Certified EHRs: Certification Reduces Risk and Effort in Product Selection

by Kevin Heubusch

Selecting, financing, and launching an EHR system is difficult. Product certification seeks to make the first step a little easier.

Somewhere on your toaster oven is a UL sticker. That’s your reasonable assurance that the appliance won’t burst into flames. Likewise, the tires you buy for your car have been tested and certified for safe use.

There is an entire industry for testing and certifying the products around us. Electronic health record systems should not be any different, says Mark Leavitt, MD, PhD.

Leavitt is chair of the Certification Commission for Healthcare Information Technology, an independent, private-sector organization that certifies EHR products and their networks. By certifying EHRs against baseline criteria, CCHIT hopes to speed adoption of health IT, especially in doctors’ offices. Certification takes some of the risk and effort out of system selection for both physician practices and inpatient facilities.

Many factors go into the successful implementation and use of health IT, Leavitt says. CCHIT seeks to ensure that providers begin with products that give them the best chance at getting the full benefit out of EHRs.

CCHIT, a nonprofit, has completed the majority of its work to date under a three-year federal contract. It began certifying ambulatory products in May 2006. To date, approximately 150 ambulatory products for both large and small practices have passed its certification process.

No Cost, High Value

Certification doesn’t cost physicians a thing, Leavitt says; vendors pay the costs of certifying their products. The benefits to physicians, however, are many.

First, Leavitt says, doctors shopping for an EHR don’t have to start from scratch. Certification offers a first screening of the hundreds of products on the market.

Secondly, when it comes time to take a closer look at select products, physicians won’t have to test the basics. That’s covered under certification. Doctors can focus instead on the needs important or unique to their offices, such as particular workflows or documentation styles.

Doctors thus “can spend their time more intelligently when they are evaluating systems,” Leavitt says—fewer systems to sort through and more valuable demonstrations that don’t require routine testing.

Perhaps most importantly, certification tests for features and capabilities that may not be apparent to a first-time buyer. It drills down into details that have a big impact on a system’s usefulness.

For example, Leavitt notes that it would be very hard, if not impossible, for an individual physician’s office to test a system to see if it employs and adheres to industry interoperability standards. If it does, the practice can receive and store lab data electronically, efficiently, and effectively. If it does not, the practice cannot.

In some instances, certified products are required for participation in pay-for-performance demonstrations or other federal and private-sector IT initiatives. If a program does not require use of a certified product, certification is still likely the surest way to meet program requirements, says Leavitt. (For more on EHR incentives and certification, visit the Journal online at http://journal.ahima.org.)

Requirements Evolve over Time

CCHIT tests products in three main categories:

• Functionality—what the product can do
• Interoperability—how well the product exchanges data with other systems
• Security—how well the product protects patient data from inappropriate disclosure

Certification criteria are drafted by volunteer work groups. The criteria are updated every year, with the requirements becoming more extensive over time.

When it comes to functionality, certification requires that systems keep a problem list, maintain medication and allergy lists, and accept and organize labs and other results as received. Certification also requires decision support. “From the start certification required drug interaction checking and drug allergy warnings,” Leavitt says. “Those criteria have become stronger each year.”

Certified products must produce a valid legal record. They must be able to prove the time at which a note was entered and the person who signed it. If a note has been changed, the system must be able to track the changes. Functionality such as this is essential if the record is going to serve as a defense in court.

Certification can only move as quickly as the industry as a whole. If standards are not in place for a given functionality, CCHIT must introduce requirements in stages.

An example is the exchange of lab results. In 2006, the first year of certification, Leavitt says, “all we were able to do was require that systems could receive a lab electronically. We couldn’t define the standard [that should be used] because it wasn’t established.” That changed the following year when a consensus standard came out of federal initiatives. Subsequently the 2007 criteria require that systems be able to receive lab results in a standardized format.

Also new in the 2007 criteria was a requirement for electronic prescribing. Certified systems now must be able to send prescriptions electronically through established e-prescribing networks.

This is an immediate benefit for doctors. It may also become a necessity. Some laws currently under consideration would require physicians to use electronic prescribing. “I think if you’re buying a system you want to be ready for that requirement,” Leavitt says.

The 2008 certification period for ambulatory products began in July. Leavitt believes the new criteria with the biggest impact is the ability to exchange a patient summary. CCHIT requires that systems use the Continuity of Care Document, a standard chosen this year as the industry standard by the Healthcare Information Technology Standards Panel.

Leavitt likens the CCD to a face sheet or a summary. It includes the patient’s registration information, their current medications, allergies, and in some cases an active problem list.

“This is tremendously valuable when a patient rolls into an emergency room, or if a patient comes to your office having been discharged from the hospital, or shows up in a clinic when they are on vacation where they have never been seen. This is the thing you’d want.” Yes, you might want the whole chart, Leavitt acknowledges, but a standard, readily available summary represents a big leap for healthcare.

Most of the areas that CCHIT has pushed forward in security pertain to audit trails. Leavitt describes these as internal records of the activity in the chart: who has looked at the chart, who wrote in the chart at a particular date and time.

Audit trails are important components of legal business records. A record produced on a system with a weak audit trail is unlikely to stand up in court. Audit trails likewise are an important tool in monitoring appropriate access of patient information within the practice.

“We require that all of the certified products have an audit trail, and we’ve been ratcheting up that requirement and making sure that it’s a solid audit trail and has all the data needed,” Leavitt says.

Audit trails were an overlooked feature in early EHR systems, and they still pose challenges. Weak audit trails represent the single greatest reason that products have failed certification to date, according to Leavitt.

Looking to 2009

Development work for the 2009 criteria is just under way. Work groups were selected in June.

Leavitt says that calls for volunteers continue to be met with enthusiasm. The work is unpaid, and the time commitment is significant, with committees often meeting weekly for a year. Still, CCHIT had twice as many applicants as openings in the latest call. In some instances, it had four to six times as many applicants as slots.

“People in the industry want to get involved in this, and they see certification as very relevant and having a significant impact,” Leavitt says.

Criteria will develop as the year progresses. Once drafted, they are posted to the CCHIT Web site.

Leavitt expects the eventual 2009 criteria will feature increased requirements around exchanging the patient summaries introduced in the 2008 cycle. The road map that guides the criteria also calls for more detail in lab results, the ability to receive microbiology reports and store them appropriately, and the capability to receive imaging reports and view images. Leavitt also expects additional functionality in e-prescribing, such as sending immunizations to registries.

In addition to the core ambulatory certification, products can apply for optional, additional certifications in specialty areas. Currently products can gain additional certification in child health and cardiovascular medicine. These products meet unique criteria for these specialties.

Work groups will develop criteria for two new specialty certifications in the areas of behavioral health and personal health for the 2009 certification cycle.

A Part of the Solution

A certified software product does not guarantee that a practice will have success with electronic records. The software is just one piece of a complex balance of technology, people, process, and policies.

“Software alone cannot create adequate privacy,” Leavitt remarks by way of example. “It’s the people and the policies in combination with the software.” An audit trail may log the activity within the record, but it takes people and policies to review the trail frequently for inappropriate access. Then people and policies are responsible for correcting any trouble.

CCHIT’s role, as Leavitt puts it, is to make sure that the product holds up in that carefully balanced system.

“We cannot solve this whole problem alone just by certifying the system,” he says. “But we want to make sure the system is not the weak link.”

Kevin Heubusch (kevin.heubusch@ahima.org) is editor-in-chief of the Journal of AHIMA .