60 ONC's EHR Certification Requirements for the USA

Would you like to be listed in the Certified Health IT Product List (CHPL)? Do you need to get assistance in certifying your EHR software by ONC? This guide from the EHR technology developer Belitsoft International LLC would be the best place for start.

Beginning in 2019, all eligible professionals and hospitals in the USA are required to use 2015 edition certified electronic health record technology (CEHRT) to meet the requirements of the Promoting Interoperability Program (the requirements were updated in the 2019). The certified EHR technology also may help with all your MIPS reporting, but for Advancing Care Information category, it’s necessary. The Advanced Alternate Payment Models (Advanced APMs) also require use of certified EHR technology.

There are sixty 2015 Edition health IT certification criteria, which are organized into eight categories. ONC-Authorized Certification Bodies (ONC-ACBs) certify health IT products that have been successfully tested by an ONC-Authorized Testing Laboratory (ONC-ATL) to theses certification criteria.

In order to qualify for these criteria, the EHR technology developer is required to conduct their own testing and submit a form to the test lab. The following test labs have been authorized by ONC: Drummond Group; ICSA Labs; UL LLCWeb; SLI Compliance, a Division of Gaming Laboratories International, LLC.

Send us your request for information to get a quote. Contact us to know how our EHR/EMR experts could help you with EHR certification

1. Clinical Processes

Criteria 1-3. Computerized Provider Order Entry (CPOE)

The CPOE certification criterion splits into three separate categories with each criterion focused on one of three order types: medications, laboratory, and diagnostic imaging. This supports health IT developers to develop order-specific CPOE adaptations and provide more implementation flexibility.

To meet the 2015 Edition Base EHR definition, providers must possess technology that has been certified to at least one of the following: 

• CPOE-Medication;
• CPOE-Laboratory;
• CPOE-Diagnostic Imaging

CPOE-Medications allows clinicians to place orders electronically for transmission to the intended recipient such as a pharmacy. CPOE for medication ordering can reduce errors related to poor handwriting or the transcription of medication orders. CPOE can also enable automated drug-drug and drug-allergy interaction checks. In addition, medication information is updated in the patient’s medical record and becomes easily available for follow-up visits.

CPOE-Laboratory allows clinicians to place orders electronically for transmission to the intended recipient such as a laboratory. In using CPOE for laboratory orders, orders are incorporated with patient information, which can then be transmitted quickly to the laboratory.

CPOE-Diagnostic Imaging allows clinicians to place orders electronically for transmission to the intended recipient such as a radiology department. In using CPOE for diagnostic imaging, orders are incorporated with patient information, which can then be transmitted quickly to the radiology department. This also enables computerized decision support to aid clinicians in choosing the best imaging to order.

Criteria 4. Drug-drug, Drug-allergy Interaction Checks for CPOE.

CPOE drug interaction capabilities gives real-time information on contraindications and/ or possible medication interactions at the time of ordering, minimizing the potential for adverse events or pharmacy call-backs. This capability can provide clinical decision support by displaying multiple types of information, including: drug-disease interactions, drug-allergy interactions, drug-frequency ranges, drug-dosage ranges, drug-drug interactions, drug-renal function dose adjustment, drug-laboratory monitoring requirements, and drug-age dosage adjustments, which can improve medication safety and effectiveness.

Criteria 5. Demographics

Proper patient identification, patient safety, and efficient practice management require capturing accurate demographic information. Maintaining these data is essential for these purposes and supports population health activities. The demographic certification criterion supports the capture of patient health information with the granularity necessary to help clinicians identify opportunities for care improvement. This criterion confirms that a user can record, change, and access patient demographic data such as race and/or races, ethnicity and/or ethnicities, preferred language, sex, sexual orientation, gender identity, and date of birth.

Criteria 6. Problem List

The problem list contains the patient’s current health problems, injuries, chronic conditions, and other factors that affect the overall health and well-being of the patient. The problem list may also contain other information such as when an illness or injury occurred, as well as when or if it resolved. Accurate active problem lists have been a pillar of efficient and effective primary care for years, providing a snapshot of a patient’s current health issues.

Criteria 7. Medication List 

Along with an active problem list, having the electronic list of active and historical medications helps streamline visits, allows for the most efficient use of clinical staff, and makes on-call coverage safer and easier. Many practices develop a more comprehensive medication list by including over the counter drugs (OTCs), vitamins, and herbal or other types of nutritional supplements. In addition, having a current medication list for patient review at each patient visit helps patients to engage more fully with their care.

Criteria 8. Medication Allergy List 

Maintaining a list of known medication allergies for each patient is essential for safe patient care. Having this information available electronically allows for easy review when prescribing new medications to a patient.

Criteria 9. Clinical Decision Support (CDS) 

Clinical decision support provides relevant knowledge and person-specific information, intelligently filtered or presented at appropriate times, to increase quality of care and enhance health outcomes. CDS can be developed for multiple users, including clinicians, staff, and patients. CDS encompasses a variety of tools to enhance decision-making in the clinical workflow. These tools include contextually relevant reference information, clinical guidelines, condition-specific order sets, focused patient data reports and summaries, documentation templates, diagnostic support including drug-disease interaction checking, alerts, and reminders, among other tools.

Criteria 10. Drug-formulary and Preferred Drug List Checks 

An automated drug-formulary and preferred drug list enables a clinician to more easily and effectively identify medications approved (or preferred) to be prescribed for a patient based on the patient’s health insurance or health system/hospital policy. This can help reduce unforeseen medication costs when the patient picks up their prescriptions and inform discussions between the patient and clinician at the point of prescribing.

Criteria 11. Smoking Status 

Tobacco use and tobacco-related illness represents the single greatest preventable health risk to patients in the United States. There is clear and compelling evidence that clinician interest in a patient’s tobacco use can be an important first step in durable cessation, and the simple act of asking and recording a patient’s use of tobacco can have a profound benefit. Clinicians can also use this information to tailor discussions and specific care plans with a patient. 

Criteria 12. Family Health History 

Capturing family health history electronically can help to inform clinical decision support (CDS) for screening and prevention of illnesses or conditions that a patient may be at increased risk for due to their family health history. In addition to potentially reducing costs and improving population health, capturing this information once can improve efficiencies by minimizing the collection of duplicate information across settings. 

Criteria 13. Patient-specific Education Resources 

Patient-specific education is designed to help patients both understand and make better decisions about their health. These resources may come in the form of articles, videos, and images, all of which allow the patient to better understand their health and make informed health decisions. 

Criteria 14. Implantable Device List

Integrating unique device identifiers (UDIs) into certified health IT supports clinicians to better track the safety and performance of devices used by their patients regardless of setting or specialty. In the event of a product recall this information can help clinicians to identify all potentially affected patients. It can also allow clinicians to identify trends in outcomes related to a particular device. Having implantable device information available across the patient’s care continuum can help clinicians to make the best care decisions.  

Criteria 15. Social, Psychological, and Behavioral Data 

The capture of social, psychological, and behavioral data (also known as social determinants of health) can help to provide a more complete view of a patient’s overall health status. This in turn can help the clinician make more appropriate decisions, enhancing patient care and outcomes. This information can also help the health care team to identify patients with elevated risk factors and reduce health disparities. Examples of this type of information include financial resource strain, education level, amount of stress, depression, physical activity level, alcohol use, recreational drug use, social connection and isolation, and exposure to violence (i.e., intimate partner violence). This data can improve care coordination and lead to the identification of appropriate social supports and community resources.

2. Care Coordination

Criteria 16. Transitions of Care 

A transition of care summary and referral summaries provide essential clinical information for the receiving care team and helps organize final clinical and administrative activities for the transferring care team. This summary helps ensure the coordination and continuity of health care as patients transfer between different clinicians at different health organizations or different levels of care within the same health organization. This document improves admissions, discharges and other transition processes, communication among clinicians, and cross-setting relationships which can improve care quality and safety. This certification criterion will rigorously assess a product’s ability to create, receive, and properly consume interoperable documents using a common content and transport standard (e.g., Consolidated Clinical Document Architecture (C-CDA) and Direct Edge Protocol, respectively) that include key health data (e.g., name, date of birth, medications) that should be accessible and available for exchange.

Criteria 17. Clinical Information Reconciliation and Incorporation (CIRI) 

CIRI allows clinicians to reconcile and incorporate patient health information sent in from external sources to maintain a more accurate and up-to-date patient record. This process can help reduce errors that are especially common among patients who use multiple pharmacies, have co-morbidity factors, and multiple health care clinicians. The Consolidated Clinical Document Architecture (C-CDA) document, shared with clinicians from external sources such as hospitals, Health Information Exchanges (HIEs), or other clinicians, allow the clinician to import and reconcile health care information into their own patient record. 

Criteria 18. Electronic Prescribing 

Electronic prescribing (e-Prescribing or eRx) is a fast, efficient way to write/re-order and transmit prescriptions. Electronic prescribing may also have pre-set fields so all the required information for prescriptions are entered and automatically stored in the patient’s record for easy review during follow-up visits or for transitions to other clinicians. Prescriptions can be automatically transmitted to a pharmacy of preference, resulting in increased overall patient satisfaction and convenience. Clinicians can also send and receive other prescription-related messages with the pharmacy, including prescription cancel requests as well as requests for a patient’s medication history. Using an electronic system also provides guided dose algorithms to assist clinicians.

Criteria 19-20. Common Clinical Data Set Summary Record – Create and Receive  

A transition of care summary and referral summaries provide essential clinical information for the receiving care team and helps organize final clinical and administrative activities for the transferring care team. This summary helps ensure the coordination and continuity of health care as patients transfer between different clinicians at different health organizations or different levels of care within the same health organization. This document improves admissions, discharges and other transition processes, communication among clinicians, and cross-setting relationships which can improve care quality and safety. This certification criterion will rigorously assess a product’s ability to create and receive interoperable documents using a common content standard (e.g., Consolidated Clinical Document Architecture (C-CDA)) that include key health data (e.g., name, date of birth, medications) that should be accessible and available for exchange.

Criteria 21. Data Export 

Data export provides access and ability to export patient data for use in a different health IT system or a third party system for the purpose of a clinician’s choosing. This facilitates the accessibility and exchange of data, ensuring critical data is included when creating and exporting key patient health information, including name, sex, date of birth, problem list, medication list, functional status, reason for referral, and other vital information.

Criteria 22-23. Data Segmentation for Privacy – Send and Receive 

Sensitive health data is often exchanged via fax or paper-based methods, or excluded from data exchange altogether, meaning a clinician may not have all the relevant data at the point of care. This can lead to lower quality of care for the patient and can also lead to redundant, unnecessary, or harmful care. This criterion confirms that health IT is capable of sending and receiving a tagged transition of care summary document with privacy metadata that expresses the data classification and possible re-disclosure restrictions placed on the data by applicable law. This standard improves patient safety, the comprehensiveness of treatment, and quality of care, as well as supports and enables the delivery of more effective care to sub-groups of patients.

Criteria 24. Care Plan 

The care plan can help improve coordination of care by providing a structured format for documenting patient information such as goals, health concerns, health status evaluations, and interventions. Inclusion of this information is essential to incorporating the patient’s perspective, improving outcomes, and represents an important step toward realizing a longitudinal, dynamic, shared care plan.

3. Clinical Quality Measurement

Criteria 25. Clinical Quality Measures – Record and Export 

Clinical quality measures (CQMs) can help clinicians understand and improve the quality of health care for their beneficiaries. CQMs are also used by CMS and other health care organizations for quality improvement, public reporting, and pay-for-reporting programs for specific health care clinicians. This criterion ensures that health IT systems can record and export CQM data electronically (eCQM). The ability to export eCQM data can help a clinician or health system to view and verify their eCQM results for quality improvement on a near real-time basis. The export functionality gives clinicians the ability to export their results to multiple programs, such as those run by CMS, states, and private payers. 

Criteria 26. Clinical Quality Measures – Import and Calculate 

This criterion supports streamlined clinician processes through the importing of CQM data in a standardized format, reducing the need for manual patient data entry. It also ensures that health IT systems can correctly calculate eCQM results using a standardized format.

Criteria 27. Clinical Quality Measures – Report 

This criterion supports eCQM reporting using consensus-based industry standards (Health Level 7 Quality Reporting Document Architecture (HL7 QRDA)) and also supports better alignment with the reporting requirements of CMS programs by providing a baseline for interoperability of eCQM data. The requirements for reporting to CMS are included as an optional provision within the criterion because not all certified health IT is intended to be used for CMS reporting. Additionally, the HL7 QRDA standards are program-agnostic and can support a number of use cases for exchanging CQM data. 

Criteria 28. Clinical Quality Measures - Filter 

The filter functionality included in this criterion supports the capability for a clinician to make a query for eCQM results using one or a combination of data captured by the certified health IT for quality improvement and quality reporting purposes. It can also aid in the identification of health disparities, enable care quality improvement, and support clinicians in delivering more effective care to their patient populations. This certification criterion requires a Health IT Module to be able to record data (according to specified standards, where applicable) and filter CQM results at both patient and aggregate levels. These filters include, but are not limited to, practice site address, patient age, patient sex, and patient problem list.

4. Privacy & Security

Criteria 29. Authentication, Access Control, and Authorization 

Maintaining the confidentiality of patient health information is an important responsibility for clinicians. This certification criterion supports patient information to be safeguarded by requiring that health IT only permit access to patient health information by users who have valid credentials and only allowing credentialed users to access the types of information legitimately needed to perform their duties. 

Criteria 30. Auditable Events and Tamper-Resistance 

Applying privacy and security safeguards help protect patient information and can help clinicians avoid common security gaps that lead to cyber-attack or data loss. This certification criterion requires that by default, actions related to health information are recorded, such as who has accessed a patient’s information, and when, where, and how that access occurred. This capability (coupled with other Privacy and Security criteria such as “Audit Report(s)” and “Auditing Actions on Health Information”) enables a practice to review audit logs and thereby regularly monitor access to patient information and detect unauthorized access. This criterion also confirms that health IT is capable of preventing such audit logs from being changed, overwritten or deleted. 

Criteria 31. Audit Report(s) 

Audit report(s) enables a user to create reports of events recorded in audit trails and audit logs (see “Auditable Events and Tamper-Resistance”). Periodic reviews of audit reports provide many benefits such as preparing evidence during investigations of suspected or known security breaches, detecting unauthorized access to patient health information, and investigating patient complaints or employee concerns about suspected unauthorized access to patient data.

Criteria 32. Amendments 

Under the provisions of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule, patients may request corrections and amendments to their patient health information. This certification criterion supports the capability for clinicians to easily append the amendment to a patient’s health record, or provide a link that indicates an amendment’s location.

Criteria 33. Automatic Access Time-Out 

Automatic access time-out prevents unauthorized users from viewing or accessing electronic health information from unattended system devices (e.g., laptops, tablets) after a predetermined period of inactivity and requires a user to re-enter their credentials (e.g., password, pin number) in order to resume or regain access.

Criteria 34. Emergency Access 

During critical situations, clinicians may need emergency access to a patient’s health information to quickly provide crucial services and emergency care. Having access to patient data such as treatment history, known allergies, and medications can make the difference between life and death for patients. Practices can use this capability to assure that an identified set of users can access electronic health information during an emergency.

Criteria 35. End-User Device Encryption 

Patient health information can be breached when unencrypted end-user devices (e.g., laptops, tablets, smartphones) are lost or stolen. This criterion focuses on the capability of certified health IT to encrypt and decrypt electronic health information managed by certified health IT on end-user devices if the electronic health information remains stored on the devices when they no longer connected to the certified health IT.

Criteria 36. Integrity 

Ensuring that a patient’s record is secured, protected and contains accurate data is essential for both patient safety and quality of care. This certification criterion helps assure that data is not compromised during electronic exchange by creating a message digest verifying that the exchanged health information has not been altered.

Criteria 37. Trusted Connection 

Establishing a trusted connection provides assurance that electronic health data being exchanged will remain private and secure when transferring from point A to point B. This assurance is often displayed as an icon or symbol (such as a “lock”) depending on the technology.  

Criteria 38. Auditing Actions on Health Information 

This certification criterion supports the recording of auditable events (see “Auditable Events and Tamper-Resistance”) for the purpose of creating audit logs that help a practice monitor access to patient health information and detect unauthorized access. 

Criteria 39. Accounting of Disclosures 

This certification criterion ensures health IT can record disclosures made for treatment, payment, and health care operations. This includes recording data such as the date, time, patient identification, user identification, and a description of disclosures as defined in the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Rules (see 45 CFR 164.501). 

5. Patient Engagement

Criteria 40. View, Download, and Transmit to 3rd Party 

This certification criterion supports patient access to their health information, including via email transmission to any third party the patient chooses (including to any email address, so long as the patient is properly advised of the risks of doing so) and through a second encrypted method of transmission (which could be accomplished with Direct or by another encrypted means). This allows patients to be more engaged in their care and enhance care coordination and management.

Criteria 41. Secure Messaging 

Secure messaging enables a clinician to send messages to, and receive messages from, a patient in a secure manner to ensure appropriate access and secure exchange of health information.

Criteria 42. Patient Health Information Capture 

This certification criterion supports clinician acceptance of health information from patients which can advance patient engagement and activation, as well as support the use of patient generated health data (PGHD) in shared decision-making. This can help provide health information to clinicians and help address health disparities in populations that are less likely to execute health care planning documents.

6. Public Health

Criteria 43. Transmission to Immunization Registries 

Immunization Registries provide a consolidated, reconciled source of individual level immunizations. Immunization registries are typically part of larger Immunization Information Systems (IIS) that offer services beyond the registry. IIS are managed by state and jurisdictional public health departments. They provide public health information on vaccine coverage in their communities, inform public health immunization policy and programs, and provide information to inform the outbreaks of vaccine preventable. For clinicians, IIS provide information that otherwise may not be found in their local health IT. IIS help prevent over vaccination, and provide information that can be helpful in determining “catch-up” schedules for missing vaccination.

Criteria 44. Transmission to Public Health Agencies – Syndromic Surveillance 

Syndromic Surveillance Systems (SyS) collect individual level data from hospital emergency departments, urgent care clinics and, in some jurisdictions, other clinicians. SyS are managed by state and jurisdictional public health departments. SyS were originally built to help identify potential bio-terrorism events. The data are also useful on providing indicators on many infectious diseases, food borne diseases, situational awareness during public health responses and other types of surveillance. SyS often include the ability to interoperate with additional statistical tools used by epidemiologists and researchers. Many states and jurisdictions are sharing de-identified data across boundaries.

Criteria 45. Transmission to Public Health Agencies – Reportable Laboratory Tests and Values/Results 

As part of state and local disease surveillance, laboratories are required to report on laboratory tests and results for “Reportable Diseases.” Reportable diseases differ by state, but there is a core set found in all public health departments. The electronic transmission has improved the timeliness and quality of reports. The elimination of “re-keying” data not only improves quality but frees staff resources for other tasks. Laboratory test results are sometimes the first indication of disease and in some cases support disease reporting from clinicians. 

Criteria 46. Transmission to Cancer Registries 

Cancer Registries have provided detailed information on cancer for many decades. Hospital cancer registries report up to “centralized” cancer registries that may be at the county or state level. This “upward” reporting continues onto the national level at the Centers for Disease Control and Prevention (CDC) where de-identified data is collected and analyzed. Automating the complex and detailed cancer reports using information found in health IT reduces burden on clinicians and their staff and provides timely and accurate data on both diseases and treatment.

Criteria 47. Transmission to Public Health Agencies – Electronic Case Reporting 

State and local health departments mandate that clinicians provide information on a list of “Reportable Diseases.” Reportable diseases differ by state, but there is a core set found in all public health departments. The electronic transmission of case information from health IT improves not only the timeliness and quality of reports but reduces “under-reporting” that can occur for many reasons. Electronic case reporting provides additional clinical information beyond the data found in electronic laboratory reporting.

Criteria 48. Transmission to Public Health Agencies – Antimicrobial Use and Resistance Reporting 

Antimicrobial use/antimicrobial resistance (AU/AR), unlike many other public health reporting processes, is reported directly to Centers for Disease Control and Prevention. This type of public health reporting reports and analyzes antimicrobial use and/or resistance as part of local or regional efforts to reduce antimicrobial resistant infections. This collection and analysis on antimicrobial use and antimicrobial resistance are important components of antimicrobial stewardship programs throughout the nation and can promote timely, accurate, and complete reporting, particularly if data is extracted from health IT systems and delivered using well established data exchange standards to a public health registry. 

Criteria 49. Transmission to Public Health Agencies – Health Care Surveys 

This certification criterion supports the transmission of health care surveys to directly to the Centers for Disease Control and Prevention. The National Health Care Surveys are designed to answer key questions of interest to health care policy makers, public health professionals, and researchers. This may include factors that influence the use of health care resources, and the quality of health care such as safety, and disparities in health care services. 

7. Health IT Design and Performance

Criteria 50. Automated Numerator Recording 

Clinicians participating in certain Centers for Medicare and Medicaid (CMS) payment programs, such as the EHR Incentive Programs and Quality Payment Program, are required to submit certain percentage-based measures to CMS in compliance with the program's reporting requirements. This criterion aims to ease the burden of creating a report for submission to CMS, particularly for smaller clinician offices and hospitals. Automated numerator recording allows a health IT user to automatically create a report or file that enables a user to review the patients or actions that are included in a measure’s numerator. 

Criteria 51. Automated Measure Calculation 

Automated measure calculation allows a health IT user to electronically record the numerator and denominator for the CMS’ EHR Incentive Programs percentage-based measures and to create a report of the measures. This automation is intended to improve the accuracy of measure calculations and to reduce burden for clinicians and hospitals in calculating and reporting measures. 

Criteria 52. Safety-Enhanced Design 

This certification criterion focuses on health IT usability and safety. The criterion requires health IT that includes certain certified capabilities to demonstrate compliance with specified user-center design requirements. The capabilities identified are those that pose the greatest opportunity for error prevention and improved patient safety.  

Criteria 53. Quality Management System 

This certification criterion requires health IT developers to identify the quality management systems (QMS) used in the development, testing, implementation, and maintenance of certified capabilities. The QMS identified by the health IT developer must be consistent with federal QMS standards or QMS standards developed by standards developing organizations. 

Criteria 54. Accessibility-Centered Design 

This certification criterion encourages health IT developers to identify the accessibility standards used, and accessibility laws complied with, in the development of certified health IT. Clinicians, consumers, and other stakeholders benefit the application of user-centered design standards for accessibility to health IT and the compliance of health IT with accessibility laws as well as increased transparency around such actions.

Criteria 55. Consolidated CDA Creation Performance 

This certification criterion helps to ensure the interoperability of transition of care and referral summaries sent and received to and from external organizations. No matter how data is entered into health IT – via whatever workflow and functionality – the transition of care or referral summary should reflect the data accurately and not be missing data a user otherwise recorded. 

Criteria 56-58. Application Access – Patient Selection, Data Category Request and All Data Request

The “application access” certification criteria are split into three separate certification criteria (Patient Selection, Data Category Request, and All Data Request) with each individual criterion focused on specific functionality. The “application access” certification criteria require health IT to demonstrate it can provide application access to a common set of patient clinical data via an application programming interface (API). API functionality will help address many of the challenges currently faced by individuals and caregivers accessing their health data, including the “multiple portal” problem, by potentially allowing individuals to aggregate data from multiple sources in a web or mobile application of their choice. 

8. Electronic Exchange

Criteria 59. Direct Project 

Despite the increase in health IT adoption, many providers and organizations still remain reliant on paper, phone, fax, and physical transport to exchange patient information. The Direct Project is a low-cost, practical, secure mechanism for exchanging health information electronically instead of relying on slow, inconvenient, expensive methods of exchange such as paper and faxes, providing a path to more advanced interoperability. Direct makes it possible for providers to securely email information to other trusted providers or parties, such as specialists, pharmacies, and laboratories. The Direct Project does not replace other ways of exchanging information electronically but rather enhances them. 

Criteria 60. Direct Project, Edge Protocol, and XDR/XDM 

Effective, efficient, and secure communications between health care providers is a key contributing factor to providing better patient care. Direct Project, Edge Protocol, and Crossenterprise Document Reliable Interchange/Cross-enterprise Document Media Interchange (XDR/ XDM) allows standard protocols, along with message formats and processing requirements to work together to securely transport health information electronically by including three distinct capabilities to support interoperability and all potential certified exchange options.