Are you familiar with the changes that have been made under the 21st Century Cures Act to a Health IT Developer’s Mandatory Disclosure Requirements?
There are two important things to note from these changes:
- Removal of Limitations
- Continued Disclosure of Costs and Fees
Removal of Limitations:
The 2015 Edition Final Rule required that Health IT Developers disclose limitations of their certified EHR technology. Specifically, ONC required the disclosure of any “limitations that a user may encounter in the course of implementing and using the Complete EHR or Health IT Module’s capabilities, whether to meet meaningful use objectives and measures or to achieve any other use within the scope of the health IT’s certification.” These limitations could be of a contractual (§170.523(k)(1)(iv)(B)) or technical and practical nature (§170.523(k)(1)(iv)(C)).
However, this requirement has now been superseded by the 21st Century Cures Act Information Blocking provision and Conditions of Certification requirements, specifying that developers are prohibited from taking any action to interfere with a user’s ability to access or use the certified technology. As a result of no longer allowing such limitations to certified technologies, the requirement that they are disclosed (170.523(k)(1)(iii)(b)) has also been removed in the Final Rule.
Furthermore, as of the Final Rule effective date, a health IT developer must ensure that its certified product conforms to the full scope of the certification criteria and that the health IT developer does not take any action that could interfere with a user’s ability to access or use certified capabilities for any purpose within the full scope of the technology’s certification (170.402(a)(2) and (3)).
- June 30, 2020*: Developers should evaluate their current stated limitations and overall practices to determine if they interfere with a user’s ability to access or use the full scope of certified capabilities. Developers must remove, both in practice and in their posted mandatory disclosure statement, any such limitations.
- November 2, 2020*: Developers should evaluate their current stated limitations and overall practices to determine if they constitute information blocking. Developers must remove, both in practice and in their posted mandatory disclosure statement, any actions that constitute information blocking.
*Enforcement discretion of three months after the stated compliance date will apply
In many cases, Developers have opted to disclose requirements of the software within their mandatory disclosure that do not constitute information blocking nor interfere with the user’s ability to access or use certified capabilities. The removal of (170.523(k)(1)(iii)(b)) means that disclosure of such items is no longer required; however, we understand that Developers may want to keep these references within their mandatory disclosure as a means of helpful and transparent communication to their customers. To reduce confusion, Drummond recommends that Developers who wish to maintain such requirements within their mandatory disclosure statement no longer refer to them as “limitations” and replace it with another description.
Continued Disclosure of Costs and Fees:
While ONC removed the reference to limitations, they did not completely remove the Mandatory Disclosure requirements. Remaining in the 21st Century Cures Act is the requirement to provide a detailed description in plain language of additional costs a user may be required to pay related to the certified technology (170.523(k)(1)(iii)(A).
Costs include additional types of “costs or fees (whether fixed, recurring, transaction-based, or otherwise) imposed by a health IT developer (or any third party from whom the developer purchases, licenses, or obtains any technology, products, or services in connection with its certified health IT) to purchase, license, implement, maintain, upgrade, use, or otherwise enable and support the use of capabilities to which health IT is certified; or in connection with any data generated in the course of using any capability to which health IT is certified” (170.523(k)(1)(iv)(A).
While ONC has not made changes to the requirement to disclose additional costs, Developers should review their current costs and validate they meet existing requirements:
- Are costs described in plain language? Plain language means a description that is no more technical than how it would be explained in marketing materials. If there are no additional costs to disclose, that information must be clearly and explicitly stated.
- Are there any new costs that a customer may incur due to new 21st Century Cures functionality?
- Are costs conspicuously posted on the Developer’s website? This information should be easily accessible and clearly visible in a logical location on the website. While this information is not required to be on the homepage, it should be no more than a few clicks away and placed on a page to which a provider would logically navigate for this type of product information.
- Is the required certified product information also posted alongside the costs?
- Developer organization name
- The date the product was certified
- Product name and version
- Unique certification number
- Certification criteria to which the product has been certified
- CQMs to which the product has been certified
- Any additional software the certified product relied upon to demonstrate its compliance with certification criteria
- ONC Disclaimer: “This Health IT Module is 2015 Edition compliant and has been certified by an ONC- ACB in accordance with the applicable certification criteria adopted by the Secretary of Health and Human Services. This certification does not represent an endorsement by the U.S. Department of Health and Human Services.”
Updates to the Action Plan occurred on July 8, 2020.