1. State Implications of the ONC 2015 Certification Edition Final Rule John Rancourt, Deputy Director, Office of Care Transformation, ONC Michael Lipinski, Division Director, Federal Policy and Regulatory Affairs, ONC Kevin Larsen, Medical Director for Meaningful Use, ONC Elisabeth Myers, Policy Lead for EHR Incentive Program, Center for Clinical Standards and Quality, CMS

2. This presentation is being recorded. If you object, please disconnect now. 1

3. Agenda Context 2015 Certification High-Level Overview – ONC Health IT Certification Program vs “Meaningful Use” – Supporting the Broader Care Continuum – Certification Can Be Referenced by State Programs – Timeline for Implementation – The 2015 Certification Criteria & the Common Clinical Data Set Key Certification Topics with State Implications – Health Information Exchange in Meaningful Use (CMS) – Certification to Support Health Information Exchange – Data Export – Provider Directories – Electronic Clinical Quality Measures (eCQMs) Criteria – LTPAC and Care Plan Certification Criterion – Behavioral Health and Data Segmentation for Privacy – Social, Psychological, and Behavioral Health Data Collection – Surveillance of Certified Health IT – Brief review of Public Health and Certification Companion Guides Q&A 2

4. Context 3 Interoperability Shared Nationwide Interoperability Roadmap Version 1.0Shared Nationwide Interoperability Roadmap Version 1.0Shared Nationwide Interoperability Roadmap Version 1.0Shared Nationwide Interoperability Roadmap Version 1.0 Interoperability Standards AdvisoryInteroperability Standards AdvisoryInteroperability Standards AdvisoryInteroperability Standards Advisory ONC 2015 Certification RuleONC 2015 Certification RuleONC 2015 Certification RuleONC 2015 Certification Rule Delivery System Reform State Innovation Models InitiativeState Innovation Models InitiativeState Innovation Models InitiativeState Innovation Models Initiative HHS Delivery System Reform GoalsHHS Delivery System Reform GoalsHHS Delivery System Reform GoalsHHS Delivery System Reform Goals Medicare Access & CHIP Reauthorization (MACRA)Medicare Access & CHIP Reauthorization (MACRA)Medicare Access & CHIP Reauthorization (MACRA)Medicare Access & CHIP Reauthorization (MACRA)

5. 2015 Certification High-Level Overview 4

6. ONC 2015 Certification Rule and the CMS EHR Incentive Program known as “Meaningful Use” are Related But Different – CMS Stage 3 EHR Incentive Program Final Rule with Comment Period is about provider behavior. CMS Stage 3 EHR Incentive Program Final Rule with Comment Period Comment deadline is 5 p.m. EST on December 15, 2015. – ONC 2015 Certification Rule is about the technology to support that behavior. ONC 2015 Certification Rule Certification vs “Meaningful Use” 5

7. ONC’s 2015 Certification Rule Supports the Broader Care Continuum A more accessible ONC Health IT Certification Program supportive of: Diverse health IT systems, including but not limited to EHR technology (“Health IT Module” instead of “EHR Module”) Health IT across the care continuum, including long- term and post-acute care (LTPAC) settings and other settings 6

8. ONC Certification Can Be Referenced By State Policies and Programs The 2015 rule makes it simpler for certified health IT to be referenced by other public programs and private entities. A number of programs currently point to certified health IT and/or the the ONC Health IT Certification Program. Here are a few: SAMHSA Certified Community Behavioral Health Clinics Grants CMS chronic care management services (included in 2015 and 2016 Physician Fee Schedule rulemakings) Department of Defense Healthcare Management System Modernization Program The Joint Commission for performance measurement initiative (“ORYX vendor” – eCQMs for hospitals) There are also other HHS rulemakings encouraging the use of certified health IT or proposing required alignment with adopted standards (see the 2015 Edition final rule for details). 7

9. ONC Certification Can Be Referenced By State Policies and Programs (cont.) State Action Items: – State managed care contracts can require that providers use ONC certified health IT Medicaid, CHIP, State employee benefit plan contracts. Interoperability Roadmap makes this call to action: “States with managed care contracts should increasingly require adoption and use of interoperable health IT and health information exchange.” Interoperability Roadmap – Multi-payer efforts (e.g., via SIM) can drive provider use of certified health IT through requirements/incentives in private payer accountable care contracts. – States can require use of ONC certified technology in State procurements. E.g., state can require that prison system EHRs are ONC certified. The ONC State Health IT Policy Levers Compendium has other examples. – Other State programs can require or incentive use of ONC Certification. E.g., State grants to behavioral health clinics can require adopt ONC certified health IT. – States can also reference the ONC Interoperability Standards Advisory. Benefit for the State: – Providers in a State will have incentives to use more interoperable technology to support care coordination, quality reporting/improvement, and to improve efficiency of care delivery. – Systems procured by the State will be more interoperable. 8

10. 2015 Certification Timeline for State Policy Considerations 9 2016 2015 EHR certification edition rule ready for reference in policy, grants and contracts for future years. 2017 2015 EHR certification edition optional for MU EPs and EHs. Early adopting organizations will begin utilizing 2015 certified products, which could include optional certification criteria (e.g., care plan, DS4P) 2018 2015 certification edition required for MU EPs and EHs. Optional certification can be required in state policies and contracting. 2019 Continued increase in market adoption of 2015 certification edition. MACRA requirement for use of certified health IT for APM participation begins – alignment across state and private APMs will create consistency.

11. EHR Incentive Programs Stage 3 Meaningful Use Objectives Objective 1: Protect Patient Health Information Objective 2: Electronic Prescribing Objective 3: Clinical Decision Support Objective 4: Computerized Provider Order Entry Objective 5: Patient Electronic Access to Health Information Objective 6: Coordination of Care through Patient Engagement Objective 7: Health Information Exchange Objective 8: Public Health and Clinical Data Registry Reporting 10

12. Certified Health IT Module(s) to Support the EHR Incentive Programs Stage 3 in 2018 and Beyond 11 Base EHR Capabilities/Certification Criteria CEHRT/ Base EHR Definition Requirements Meaningful Use Measurement Capabilities/ Certification Criteria CEHRT Definition Requirements (Objective 2) e-Prescribing; and Drug-formulary Checks (Objective 3) Clinical Decision Support; and Drug-drug, Drug-allergy Interaction Checks Certification Criteria to Support Meeting Specific Objectives & CEHRT Definition (Objective 4) Computerized Provider Order Entry (Objective 5 only) Patient-specific Education Resources (Objectives 5 & 6) View, Download, & Transmit to 3 rd Party; and API Access to CCDS (Objective 7) Transitions of Care; and Clinical Information Reconciliation & Incorp (Objective 6 only) Secure Messaging (Objective 8) “Public Health” (EP: choose 2 of 5; EH/CAH: choose 4 of 6) Privacy & SecuritySafety-enhanced Design Conditional Certification Requirements C-CDA Creation Performance Quality Management SystemAccessibility-centered Design Mandatory Certification Requirements Support Stage 3 of the EHR Incentive Programs Family Health History Patient Health Information Capture (and supports Objective 6) CQMs - Import and Calculate; and CQMs - Report Dark blue font indicates in the Base EHR definition

13. * Red - New to the Base EHR Definition as compared to the 2014 Edition 2015 Base EHR Definition * Red - New to the Base EHR Definition as compared to the 2014 Edition ** Privacy and security removed – now attached to the applicable certification criteria 12 Base EHR Capabilities Certification Criteria Includes patient demographic and clinical health information, such as medical history and problem lists Demographics § 170.315(a)(5) Problem List § 170.315(a)(6) Medication List § 170.315(a)(7) Medication Allergy List § 170.315(a)(8) Smoking Status § 170.315(a)(11) Implantable Device List § 170.315(a)(14) Capacity to provide clinical decision support Clinical Decision Support § 170.315(a)(9) Capacity to support physician order entry Computerized Provider Order Entry (medications, laboratory, or diagnostic imaging) § 170.315(a)(1), (2) or (3) Capacity to capture and query information relevant to health care quality Clinical Quality Measures – Record and Export § 170.315(c)(1) Capacity to exchange electronic health information with, and integrate such information from other sources Transitions of Care § 170.315(b)(1) Data Export § 170.315(b)(6) Application Access – Patient Selection § 170.315(g)(7) Application Access – Data Category Request § 170.315(g)(8) Application Access – All Data Request § 170.315(g)(9) Direct Project § 170.315(h)(1) or Direct Project, Edge Protocol, and XDR/XDM § 170.315(h)(2)

14. Certification Program Requirements* 2015 Edition Certification Criteria Associated with EHR Incentive Programs Stage 3 (n=38) 2015 Edition Certification Criteria Supporting the Broader Care Continuum (n=8) 2015 Edition Mandatory Certification Criteria (n=2) 2015 Edition Conditional Certification Criteria (n= 12) Quality Management System - (g)(4) Authentication, Access Control, Authorization -(d)(1) CPOE – Medications - (a)(1)CQM – Record and Export - (c)(1)Social, Psychological, and Behavioral Data - (a)(15) Accessibility-Centered Design - (g)(5) Auditable Events and Tamper-Resistance - (d)(2) CPOE – Laboratory - (a)(2)CQM – Import and Calculate - (c)(2)DS4P – Send - (b)(7) Audit Report(s) - (d)(3)CPOE Diagnostic Imaging - (a)(3)CQM – Report - (c)(3)DS4P – Receive - (b)(8) Amendments - (d)(4)Drug-Drug, Drug-Allergy Interaction Checks for CPOE - (a)(4) View, Download, and Transmit to 3 rd Party - (e)(1)Care Plan - (b)(9) Automatic Access Time-Out - (d)(5) Demographics - (a)(5)Secure Messaging - (e)(2)CQM Filter - (c)(4) Emergency Access - (d)(6)Problem List - (a)(6)Patient Health Information Capture - (e)(3)Accounting of Disclosures - (d)(11) End-User Device Encryption - (d)(7) Medication List - (a)(7)Transmission to Immunization Registries -(f)(1)Common Clinical Data Set Summary Record – Create -(b)4) Integrity - (d)(8)Medication Allergy List - (a)(8)Transmission to PHA – Syndromic Surveillance - (f)(2)Common Clinical Data Set Summary Record – Receive -(b)(5) Trusted Connection - (d)(9)CDS - (a)(9)Transmission to PHA – Reportable Laboratory Tests and Values/Results - (f)(3) Auditing Actions on Health Information - (d)(10) Drug-Formulary and Preferred Drug List Checks - (a)(10) Transmission of Cancer Registries - (f)(4) Safety Enhanced Design - (g)(3) Smoking Status - (a)(11)Transmission to PHA – Electronic Case Reporting - (f)(5) Consolidated CDA Creation Performance - (g)(6) Family Health History - (a)(12)Transmission to PHA – Antimicrobial Use and Resistance Reporting - (f)(6) Patient-Specific Education Resources - (a)(13) Transmission to PHA – Health Care Surveys - (f)(7) Implantable Device List - (a)(14)Automated Numerator Recording - (g)(1) or Automated Measure Calculation - (g)(2) Transitions of Care - (b)(1)Application Access – Patient Selection - (g)(7) Clinical Information Reconciliation and Incorporation - (b)(2) Application Access – Data Category Request - (g)(8) Electronic Prescribing - (b)(3)Application Access – All Data Request -(g)(9) Data Export - (b)(6)Direct Project - (h)(1) Direct Project, Edge Protocol, and XDR/XDM - (h)(2) Black Font/Green Background = new to the 2015 Edition Red Font/Gray Background = “unchanged” criteria (eligible for gap certification) Black Font/Gray Background = “revised” criteria KEY: Criteria are “new,” “unchanged,” and “revised” as compared to the 2014 Edition * These columns identify mandatory and conditional certification requirements (i.e., the application of certain certification criteria to Health IT Modules) that Health IT Modules presented for certification must meet regardless of the setting or program the Health IT Module is designed to support.

15. See page 62614 in the ONC rule and page 62876 in the CMS rule.62614 in the ONC rulepage 62876 in the CMS rule Crosswalk of 2015 Criteria to MU3 Objectives 14 … (table continues)

16. Common Clinical Data Set Renamed the “Common MU Data Set.” This does not impact 2014 Edition certification. Includes key health data that should be accessible and available for exchange. Data must conform with specified vocabulary standards and code sets, as applicable. 15 Patient nameLab tests SexLab values/results Date of birthVital signs (changed from proposed rule) RaceProcedures EthnicityCare team members Preferred languageImmunizations ProblemsUnique device identifiers for implantable devices Smoking StatusAssessment and plan of treatment MedicationsGoals Medication allergiesHealth concerns 2015-2017 Send, receive, find and use priority data domains to improve health and health quality ONC Interoperability Roadmap Goal Red = New data added to data set (+ standards for immunizations) Blue = Only new standards for data

17. Key Certification Topics with State Implications 16

18. Denominator: Number of transitions of care and referrals during the EHR reporting period for which the EP’s or eligible hospital’s or CAH’s inpatient or emergency department (POS 21 or 23) was the transferring or referring provider. Numerator: The number of transitions of care and referrals in the denominator where a summary of care record was created using CEHRT and exchanged electronically. Threshold: The percentage must be more than 10 percent in order for an EP, eligible hospital or CAH to meet this measure. Exclusion: Any EP who transfers a patient to another setting or refers a patient to another provider less than 100 times during the EHR reporting period. CMS Modified Stage 2 HIE Objective 17

19. A provider must attest to the numerator and denominator for all three measures but would only be required to successfully meet the threshold for two of the three proposed measures. Measure 1: Denominator: Number of transitions of care and referrals during the EHR reporting period for which the EP or eligible hospital or CAH inpatient or emergency department (POS 21 or 23) was the transferring or referring provider. Numerator: The number of transitions of care and referrals in the denominator where a summary of care record was created using certified EHR technology and exchanged electronically. Threshold: The percentage must be more than 50 percent in order for an EP, eligible hospital, or CAH to meet this measure. Exclusion: see CMS Rule page 62855CMS Rule page 62855 CMS Stage 3 HIE Objective 18

20. Measure 2: Denominator: Number of patient encounters during the EHR reporting period for which an EP, eligible hospital, or CAH was the receiving party of a transition or referral or has never before encountered the patient and for which an electronic summary of care record is available. Numerator: Number of patient encounters in the denominator where an electronic summary of care record received is incorporated by the provider into the certified EHR technology. Threshold: The percentage must be more than 40 percent in order for an EP, eligible hospital, or CAH to meet this measure. Exclusion: see the rule. CMS Stage 3 HIE Objective 19

21. Measure 3: Denominator: Number of transitions of care or referrals during the EHR reporting period for which the EP or eligible hospital or CAH inpatient or emergency department (POS 21 or 23) was the recipient of the transition or referral or has never before encountered the patient. Numerator: The number of transitions of care or referrals in the denominator where the following three clinical information reconciliations were performed: Medication list, medication allergy list, and current problem list. Threshold: The resulting percentage must be more than 80 percent in order for an EP, eligible hospital, or CAH to meet this measure. Exclusion: see the rule. CMS Stage 3 HIE Objective 20

22. Certification Includes “Transitions of Care” Criterion What standards do we certify? – Direct Project § 170.315(h)(1) or Direct Project, Edge Protocol, and XDR/XDM § 170.315(h)(2) Message Delivery Notification is now required (from provider to provider). What is important to understand? – “Adoption of the ONC IG for Direct Edge Protocols can improve the market availability of electronic health information exchange services for transitions of care by separating content from transport related to transitions of care.” – The 2015 rule separates the capabilities of EHR (which are content focused) from that of HISPs (which are transport focused). This enables both EHRs and HISPS to become more “plug-and-play,” thereby increasing flexibility for developers. Certification to Support Health Information Exchange 21

23. State Implications – States are building or supporting HIEs. The XDR/XDM certification criterion can potentially reduce the cost of interfaces for EHRs connecting to an HIE. Certified Health IT vendors, including EHRs, can be held accountable to providing these standardized interfaces. – Health IT systems serving providers other than physicians and hospitals can be certified to these standards, allowing for potential interoperability with BH, LTPAC, and human services. – Action item: Any state procurement or funding that involves systems that transport health data could be made to adhere to these requirements. – Benefit for the State: Systems procured by the state or supported by state funding will be more interoperable. Certification to Support Health Information Exchange (cont.) 22

24. Reminder: ONC certification can be referenced by state policies and programs. (See slides 7-8 above.) Reminder 23

25. 2015 Certification Edition includes – Data Export § 170.315(b)(6) – The idea is to “give providers easy access and an easy ability to export clinical data about their patients for use in a different health information technology or a third party system.” What do we certify? – “A user must be able to configure a time period within which data would be used to create export summaries, which must include the ability to express a start and end date range.” (1) create export summaries in real-time (i.e., on demand); (2) configure technology to create such summaries based on a relative date and time; and (3) configure technology to create such summaries based on a specific date and time. State Implications – Action item: States should know that this capability will exist and begin to plan to use it in support of efforts requiring data collection. – Benefit for the State: This certification criterion can better enable data extraction from EHRs in support of value-based payment programs. Data Export 24

26. 2015 Certification Rule did not include the proposed Provider Directory criteria based on the HPD standard. What is HPD? – The IHE HPD Profile is a provider directory standard and was listed as the best available standard in the 2015 Interoperability Standards Advisory and draft 2016 ISA. Why was this not included in the rule? – IHE HPD standard requires further implementation to ensure stability and support widespread adoption. – RESTful solutions are being defined and may be a viable alternative in the near future. State Implications – States are developing Provider Directory strategies right now and some have plans to build directories to be HPD compliant. – Interoperability Roadmap: The Roadmap includes a call to action that states that “Provider directory operators should align existing directories to the extent possible with best available standards for provider directories as identified in ONC’s most recent finalized Interoperability Standards Advisory or with emerging RESTful approaches if implementation timelines are not near-term.”Interoperability Standards Advisory – State Action Item: Consider the call to action from the Interoperability Roadmap when conducting procurements for provider directory systems or when building requirements related provider directories into contracts for health care services. – Benefit for the State: States that build directories to the best available standards will improve the interoperability of their provider directories. Provider Directories

27. 2015 Certification continues with 2014 edition (MU2) eCQM certification approach What do we certify? – Modular certification for: Capture and export of quality measure data (c)(1) Import and calculate quality measures (c)(2) Report quality measures (c)(3) as aggregate data by provider and/or individual patient level data – Filter (c)(4) - new optional criteria, not required by MU. Changes from 2014 (MU2) – Enhanced rigor of testing, require ability for on demand export of quality measures by providers, all vendors must be certified to export patient level data. – Filter (c)(4) - Ability to filter eCQM results by demographics, payer, medical condition, practice site. State Implications – Re-affirmed QRDA (quality reporting data architecture) as the standard for eCQM. – CMS is requiring all providers to submit eCQM data to CMS in 2018. – States could require filter (c4) in 2018 (for 2019 data submission) if there are needs to filter data by practice site, payer or demographics. – States can currently require patient-level or aggregate data submission—this will continue. Electronic Clinical Quality Measures (eCQMs) Criteria

28. 2015 Certification Edition includes Care Plan CCDA standard – § 170.315(b)(9) (Care plan) What do we certify? – Care plan document—based on the consolidated clinical document architecture (CCDA) with new sections for patient goals and interventions. This is not required for MU2 or MU3—but is available to be referenced by other policies and program requirements State Implications – States could require as part of state advance payment models, demos, grants, conditions of participation and/or pilots. – Applicability across multiple populations and patient groups. – Useful for care coordination or referral for services such as mental health, home care, etc. – Consistently listed as a high priority by consumer groups and APMs. LTPAC & Care Plan

29. 2015 Certification Edition Data Segmentation for Privacy—send (b)(7) and receive (b)(8) What do we certify? – Ability to mark sections of exchange documents (CCDs) as private during sending and receiving. These are not required for MU2 or MU3— but are available to be referenced by other policies and program requirements State Implications – Option for States: Require as part of state advance payment models, demos, grants, conditions of participation and/or pilots. – Applicability across multiple populations and patient groups. – Useful for care coordination or referral for services such as mental health, home care, etc. – Consistently listed as a high priority by consumer groups and APMs. Behavioral Health & Data Segmentation for Privacy (DS4P)

30. 2015 Certification Edition Ability to Capture 8 Domains of Social, Psychological, and Behavioral Health Data What do we certify? – Certification includes the ability to record, change and access standardized questions and responses(a)(15) for: Financial resource strain Education level Stress Depression screening (PHQ2) Physical Activity Alcohol Use Social Connection and Isolation These are not required for MU2 or MU3—but are available to be referenced by other policies and program requirements. State Implications – States could require as part of state advance payment models, demos, grants, conditions of participation and/or pilots. – Applicability across multiple populations and patient groups. – Useful for care coordination or referral for services such as mental health, home care, etc. Social, Psychological, and Behavioral Health Data Collection

31. Surveillance of Certified Health IT New requirements for “in-the-field” surveillance under the ONC Health IT Certification Program ONC-ACBs should ensure that certified Health IT Modules can perform certified capabilities in a production environment (when implemented and used)  Reactive surveillance (e.g., complaints)  Randomized surveillance (2% of annually certified health IT at one or more location) Enhanced surveillance of mandatory transparency requirements Non-conformity and corrective action reported to the CHPL beginning in CY 2016 30 Improve the Reliability and Transparency of Certified Health IT Improve Patient Safety

32. The ONC/CDC Joint Public Health Forum & CDC Nationwide initiative has already held multiple webinars on this topic. Please visit their website for presentations and recordings. – http://www.phconnect.org/group/joint-public-health- forum-cdc-nationwide http://www.phconnect.org/group/joint-public-health- forum-cdc-nationwide Public Health 31

33. Detailed information on each certification criteria including: – The policy – Technical explanations and clarifications – Standards referenced with links to current standards details The Certification Companion Guides (CCGs) are designed help health IT developers more quickly understand and interpret our regulatory requirements so that they can focus on product development. A CCG has been developed for each certification criterion and will serve as the single, consolidated information source for any clarifications related to a certification criterion. https://www.healthit.gov/policy-researchers- implementers/2015-edition-test-method https://www.healthit.gov/policy-researchers- implementers/2015-edition-test-method Tools for State Use: Certification Companion Guides 32

34. The Stage 3 EHR Incentive Program Final Rule is also open for comments. Please comment! Reminder 33

35. ONC certification can be referenced by State policies and programs. In 2018, ONC’s 2015 Certification will be mandatory for providers in the EHR Incentive Program. ONC certification can be applied to health IT systems for other settings of care (e.g., BH and LTPAC). The 2015 Certification rule includes optional certification criteria for care plans; data segmentation for privacy; and social, psychological, and behavioral health data collection. The 2015 rule separates the content from transport, allowing EHRs and HISPs to become more “plug-and-play.” New requirements for “in-the-field” surveillance. Take Home Considerations for States 34

36. Q&A Discussion 35

37. Michael.Lipinski@hhs.gov Kevin.Larsen@hhs.gov John.Rancourt@hhs.gov Elisabeth.Myers@cms.hhs.gov Contact Information 36