CCHIT holds release of IT system testing criteria

The Certification Commission for Healthcare Information Technology has put on hold the rollout of its new sets of completed testing criteria for multiple health IT systems while it waits for HHS to release its plans for certifying IT under the American Recovery and Reinvestment Act of 2009, also called the stimulus law.

Earlier this month, CCHIT announced it had completed work on updated versions of test scripts and criteria for use in the 2009-10 round of testing and certification.

The commission also announced it will publish in either June or July an updated certification handbook explaining the testing and certification process. But CCHIT Chairman Mark Leavitt said that it won't be taking applications from IT vendors for testing and certifying their electronic health record and other systems until HHS acts.





Leavitt said that CCHIT will defer launch of its 2009-10 testing programs until its people have had a chance to look at the initial batch of HHS-approved criteria under the stimulus act. The law mandates the creation of an HIT Policy Committee and an HIT Standards Committee to develop and review IT certification criteria as well as health information transmission standards and implementation specifications.

"The policy and standards committees have some very tight deadlines," Leavitt said.

"HHS has to take it through a public rulemaking and then it goes to OMB," Leavitt said, referring to the White House's Office of Management and Budget.

To keep the whole process on schedule, the policy and standards committees have to be done with their work by Aug 21, Leavitt said. "Since we want to conform our process to what those committees' recommendations are, we want to hold our process," until the committees' work is completed. "They may want to add or subtract something. This will give us a chance to adapt the 2009-2010 process” to the stimulus act.

Initially, CCHIT certification lasted for three years, but testing was updated annually. Going forward, Leavitt said, he's guessing certification will be on a two-year cycle.

CCHIT has been criticized in some quarters for certifying systems only on functionality, but not ease of use. Leavitt said that CCHIT is "beginning to investigate how to test usability."

"There are a number of ways to do it, but we have to look for ways that are objective, that we can repeat," Leavitt said.

One way, Leavitt said, would be to "look for the most common tasks and then count the number of clicks to do those tasks." Those would include what Leavitt, himself a physician, calls "the speed-dial tasks in a physician's office," including refilling a prescription or taking a history on a new patient.

"You test that part of the product and you literally time it," Leavitt said. Vendors could be asked to bring in their systems and their best user and test them on these common tasks. “If it takes 150 clicks and 10 minutes, you have a big problem.

"The other end of the spectrum is you survey users," Leavitt said. "We ask the vendors for 10 sites. We want to see at least one that's measuring quality, or using (the system) to manage chronic disease. Or even do a survey as part of the reimbursement payment process."

The survey results could provide data on how many customers of a given system have applied for reimbursement under the "meaningful use" standard in the stimulus act vs. how many have qualified under that standard.

Leavitt said that the new certification criteria for 2009-10 have "a big focus on interoperability, including a requirement that EHRs be able to input and store data using the Continuity of Care Document format developed by standards development organizations Health Level 7 in collaboration with ASTM International.

Another test area—an option, not a requirement this year—will be whether the systems incorporate the interoperability specification approved by the federally supported Healthcare Information Technology Standards Panel that deals with querying another data source, such as a health information exchange, for the existence of patient records.

"If they do it, we give them a gold star and everyone will know it, but if they don't, they'll still get certified," Leavitt said.

Another testing requirement that was on the CCHIT road map for inclusion in future certification criteria was that all EHRs be able to link the diagnosis code with an electronic prescription and be able to communicate the diagnosis code and prescription information together in a single electronic prescription sent to a drugstore or pharmacy benefit manager outside the physician's practice.

The American Medical Association has a long-standing and oft-reaffirmed policy against any requirement to include diagnosis codes on prescriptions "to protect patient confidentiality and to minimize administrative burdens."

According to a grid of CCHIT testing criteria posted on the organization's Web site, the specific listing of this testing requirement "will be removed in 2009 when the corresponding Foundation criterion is tested." The requirement itself isn't being eliminated, however.

Leavitt said that by requiring EHRs be able to combine prescription data with a patient's diagnosis doesn't mean physicians will be forced to do so.

"The AMA doesn't want you to provide it. Fine. Don't provide it," Leavitt said. "That's a policy decision, so go ahead and fight that one out."

But there are safety benefits, Leavitt said, allowing a second set of eyes to review the applicability of the prescription for the specified diagnosis. "It's a potential way to reduce errors." And there are financial considerations. "For some medications, in some prescribing situations, you're required to do it. I believe it has to do with health plans qualifying patients to be on a medication."

Another controversial requirement that was originally proposed as a separate line item in the 2009 criteria would require building into EHRs a back door to allow access by insurance companies for fraud control. The requirement would make EHRs conform to a recommendations in the 2007, HHS-funded report by RTI International.

"Recommended Requirements for Enhancing Data Quality in Electronic Health Records Systems," which, despite the title, primarily dealt with the issue of medical billing and payment fraud control. According to CCHIT spokeswoman Sue Reber, that specific testing criterion also was de-listed—but not eliminated—sometime before the first draft of the 2009 criteria was published "because it is redundant with existing security criteria in the area of 'access control.'"