HTI-1_NPRM_PRASupportingStatement_Final_4-25-2023

Health Data, Technology, and Interoperability: Certification Program Updates, Algorithm Transparency, and Information Sharing Proposed Rule

Department of Health and Human Services

Office of the National Coordinator for Health IT

Office of Policy

330 C Street SW

Washington D.C. 20201

Supporting Statement for Health Data, Technology, and Interoperability: Certification Program Updates, Algorithm Transparency, and Information Sharing Proposed Rule

A. Justification

1. Circumstances Making the Collection of Information Necessary

The Office of the National Coordinator for Health IT (ONC) is requesting OMB approval for the collection of information proposed in the Health Data, Technology, and Interoperability: Certification Program Updates, Algorithm Transparency, and Information Sharing Proposed Rule. This new information collection request which pertains to the Insights Condition and Maintenance of Certification requirements is found at § 170.407.

Section 4002(c) of the Cures Act, which amended section 3001(c)(5) of the Public Health Service Act (PHSA) (42 U.S.C. 300jj–11) requires the Secretary of HHS, through notice and comment rulemaking, to establish Conditions and Maintenance of Certification requirements for the ONC Health IT Certification Program (Certification Program). Specifically, the Cures Act requires health IT developers, as Condition and Maintenance of Certification requirements under the Certification Program, to submit reporting criteria on certified health IT in accordance with the EHR Reporting Program established under section 3009A of the PHSA, as added by the Cures Act.

Specifically, this includes establishing an Electronic Health Record (EHR) Reporting Program (which we intend to refer to the Condition and Maintenance of Certification associated with the “EHR Reporting Program” as the “Insights” Condition and Maintenance of Certification (also referred to as the “Insights Condition”) throughout the proposed rule and this supporting statement) to provide transparent reporting on certified health IT in the categories of interoperability, usability and user-centered design, security, conformance to certification testing, and other categories, as appropriate to measure the performance of certified health IT.

We are proposing to implement the Insights Condition and Maintenance of Certification requirements in § 170.407. As a Condition of Certification in § 170.407(a), a health IT developer must submit responses in accordance with the established Insights Condition of Certification requirements with respect to all applicable certified health technology a health IT developer offers under the Certification Program. As a Maintenance of Certification in § 170.407(b), a health IT developer must provide responses semiannually (twice a year) to the Insights Condition of Certification for any applicable Health IT Module(s) that have or have had an active certification at any time under the Certification Program during the prior six months.

To reduce burden for smaller and startup health IT developers, we also propose to establish minimum reporting qualifications that a health IT developer must meet in order to report on the measure requirements. The minimum reporting qualifications include whether a health IT developer has any applicable Health IT Modules certified to criteria associated with the measure, and whether the developer has at least 50 hospital users or 500 clinician users across its certified health IT products, which serves as a proxy for its size or maturation status (e.g., whether it is a startup). If a developer of certified health IT does not meet these minimum reporting qualifications, it would be required to submit a response that it does not meet the minimum reporting qualifications on specific measures for a given Health IT Module(s) subject to the Insights Condition requirements. In addition, if a health IT developer does not have at least one product that meets the applicable certification criteria specified in the measure requirements, or a developer of certified health IT that is certified to the criterion or criteria specified in the applicable measure during the reporting period but does not have any users using the functionality, the developer would still be required to submit a response that it does not meet the applicable certification criteria or the number of users required to report on the measure.

2. Purpose and Use of Information Collection

As a Condition of Certification in § 170.407(a), a health IT developer must submit responses and report in accordance with the established Insights Condition of Certification requirements with respect to all applicable certified health technology a health IT developer offers under the Certification Program. The proposed measures associated with the Insights Condition requirements described in the proposed rule relate to and reflect the interoperability category in section 3009A(a)(3)(A)(iii) of the PHSA. They relate to four aspects or areas of interoperability, which we refer to as “areas” throughout the proposed rule: individuals' access to electronic health information (EHI), public health information exchange, clinical care information exchange, and standards adoption and conformance. The approach for identifying measures included several considerations, such as priority interoperability functions, relevance to ONC policy priorities and broader interests, measures reflecting information that ONC cannot obtain without regulation, and efforts that are not duplicative of other data collection.

The majority of our proposed measures, which health IT developers must submit responses to, are data points derived from certified health IT systems. The proposed measures generally consist of numerators and denominators that will help generate metrics (e.g., percent across a population), which are further detailed in each proposed measure, but measures can also serve as standalone values. In some cases, we plan to generate multiple metrics by using different denominators for the same numerator or using different numerators with the same denominator. This approach would allow us to generate a variety of metrics. In one case, the measure is a simple attestation. For each measure, we have included information on the rationale for proposing the measure, proposed numerators and denominators, and key topics for comment.

The intent of the Insights Condition is to address information gaps in the health IT marketplace, as well as provide insights on how certified health IT is being used, consistent with Certification Program certification criteria and associated conformance to identified technical standards. Overall, the information collected would provide ONC and the public with information that would aid our collective understanding of how certified health IT is contributing to interoperability nationally.

3. Use of Improved Information Technology and Burden Reduction

We expect the costs and burden for health IT developers to submit responses, in accordance with the established Insights Condition of Certification requirements, to be mitigated due to the following factors. First, we plan to minimize burden for health IT developers by providing a web-based submission form and method to simplify the process for response submission. We also intend for the independent entity who is collecting the response submissions on behalf of ONC to have minimal burden by automating parts of the response review and submission process via an online tool.

4. Efforts to Identify Duplication and Use of Similar Information

Currently, there are no existing regulatory requirements regarding the submission of responses for the Insights Condition requirements by health IT developers.

5. Impact on Small Businesses or Other Small Entities

Consistent with statutory instruction per section 3009A(a)(3)(C) of the PHSA, we are proposing to implement minimum reporting qualifications designed to ensure that small and startup developers are not unduly disadvantaged by the proposed measures.

We understand that developers of certified health IT would need to invest resources to capture and report on these proposed measures. Given this understanding and with the objective to avoid unduly disadvantaging small and startup health IT developers, we propose to establish minimum reporting qualifications that a health IT developer must meet to report on the measure. Developers of certified health IT who do not meet the minimum reporting qualifications (as specified under each measure), would submit a response to specify that they do not meet the minimum reporting qualification(s) under the Insights Condition measure.

6. Consequences of Collecting the Information Less Frequent Collection

We propose in § 170.407(b)(1) that, as a Maintenance of Certification requirement for the Insights Condition, health IT developers of certified health IT must submit responses every six months (i.e., two times per year). Overall, we believe that semiannual reporting would provide more actionable and valuable data, including enabling us to recognize trends and provide more timely information to the health IT marketplace on the use of certified health IT. We also believe that this would provide an appropriate and balanced reporting period to review health IT developer responses to the criteria, as well as base any enforcement actions as necessary under the Certification Program.

We believe if information is collected less frequently, the information collected would be considered less timely and impactful due to our proposal to give an additional six months for developers to assemble and assess their collected data before submitting to ONC. Semiannual reporting would help mitigate the six-month delay of data and may also reduce data storage burden for health IT developers.

7. Special Circumstances Relating to the Guidelines of 5 CFR 1320.5

We believe the request fully complies with the regulation.

8. Comments in Response to the Federal Register Notice/Outside Consultation

The proposed rule was published in the Federal Register on April 18, 2023 (88 FR 23746).

The proposed rule solicits comments on the Insights Condition and Maintenance of Certification requirements and will summarize public comments received in response to the notice, and describe actions taken by ONC in response to these comments after the comment period has concluded.

We have consulted with the Health Information Technology Advisory Committee (HITAC) regarding the overall policy, reporting period, and frequency of reporting in accordance with the Insights Condition requirements.

9. Explanation of any Payment/Gift to Respondents

Payment/gifts will not be made to respondents.

10. Assurance of Confidentiality Provided to Respondents

Data submitted by health IT developers to comply with the requirements of the Insights Condition would be provided and aggregated at the product level (across versions). There is no assurance of confidentiality as this data would be made public on ONC’s website unless we determine the data could potentially identify a health care provider.

11. Justification for Sensitive Questions

There are no questions or collection of information that is of a sensitive nature.

12. Estimates of Annualized Hour and Cost Burden

We propose that response submissions related to the Insights Condition and Maintenance of Certification requirements would be submitted to an independent entity on behalf of ONC. Specifically, we intend to award a grant, contract, or other agreement to an independent entity as part of the implementation of the Insights Condition and will provide additional details through subsequent information. We intend to make responses publicly available via an ONC website and intend to provide developers of certified health IT the opportunity to submit qualitative notes that would enable them to explain findings and provide additional context and feedback regarding their submissions.

For the purposes of estimating potential burden, we believe the independent entity will take approximately 5 minutes to review a response submission for completeness per § 170.407(a), and approximately 30 minutes to submit the completed response submission to ONC per § 170.407(b), based on how many products a certified health IT developer may be required to submit responses for. We also plan to minimize burden for the independent entity by automating parts of the response review and submission process via an online tool.

We expect that the Software Quality Assurance Analyst could complete the response review for completeness responsibilities. According to the 2021 BLS occupational employment statistics, the mean hourly wage for the Software Quality Assurance Analyst (15-1253) is $46.97. Therefore, we estimate the total annual cost for reviewing response submissions per § 170.407(a) would on average be $1,114.00. Per § 170.407(b), we estimate the total annual cost for submitting response submissions to ONC twice year to be on average $6,716.71. We note that these are estimated averages which may vary dependent on how many products a developer of certified health IT may be required to submit responses for.

Estimated Annualized Burden Hours for Independent Entity to Review and Submit Developer Responses to ONC per Insights Condition Requirements

Type of Respondent	Code of Federal Regulations Section	Number of Respondents	Number of Responses per Respondent	Average Burden Hours per Response	Total Burden Hours	Cost Per Hour	Total Cost
Independent Entity	§ 170.407(a)	1	2	12	24	$46.97	$1,114.97
Independent Entity	§ 170.407(b)	1	2	71.5	143	$46.97	$6,716.71

We propose in 45 CFR 170.407(b) that a health IT developer must submit responses associated with the Insights Condition and Maintenance of Certification requirements to an independent entity twice a year. For the purposes of estimating potential burden, we are estimating 52 health IT developers will be required to report on the proposed measures within the Insights Condition and Maintenance of Certification requirements. According to the 2020 BLS Occupational Employment and Wage Statistics, the mean hourly wage for a health IT developer with BLS Occupation Codes (15-1252, 15-1253, 15-1133) who would be appropriate for this responsibility is $54.94.

We believe it will take approximately 21,136 to 44,900 hours on average for a health IT developer to collect and report on the proposed measures within the Insights Condition and Maintenance of Certification requirements. For the purposes of estimating the total potential burden for health IT developers, we estimate an average burden of 1,688,368 hours. However, this is a crude upper bound estimate as there are multiple measures with varying complexity associated with the Insights Condition, and the number of health IT developers required to report changes by each measure.

Estimated Annualized Total Burden Hours for Health IT Developers to Collect and Report on the Measures Proposed Within the Insights Condition and Maintenance of Certification Requirements

Type of Respondent	Code of Federal Regulations Section	Number of Respondents	Number of Responses per Respondent	Average Burden Hours per Response	Total Burden Hours	Cost Per Hour	Total Cost
Health IT Developer	§ 170.407	52	2	3,668	1,688,368	$92	$154,993,157

13. Estimates of other Total Annual Cost Burden to Respondents or Recordkeepers/Capital Costs

There are no capital or start-up costs to the public associated with this data collection.

Capital or start-up costs for the government are outlined under section 14.

14. Annualized Cost to Federal Government

We are proposing that response submissions related to the Insights Condition (§ 170.407) would be submitted to an independent entity on behalf of ONC. We intend to award a grant, contract, or other agreement to an independent entity as part of the implementation of the Insights Condition.

We plan to minimize burden for the independent entity by automating parts of the response review and submission process via an online tool/dashboard. We estimate that building this online tool and dashboard would take on average 12,795 hours with total labor costs to be $1.5 million. Labor categories are similar to previous ONC contracts of similar work. Rates are calculated (representing 2022 rates) within one standard deviation of average rates from GSA Contract-Award Labor Category Calculator.

Labor Category	Hours	Rate (per hour)	Total
Engagement Manager	420	$211.00	$88,620.00
Senior Engineering Lead	450	$134.00	$60,300.00
User Interface Design	2,625	$79.00	$207,375.00
Project Manager	1,425	$134.00	$190,950.00
Senior Technical Lead	1,875	$136.00	$255,000.00
Developer	3,375	$110.00	$371,250.00
Testing and Support Analyst	2,625	$124.00	$325,500.00
Labor Total	12,795	---	$1,498,995.00

15. Explanation for Program Changes or Adjustments

This is a new data collection.

16. Plans for Tabulation and Publication and Project Time Schedule

To further minimize burden, we are proposing to provide developers with ample time to collect, assemble, and submit their data. We propose that developers of certified health IT would be able to provide their submissions within a designated 30-day window, twice a year. Under this proposal, health IT developers would begin collecting their data twelve months prior to the first 30-day submission window. The first six months of this period would be the period that health IT developers would report on for the first 30-day submission window. Health IT developers would then have the next six months to assemble this data for reporting. During the second six months of this period, health IT developers would begin collecting data for the next 30-day submission window and so on.

For example, if we establish the first 30-day submission window as April 1, 2025 we would expect developers to begin gathering data for the first six-month submission beginning April 1, 2024 (this reporting period would cover April 2024 through October 2024) and spend from October 2024 to April 2025 assembling their data for submission. Meanwhile, we would expect, under this example, developers would also be collecting data for the October 2025 submission during this same period, from October 2024 to April 2025. This would allow six months to collect data, and an additional six months to assemble and assess that initial data while simultaneously collecting data for the following reporting period. With this approach, we understand that data is less timely due to a six-month delay, however we believe it is important to give health IT developers reasonable time to assemble and report their data. Semiannual reporting will also help mitigate the six-month delay of data and may also reduce data storage burden for health IT developers.

We propose in § 170.407(b)(1)(i) that a developer of certified health IT must provide responses beginning in April 2025 for the following measures: (1) Individuals’ access to electronic health information supported by certified API technology; (2) Applications supported through certified health IT; (3) Immunization administrations electronically submitted to an immunization information system through certified health IT; and (4) Immunization history and forecasts. We propose in § 170.407(b)(1)(ii) that a developer of certified health IT must provide responses beginning in April 2026 for the remaining measures: (1) C-CDA documents obtained using certified health IT by exchange mechanism; (2) C-CDA medications, allergies, and problems reconciliation and incorporation using certified health IT; (3) Use of FHIR in apps supported by certified API technology; (4) Use of FHIR bulk data access through certified health IT; and (5) Electronic health information export through certified health IT.

We would then use the measure responses submitted by health IT developers to calculate the metrics (e.g., percentages and other related statistics) which we intend to make publicly available via an ONC website, and we intend to provide developers of certified health IT the opportunity to submit qualitative notes that would enable them to explain findings and provide additional context and feedback regarding their response submissions.

17. Reason(s) Display of OMB Expiration Date is Inappropriate

The Program agrees to show the approval date.

18. Exceptions to Certification for Paperwork Reduction Act Submissions

We propose in § 170.315(b)(11)(vii)(B) that developers of certified health IT compile detailed documentation regarding the results of IRM practices listed in § 170.315(b)(11)(vii)(A). As an additional requirement of that provision, we propose that developers of certified health IT must make detailed documentation available to ONC upon request from ONC for any predictive decision support intervention, as defined in § 170.102, that the Health IT Module enables or interfaces with. We believe ONC has the authority to conduct Direct Review consistent with § 170.580 for any known or potential non-conformity, or where it has a reasonable belief that a non-conformity exists, enabling ONC to have oversight of these requirements. The PRA, however, exempts these information collections. Specifically, 44 U.S.C. 3518(c)(1)(B)(ii) excludes collection activities during the conduct of administrative actions or investigations involving the agency against specific individuals or entities.

We propose in § 170.315(b)(11)(vii)(C) that a health IT developer that attests “yes” in § 170.315(b)(11)(v)(A) must make available to their ONC-ACB summary information of the intervention risk management practices listed in § 170.315(b)(11)(vii)(A)(1)-(3) via publicly accessible hyperlink that allows any person to directly access the information without any preconditions or additional steps. To support submission of documentation, and consistent with other Principles of Proper Conduct in § 170.523(f)(1), we propose a new Principle of Proper Conduct for documentation related to § 170.315(b)(11)(vii)(C) in § 170.523(f)(1)(xxi). In the 2015 Edition proposed rule (80 FR 16894), we estimated fewer than ten annual respondents for all of the regulatory ‘‘collection of information’’ requirements that applied to the ONC– ACBs, including those previously approved by OMB. In the 2015 Edition final rule (80 FR 62733), we concluded that the regulatory ‘‘collection of information’’ requirements for the ONC– ACBs were not subject to the PRA under 5 CFR 1320.3(c). We continue to estimate fewer than 10 respondents for all of the regulatory “collection of information” requirements under Part 170 of Title 45.

8