Clarifications:
- In order to meet the Base EHR Definition, a provider would need to possess technology that has been certified to either this criterion at § 170.315(h)(1) or the “Direct Project, Edge Protocol, and XDR/XDM” criterion at § 170.315(h)(2).
- Use of the Applicability Statement for Secure Health Transport (“Direct”) is required to meet this certification criterion. There is no exemption or additional possible transport standard for certification to this criterion.
- This certification criterion uses the Applicability Statement for Secure Health Transport, Version 1.2 standard. This new version of the specification includes updates that improve interoperability through the clarification of requirements that have been subject to varying interpretations, particularly requirements around message delivery notifications. This version also clarifies pertinent requirements in the standards underlying the Applicability Statement for Secure Health Transport. Refer to the standard for more details about the improvements it includes. [see also 80 FR 62679]
- Testing for this criterion will require the processing of invalid test cases that frequently occur in real-world situations so that Security/Trust Agents (STAs) can demonstrate error handling abilities, including handling XDM packages and message disposition.
- As specified in § 170.550(j), an ONC-ACB can only issue a certification to a Health IT Module for § 170.315(h)(1) if the Health IT Module's certification also includes § 170.315(b)(1). For example, if Developer X seeks certification to (b)(1) and (h)(1) with its homegrown integrated health information service provider (HISP) solution, then their ONC-ACB can issue a certificate with (h)(1) included. Likewise, if Developer X seeks certification to (b)(1) and partners with/integrates a third party HISP for (h)(1) consistent with the “relied upon software” paradigm, then their ONC-ACB can issue a certificate with (h)(1) included. To note, in this instance, the certification would be specific to Developer X and the third party HISP. Each developer that would want to work with the third party HISP in a similar manner would need to seek the same type of relied upon software certification. Thus, HISPs may want to consider certifying to § 170.315(h)(2), which would not require separate testing/certifications with each developer certified to § 170.315(b)(1).
- Consistent with the Implementation Guide for Delivery Notification in Direct, ONC's policy intent is that the receiving HISP must provide delivery notification messages either when it is also the sending HISP, or when it is specifically requested to do so by the sending HISP. A HISP is not compelled to request delivery notifications, but a certified HISP is required to produce them if requested.
