement for encryption and decryption of electronic health information exchange, we infer that this requirement refers to stored data or data at “rest.” We request that ONC clarify that encrypting data at rest refers only to mobile devices and does not include business systems that are inside the organization’s firewall and that use authentication. These are low risk systems for which a requirement of encryption would be a time-consuming and expensive step that would provide limited return.
PRIVACY AND SECURITY STANDARDS: RECORD TREATMENT, PAYMENT AND HEALTH CARE OPERATIONS DISCLOSURES (page 2035)
In table 2B row 6 of the privacy and security standards, we recommend that the expectation for capturing and recording a “description of the disclosure” be clarified to allow for the description to take place outside the real-time disclosure rather than requiring the capture of a “human-readable” format in real time. The need for real-time recording of disclosure-related events thus could be minimized, creating the desired result with minimal real-time burden on the EHR system or user. Experience with the current HIPAA accounting for disclosures requirement has shown that very few patients exercise this right. Therefore, there is no reason that ONC should impose an unreasonable burden on providers by requiring real-time accounting. The ONC instead could require a coded system that is translated into a “human-readable” format on an as-needed basis outside the care process.
IMPLEMENTATION SPECIFICATIONS (page 2035)
The AAMC understands the limited implementation guidance provided in the rule was intended to allow for more flexibility by not tying the implementation process to rulemaking. While this is a reasonable approach, we believe it requires ONC to release implementation guidance when the IFR is finalized, or close to that time, so as to avoid limiting market movement.
Thank you for the opportunity to present our views. We would be happy to work with the ONC on any of the issues discussed above or other topics that involve the academic health center community. If you have questions regarding our comments, please feel free to contact Morgan Passiment at 202-828-0476 or at [email protected].
Sincerely,
Darrell G. Kirch, M.D.
cc: David Blumenthal, M.D. M.P.H, ONC Joanne Conroy, M.D., AAMC
