A Brief Review of CMS and ONC Rulings

By David C. Kibbe, MD MBA, Healthcare IT Subject Matter Expert

Having scanned the ONC and CMS Final Rules, two things pop out right away in regard to requirements for provider notifications, interoperability and Direct Secure Messaging for clinical data. The first is that ONC decided NOT to remove the “secure messaging” criterion from its certification program right away, but to do so beginning January, 2022. Obviously, this is a mixed result for Direct Secure Messaging continuing to be supported by IT technology and EHR vendors in the future. Markets are hard to predict, but it could well be that some vendors will see this as a means of ceasing support for Direct Messaging in their products that will be undergoing ONC Certification in 2022 and beyond. Of course, we don’t have any assurances, really, that there will even be a Certification Program by then. ONC is doing this, in part, because Direct Messaging is so well established, and ONC feels supports for secure messaging are no longer needed. 

“Having reviewed all comments received on this proposal, we have decided not to remove the “secure messaging” criterion from the Program at this time. CMS has identified this criterion as supporting the coordination of care through patient engagement objective and measure, which is expected to remain operational for Medicaid until January 1, 2022; after 2021 there will be no further incentives under the Medicaid Promoting Interoperability Program (84 FR 42592). We, therefore, will permit ONC Accredited Certification Bodies (ACBs) to issue certificates for this criterion up until January 1, 2022 to align with the requirements of the CMS Medicaid PI Program (84 FR 42592). We have included a provision in § 170.550(m)(1) to only allow ONC-ACBs to issue certificates for this criterion until January 1, 2022.”

The second standout from CMS is the requirement in the Participation Agreement that all hospitals must send direct electronic notification of transfers and discharges to other care givers involved in the patients’ care. The technology for this is not specified. However, Direct Secure Messaging would certainly be a leading technology for such notifications, and could provide a boost to the kind of partnerships we are trying to make with Community Care Providers (CCPs).

A Critical Access Hospital (CAH) is a designation given to eligible rural hospitals by the Centers for Medicare and Medicaid  Services (CMS). To further advance electronic exchange of information that supports effective transitions of care we are finalizing the requirement for a hospital, psychiatric hospital, and CAH, which utilizes an electronic medical records system or other electronic administrative system that is conformant with the content exchange standard at 45 CFR 170.205(d)(2) to demonstrate that: 

      1) Its system’s notification capacity is fully operational and that it operates in accordance
          with all state and federal statutes and regulations regarding the exchange of patient
          health information; 

      2) Its system sends notifications that must include the minimum patient health
          information specified in section X. of this final rule 

      3) Its system sends notifications directly, or through an intermediary that facilitates
          exchange of health information, and at the time of a patient’s registration in the
           emergency department or admission to inpatient services, and also prior to, or at the
           time of, a patient’s discharge and/or transfer from the emergency department or
           inpatient services, to all applicable post-acute care services providers and suppliers,
           primary care practitioners and groups, and other practitioners and groups identified
           by the patient as primarily responsible for his or her care, and who or which need to
           receive notification of the patient’s status for treatment, care coordination, or quality
           improvement purposes. 

We are establishing that this policy will be applicable six months after publication of this rule for hospitals, including psychiatric hospitals, and CAHs to allow for adequate and additional time for these institutions, especially small and/or rural hospitals as well as CAHs, to come into compliance with the new requirements.

I’m sure there will be much more revealed as we continue to dig into the Final Rules.