Authorized Certification Body (ACB)

Conditions and Maintenance of Certification

The 21st CenturyCures Act established a set of requirements for health IT developers that define both the initial and ongoing certification requirements for health IT developers and their certified health IT modules. 

The Conditions and Maintenance of Certification requirements are divided into these seven distinct areas:

Assurances

Condition of Certification Requirement: A health IT developer must: 

  1. Provide assurances that it will not take any action that constitutes information blocking, or any other action that may inhibit the appropriate exchange, access, and use of electronic health information, 
  2. Ensure full compliance and unrestricted implementation of certification criteria capabilities,
  3. Not take any action to interfere with a user’s ability to access or use certified capabilities, and
  4. Certify a health IT product which electronically stores EHI to the §170.315(b)(10) criteria.

Maintenance of Certification: 

  1. For a period of 10 years beginning from the date of certification, retain all records and information necessary that demonstrate initial and ongoing compliance with the requirements of the ONC Health IT Certification Program, and
  2. Certify to the criterion in § 170.315(b)(10) by December 31, 2023, if a health IT product electronically stores EHI.

Please refer to the Certification Companion Guide: Assurances for additional details on the requirement. 

Communications

Condition of Certification Requirement:  A health IT developer may not prohibit or restrict communication regarding the following subjects for certified Health IT Modules:

  1. The usability of its health IT,
  2. The interoperability of its health IT,
  3. The security of the health IT,
  4. Relevant information regarding users’ experiences when using its health IT,
  5. The business practices of developers of health IT related to exchanging EHI, and
  6. The manner in which a user of the health IT has used such technology.

Maintenance of Certification: A health IT developer must:

  1. Notify all customers it will not enforce any communication or contract provision contravening the Communication CoC requirements on an annual basis, beginning in calendar year 2021, up to and until the health IT developer amends the contract or agreement to remove or void the contravening contractual provisions, and
  2. Not establish, renew, or enforce any contract or agreement that contravenes the Communications CoC requirement, and must amend the contract or agreement when it is next modified for other reasons or renewed, as of June 30, 2020 to remove or void contravening contractual provisions. 

Please refer to the Certification Companion Guide: Communications for additional details on the requirement. 

API

Condition of Certification Requirement: A health IT developer of a Health IT Module certified to any certification criteria adopted in § 170.315(g)(7) through (g)(10) must:

  1. Publish APIs and allow health information from such technology to be accessed, exchanged, and used without special effort,
  2. Publish complete business and technical documentation, via a publicly accessible hyperlink,
  3. Publish all terms and conditions for its certified API technology including material information and API Fees,
  4. Abide by permitted/prohibited API fees and keep for inspection detailed records of any fees charged with respect to the certified API technology, and 
  5. Abide by openness and pro-competitive conditions.

Maintenance of Certification: A health IT developer of a Health IT Module that meets the requirements outlined in the Condition of Certification must comply with the following requirements:

  1. Authenticity verification and registration for production use,
  2. Service Base Uniform Resource Locator (URL) publication,
  3. Rollout of (g)(10)-Certified APIs by December 31, 2022 and
  4. Compliance to API CoC for existing certified API technology by April 5, 2021.

Please refer to the Certification Companion Guide: Application Programming Interfaces for additional details on the requirement. 

View the API Resource Guide, here. 

Attestation

Condition of Certification Requirement: A health IT developer must attest, as applicable, to compliance with the Conditions and Maintenance of Certification related to:

  1. Information Blocking,
  2. Assurances,
  3. Communications,
  4. API, and
  5. Real World Testing

Maintenance of Certification: A health IT developer must submit their attestations every six months as of the first attestation window beginning on April 1, 2022.

Real World Testing

Condition of Certification: A health IT developer with Health IT Module(s) certified to § 170.315(b)(1) through (10), (c)(1) through (3), (e)(1), (f)(1) through (7), (g)(7) through (10), and (h)(1) and (2) must: successfully test the real world use of the technology for interoperability in the type of setting in which such technology would be marketed.

For Maintenance of Certification requirements and additional details, please see the Certification Companion Guide: Real World Testing, the Real World Testing (RWT) Fact Sheet as well as the Real World Testing Resource Guide.

While optional, we strongly encourage developers to use the Real World Testing Plan Template when creating their test plans. 

Additional resources can be found here. 

Information Blocking

Condition of Certification Requirement: A health IT developer of certified health IT does not take any action that constitutes information blocking on or after April 5, 2021. A health IT developer of certified health IT is responsible for ensuring that all of its health IT and related actions and behaviors do not constitute information blocking or inhibit the appropriate access, exchange, and use of electronic health information (EHI).

Maintenance of Certification: There are no accompanying Maintenance of Certification requirements beyond compliance with the Condition.

Please refer to the Certification Companion Guide: Information Blocking for exceptions to the information blocking provisions and additional details on the requirement. 

View the Information Blocking Fact Sheet, here and Information Blocking FAQs, here. 

EHR Reporting Criteria Submission - TBD