Department of Health and Human Services, Office of the Secretary: 2015 Edition Health Information Technology (Health IT) Certification Criteria, 2015 Edition Base Electronic Health Record (EHR) Definition, and ONC Health IT Certification Program Modifications

B-327450

October 29, 2015

The Honorable Lamar Alexander
Chairman
The Honorable Patty Murray
Ranking Member
Committee on Health, Education, Labor, and Pensions
United States Senate

The Honorable Fred Upton
Chairman
The Honorable Frank Pallone, Jr.
Ranking Member
Committee on Energy and Commerce
House of Representatives

Subject: Department of Health and Human Services, Office of the Secretary: 2015 Edition Health Information Technology (Health IT) Certification Criteria, 2015 Edition Base Electronic Health Record (EHR) Definition, and ONC Health IT Certification Program Modifications

Pursuant to section 801(a)(2)(A) of title 5, United States Code, this is our report on a major rule promulgated by the Department of Health and Human Services (HHS), Office of the Secretary entitled “2015 Edition Health Information Technology (Health IT) Certification Criteria, 2015 Edition Base Electronic Health Record (EHR) Definition, and ONC Health IT Certification Program Modifications” (RIN: 0991-AB93).  We received the rule on October 6, 2015.  It was published in the Federal Register as a final rule on October 16, 2015.  80 Fed. Reg. 62,602.

The final rule finalizes a new edition of certification criteria (the 2015 Edition health IT certification criteria or ‘‘2015 Edition’’) and a new 2015 Edition Base Electronic Health Record (EHR) definition, while also modifying the Office of the National Coordinator for Health Information Technology (ONC) Health IT Certification Program to make it open and accessible to more types of health IT and health IT that supports various care and practice settings.  The 2015 Edition establishes the capabilities and specifies the related standards and implementation specifications that Certified Electronic Health Record Technology would need to include to, at a minimum, support the achievement of meaningful use by eligible professionals, eligible hospitals, and critical access hospitals under the Medicare and Medicaid Electronic Health Record (EHR) Incentive Programs (EHR Incentive Programs) when such edition is required for use under these programs.

Enclosed is our assessment of HHS’s compliance with the procedural steps required by section 801(a)(1)(B)(i) through (iv) of title 5 with respect to the rule.  Our review of the procedural steps taken indicates that HHS complied with the applicable requirements.

If you have any questions about this report or wish to contact GAO officials responsible for the evaluation work relating to the subject matter of the rule, please contact Shirley A. Jones, Assistant General Counsel, at (202) 512-8156.

  signed

Robert J. Cramer
Managing Associate General Counsel

Enclosure

cc: Ann Stallion
Deputy Director, ODRM
Department of Health and Human Services

ENCLOSURE

REPORT UNDER 5 U.S.C. § 801(a)(2)(A) ON A MAJOR RULE
ISSUED BY THE
DEPARTMENT OF HEALTH AND HUMAN SERVICES,
OFFICE OF THE SECRETARY
ENTITLED
"2015 Edition Health Information Technology
(Health IT) Certification Criteria, 2015 Edition Base
Electronic Health Record (EHR) Definition, and
ONC Health IT Certification Program Modifications"
(RIN: 0991-AB93)

(i) Cost-benefit analysis

HHS provided a cost benefit analysis and included a summary table within the final rule.  HHS estimates indicate that the final rule is an economically significant rule as its overall costs for health IT developers may be greater than $100 million in at least one year.  HHS has, therefore, projected the costs and benefits of the final rule.  The estimated costs expected to be incurred by health IT developers to develop and prepare health IT to be tested and certified in accordance with the 2015 Edition certification criteria (and the standards and implementation specifications they include) are represented in monetary terms in the summary table it included.  HHS noted that the final rule does not impose the costs cited as compliance costs, but rather as investments that health IT developers voluntarily take on and may expect to recover with an appropriate rate of return.  HHS further noted that, based on the estimates provided by a health IT developer association in response to the proposed rule, it reduced the estimated burden of the 2015 Edition by over 40,000 burden hours per health IT developer by not adopting certain proposed certification criteria, functionality, and standards.

The 4-year total low cost estimate was stated to be (in millions) $260.44.  The total high cost estimate was stated to be (in millions) $403.19.  The total average cost estimate was stated to be (in millions) $331.82.  HHS explained that the dollar amounts it expressed in the table in the final rule are expressed in 2014 dollars.  HHS expects that health IT developers will recover an appropriate rate of return for their investments in developing and preparing their health IT for certification to the 2015 Edition certification criteria adopted in the final rule.  However, HHS did not have data available to quantify these benefits or other benefits that will likely arise from health IT developers certifying their health IT to the 2015 Edition.

HHS stated that it believes that there will be several significant benefits that may arise from this final rule for patients, health care providers, and health IT developers.  The 2015 Edition continues to improve health IT interoperability through the adoption of new and updated standards and implementation specifications.  For example, according to HHS, many proposed certification criteria include standards and implementation specifications for interoperability that directly support the EHR Incentive Programs, which include objectives and measures for the interoperable exchange of health information and for providing patients electronic access to their health information in structured formats.  In addition, as discussed in the rule, the adopted certification criteria that support the collection of patient data that could be used to address health disparities would not only benefit patients, but the entire health care delivery system through improved quality of care.  The 2015 Edition also supports usability and patient safety through new and enhanced certification requirements for health IT.

HHS stated that the final rule also makes the ONC Health IT Certification Program open and accessible to more types of health IT and for health IT that supports a variety of care and practice settings.  HHS explained this should benefit health IT developers, providers practicing in other care/practice settings, and consumers through the availability and use of certified health IT that includes capabilities that promote interoperability and enhanced functionality.

(ii) Agency actions relevant to the Regulatory Flexibility Act (RFA), 5 U.S.C. §§ 603-605, 607, and 609

The Regulatory Flexibility Act requires agencies to analyze regulatory options that would minimize any significant impact of a rule on a substantial number of small entities.  HHS stated that it believes that it has adopted the minimum amount of requirements necessary to accomplish its policy goals, including a reduction in regulatory burden and additional flexibility for the regulated community, and that no additional appropriate regulatory alternatives could be developed to lessen the compliance burden associated with this final rule.  HHS noted that the final rule does not impose the costs cited in the regulatory impact analysis as compliance costs, but rather as investments that these health IT developers voluntarily take on and may expect to recover with an appropriate rate of return.  Accordingly, HHS concluded that it does not believe that the final rule will create a significant impact on a substantial number of small entities.  Additionally, the Secretary of HHS certified that the final rule will not have a significant impact on a substantial number of small entities.

(iii) Agency actions relevant to sections 202-205 of the Unfunded Mandates Reform Act of 1995, 2 U.S.C. §§ 1532-1535

HHS stated that the final rule will not impose an unfunded mandate on state, local, and tribal governments or on the private sector that will reach the threshold level.  The Office of Management and Budget (OMB) reviewed this final rule.

(iv) Other relevant information or requirements under acts and executive orders

Administrative Procedure Act, 5 U.S.C. §§ 551 et seq.

HHS published a lengthy regulatory history covering Standards, Implementation Specifications, and Certification Criteria Rules; Medicare and Medicaid Electronic Health Record (EHR) Incentive Programs Rules; and ONC Health IT Certification Program Rules.  On March 30, 2015, HHS issued a notice of proposed rulemaking with comment period.  80 Fed. Reg. 16,804.  HHS did not quantify the number of comments overall, but did describe the comments, responded to them, and explained any revisions made to the proposed rule.

Paperwork Reduction Act (PRA), 44 U.S.C. §§ 3501-3520

This final rule contains information collection provisions that are subject to review by OMB under PRA.  HHS sought comment on the proposed PRA requirements in the proposed rule.  Under the ONC Health IT Certification Program, accreditation organizations that wish to become the ONC-Approved Accreditor (ONC–AA) must submit certain information, organizations that wish to become ONC-Authorized Certification Bodies (ONC–ACBs) must submit the information specified by the application requirements, and ONC–ACBs must comply with collection and reporting requirements, records retention requirements, and submit annual surveillance plans and annually report surveillance results.  In the Permanent Certification Program final rule (76 Fed. Reg. 1262) (Jan. 7, 2011), HHS solicited public comment on each of the information collections associated with the requirements (and included in regulation at 45 C.F.R. 170.503(b), 170.520, and 170.523(f), (g), and (i), respectively).  In the 2014 Edition final rule (77 Fed. Reg. 54,163) (Sept. 4, 2012), HHS sought comment on these collection requirements again and finalized an additional requirement at § 170.523(f)(8) for ONC–ACBs to report to ONC a hyperlink with each EHR technology they certify that provides the public with the ability to access the test results used to certify the EHR technology.  These collections of information were approved under OMB control number 0955–0013 (previous OMB control number 0990–0378).

HHS stated that in the proposed rule, it estimated less than 10 annual respondents for all of the regulatory collection of information requirements under Part 170 of title 45, including those previously approved by OMB and proposed in the March 30, 2015, proposed rule (80 Fed. Reg. 16,894).  The collection of information requirements that apply to ONC–AA are found in § 170.503(b).  The collection of information requirements that apply to the ONC–ACBs are found in § 170.520; § 170.523(f)(1) and (2), (g), (i), and (o); and § 170.540(c).  HHS stated that in the proposed rule, it estimated the number of respondents for § 170.503(b) (applicants for ONC–AA status) at two based on past selection processes for ONC–AA, which have included no more than two applicants.  HHS also stated in the proposed rule that it anticipated that there would be three ONC–ACBs participating in the ONC Health IT Certification Program as this is the current number of ONC–ACBs.  Further, according to HHS, since the establishment of the ONC Health IT Certification Program in 2010, ONC has never had more than six applicants for ONC–ACB or ONC-Authorized Testing and Certification Bodies (ONC–ATCB) status or selected more than six ONC–ACBs or ONC–ATCBs.  HHS concluded that the regulatory collection of information requirements under the ONC Health IT Certification Program described above were not subject to PRA under 5 C.F.R. 1320.3(c).  HHS solicited comments on this conclusion and the supporting rationale on which it was based and received one comment suggesting that the time estimated for proposed ONC–ACB surveillance activities may be underestimated in terms of reviewing surveillance guidance, developing plans, and finalizing surveillance results for submission.  HHS agreed with the commenter that the time estimate for surveillance-related activities was an underestimation.  HHS provided a new estimate as part of the regulatory impact statement.  HHS continues to estimate fewer than 10 respondents for all of the regulatory collection of information requirements under Part 170 of title 45.  Accordingly, the collection of information requirements/burden that are associated with this final rule are not subject to PRA under 5 C.F.R. 1320.3(c).

Statutory authorization for the rule

HHS stated that it promulgated the final rule under the authority of the Health Information Technology for Economic and Clinical Health (HITECH) Act, title XIII of Division A and title IV of Division B of the American Recovery and Reinvestment Act of 2009 (Pub. L. 111–5), which was enacted on February 17, 2009.  The HITECH Act amended the Public Health Service Act and created ‘‘Title XXX—Health Information Technology and Quality’’ to improve health care quality, safety, and efficiency through the promotion of health information technology and electronic health information exchange.

Executive Order No. 12,866 (Regulatory Planning and Review)

HHS stated that OMB determined that the final rule is an economically significant rule as HHS estimated the costs to develop and prepare health IT to be tested and certified may be greater than $100 million per year.

Executive Order No. 13,132 (Federalism)

HHS determined that nothing in the final rule imposes substantial direct compliance costs on state and local governments, preempts state law or otherwise has federalism implications.  Further, HHS said it is unaware of any state laws or regulations that are contradicted or impeded by any of the standards, implementation specifications, or certification criteria that HHS has adopted.