Authorized Certification Body (ACB)

ONC Certification Program Updates

The below information is directly related to the Certification Process - for updates and information pertaining to Testing, please visit the ATL's Testing Program Updates page.

2015 Edition

In the ONC Health IT Certification Program, testing and certification activities are performed by distinct and separate entities within ICSA Labs. Certification for EHR Technology that meets requirements adopted by the Secretary of Health and Human Services (HHS) is granted by the ICSA Labs ONC-Authorized Certification Body (ONC-ACB), which has also been accredited as an independent and impartial Health IT Certification Body by the American National Standards Institute (ANSI). More information on the ANSI Health IT Accreditation Program can be found at www.ansi.org. 
 
Certification by ICSA Labs reassures health care providers that the EHR technology they adopt has been evaluated by an independent third party for conformance to specific federal criteria related to clinical functionality, interoperability, information security, and patient privacy.
 
ICSA Labs is authorized to certify EHR technology for the ONC's Health IT Certification Program related to the 2015 Edition and 2015 Edition Cures criteria.
 
For more information about the ICSA Labs Certification Program, see the Certification Program Manual.
 

2015 Edition Cures Update Info

On May 1, 2020 the 21st Century Cures Act: Interoperability, Information Blocking, and the ONC Health IT Certification Program final rule was officially published in the federal register. The rule introduced many new changes to the ONC’s 2015 Edition Health IT Certification Program, including the removal of the following 2015 Edition criteria: 

  • 170.315(a)(6) Problem list*
  • 170.315(a)(7) Medication list*
  • 170.315(a)(8) Medication allergy list*
  • 170.315(a)(11) Smoking status
  • 170.315(b)(4) CCDS summary record – create
  • 170.315(b)(5) CCDS summary record – receive
*These criteria were also removed from 170.315(g)(3) Safety-Enhanced Design
 

Additional criteria set to be removed by January 1, 2022 are:

  • 170.315(a)(10) Drug-formulary and preferred drug lists
  • 170.315(a)(13) Patient-specific education resources
  • 170.315(e)(2) Secure messaging    

The criterion set to be removed as of December 31, 2022 is:

  • 170.315(g)(8) Application access — data category request

The criterion set to be removed as of December 31, 2023 is:

  • 170.315(b)(6) Data export

Additionally, the 2015 Edition Cures Update introduced the following two new technical certification criteria as well as two new privicay and security criteria: 

  • 170.315(b)(1) Electronic Health Information (EHI) Export
  • 170.315(g)(1) Standardized API for Patient and Population Services
  • 170.315(d)(12) Encrypt Authentication Credentials
  • 170.315(d)(13) Multi-factor Authentication

Additional details on the changes to the above criteria, and their applicable timelines, can be found on the Cures Update Reference Guide. 

Conditions and Maintenance of Certification

The Cures Act established a set of requirements for health IT developers that define both the initial and ongoing certification requirements for health IT developers and their certified health IT modules. These are divided into the following seven distinct areas:

  • Information Blocking
  • Assurances
  • Communications
  • Application Programming Interfaces (APIs)
  • Real World Testing
  • Attestations
  • EHR Reporting Criteria Submission

Details regarding the these seven Conditions of Certification can be found on the Conditions and Maintenance of Certification tab.

Interim Final Rule

ONC announced an Interim Final Rule (IFR) that extends many of the compliance dates and timeframes previously issued as part of the recent Cures Act final rule in March of 2020. These changes have been proposed in light of the COVID-19 pandemic. A summary of the changes include:

  • Extending the applicability date for the Information Blocking provisions.
  • Extending the compliance dates in the ONC Health IT Certification Program (Program), including certain 2015 Edition health IT certification criteria and Conditions and Maintenance of Certification requirements.
  • Changes to the Program by updating standards and clarifying regulatory text for specific certification criteria.
  • Technical corrections and clarifications.

The Interim Final Rule extends the Program compliance dates beyond those identified in the April 21, 2020 enforcement discretion announcement and establishes new future applicability dates for information blocking provisions. The Interim Final Rule also adopts updated standards and makes technical corrections and clarifications to the ONC Cures Act Final Rule.

New Applicability and Compliance Dates/Timeframes & Corresponding Provisions

April 5, 2021 December 31, 2022 One Calendar Year Extension
  •  Information blocking provisions (45 CFR Part 171)
  • Information Blocking CoC/MoC requirements (§ 170.401)
  • Assurances CoC/MoC requirements (§ 170.402, except for § 170.402(b)(2) as it relates to § 170.315(b)(10))
  • API CoC/MoC requirement (§ 170.404(b)(4)) - compliance for current API criteria
  • Communications CoC/MoC requirements (§ 170.403) (except for § 170.403(b)(1) – where we removed the notice requirement for 2020)
  • 2015 Edition health IT certification criteria updates (except for § 170.315(b)(10) – EHI export, which is extended until December 31, 2023)
  • New standardized API functionality (§ 170.315(g)(10))
  • Submission of initial attestations (§ 170.406)
  • Submission of initial plans and results of real world testing (§ 170.405(b)(1) and (2))

Additionally, compliance for the Real World Testing (RWT) requirements was extended on calendar year. 

Product Surveillance

ICSA Labs certification staff conducts regualar surveillance on all certified products to ensure continued conformance to the standards and requirements under which the product was certified. Surveillance activities are tracked and documented as part of the policy guidance issued by the ONC. For more information on surveillance, see the ONC's Program Guidance. 

See the current ICSA Labs Surveillance Plan, here

2014 Edition Retirement

The Cures Act Final Rule officially retired the 2014 Edition ONC Health IT Certification Program as of June 30, 2020. Developers who were certified in the 2014 Edition Program are no longer able to claim certification and are required to remove any references of their 2014 Edition certified products from their website disclosures and/or marketing materials.