§ 170.315(e)(1)

View, download, and transmit to 3rd party

Certification Companion Guide
Test Procedure

Certification Companion Guide v1.6

Issued Date: 03-11-2024

Last Updated: 08-29-2025

This Certification Companion Guide (CCG) is an informative document designed to assist with health IT product certification. The CCG is not a substitute for the requirements outlined in regulation and related ONC final rules. It extracts key portions of ONC final rules’ preambles and includes subsequent clarifying interpretations. To access the full context of regulatory intent please consult the Certification Regulations page for links to all ONC final rules or consult other regulatory references as noted. The CCG is for public use and should not be sold or redistributed.

Archived Version: § 170.315(e)(1) View, download, and transmit to 3rd party CCG

Quick Overview

Required Updates

Design and Performance

IN THIS SECTION

Certification Clarifications

Technical Explanations and Clarifications

Clarifications:

The scope of this criterion is limited to the C-CDA Release 2.1 CCD document template for both ambulatory and inpatient settings. In the inpatient setting C-CDA Release 2.1 Referral and Transition of Care document templates are also within scope. Health IT developers may choose to offer view, download, and transmit to 3rd party (VDT) capabilities for other C-CDA templates as appropriate for different care and practice settings, but the CCD document template is the mandatory minimum that must be supported for this criterion.
In combination with the C-CDA R2.1 standard, developers certifying to the USCDI must follow the guidance and templates provided in HL7® CDA® R2 IG: C-CDA Templates for Clinical Notes R2 Companion Guide, Release 2, or a time period until December 31, 2025, or HL7® CDA® R2 Implementation Guide: C-CDA Templates for Clinical Notes STU Companion Guide, Release 4.1 - US Realm, for implementation of the C-CDA Release 2.1 standard. For example, details on how to structure and exchange Clinical Notes are included in the C-CDA Companion Guide.
ONC provides flexibility for the Diagnostic Imaging and Laboratory Test Results Narratives to be placed in the CCD document template in either the “Result Observation” or “Note Activity” entry templates that can be represented in the “Result” or “Notes” sections.
“Patients (and their authorized representatives)” are defined as any individuals to whom the patient has granted access to their health information. [see also 80 FR 62658 and 77 FR 13720]
The technology specifications should be designed and implemented in such a way as to provide maximum clarity to a patient (and their authorized representative) about what data exists in the system and how to interpret it. ONC expects that health IT developers will make choices following design and usability best practices that will make it easier and clearer for patients to find and use their records. [see also 80 FR 62659]
In order to mitigate potential interoperability errors and inconsistent implementation of the HL7® Implementation Guide for CDA® Release 2: Consolidated CDA Templates for Clinical Notes, Draft Standard for Trial Use, Release 2.1, ONC assesses, approves, and incorporates corrections as part of required testing and certification to this criterion. [see the Health IT Certification Program Overview] Certified health IT adoption and compliance with the following corrections are necessary because they implement updates to vocabularies, update rules for cardinality and conformance statements, and promote proper exchange of C-CDA documents. There is a 90-day delay from the time the CCG has been updated with the ONC-approved corrections to when compliance with the corrections will be required to pass testing (i.e., ETT Message Validator). Similarly, there will be an 18-month delay before a finding of a correction’s absence in certified health IT during surveillance would constitute a non-conformity under the Certification Program.
Health IT developers can choose to use the flexibility of the Standards Version Advancement Process (SVAP) to use more advanced version(s) of standards than the version(s) incorporated by reference in the regulation for this certification criterion. To comply with the Maintenance of Certification requirement in § 170.405(b), a health IT developer that chooses to pursue such updates must include in their Real World Testing plan each Certified Health IT Module updated to newer version(s) of any standard(s) prior to August 31 of the year in which their updates were made and test each Module the following calendar year for conformance to all applicable criteria within its scope, including the newer version(s) of the standard(s).
Developers updating their already Certified Health IT Modules who choose to leverage the SVAP flexibility will be required to provide advance notice to all affected customers and its ONC-Authorized Certification Body (ONC-ACB). To be open and transparent to the public, developers must also provide its ONC-ACB with a publicly accessible hyperlink to the SVAP Notice to be published with the Module on the ONC Certified Health IT Product List (CHPL).
Consistent with Executive Order (EO) 14168 and OPM guidance, Health IT Modules certifying and/or currently certified to certification criteria that cross-reference the USCDI standard at 45 CFR 170.213 are only required to demonstrate the capability to categorize data on individuals for the sex data element in accordance with the following SNOMED CT® codes:
- 248152002 |Female (finding)| and
- 248153007 |Male (finding)|
Further, these Health IT Modules are no longer required to support the following USCDI data elements for purposes of certification:
- Sexual orientation in USCDI version 4;
- Gender identity in USCDI version 4;
- Sex parameter for clinical use in USCDI version 5;
- Name to use in USCDI version 5;
- Pronouns in USCDI version 5.
Through the C-CDA Patch Process, the HL7® Structured Documents Work Group (SDWG) approves C-CDA “patches”, which are corrections for issues with the C-CDA implementation guide (C-CDA IG) and companion guides. C-CDA “patches” include corrections for issues such as ambiguous requirements and requirements incompatible with real world deployment. Similar to C-CDA “patches” are C-CDA “additional guidance”. C-CDA “additional guidance” approved by the SDWG indicates guidance included in a newer version of the C-CDA IG or companion guide as being relevant to a previous version of the C-CDA IG or companion guide. A C-CDA “patch” may require a code change to correct errors or ambiguities in the guide, while “additional guidance” is purely clarifying and does not require any code changes. Though C-CDA “patches” and “additional guidance” are not required for certification purposes (unless indicated in the Certification Companion Guide), health IT developers may optionally implement C-CDA “additional guidance” in their Health IT Module and still be conformant with § 170.315(e)(1) criterion requirements.
More information regarding the C-CDA Patch Process and C-CDA “patches” and “additional guidance” approved by the SDWG is available on the HL7® Confluence pages of C-CDA 'Patch' Process and Approved Patches and Additional Guidance

Technical outcome – Download:

In general, health IT presented for certification must be capable of creating CCD documents in order to demonstrate compliance with this certification criterion specified in § 170.205(a)(4) and (5) for a period until December 31, 2025, or § 170.205(a)(4) and (6), following the CCD document template. [see also 80 FR 16850; 80 FR 62659; and 80 FR 62674]
Ambulatory setting – Patients (and their authorized representatives) must be able to download a summary in both a human readable format and using the CCD document template of the Consolidated CDA Release 2.1. If the patient (or their authorized representative) chooses to download a summary using the CCD document template, the information must contain:
- The USCDI data elements;
- The provider’s name and office contact information;
- Laboratory test report(s);
- Diagnostic image report(s).
Inpatient setting –
- Patients (and their authorized representatives) must be able to download a summary in both a human readable format and using the CCD document template of the Consolidated CDA Release 2.1. If the patient (or their authorized representative) chooses to download a summary using the CCD document template, the information must contain:
  - The USCDI data elements;
  - Admission and discharge dates and locations;
  - Discharge instructions;
  - Reason(s) for hospitalization;
  - Laboratory test report(s);
  - Diagnostic image report(s).
- Patients (and their authorized representatives) must be able to download transition of care/referral summaries that were created for a transition of care. [see also Transitions of care CCG]
For both settings, if the patient (or their authorized representative) chooses to download a summary using the CCD document template, the human readable CCD must include data in their English (i.e., non-coded) representation if associated with a vocabulary or code set.

Clarifications:

Health IT may demonstrate that it is capable of creating CCDs in one of two ways.
1. As a native capability that is part of the health IT presented for certification; or
2. Relying upon a separate source system to perform the CCD creation capability. In this latter case, the source system would be performing a required capability to demonstrate compliance with this certification criterion and would be bound to the issued certificate as “relied upon software.” [see Relied Upon Software Guidance] If taking this approach, the Health IT Module must be tested with at least one relied upon software product.
The “human readable” aspect of this provision can be satisfied using a style sheet associated with a document formatted according to the C-CDA as specified in § 170.205(a)(4) and (5) for a period until December 31, 2025, or § 170.205(a)(4) and (6), following the CCD document template. [see also 80 FR 62634]
A hyperlink to the data alone cannot satisfy this provision. The patient (or their authorized representatives) must be able to download the data to meet this requirement. [see also 77 FR 54180]
For inpatient setting only, patients (and their authorized representatives) must be able to download transition of care/referral summaries.
Health IT Modules may include laboratory test reports and diagnostic image reports in the “Results” or the "Notes" sections of the CCD.
- For laboratory test reports, the C-CDA can support this information in a structured way using the “Result Observation Template” in the “Results” section, or in the “Note Activity Template” in either the “Results” or the “Notes” sections.
  - There is no need to test for sending a corrected laboratory report; this requirement is satisfied if the Health IT Module can demonstrate that it can send a laboratory test report. [see also 80 FR 62660]
- The C-CDA can support the laboratory test reports data in a structured way using the “Result Observation Template” in the “Results” section. ONC recommends developers follow the best practices for use of the Result Observation Template per HL7® (e.g., HL7® Task Force Examples). [see also 80 FR 62660]
- ONC recommends developers code laboratory test report data where possible and appropriate in anticipation that future certification will require more extensively coded laboratory test report data. [see also 80 FR 62660] For diagnostic image reports, unstructured data for the interpretation text is acceptable. [see also 80 FR 62659]
The “inpatient setting only” provision at paragraph (e)(1)(i)(B)(3), which requires a Health IT Module to enable the download of transition of care/referral summaries created as a result of a transition of care, tests the functionality of supplying such previously created C-CDAs and not the content/conformance of the C-CDAs supplied.
As currently written in regulation, there is a typo regarding the required data specifications for ambulatory and inpatient settings. It is ASTP’s intent to address this typo in future rulemaking. In the meantime, the correct subparagraphs for reference would be:
- (i) Ambulatory setting only. All of the data specified in paragraph (e)(1)(i)(A)(1), (2), (3), (4), (6), and (7) of this section.
- (ii) Inpatient setting only. All of the data specified in paragraphs (e)(1)(i)(A)(1), (2), (3), (5), (6), and (7) of this section.

Technical outcome – Transmit:

For both settings, patients (and their authorized representatives) must be able to transmit the CCD summary created in provision (i)(B)(2) through both (1) email transmission to any email address; and (2) an encrypted method of electronic transmission.
In addition, for the inpatient setting, patients (and their authorized representatives) must be able to select and transmit transition of care/referral summaries created for a transition of care through both (1) email transmission to any email address; and (2) an encrypted method of electronic transmission.

Clarifications:

Please see the Office of Civil Rights (OCR) Frequently Asked Questions for best practices regarding the use of email for transmitting health information.
For the email option, the approach is to provide patients with a readily understood and convenient option to send their health information via email. Under the current Health Insurance Portability and Accountability Act (HIPAA) regulations (45 CFR 164.524 and related guidance), patients may presently ask that their data be disclosed to them via unencrypted email. [see also 80 FR 62660]
For the encrypted “transmit” option, ONC encourages developers to provide innovative options for individuals to easily and efficiently protect their health information based on generally available mechanisms for security and new advances in this area.
- The second “transmit” option is subject to the privacy and security certification framework, particularly the “Trusted connection” certification criterion (§ 170.315(d)(9)).
- Health IT developers have the flexibility to either establish an encrypted connection between two end points or, alternatively, secure the payload via encryption.
- The Direct protocol remains an encouraged and viable method to meet the requirements of the encrypted “transmit” requirement.
Transferring data to an electronic media like a USB drive or DVD does not constitute “electronic transmission” to meet this criterion. [see also 77 FR 54182]
For the purposes of transmission, several methods are acceptable with respect to enabling patients to use this capability. The transmission capabilities could include the ambulatory or inpatient summary created as a file attachment or provide another way for the patient to access their ambulatory or inpatient summary after initiating a transmission, such as a link embedded to their ambulatory or inpatient summary. In either case, however, note that the transmission capability must be able to support transmitting CCD documents and human readable formatted documents.

Technical outcome – Timeframe Selection:

For all of the provisions in (i)(A), (i)(B), and (i)(C) (i.e., VDT capabilities), patients and their authorized representatives must be able to select data associated with a specific date and select data within an identified time range.

Clarifications:

Timeframes

This criterion has two timeframe filters that patients must be able to select and configure on their own (specific date and date range). ONC did not include the ability to select a specific data element category as part of this filtering requirement.
There is no need to allow for selection of a specific time within each date range. For example, “9/1/2015 to 10/1/2015” is sufficient, rather than “9/1/2015 at 9:00am to 10/1/2015 at 5:00pm.” However, health IT developers may choose to include additional functionality to make it easy for patients to locate the information they need.

Data Requirements

Paragraph (e)(1)(i)(D) and its subsequent subparagraphs focus on "data." The scope of the information to be included in the timeframe selection for paragraphs (e)(1)(i)(A),(B), and (C) is focused on the data as laid out in (e)(1)(i)(A)(1) and (e)(1)(i)(A)(3) through (7), which are more than just the USCDI data elements.
All referenced data in the specified range of the timeframe selection must be returned regardless of whether the data is contained in a C-CDA document or in an atomic form and parsed.
Returning all data all the time regardless of a date selection or date range selection is non-conformant insofar as the technology is not demonstrating filtering by date range. The health IT developer must be able to demonstrate that filtering based on the two timeframes can be done properly.
Filtering in terms of excluding certain data must be by timeframe pursuant to the two filtering functionalities.
- ONC expects that the Health IT Module must be able to send, at a minimum, all required data for a specified date range(s). ONC acknowledges that there will be organizational policies and/or safety best practices that will dictate additional data to be sent and when data is considered complete and/or ready for being sent.
- For a Date Range Filter associated with VDT a System Under Test can provide the patient with one or more C-CDA documents that contain the data that is appropriate for the date range.

Approach

The date/date range filtering capability does not alone require the creation of new CCD documents to match the patient’s date or date range selection. Health IT is not expected to decompose, extract, and recompose the data from multiple CCD documents into a single larger CCD reflective of the entire date/date range filter selected. Rather, existing/previously created CCD documents in the health IT could be returned in response to a date/date range filter request that the patient could then view, download, or transmit. In other words, the health IT would not be expected to reproduce duplicative copies of CCDs it already created as part of this criterion’s conformance requirements in order to meet the date/date range filter requirement. Providing a list of the existing/previously created CCDs for that date or within the specified date range would be acceptable.
However, to be clear, the practice of creating a new CCD is not prohibited and would have the positive effect of making discrete data available to the patient upon request.
Health IT must separately demonstrate compliance with paragraphs (e)(1)(i)(B)(3) and (e)(1)(i)(C)(2) of this criterion. However, the data requirements of paragraph (e)(1)(i)(D) do not apply to “supplied” transition of care/referral summaries referenced in these paragraphs.

Regulation Text

§ 170.315 (e)(1) View, download, and transmit to 3rd party—

(i) Patients (and their authorized representatives) must be able to use internet-based technology to view, download, and transmit their health information to a 3rd party in the manner specified below. Such access must be consistent and in accordance with the standard adopted in § 170.204(a)(1) and may alternatively be demonstrated in accordance with the standard specified in § 170.204(a)(2).

View. Patients (and their authorized representatives) must be able to use health IT to view, at a minimum, the following data:
- The data classes expressed in the standard in § 170.213 (which should be in their English (i.e., non-coded) representation if they associate with a vocabulary/code set), and in accordance with § 170.205(a)(4) and (a)(5), and paragraphs (e)(1)(i)(A)(3)(i) through (iii) of this section, for the time period up to and including December 31, 2025, or
- The data classes expressed in the standards in § 170.213 (which should be in their English (i.e., non-coded) representation if they associate with a vocabulary/code set), and in accordance with § 170.205(a)(4) and (a)(6), and paragraphs (e)(1)(i)(A)(3)(i) through (iii) of this section.
- The following data classes:
  - Assessment and plan of treatment. In accordance with the “Assessment and Plan Section (V2)” of the standard specified in § 170.205(a)(4); or in accordance with the “Assessment Section (V2)” and “Plan of Treatment Section (V2)” of the standard specified in § 170.205(a)(4).
  - Goals. In accordance with the “Goals Section” of the standard specified in § 170.205(a)(4).
  - Health concerns. In accordance with the “Health Concerns Section” of the standard specified in § 170.205(a)(4).
  - Unique device identifier(s) for a patient's implantable device(s). In accordance with the “Product Instance” in the “Procedure Activity Procedure Section” of the standards specified in § 170.205(a)(4).
- Ambulatory setting only. Provider's name and office contact information.
- Inpatient setting only. Admission and discharge dates and locations; discharge instructions; and reason(s) for hospitalization.
- Laboratory test report(s). Laboratory test report(s), including:
  - The information for a test report as specified all the data specified in 42 CFR 493.1291(c)(1) through (7);
  - The information related to reference intervals or normal values as specified in 42 CFR 493.1291(d); and
  - The information for corrected reports as specified in 42 CFR 493.1291(k)(2).
- Diagnostic image report(s).
Download.
1. Patients (and their authorized representatives) must be able to use technology to download an ambulatory summary or inpatient summary (as applicable to the health IT setting for which certification is requested) in the following formats:
  1. Human readable format; and
  2. The format specified in accordance to the standard specified in § 170.205(a)(4) and (5) for the time period up to and including December 31, 2025, or § 170.205(a)(4) and (6), and following the CCD document template.
2. When downloaded according to the standard specified in § 170.205(a)(4) through (6) following the CCD document template, the ambulatory summary or inpatient summary must include, at a minimum, the following data (which, for the human readable version, should be in their English representation if they associate with a vocabulary/code set):
  1. Ambulatory setting only. All of the data specified in paragraph (e)(1)(i)(A)(1), (2), (4), and (5) of this section.
  2. Inpatient setting only. All of the data specified in paragraphs (e)(1)(i)(A)(1), and (3) through (5) of this section.
3. Inpatient setting only. Patients (and their authorized representatives) must be able to download transition of care/referral summaries that were created as a result of a transition of care (pursuant to the capability expressed in the certification criterion specified in paragraph (b)(1) of this section).
Transmit to third party. Patients (and their authorized representatives) must be able to:
1. Transmit the ambulatory summary or inpatient summary (as applicable to the health IT setting for which certification is requested) created in paragraph (e)(1)(i)(B)(2) of this section in accordance with both of the following ways:
  1. Email transmission to any email address; and
  2. An encrypted method of electronic transmission.
2. Inpatient setting only. Transmit transition of care/referral summaries (as a result of a transition of care/referral as referenced by (e)(1)(i)(B)(3)) of this section selected by the patient (or their authorized representative) in both of the ways referenced (e)(1)(i)(C)(1)(i) and (ii) of this section).
Timeframe selection. With respect to the data available to view, download, and transmit as referenced paragraphs (e)(1)(i)(A), (B), and (C) of this section, patients (and their authorized representatives) must be able to:
- Select data associated with a specific date (to be viewed, downloaded, or transmitted); and
- Select data within an identified date range (to be viewed, downloaded, or transmitted).

(ii) Activity history log.

When any of the capabilities included in paragraphs (e)(1)(i)(A) through (C) of this section are used, the following information must be recorded and made accessible to the patient (or his/her authorized representative):
- The action(s) (i.e., view, download, transmission) that occurred;
- The date and time each action occurred in accordance with the standard specified in § 170.210(g);
- The user who took the action; and
- Where applicable, the addressee to whom an ambulatory summary or inpatient summary was transmitted.
[Reserved]

(iii) Request for restrictions.

Patients (and their authorized representatives) must be able to use an internet-based method to request a restriction to be applied for any data expressed in the standards in § 170.213. Conformance with this paragraph is required by January 1, 2026.

Standards & References

The following standards are referenced within the certification criteria for: § 170.315(e)(1) View, download, and transmit to 3rd party

Paragraph (e)(1)(i)

§ 170.204(a)(1) Web Content Accessibility Guidelines (WCAG) 2.0, Level A Conformance

§ 170.204(a)(2) WCAG 2.0, Level AA Conformance

§ 170.205(a)(4) Health Level 7 (HL7^®) Implementation Guide for CDA^® Release 2 Consolidation CDA^® Templates for Clinical Notes (US Realm), Draft Standard for Trial Use Release 2.1 C-CDA 2.1 with Errata, August 2015, June 2019 (with Errata)

§ 170.205(a)(5) HL7^® CDA ^® R2 IG: C-CDA Templates for Clinical Notes R2.1 Companion Guide, Release 2, October 2019 (Adoption of this standard expires on January 1, 2026)

§ 170.205(a)(6) HL7^® CDA^® R2 Implementation Guide: C-CDA Templates for Clinical Notes STU Companion Guide, Release 4.1 - US Realm (This standard is required by December 31, 2025)

Paragraph (e)(1)(i)(A)

§ 170.213(a) United States Core Data for Interoperability (USCDI), July 2020 Errata, Version 1 (v1) (Adoption of this standard expires on January 1, 2026)

§ 170.213(b) United States Core Data for Interoperability Version 3 (USCDI v3) (This standard is required by December 31, 2025.)

Laboratory test report(s):

The information for a test report as specified all the data specified in 42 CFR 493.1291(c)(1) through (7);
1. For positive patient identification, either the patient's name and identification number, or a unique patient identifier and identification number.
2. The name and address of the laboratory location where the test was performed.
3. The test report date.
4. The test performed.
5. The specimen source, when appropriate.
6. The test result and, if applicable, the units of measurement or interpretation, or both.
7. Any information regarding the condition and disposition of specimens that do not meet the laboratory's criteria for acceptability.
The information related to reference intervals or normal values as specified in 42 CFR 493.1291(d) – Pertinent “reference intervals” or “normal” values, as determined by the laboratory performing the tests, must be available to the authorized person who ordered the tests and, if applicable, the individual responsible for using the test results.
The information for corrected reports as specified in 42 CFR 493.1291(k)(2) – When errors in the reported patient test results are detected, the laboratory must do the following: Issue corrected reports promptly to the authorized person ordering the test and, if applicable, the individual using the test results.

Paragraph (e)(1)(i)(B)

§ 170.213(a) United States Core Data for Interoperability (USCDI), July 2020 Errata, Version 1 (v1) (Adoption of this standard expires on January 1, 2026)

§ 170.213(b) United States Core Data for Interoperability Version 3 (USCDI v3) (This standard is required by December 31, 2025.)

§ 170.205(a)(4) HL7^® Implementation Guide for CDA^® Release 2 Consolidation CDA^® Templates for Clinical Notes (US Realm), Draft Standard for Trial Use Release 2.1 C-CDA 2.1, August 2015, June 2019 (with Errata)

§ 170.205(a)(5) HL7^® CDA ^® R2 IG: C-CDA Templates for Clinical Notes R2.1 Companion Guide, Release 2, October 2019, IBR approved for § 170.205(a)(5) (Adoption of this standard expires on January 1, 2026)

§ 170.205(a)(6) HL7^® CDA^® R2 Implementation Guide: C-CDA Templates for Clinical Notes STU Companion Guide, Release 4.1 - US Realm (This standard is required by December 31, 2025)

Laboratory test reports:

The information for a test report as specified all the data specified in 42 CFR 493.1291(c)(1) through (7) –
1. For positive patient identification, either the patient's name and identification number, or a unique patient identifier and identification number.
2. The name and address of the laboratory location where the test was performed.
3. The test report date.
4. The test performed.
5. Specimen source, when appropriate.
6. The test result and, if applicable, the units of measurement or interpretation, or both.
7. Any information regarding the condition and disposition of specimens that do not meet the laboratory's criteria for acceptability.
The information related to reference intervals or normal values as specified in 42 CFR 493.1291(d) – Pertinent “reference intervals” or “normal” values, as determined by the laboratory performing the tests, must be available to the authorized person who ordered the tests and, if applicable, the individual responsible for using the test results.
The information for corrected reports as specified in 42 CFR 493.1291(k)(2) – When errors in the reported patient test results are detected, the laboratory must do the following: Issue corrected reports promptly to the authorized person ordering the test and, if applicable, the individual using the test results.

Paragraph (e)(1)(i)(C)

Please refer to the standards required for § 170.315(d)(9) “Trusted connection” for the encrypted method of electronic transmission.

Paragraph (e)(1)(ii)

§ 170.210(g) Synchronized clocks. The date and time recorded utilize a system clock that has been synchronized using any Network Time Protocol (NTP) standard.

Review the NTP Reference Document for guidance on certifying to this requirement.

Standard Version Advancement Process (SVAP) Version(s) Approved

Web Content Accessibility Guidelines (WCAG) 2.2, October 5, 2023

United States Core Data for Interoperability (USCDI), Version 3.1, June 2025

United States Core Data for Interoperability (USCDI), Version 5 (March 2025 Errata)

HL7 CDA® R2 Implementation Guide: Consolidated -CDA Templates for Clinical Notes Edition 4.0 - US Realm

For more information, please visit the Standards Version Advancement Process (SVAP) Version(s) page.

Certification Dependencies

§ 170.405

Real World Testing

Products certified to this criterion must complete requirements outlined for the Real World Testing Conditions and Maintenance of Certification.

Note: For calendar year (CY) 2025, a developer is not expected to submit an annual Real World Testing plan to its ONC-Authorized Certification Body (ONC-ACB) for the 2026 Real World Testing year. For CY 2026, ASTP/ONC only expects a developer with a Health IT Module(s) certified to the (g)(7) through (10) certification criteria, as of August 31, 2024, to submit a CY 2025 Real World Testing results report to its ONC-ACB by March 2026. Please read the full notice outlining the details of the Real World Testing enforcement discretion.

Learn More

Insights Condition

Products certified to this criterion must submit responses for the following measures:

Individuals’ access to view, download and transmit to a third party

Learn More

Privacy and Security

This certification criterion was adopted at § 170.315(e)(1). As a result, an ONC-ACB must ensure that a product presented for certification to a § 170.315(e) criterion includes the privacy and security criteria (adopted in § 170.315(d)) within the overall scope of the certificate issued to the product.

The privacy and security criteria (adopted in § 170.315(d)) do not need to be explicitly tested with this specific paragraph (e) criterion unless it is the only criterion for which certification is requested.
As a general rule, a product presented for certification only needs to be tested once to each applicable privacy and security criterion (adopted in § 170.315(d)) so long as the health IT developer attests that such privacy and security capabilities apply to the full scope of capabilities included in the requested certification. However, exceptions exist for § 170.315(e)(1) “View, download, and transmit to 3rd party (VDT)” and (e)(2) “Secure messaging,” which are explicitly stated.

For more information on the approaches to meet these Privacy and Security requirements, please download the Privacy and Security CCG below:

Privacy and Security CCG

if choosing

Approach 1

if choosing

Approach 2

For each applicable privacy and security certification criterion not certified for Approach 1, the health IT developer may certify using system documentation which is sufficiently detailed to enable integration such that the Health IT Module has implemented service interfaces that enable the Health IT Module to access external services necessary to meet the requirements of the privacy and security certification criterion. Please see the ONC Cures Act Final Rule at 85 FR 25710 for additional clarification.

Design and Performance

The following design and performance certification criteria (adopted in § 170.315(g)) must also be certified in order for the product to be certified.

Quality management system (§ 170.315(g)(4)): When a single quality management system (QMS) is used, the QMS only needs to be identified once. Otherwise, when different QMS are used, each QMS needs to be separately identified for every capability to which it was applied.
Accessibility-centered design (§ 170.315(g)(5)): When a single accessibility-centered design standard is used, the standard only needs to be identified once. Otherwise, the accessibility-centered design standards need to be identified for every capability to which they were applied; or, alternatively, the developer must state that no accessibility-centered design was used.
Consolidated CDA creation performance (§ 170.315(g)(6)): Consolidated Clinical Document Architecture (C-CDA) creation performance (§ 170.315(g)(6)) does not need to be explicitly tested with this criterion unless it is the only criterion within the scope of the requested certification that includes C-CDA creation capabilities. Note that the application of § 170.315(g)(6) depends on the C-CDA templates explicitly required by the C-CDA-referenced criterion or criteria included within the scope of the certificate sought. Please refer to the C-CDA creation performance CCG for more details.

Certification Companion Guide Changelog

The following changelog applies to:
§ 170.315(e)(1) View, download, and transmit to 3rd party

Changelog functionality is not available.

Revision History

Version #	Description of Change	Version Date
1.0	Initial publication	03-11-2024
1.1	Standards Referenced updated to reflect 2024 Approved SVAP Standards	08-19-2024
1.2	Removed typo in regulation that erroneously added a requirement at (e)(1)(i)(B)(2)(iii)	03-04-2025
1.3	For entire criterion, added clarification regarding compliance with EO 14168 and OPM guidance	03-27-2025
1.4	Added clarification for entire criterion providing information regarding C-CDA patch process. Added clarification to (e)(1)(i)(B)(2) to address typo in regulation regarding the data requirements for ambulatory and inpatient settings.	06-17-2025
1.5	Added update to Certification Dependencies section to reflect recent Real World Testing enforcement discretion notice.	07-23-2025
1.6	Standards Referenced updated to reflect 2025 Approved SVAP Standards	08-29-2025

#query-monitor-main {display:none;} /* Improve table styling for print */ table { width: 100%; border-collapse: collapse; margin-bottom: 1em; font-size: 14px; } #pf-body table { width:100% !important; } #pf-body table thead { background: #f6f6f6; } figure.wp-block-table { width:100%; } #pf-body table td { padding:1em; } #pf-body ul li:first-child:last-child { list-style-type: disc; } table, th, td { border: 1px solid #333; } th, td { padding: 8px 12px; text-align: left; } /* Alternate row shading for better readability */ tr:nth-child(even) { background-color: #f2f2f2; } /* Add page break inside long tables */ table { page-break-inside: avoid; } /* Improve list styling */ ul, ol { margin: 0 0 1em 1em; padding-left: .5em; } ul li, ol li { margin-bottom: 0.5em; font-size: 14px; line-height: 1.5; } /* Optional: Fix nested list indentation */ ul ul, ol ol { margin-top: 0.3em; margin-bottom: 0.3em; margin-left: 1.5em; } /* Prevent list items from splitting across pages */ li { page-break-inside: avoid; } /** * Extended List Block - Complete CSS Styling * All parentheses and italic combinations for legal */ /* === BASE RESET FOR EXTENDED LISTS === */ [class*="extended-list-"] { list-style: none !important; counter-reset: extended-counter; padding-left: 0; } /* Reset for nested lists */ [class*="extended-list-"] ol, [class*="extended-list-"] ul { list-style: none !important; counter-reset: extended-counter; } /* === BASE LIST ITEM STYLES === */ [class*="extended-list-"] li { counter-increment: extended-counter; position: relative; padding-left: 2em; margin-bottom: 0.5em; list-style: none !important; } /* Remove default markers */ [class*="extended-list-"] li::marker { display: none !important; } /* === UPPERCASE LETTERS WITH FULL PARENTHESES (A) (B) (C) === */ .extended-list-upper-alpha-paren li::before { content: "(" counter(extended-counter, upper-alpha) ")"; position: absolute; left: 0; top: 0; font-weight: 600; width: auto; color: #081f7a; } .extended-list-upper-alpha-paren-italic li::before { content: "(" counter(extended-counter, upper-alpha) ")"; position: absolute; left: 0; top: 0; font-style: italic; font-weight: 600; width: auto; color: #081f7a; } /* === UPPERCASE LETTERS WITH RIGHT PARENTHESIS A) B) C) === */ .extended-list-upper-alpha-right-paren li::before { content: counter(extended-counter, upper-alpha) ")"; position: absolute; left: 0; top: 0; font-weight: 600; width: auto; color: #081f7a; } .extended-list-upper-alpha-right-paren-italic li::before { content: counter(extended-counter, upper-alpha) ")"; position: absolute; left: 0; top: 0; font-style: italic; font-weight: 600; width: auto; color: #081f7a; } /* === LOWERCASE LETTERS WITH FULL PARENTHESES (a) (b) (c) === */ .extended-list-lower-alpha-paren li::before { content: "(" counter(extended-counter, lower-alpha) ")"; position: absolute; left: 0; top: 0; font-weight: 600; width: auto; color: #081f7a; } .extended-list-lower-alpha-paren-italic li::before { content: "(" counter(extended-counter, lower-alpha) ")"; position: absolute; left: 0; top: 0; font-style: italic; font-weight: 600; width: auto; color: #081f7a; } /* === LOWERCASE LETTERS WITH RIGHT PARENTHESIS a) b) c) === */ .extended-list-lower-alpha-right-paren li::before { content: counter(extended-counter, lower-alpha) ")"; position: absolute; left: 0; top: 0; font-weight: 600; width: auto; color: #081f7a; } .extended-list-lower-alpha-right-paren-italic li::before { content: counter(extended-counter, lower-alpha) ")"; position: absolute; left: 0; top: 0; font-style: italic; font-weight: 600; width: auto; color: #081f7a; } /* === NUMBERS WITH FULL PARENTHESES (1) (2) (3) === */ .extended-list-decimal-paren li::before { content: "(" counter(extended-counter, decimal) ")"; position: absolute; left: 0; top: 0; font-weight: 600; width: auto; color: #081f7a; } .extended-list-decimal-paren-italic li::before { content: "(" counter(extended-counter, decimal) ")"; position: absolute; left: 0; top: 0; font-style: italic; font-weight: 600; width: auto; color: #081f7a; } /* === NUMBERS WITH RIGHT PARENTHESIS 1) 2) 3) === */ .extended-list-decimal-right-paren li::before { content: counter(extended-counter, decimal) ")"; position: absolute; left: 0; top: 0; font-weight: 600; width: auto; color: #081f7a; } .extended-list-decimal-right-paren-italic li::before { content: counter(extended-counter, decimal) ")"; position: absolute; left: 0; top: 0; font-style: italic; font-weight: 600; width: auto; color: #081f7a; } /* === UPPERCASE ROMAN WITH FULL PARENTHESES (I) (II) (III) === */ .extended-list-upper-roman-paren li::before { content: "(" counter(extended-counter, upper-roman) ")"; position: absolute; left: 0; top: 0; font-weight: 600; width: auto; color: #081f7a; } .extended-list-upper-roman-paren-italic li::before { content: "(" counter(extended-counter, upper-roman) ")"; position: absolute; left: 0; top: 0; font-style: italic; font-weight: 600; width: auto; color: #081f7a; } /* === UPPERCASE ROMAN WITH RIGHT PARENTHESIS I) II) III) === */ .extended-list-upper-roman-right-paren li::before { content: counter(extended-counter, upper-roman) ")"; position: absolute; left: 0; top: 0; font-weight: 600; width: auto; color: #081f7a; } .extended-list-upper-roman-right-paren-italic li::before { content: counter(extended-counter, upper-roman) ")"; position: absolute; left: 0; top: 0; font-style: italic; font-weight: 600; width: auto; color: #081f7a; } /* === LOWERCASE ROMAN WITH FULL PARENTHESES (i) (ii) (iii) === */ .extended-list-lower-roman-paren li::before { content: "(" counter(extended-counter, lower-roman) ")"; position: absolute; left: 0; top: 0; font-weight: 600; width: auto; color: #081f7a; } .extended-list-lower-roman-paren-italic li::before { content: "(" counter(extended-counter, lower-roman) ")"; position: absolute; left: 0; top: 0; font-style: italic; font-weight: 600; width: auto; color: #081f7a; } /* === LOWERCASE ROMAN WITH RIGHT PARENTHESIS i) ii) iii) === */ .extended-list-lower-roman-right-paren li::before { content: counter(extended-counter, lower-roman) ")"; position: absolute; left: 0; top: 0; font-weight: 600; width: auto; color: #081f7a; } .extended-list-lower-roman-right-paren-italic li::before { content: counter(extended-counter, lower-roman) ")"; position: absolute; left: 0; top: 0; font-style: italic; font-weight: 600; width: auto; color: #081f7a; } /* === AUTO-NESTING OUTLINE STYLES === */ /* Outline Alpha: (A) -> (1) -> (a) -> (i) -> *(A)* -> *(1)* */ .extended-auto-nest.extended-list-outline-alpha { counter-reset: level1; } .extended-auto-nest.extended-list-outline-alpha > li { counter-increment: level1; } .extended-auto-nest.extended-list-outline-alpha > li::before { content: "(" counter(level1, upper-alpha) ")"; position: absolute; left: 0; top: 0; font-weight: 600; width: auto; color: #081f7a; } /* Level 2: Numbers with parentheses */ .extended-auto-nest.extended-list-outline-alpha > li > ol, .extended-auto-nest.extended-list-outline-alpha > li > ul { counter-reset: level2; } .extended-auto-nest.extended-list-outline-alpha > li > ol > li, .extended-auto-nest.extended-list-outline-alpha > li > ul > li { counter-increment: level2; } .extended-auto-nest.extended-list-outline-alpha > li > ol > li::before, .extended-auto-nest.extended-list-outline-alpha > li > ul > li::before { content: "(" counter(level2, decimal) ")"; font-weight: 600; width: auto; color: #081f7a; } /* Level 3: Lowercase letters with parentheses */ .extended-auto-nest.extended-list-outline-alpha > li > ol > li > ol, .extended-auto-nest.extended-list-outline-alpha > li > ol > li > ul, .extended-auto-nest.extended-list-outline-alpha > li > ul > li > ol, .extended-auto-nest.extended-list-outline-alpha > li > ul > li > ul { counter-reset: level3; } .extended-auto-nest.extended-list-outline-alpha > li > ol > li > ol > li::before, .extended-auto-nest.extended-list-outline-alpha > li > ol > li > ul > li::before, .extended-auto-nest.extended-list-outline-alpha > li > ul > li > ol > li::before, .extended-auto-nest.extended-list-outline-alpha > li > ul > li > ul > li::before { content: "(" counter(level3, lower-alpha) ")"; font-weight: 600; width: auto; color: #081f7a; } /* Level 4: Lower roman with parentheses */ .extended-auto-nest.extended-list-outline-alpha li li li ol, .extended-auto-nest.extended-list-outline-alpha li li li ul { counter-reset: level4; } .extended-auto-nest.extended-list-outline-alpha li li li ol li::before, .extended-auto-nest.extended-list-outline-alpha li li li ul li::before { content: "(" counter(level4, lower-roman) ")"; font-weight: 600; width: auto; color: #081f7a; } /* Level 5: Upper alpha italic with parentheses */ .extended-auto-nest.extended-list-outline-alpha li li li li ol, .extended-auto-nest.extended-list-outline-alpha li li li li ul { counter-reset: level5; } .extended-auto-nest.extended-list-outline-alpha li li li li ol li::before, .extended-auto-nest.extended-list-outline-alpha li li li li ul li::before { content: "(" counter(level5, upper-alpha) ")"; font-style: italic; font-weight: 600; width: auto; color: #081f7a; } /* Level 6: Decimal italic with parentheses */ .extended-auto-nest.extended-list-outline-alpha li li li li li ol, .extended-auto-nest.extended-list-outline-alpha li li li li li ul { counter-reset: level6; } .extended-auto-nest.extended-list-outline-alpha li li li li li ol li::before, .extended-auto-nest.extended-list-outline-alpha li li li li li ul li::before { content: "(" counter(level6, decimal) ")"; font-style: italic; font-weight: 600; width: auto; color: #081f7a; } /* === OUTLINE NUMERIC PATTERN === */ .extended-auto-nest.extended-list-outline-numeric { counter-reset: level1; } .extended-auto-nest.extended-list-outline-numeric > li::before { content: "(" counter(level1, decimal) ")"; font-weight: normal; width: 2.5em; } .extended-auto-nest.extended-list-outline-numeric > li > ol > li::before, .extended-auto-nest.extended-list-outline-numeric > li > ul > li::before { content: "(" counter(level2, lower-alpha) ")"; font-weight: 600; width: auto; color: #081f7a; } .extended-auto-nest.extended-list-outline-numeric > li > ol > li > ol > li::before, .extended-auto-nest.extended-list-outline-numeric > li > ol > li > ul > li::before, .extended-auto-nest.extended-list-outline-numeric > li > ul > li > ol > li::before, .extended-auto-nest.extended-list-outline-numeric > li > ul > li > ul > li::before { content: "(" counter(level3, lower-roman) ")"; font-weight: 600; width: auto; color: #081f7a; } /* === EDITOR-SPECIFIC STYLES === */ .block-editor-writing-flow [class*="extended-list-"] { list-style: none !important; } .block-editor-writing-flow [class*="extended-list-"] li { list-style: none !important; } /* === DEEP NESTING SUPPORT === */ [class*="extended-list-"] li ol, [class*="extended-list-"] li ul { margin-top: 0.5em; margin-bottom: 0.5em; padding-left: 2em; } /* === RESPONSIVE ADJUSTMENTS === */ @media (max-width: 768px) { [class*="extended-list-"] li { padding-left: 2.5em; } [class*="extended-list-"] li::before { width: 2em; } } /* === PRINT STYLES === */ @media print { [class*="extended-list-"] li::before { color: black !important; font-style: normal; } [class*="extended-list-"] li { break-inside: avoid; page-break-inside: avoid; } } /* === ACCESSIBILITY === */ [class*="extended-list-"] li:focus-within::before { outline: 2px solid #005cee; outline-offset: 2px; }

Function	Both Care Settings	Ambulatory Setting	Inpatient Setting
View	USCDI (English/human readable) Laboratory test report(s) Diagnostic image report(s)	Provider name Office contact information	Admission and discharge dates and locations Discharge instructions Reason(s) for hospitalization
Download and Transmit	Human readable summary and Continuity of Care Document (CCD) document template containing: USCDI Laboratory test report(s) Diagnostic image report(s)	Human readable summary and CCD also contain: Provider name Office contact information	Human readable summary and CCD also contain: Admission and discharge dates and locations Discharge instructions Reason(s) for hospitalization Transition of care/referral summaries created as a result of a transition of care or referral (human readable and CCD)

Version #	Description of Change	Version Date
1.0	Initial publication	03-11-2024
1.1	Updated a typo in Paragraph (e)(1)(i) Web Content Accessibility to reflect the correct SVAP version cited in regulation as WCAG 2.2.	10-09-2024
1.2	Updated test tool link	12-02-2024
1.3	Updated test steps with 2024 SVAP approved standards and new SITE UI language	03-21-2025
1.4	Updated test steps in (e)(1)(iii) to include authorized representatives in the scope of users	04-11-2025

Featured

Artificial Intelligence

Care Continuum

Care Settings

Clinical Topics

Interoperability

Policy

Rulemaking

Research & Analysis

Featured Resources & Tools

Resources

Implementation

Tools

Quick Links

Featured Blogs & News

TEFCA’s growing, are you in? Take a look at who’s participating in TEFCA Exchange

ASTP/ONC Rule Creates Prescription Drug Cost Transparency, Eases Administrative Burden, and Speeds Access to Care

USCDI v6 and Standards Bulletin 25-2

View, download, and transmit to 3rd party

Certification Companion Guide v1.6

Quick Overview

Required Updates

Design and Performance

Certification Clarifications

Content Required

Applies to entire criterion

§170.315(e)(1)(i)View, download, and transmit to 3rd party

Paragraph (e)(1)(i)(A)View

Paragraph (e)(1)(i)(B)Download

Paragraph (e)(1)(i)(C)Transmit

Paragraph (e)(1)(i)(D)Timeframe selection

Paragraph (e)(1)(ii)Activity history log

Paragraph (e)(1)(ii)Request for restrictions

System Under Test

ONC-ACB Verification

System Under Test

Test Lab Verification

System Under Test

Test Lab Verification

System Under Test

Test Lab Verification

System Under Test

Test Lab Verification

System Under Test

Test Lab Verification

System Under Test

Test Lab Verification

System Under Test

Test Lab Verification

System Under Test

Test Lab Verification

System Under Test

Test Lab Verification

System Under Test

Test Lab Verification

System Under Test

Test Lab Verification

System Under Test

Test Lab Verification

System Under Test

Test Lab Verification

System Under Test

Test Lab Verification

System Under Test

Test Lab Verification

System Under Test

Test Lab Verification

System Under Test

Test Lab Verification

System Under Test

Test Lab Verification