§170.315(b)(9) Care plan
§ 170.315 (b)(9) Care plan—
Enable a user to record, change, access, create, and receive care plan information in accordance with:
- The Care Plan document template, including the Health Status Evaluations and Outcomes Section and Interventions Section (V2), in the standard specified in § 170.205(a)(4); and
- The standard in § 170.205(a)(5) for the time period up to and including December 31, 2025; or § 170.205(a)(6).
Applies to entire criterion
§ 170.205(a)(5) HL7® CDA® R2 IG: C-CDA Templates for Clinical Notes R2.1 Companion Guide, Release 2-US Realm, October 2019 (Adoption of this standard expires on January 1, 2026)
§ 170.205(a)(6) HL7® CDA® R2 Implementation Guide: C-CDA Templates for Clinical Notes STU Companion Guide, Release 4.1 - US Realm (This standard is required by December 31, 2025)
Standards Version Advancement Process (SVAP) Version(s) Approved
For more information, please visit the Standards Version Advancement Process (SVAP) Version(s) page.
The following outlines deadlines for required updates for this criterion as they relate to changes published in recent ONC final rules. Developers must update their products to the requirements outlined and provide them to their customers by the stated deadlines. These represent one-time deadlines as set by recent regulatory updates and do not encompass ongoing deadlines related to the Conditions and Maintenance of Certification. Please review those requirements for additional compliance activities related to one’s certification under Certification Dependencies.
Deadline: December 31, 2025
Action to be taken: Developers certified to this criterion must update their version of C-CDA Companion Guide used as outlined in paragraph (b)(9)(ii).
Conditions and Maintenance of Certification Requirements
Real World Testing: Products certified to this criterion must complete requirements outlined for the Real World Testing Conditions and Maintenance of Certification.
Design and Performance: The following design and performance certification criteria (adopted in § 170.315(g)) must also be certified in order for the product to be certified.
- Quality management system (§ 170.315(g)(4)): When a single quality management system (QMS) is used, the QMS only needs to be identified once. Otherwise, when different QMS are used, each QMS needs to be separately identified for every capability to which it was applied.
- Accessibility-centered design (§ 170.315(g)(5)): When a single accessibility-centered design standard is used, the standard only needs to be identified once. Otherwise, when different QMS are used, each QMS needs to be separately identified for every capability to which it was applied.
- Consolidated CDA creation performance (§ 170.315(g)(6)) Consolidated Clinical Document Architecture (C-CDA) creation performance (§ 170.315(g)(6)) does not need to be explicitly tested with this criterion unless it is the only criterion within the scope of the requested certification that includes C-CDA creation capabilities. Note that the application of § 170.315(g)(6) depends on the C-CDA templates explicitly required by the C-CDA-referenced criterion or criteria included within the scope of the certificate sought. Please refer to the C-CDA creation performance CCG for more details.
This certification criterion was adopted at § 170.315(b)(9). As a result, an ONC Authorized Certification Body (ONC-ACB) must ensure that a product presented for certification to a § 170.315(b) criterion includes the privacy and security criteria (adopted in § 170.315(d)) within the overall scope of the certificate issued to the product.
- The privacy and security criteria (adopted in § 170.315(d)) do not need to be explicitly tested with this specific paragraph (a) criterion unless it is the only criterion for which certification is requested.
- As a general rule, a product presented for certification only needs to be tested once to each applicable privacy and security criterion (adopted in § 170.315(d)) so long as the health IT developer attests that such privacy and security capabilities apply to the full scope of capabilities included in the requested certification. However, exceptions exist for § 170.315(e)(1) “View, download, and transmit to 3rd party (VDT)” and (e)(2) “Secure messaging,” which are explicitly stated.
For more information on the approaches to meet these Privacy and Security requirements, please review the Privacy and Security CCG.
- If choosing Approach 1:
- Authentication, access control, and authorization (§ 170.315(d)(1))
- Auditable events and tamper-resistance (§ 170.315(d)(2))
- Audit reports (§ 170.315(d)(3))
- Automatic access time-out (§ 170.315(d)(5))
- Emergency access (§ 170.315(d)(6))
- End-user device encryption (§ 170.315(d)(7))
- Integrity (§ 170.315(d)(8))
- Encrypt authentication credentials (§ 170.315(d)(12))
- Multi-factor authentication (MFA) (§ 170.315(d)(13))
- If choosing Approach 2:
- For each applicable privacy and security certification criterion not certified for Approach 1, the health IT developer may certify using system documentation that is sufficiently detailed to enable integration such that the Health IT Module has implemented service interfaces for each applicable privacy and security certification criterion that enable the Health IT Module to access external services necessary to meet the requirements of the privacy and security certification criterion. Please see the ONC Cures Act Final Rule at 85 FR 25710 for additional clarification.
| Version # | Description of Change | Version Date |
|---|---|---|
| 1.0 |
Initial publication |
03-11-2024
|
| 1.1 |
Updated test tool link |
12-02-2024
|
| 1.2 |
Updated test steps with 2024 SVAP approved standards and new SITE UI language |
03-21-2025
|
- Regulation Text
-
Regulation Text
§ 170.315 (b)(9) Care plan—
Enable a user to record, change, access, create, and receive care plan information in accordance with:
- The Care Plan document template, including the Health Status Evaluations and Outcomes Section and Interventions Section (V2), in the standard specified in § 170.205(a)(4); and
- The standard in § 170.205(a)(5) for the time period up to and including December 31, 2025; or § 170.205(a)(6).
- Standard(s) Referenced
-
Applies to entire criterion
§ 170.205(a)(5) HL7® CDA® R2 IG: C-CDA Templates for Clinical Notes R2.1 Companion Guide, Release 2-US Realm, October 2019 (Adoption of this standard expires on January 1, 2026)
§ 170.205(a)(6) HL7® CDA® R2 Implementation Guide: C-CDA Templates for Clinical Notes STU Companion Guide, Release 4.1 - US Realm (This standard is required by December 31, 2025)
Standards Version Advancement Process (SVAP) Version(s) Approved
For more information, please visit the Standards Version Advancement Process (SVAP) Version(s) page.
- Required Update Deadlines
-
The following outlines deadlines for required updates for this criterion as they relate to changes published in recent ONC final rules. Developers must update their products to the requirements outlined and provide them to their customers by the stated deadlines. These represent one-time deadlines as set by recent regulatory updates and do not encompass ongoing deadlines related to the Conditions and Maintenance of Certification. Please review those requirements for additional compliance activities related to one’s certification under Certification Dependencies.
Deadline: December 31, 2025
Action to be taken: Developers certified to this criterion must update their version of C-CDA Companion Guide used as outlined in paragraph (b)(9)(ii).
- Certification Dependencies
-
Conditions and Maintenance of Certification Requirements
Real World Testing: Products certified to this criterion must complete requirements outlined for the Real World Testing Conditions and Maintenance of Certification.
Design and Performance: The following design and performance certification criteria (adopted in § 170.315(g)) must also be certified in order for the product to be certified.
- Quality management system (§ 170.315(g)(4)): When a single quality management system (QMS) is used, the QMS only needs to be identified once. Otherwise, when different QMS are used, each QMS needs to be separately identified for every capability to which it was applied.
- Accessibility-centered design (§ 170.315(g)(5)): When a single accessibility-centered design standard is used, the standard only needs to be identified once. Otherwise, when different QMS are used, each QMS needs to be separately identified for every capability to which it was applied.
- Consolidated CDA creation performance (§ 170.315(g)(6)) Consolidated Clinical Document Architecture (C-CDA) creation performance (§ 170.315(g)(6)) does not need to be explicitly tested with this criterion unless it is the only criterion within the scope of the requested certification that includes C-CDA creation capabilities. Note that the application of § 170.315(g)(6) depends on the C-CDA templates explicitly required by the C-CDA-referenced criterion or criteria included within the scope of the certificate sought. Please refer to the C-CDA creation performance CCG for more details.
- Privacy & Security Requirements
-
This certification criterion was adopted at § 170.315(b)(9). As a result, an ONC Authorized Certification Body (ONC-ACB) must ensure that a product presented for certification to a § 170.315(b) criterion includes the privacy and security criteria (adopted in § 170.315(d)) within the overall scope of the certificate issued to the product.
- The privacy and security criteria (adopted in § 170.315(d)) do not need to be explicitly tested with this specific paragraph (a) criterion unless it is the only criterion for which certification is requested.
- As a general rule, a product presented for certification only needs to be tested once to each applicable privacy and security criterion (adopted in § 170.315(d)) so long as the health IT developer attests that such privacy and security capabilities apply to the full scope of capabilities included in the requested certification. However, exceptions exist for § 170.315(e)(1) “View, download, and transmit to 3rd party (VDT)” and (e)(2) “Secure messaging,” which are explicitly stated.
For more information on the approaches to meet these Privacy and Security requirements, please review the Privacy and Security CCG.
- If choosing Approach 1:
- Authentication, access control, and authorization (§ 170.315(d)(1))
- Auditable events and tamper-resistance (§ 170.315(d)(2))
- Audit reports (§ 170.315(d)(3))
- Automatic access time-out (§ 170.315(d)(5))
- Emergency access (§ 170.315(d)(6))
- End-user device encryption (§ 170.315(d)(7))
- Integrity (§ 170.315(d)(8))
- Encrypt authentication credentials (§ 170.315(d)(12))
- Multi-factor authentication (MFA) (§ 170.315(d)(13))
- If choosing Approach 2:
- For each applicable privacy and security certification criterion not certified for Approach 1, the health IT developer may certify using system documentation that is sufficiently detailed to enable integration such that the Health IT Module has implemented service interfaces for each applicable privacy and security certification criterion that enable the Health IT Module to access external services necessary to meet the requirements of the privacy and security certification criterion. Please see the ONC Cures Act Final Rule at 85 FR 25710 for additional clarification.
- Testing
-
Testing Tool
Criterion Subparagraph Test Data (b)(9) Inpatient setting: - 170.315_b9_cp_inp_sample*.docx (All Samples)
Ambulatory setting - 170.315_b9_cp_amb_sample*.docx (All Samples)
All settings: 170.315_b9_cp_sample*.xml (All Samples)
Negative testing: NT*r21*.xml (All Samples)
- Revision History
-
Version # Description of Change Version Date 1.0 Initial publication
03-11-20241.1 Updated test tool link
12-02-20241.2 Updated test steps with 2024 SVAP approved standards and new SITE UI language
03-21-2025
This Test Procedure illustrates the test steps required to certify a Health IT Module to this criterion. Please consult the most recent Final Rules on the Certification Regulations page for a detailed description of the certification criterion with which these testing steps are associated. ASTP/ONC also encourages developers to consult the Certification Companion Guide in tandem with the test procedure as it provides clarifications that may be useful for product development and testing.
Note: The test step order does not necessarily prescribe the order in which the tests should take place.
Testing components
Paragraph (b)(9) – (Conditional – For Modules with existing certifications to (b)(9))
- Required by December 31, 2025
A Health IT Module currently certified to the § 170.315(b)(9) Care plan will attest directly to the ONC-ACB to conformance with the updated § 170.315(b)(9) requirements outlined in the Health Data, Technology, and Interoperability: Certification Program Updates, Algorithm Transparency, and Information Sharing (HTI-1) Final Rule.
- Required by December 31, 2025
The ONC-ACB verifies the Health IT Module certified to § 170.315(b)(9) Care plan attests conformance to updated § 170.315(b)(9) criterion requirements.
| System Under Test |
ONC-ACB Verification
|
|---|---|
|
|
Paragraph (b)(9) - Record
- Expires on January 1, 2026
Record
- Using the ASTP Standards Implementation & Testing Environment (SITE): C-CDA Validator – USCDI v1, the health IT developer chooses "Sender" then selects the “170.315_b9_CP_Amb” or “170.315_b9_CP_Inp” criteria and one of the care plan instruction documents and executes the download.
- Using the ASTP/ONC-supplied care plan instruction document returned in step 1, the user enters the care plan information into the Health IT Module.
- The user records care plan information that includes the following:
- Patient Name;
- Goals;
- Health Concerns;
- Health Status Evaluations and Outcomes; and
- Interventions.
- Based on the health IT setting(s) to be certified, the user repeats steps 1-3, for each of the ambulatory and/or inpatient care plan instruction documents found in the SITE: C-CDA Validator – USCDI v1. The recording of a care plan is required for all of the care plan instruction documents for a given health IT setting.
(Approved SVAP Version)
- Complete steps above using SITE C-CDA Validator for USCDI v4 and;
- Reference United States Core Data for Interoperability (USCDI), Version 4, October 2023 Errata
- Required by December 31, 2025
- Record
Using the SITE: C-CDA Validator USCDI v3, the health IT developer chooses “Sender” then selects the “170.315_b9_CP_Amb” or “170.315_b9_CP_Inp” criteria and one of the care plan instruction documents and executes the download. - Using the ASTP/ONC-supplied care plan instruction document returned in step 1, the user enters the care plan information into the Health IT Module.
- The user records care plan information that includes the following:
- Patient Name;
- Goals;
- Health Concerns;
- Health Status Evaluations and Outcomes; and
- Interventions.
- Based on the health IT setting(s) to be certified, the user repeats steps 1-3, for each of the ambulatory and/or inpatient care plan instruction documents found in SITE: C-CDA Validator – USCDI v3. The recording of a care plan is required for all of the care plan instruction documents for a given health IT setting.
(Approved SVAP Version)
- Complete steps above using SITE C-CDA Validator for USCDI v4 and;
- Reference United States Core Data for Interoperability (USCDI), Version 4, October 2023 Errata
- Record
- Expires on January 1, 2026
Record
- The tester verifies the health IT developer can download the care plan instruction document for the health IT setting to be certified.
- The tester verifies the user can enter all of the care plan information outlined in the ASTP/ONC-supplied care plan instruction documents returned in step 1.
- The tester verifies the outlined care plan information has been recorded correctly and without omission through visual inspection of the System Under Test using the ASTP/ONC-supplied care plan instruction document associated with the recorded care plan.
- For each of the health IT setting(s) to be certified, the tester repeats steps 1-3.
- Required by December 31, 2025
Record
- The tester verifies the health IT developer can download the care plan instruction document for the health IT setting to be certified.
- The tester verifies the user can enter all of the care plan information outlined in the ASTP/ONC-supplied care plan instruction documents returned in step 1.
- The tester verifies the outlined care plan information has been recorded correctly and without omission through visual inspection of the System Under Test using the ASTP/ONC-supplied care plan instruction document associated with the recorded care plan. For each of the health IT setting(s) to be certified, the tester repeats steps 1-3.
| System Under Test | Test Lab Verification |
|---|---|
|
|
Paragraph (b)(9) - Change and access
Change and Access
- Using the Health IT Module, the user accesses and changes the care plan information for a specific patient that includes the following:
- Patient Name;
- Goals;
- Health Concerns;
- Health Status Evaluations and Outcomes; and
- Interventions.
Change and Access
- The tester verifies care plan information can be accessed and changed using visual inspection of the System Under Test.
| System Under Test | Test Lab Verification |
|---|---|
|
Change and Access
|
Change and Access
|
Paragraph (b)(9) - Create
- Expires on January 1, 2026
Create
- For each care plan recorded by the Health IT Module, the user creates a care plan document formatted in accordance with the Care Plan document template in the standard adopted at § 170.205(a)(4) HL7® Implementation Guide for CDA® Release 2: Consolidated CDA Templates for Clinical Notes (US Realm), Draft Standard for Trial Use Release 2.1 C-CDA 2.1 with Errata, August 2015, June 2019 (with Errata), and § 170.205(a)(5) HL7® CDA® R2 IG: C-CDA Templates for Clinical Notes R1 Companion Guide, Release 2, and includes the Health Status Evaluations and Outcomes Section and Interventions Section (V2), which at a minimum includes:
- Patient Name;
- Goals;
- Health Concerns;
- Health Status Evaluations and Outcomes; and
- Interventions.
- For each care plan document created in step 1, the user submits the care plan document to the tester for verification.
All Steps (Approved SVAP Version)
- Complete steps above using SITE C-CDA Validator for USCDI v4 and;
- Reference United States Core Data for Interoperability (USCDI), Version 4, October 2023 Errata, and;
- Use HL7® CDA® R2 Implementation Guide: Consolidated CDA Templates for Clinical Notes Edition 3.0 – US Realm, May 2024 for § 170.205(a)(4), (a)(5) or (a)(6).
- For each care plan recorded by the Health IT Module, the user creates a care plan document formatted in accordance with the Care Plan document template in the standard adopted at § 170.205(a)(4) HL7® Implementation Guide for CDA® Release 2: Consolidated CDA Templates for Clinical Notes (US Realm), Draft Standard for Trial Use Release 2.1 C-CDA 2.1 with Errata, August 2015, June 2019 (with Errata), and § 170.205(a)(5) HL7® CDA® R2 IG: C-CDA Templates for Clinical Notes R1 Companion Guide, Release 2, and includes the Health Status Evaluations and Outcomes Section and Interventions Section (V2), which at a minimum includes:
- Required by December 31, 2025
Create
- For each care plan recorded by the Health IT Module, the user creates a care plan document formatted in accordance with the Care Plan document template in the standard adopted at § 170.205(a)(4) HL7® Implementation Guide for CDA® Release 2: Consolidated CDA Templates for Clinical Notes (US Realm), Draft Standard for Trial Use Release 2.1 C-CDA 2.1 with Errata, August 2015, June 2019 (with Errata), and § 170.205(a)(6) HL7® CDA® R2 IG: C-CDA Templates for Clinical Notes R1 Companion Guide, Release 4.1, and includes the Health Status Evaluations and Outcomes Section and Interventions Section (V2), which at a minimum includes:
- Patient Name;
- Goals;
- Health Concerns;
- Health Status Evaluations and Outcomes; and
- Interventions.
- For each care plan document created in step 1, the user submits the care plan document to the tester for verification.
All Steps (Approved SVAP Version)
- Complete steps above using SITE C-CDA Validator for USCDI v4 and;
- Reference United States Core Data for Interoperability (USCDI), Version 4, October 2023 Errata, and;
- Use HL7® CDA® R2 Implementation Guide: Consolidated CDA Templates for Clinical Notes Edition 3.0 – US Realm, May 2024 for § 170.205(a)(4), (a)(5) or (a)(6).
- For each care plan recorded by the Health IT Module, the user creates a care plan document formatted in accordance with the Care Plan document template in the standard adopted at § 170.205(a)(4) HL7® Implementation Guide for CDA® Release 2: Consolidated CDA Templates for Clinical Notes (US Realm), Draft Standard for Trial Use Release 2.1 C-CDA 2.1 with Errata, August 2015, June 2019 (with Errata), and § 170.205(a)(6) HL7® CDA® R2 IG: C-CDA Templates for Clinical Notes R1 Companion Guide, Release 4.1, and includes the Health Status Evaluations and Outcomes Section and Interventions Section (V2), which at a minimum includes:
- Expires on January 1, 2026
Create
- Using SITE: C-CDA Validator – USCDI v1, the tester uploads the submitted care plan (xml file) created by the Health IT Module in step 1 of the System Under Test, through the sender upload selection of the “170.315_b9_CP_Amb” or “170.315_b9_CP_Inp” criteria and file name of the care plan recorded by the System Under Test, and executes the upload of the submitted file to the SITE: C-CDA Validator.
- The tester uses the Validation Report produced by SITE: C-CDA Validator in step 1, to verify the validation report indicates passing without error to confirm that the care plan is a C-CDA R2.1 document conformant to the standard specified at § 170.205(a)(4) and § 170.205(a)(5) and includes the Health Status Evaluations and Outcomes Section and Interventions Section (V2). Additionally, as required by the ASTP/ONC-supplied care plan instructions with the corresponding file names as uploaded in step 1, the tester uses the ASTP/ONC-supplied care plan document and the SITE: C-CDA Validator Message Content Report to verify the additional checks for equivalent text for the content of all section level narrative text.
- Required by December 31, 2025
Create
1. Using SITE: C-CDA Validator – USCDI v3, the tester uploads the submitted care plan (xml file) created by the Health IT Module in step 1 of the System Under Test, through the sender upload selection of the “170.315_b9_CP_Amb” or “170.315_b9_CP_Inp” criteria and file name of the care plan recorded by the System Under Test, and executes the upload of the submitted file to SITE: C-CDA Validator.
2. The tester uses the Validation Report produced by SITE: C-CDA Validator in step 1, to verify the validation report indicates passing without error to confirm that the care plan is a C-CDA R2.1 document conformant to the standard specified at § 170.205(a)(4) and § 170.205(a)(6) and includes the Health Status Evaluations and Outcomes Section and Interventions Section (V2). Additionally, as required by the ASTP/ONC-supplied care plan instructions with the corresponding file names as uploaded in step 1, the tester uses the ASTP/ONC-supplied care plan document and the SITE: C-CDA Validator Message Content Report to verify the additional checks for equivalent text for the content of all section level narrative text.
| System Under Test | Test Lab Verification |
|---|---|
|
|
Paragraph (b)(9) - Receive
- Expires on January 1, 2026
Receive
- Using SITE: C-CDA Validator – USCDI v1, the health IT developer downloads the ASTP/ONC-supplied care plan xml documents through the receiver download selections of the “170.315_CP_Amb” or “170.315_CP_Inp” criteria and care plan xml file and executes the download of the care plan xml file.
- Using the Health IT Module, the user receives the care plan (xml files) downloaded from SITE: C-CDA Validator – USCDI v1, in step 1, which is formatted in accordance with the care plan document template in the standard adopted at § 170.205(a)(4) and § 170.205(a)(5) and includes the Health Status Evaluations and Outcomes Section and Interventions Section (V2), which at a minimum includes:
- Patient Name;
- Goals;
- Health Concerns;
- Health Status Evaluations and Outcomes; and
- Interventions.
- Based upon the health IT setting(s) to be certified, the user repeats steps 1-2, for each ambulatory and/or inpatient care plan (xml) document in SITE: C-CDA Validator – USCDI v1. All of the care plan (xml) documents for a given health IT setting must be received.
Negative Test
- Using SITE: C-CDA Validator – USCDI v1, the health IT developer downloads the ASTP/ONC-supplied care plan negative test xml documents through the receiver download selections of the “NegativeTesting CarePlan” criteria and one of the invalid C-CDA documents and executes the download of the invalid C-CDA xml file.
- Using the Health IT Module, the user receives the applicable C-CDA document types containing errors in the corresponding “document-templates,” “section-templates,” and “entry-templates” including invalid vocabulary standards and codes not specified in the standards adopted in at § 170.205(a)(4) and § 170.205(a)(5), and reports the errors.
- The user repeats steps 4-5 for each of the negative test samples in SITE: C-CDA Validator - USCDI v1 “NegativeTesting_CarePlan.” All of the negative test care plan (xml) documents must be received.
All Steps (Approved SVAP Version)
- Complete steps above using SITE C-CDA Validator for USCDI v4 and;
- Reference United States Core Data for Interoperability (USCDI), Version 4, October 2023 Errata, and;
- Use HL7® CDA® R2 Implementation Guide: Consolidated CDA Templates for Clinical Notes Edition 3.0 - US Realm, May 2024 for § 170.205(a)(4), (a)(5) or (a)(6).
- Required by December 31, 2025
Receive
- Using SITE: C-CDA Validator – USCDI v3, the health IT developer downloads the ASTP/ONC-supplied care plan xml documents through the receiver download selections of the “170.315_CP_Amb” or “170.315_CP_Inp” criteria and care plan xml file and executes the download of the care plan xml file.
- Using the Health IT Module, the user receives the care plan (xml files) downloaded from SITE: C-CDA Validator – USCDI v3, in step 1, which is formatted in accordance with the care plan document template in the standard adopted at § 170.205(a)(4) and § 170.205(a)(6) and includes the Health Status Evaluations and Outcomes Section and Interventions Section (V2), which at a minimum includes:
- Patient Name;
- Goals;
- Health Concerns;
- Health Status Evaluations and Outcomes; and
- Interventions.
- Based upon the health IT setting(s) to be certified, the user repeats steps 1-2, for each ambulatory and/or inpatient care plan (xml) document in the SITE: C-CDA Validator – USCDI v3. All of the care plan (xml) documents for a given health IT setting must be received.
Negative Test
- Using SITE: C-CDA Validator – USCDI v3, the health IT developer downloads the ASTP/ONC-supplied care plan negative test xml documents through the receiver download selections of the “NegativeTesting CarePlan” criteria and one of the invalid C-CDA documents and executes the download of the invalid C-CDA xml file.
- Using the Health IT Module, the user receives the applicable C-CDA document types containing errors in the corresponding “document-templates,” “section-templates,” and “entry-templates” including invalid vocabulary standards and codes not specified in the standards adopted in at § 170.205(a)(4) and § 170.205(a)(6), and reports the errors.
- The user repeats steps 4-5 for each of the negative test samples in SITE: C-CDA Validator – USCDI v3, “NegativeTesting_CarePlan.” All of the negative test care plan (xml) documents must be received.
All Steps (Approved SVAP Version)
- Complete steps above using SITE C-CDA Validator for USCDI v4 and;
- Reference United States Core Data for Interoperability (USCDI), Version 4, October 2023 Errata, and;
- Use HL7® CDA® R2 Implementation Guide: Consolidated CDA Templates for Clinical Notes Edition 3.0 - US Realm, May 2024 for § 170.205(a)(4), (a)(5) or (a)(6).
- Expires on January 1, 2026
Receive
- The tester creates a version in human readable format of the care plan document downloaded in step 1, of the System Under Test to be used for verification.
- For each care plan document received, the tester verifies that the Health IT Module can receive a care plan document formatted in accordance with the standard specified at § 170.205(a)(4) and170.205(a)(5), and includes the Health Status Evaluations and Outcomes Section and Interventions Section (V2) using visual inspection.
- Using the Health IT Module, the tester verifies the care plan document received in step 2 is accurate and without omission through the visual inspection.
Negative Test
- The tester verifies the health IT developer can download all of the ASTP/ONC-supplied care plan negative test xml documents.
- For each invalid C-CDA document received, the tester uses visual inspection to verify the Health IT Module can successfully identify errors in the C-CDA documents not specified in accordance with the standards adopted in § 170.205(a)(4) and 170.205(a)(5) including:
- “document-templates”;
- “section-templates”;
- Invalid vocabulary standards; and
- Invalid codes.
- For each of care plan negative test xml documents downloaded in step 4, the tester repeats step 5.
- Required by December 31, 2025
Receive
- The tester creates a version in human readable format of the care plan document downloaded in step 1, of the System Under Test to be used for verification.
- For each care plan document received, the tester verifies that the Health IT Module can receive a care plan document formatted in accordance with the standard specified at § 170.205(a)(4) and 170.205(a)(6), and includes the Health Status Evaluations and Outcomes Section and Interventions Section (V2) using visual inspection.
- Using the Health IT Module, the tester verifies the care plan document received in step 2 is accurate and without omission through the visual inspection.
Negative Test
- The tester verifies the health IT developer can download all of the ASTP/ONC-supplied care plan negative test xml documents.
- For each invalid C-CDA document received, the tester uses visual inspection to verify the Health IT Module can successfully identify errors in the C-CDA documents not specified in accordance with the standards adopted in § 170.205(a)(4) and 170.205(a)(6) including:
- “document-templates”;
- “section-templates”;
- Invalid vocabulary standards; and
- Invalid codes.
- For each of care plan negative test xml documents downloaded in step 4, the tester repeats step 5.
| System Under Test | Test Lab Verification |
|---|---|
|
|
Archived Version:
§ 170.315 (b)(9) Care plan—
Enable a user to record, change, access, create, and receive care plan information in accordance with:
- The Care Plan document template, including the Health Status Evaluations and Outcomes Section and Interventions Section (V2), in the standard specified in § 170.205(a)(4); and
- The standard in § 170.205(a)(5) for the time period up to and including December 31, 2025; or § 170.205(a)(6).
Applies to entire criterion
§ 170.205(a)(5) HL7® CDA® R2 IG: C-CDA Templates for Clinical Notes R2.1 Companion Guide, Release 2-US Realm, October 2019 (Adoption of this standard expires on January 1, 2026)
§ 170.205(a)(6) HL7® CDA® R2 Implementation Guide: C-CDA Templates for Clinical Notes STU Companion Guide, Release 4.1 - US Realm (This standard is required by December 31, 2025)
Standards Version Advancement Process (SVAP) Version(s) Approved
For more information, please visit the Standards Version Advancement Process (SVAP) Version(s) page.
The following outlines deadlines for required updates for this criterion as they relate to changes published in recent ONC final rules. Developers must update their products to the requirements outlined and provide them to their customers by the stated deadlines. These represent one-time deadlines as set by recent regulatory updates and do not encompass ongoing deadlines related to the Conditions and Maintenance of Certification. Please review those requirements for additional compliance activities related to one’s certification under Certification Dependencies.
Deadline: December 31, 2025
Action to be taken: Developers certified to this criterion must update their version of C-CDA Companion Guide used as outlined in paragraph (b)(9)(ii).
Conditions and Maintenance of Certification Requirements
Real World Testing: Products certified to this criterion must complete requirements outlined for the Real World Testing Conditions and Maintenance of Certification.
Design and Performance: The following design and performance certification criteria (adopted in § 170.315(g)) must also be certified in order for the product to be certified.
- Quality management system (§ 170.315(g)(4)): When a single quality management system (QMS) is used, the QMS only needs to be identified once. Otherwise, when different QMS are used, each QMS needs to be separately identified for every capability to which it was applied.
- Accessibility-centered design (§ 170.315(g)(5)): When a single accessibility-centered design standard is used, the standard only needs to be identified once. Otherwise, when different QMS are used, each QMS needs to be separately identified for every capability to which it was applied.
- Consolidated CDA creation performance (§ 170.315(g)(6)) Consolidated Clinical Document Architecture (C-CDA) creation performance (§ 170.315(g)(6)) does not need to be explicitly tested with this criterion unless it is the only criterion within the scope of the requested certification that includes C-CDA creation capabilities. Note that the application of § 170.315(g)(6) depends on the C-CDA templates explicitly required by the C-CDA-referenced criterion or criteria included within the scope of the certificate sought. Please refer to the C-CDA creation performance CCG for more details.
This certification criterion was adopted at § 170.315(b)(9). As a result, an ONC Authorized Certification Body (ONC-ACB) must ensure that a product presented for certification to a § 170.315(b) criterion includes the privacy and security criteria (adopted in § 170.315(d)) within the overall scope of the certificate issued to the product.
- The privacy and security criteria (adopted in § 170.315(d)) do not need to be explicitly tested with this specific paragraph (a) criterion unless it is the only criterion for which certification is requested.
- As a general rule, a product presented for certification only needs to be tested once to each applicable privacy and security criterion (adopted in § 170.315(d)) so long as the health IT developer attests that such privacy and security capabilities apply to the full scope of capabilities included in the requested certification. However, exceptions exist for § 170.315(e)(1) “View, download, and transmit to 3rd party (VDT)” and (e)(2) “Secure messaging,” which are explicitly stated.
For more information on the approaches to meet these Privacy and Security requirements, please review the Privacy and Security CCG.
- If choosing Approach 1:
- Authentication, access control, and authorization (§ 170.315(d)(1))
- Auditable events and tamper-resistance (§ 170.315(d)(2))
- Audit reports (§ 170.315(d)(3))
- Automatic access time-out (§ 170.315(d)(5))
- Emergency access (§ 170.315(d)(6))
- End-user device encryption (§ 170.315(d)(7))
- Integrity (§ 170.315(d)(8))
- Encrypt authentication credentials (§ 170.315(d)(12))
- Multi-factor authentication (MFA) (§ 170.315(d)(13))
- If choosing Approach 2:
- For each applicable privacy and security certification criterion not certified for Approach 1, the health IT developer may certify using system documentation that is sufficiently detailed to enable integration such that the Health IT Module has implemented service interfaces for each applicable privacy and security certification criterion that enable the Health IT Module to access external services necessary to meet the requirements of the privacy and security certification criterion. Please see the ONC Cures Act Final Rule at 85 FR 25710 for additional clarification.
| Version # | Description of Change | Version Date |
|---|---|---|
| 1.0 |
Initial publication |
03-11-2024
|
| 1.1 |
Updated test tool link |
12-02-2024
|
| 1.2 |
Updated test steps with 2024 SVAP approved standards and new SITE UI language |
03-21-2025
|
- Regulation Text
-
Regulation Text
§ 170.315 (b)(9) Care plan—
Enable a user to record, change, access, create, and receive care plan information in accordance with:
- The Care Plan document template, including the Health Status Evaluations and Outcomes Section and Interventions Section (V2), in the standard specified in § 170.205(a)(4); and
- The standard in § 170.205(a)(5) for the time period up to and including December 31, 2025; or § 170.205(a)(6).
- Standard(s) Referenced
-
Applies to entire criterion
§ 170.205(a)(5) HL7® CDA® R2 IG: C-CDA Templates for Clinical Notes R2.1 Companion Guide, Release 2-US Realm, October 2019 (Adoption of this standard expires on January 1, 2026)
§ 170.205(a)(6) HL7® CDA® R2 Implementation Guide: C-CDA Templates for Clinical Notes STU Companion Guide, Release 4.1 - US Realm (This standard is required by December 31, 2025)
Standards Version Advancement Process (SVAP) Version(s) Approved
For more information, please visit the Standards Version Advancement Process (SVAP) Version(s) page.
- Required Update Deadlines
-
The following outlines deadlines for required updates for this criterion as they relate to changes published in recent ONC final rules. Developers must update their products to the requirements outlined and provide them to their customers by the stated deadlines. These represent one-time deadlines as set by recent regulatory updates and do not encompass ongoing deadlines related to the Conditions and Maintenance of Certification. Please review those requirements for additional compliance activities related to one’s certification under Certification Dependencies.
Deadline: December 31, 2025
Action to be taken: Developers certified to this criterion must update their version of C-CDA Companion Guide used as outlined in paragraph (b)(9)(ii).
- Certification Dependencies
-
Conditions and Maintenance of Certification Requirements
Real World Testing: Products certified to this criterion must complete requirements outlined for the Real World Testing Conditions and Maintenance of Certification.
Design and Performance: The following design and performance certification criteria (adopted in § 170.315(g)) must also be certified in order for the product to be certified.
- Quality management system (§ 170.315(g)(4)): When a single quality management system (QMS) is used, the QMS only needs to be identified once. Otherwise, when different QMS are used, each QMS needs to be separately identified for every capability to which it was applied.
- Accessibility-centered design (§ 170.315(g)(5)): When a single accessibility-centered design standard is used, the standard only needs to be identified once. Otherwise, when different QMS are used, each QMS needs to be separately identified for every capability to which it was applied.
- Consolidated CDA creation performance (§ 170.315(g)(6)) Consolidated Clinical Document Architecture (C-CDA) creation performance (§ 170.315(g)(6)) does not need to be explicitly tested with this criterion unless it is the only criterion within the scope of the requested certification that includes C-CDA creation capabilities. Note that the application of § 170.315(g)(6) depends on the C-CDA templates explicitly required by the C-CDA-referenced criterion or criteria included within the scope of the certificate sought. Please refer to the C-CDA creation performance CCG for more details.
- Privacy & Security Requirements
-
This certification criterion was adopted at § 170.315(b)(9). As a result, an ONC Authorized Certification Body (ONC-ACB) must ensure that a product presented for certification to a § 170.315(b) criterion includes the privacy and security criteria (adopted in § 170.315(d)) within the overall scope of the certificate issued to the product.
- The privacy and security criteria (adopted in § 170.315(d)) do not need to be explicitly tested with this specific paragraph (a) criterion unless it is the only criterion for which certification is requested.
- As a general rule, a product presented for certification only needs to be tested once to each applicable privacy and security criterion (adopted in § 170.315(d)) so long as the health IT developer attests that such privacy and security capabilities apply to the full scope of capabilities included in the requested certification. However, exceptions exist for § 170.315(e)(1) “View, download, and transmit to 3rd party (VDT)” and (e)(2) “Secure messaging,” which are explicitly stated.
For more information on the approaches to meet these Privacy and Security requirements, please review the Privacy and Security CCG.
- If choosing Approach 1:
- Authentication, access control, and authorization (§ 170.315(d)(1))
- Auditable events and tamper-resistance (§ 170.315(d)(2))
- Audit reports (§ 170.315(d)(3))
- Automatic access time-out (§ 170.315(d)(5))
- Emergency access (§ 170.315(d)(6))
- End-user device encryption (§ 170.315(d)(7))
- Integrity (§ 170.315(d)(8))
- Encrypt authentication credentials (§ 170.315(d)(12))
- Multi-factor authentication (MFA) (§ 170.315(d)(13))
- If choosing Approach 2:
- For each applicable privacy and security certification criterion not certified for Approach 1, the health IT developer may certify using system documentation that is sufficiently detailed to enable integration such that the Health IT Module has implemented service interfaces for each applicable privacy and security certification criterion that enable the Health IT Module to access external services necessary to meet the requirements of the privacy and security certification criterion. Please see the ONC Cures Act Final Rule at 85 FR 25710 for additional clarification.
- Revision History
-
Version # Description of Change Version Date 1.0 Initial publication
03-11-20241.1 Standards Referenced updated to reflect 2024 Approved SVAP Standards
08-19-2024 - Testing
-
Testing Tool
Criterion Subparagraph Test Data (b)(9) Inpatient setting: - 170.315_b9_cp_inp_sample*.docx (All Samples)
Ambulatory setting - 170.315_b9_cp_amb_sample*.docx (All Samples)
All settings: 170.315_b9_cp_sample*.xml (All Samples)
Negative testing: NT*r21*.xml (All Samples)
Certification Companion Guide: Care plan
This Certification Companion Guide (CCG) is an informative document designed to assist with health IT product certification. The CCG is not a substitute for the requirements outlined in regulation and related ONC final rules. It extracts key portions of ONC final rules’ preambles and includes subsequent clarifying interpretations. To access the full context of regulatory intent please consult the Certification Regulations page for links to all ONC final rules or consult other regulatory references as noted. The CCG is for public use and should not be sold or redistributed.
The below table outlines whether this criterion has additional Maintenance of Certification dependencies, update requirements and/or eligibility for standards updates via SVAP. Review the Certification Dependencies and Required Update Deadline drop-downs above if this table indicates “yes” for any field.
| Base EHR Definition | Real World Testing | Insights Condition | SVAP | Requires Updates |
|---|---|---|---|---|
| Not Included | Yes | No | Yes | Yes |
Applies to entire criterion
Technical outcome – A user can record, change, access, create, and receive care plan information according to the Care Plan document template in the HL7® Implementation Guide for CDA® Release 2: Consolidated CDA Templates for Clinical Notes (US Realm), Draft Standard for Trial Use Release 2.1, including the Health Status Evaluations and Outcomes Section and Interventions Section (V2).
Clarifications:
- In combination with the C-CDA R2.1 standard, developers certifying to the Care Plan criterion must follow the guidance and templates provided in HL7® CDA® R2 IG: C-CDA Templates for Clinical Notes R2 Companion Guide, Release 2 for implementation of the C-CDA Release 2.1 standard for a period up to and including December 31, 2025 or use the templates provided in HL7® CDA® R2 Implementation Guide: C-CDA Templates for Clinical Notes STU Companion Guide, Release 4.1 - US Realm.
- The Care Plan document template supports broader information about the patient, including education, physical therapy/range of motion, and social interventions not commonly found in other parts of the C-CDA standard, and is also distinct from the 'Plan of Treatment Section' in Version 2.1 of the C-CDA. (The Plan of Care Section in C-CDA 1.1 was renamed Plan of Treatment Section in C-CDA 2.1). [see also 80 FR 62648]
- The Care Plan document template is distinct from the “Plan of Care Section” in previous versions of the C-CDA. [see also 80 FR 62648]
- Consistent with ONC policy, health IT must enable a user to record, change, access, create, and receive information for those sections of the C-CDA Care Plan template that are required, including the “Goals” and “Health Concerns” Sections. [see also 80 FR 62648] ONC would expect that these sections could contain patient-expressed information, including patient-expressed goals and health concerns. Because of this, the information contained within the “Goals” and “Health Concerns” Sections of the Care Plan document could differ from the information contained within those same sections in a transition of care/referral summary document.
- Health IT must enable a user to record, change, access, create, and receive information for the “Health Status Evaluations and Outcomes Section” and “Interventions Section (V2)”. Although these sections are deemed optional in the C-CDA standard, they are required for certification. [see also 80 FR 62649]
- Although a system will need to be able to receive a care plan in accordance with C-CDA Release 2.1, the system is not required to enable a user to reconcile the care plan data. [see also 80 FR 62649]
- In order to mitigate potential interoperability errors and inconsistent implementation of the HL7 Implementation Guide for CDA® Release 2: Consolidated CDA Templates for Clinical Notes, Draft Standard for Trial Use, Release 2.1, ONC assesses, approves, and incorporates corrections as part of required testing and certification to this criterion [see the ONC Health IT Certification Program Overview]. Certified health IT adoption and compliance with the following corrections are necessary because they implement updates to vocabularies, update rules for cardinality and conformance statements, and promote proper exchange of C-CDA documents. There is a 90-day delay from the time the CCG has been updated with the ONC-approved corrections to when compliance with the corrections will be required to pass testing (i.e., ETT: Message Validators). Similarly, there will be an 18-month delay before a finding of a correction’s absence in certified health IT during surveillance would constitute a non-conformity under the Certification Program.
|
Technical outcome – A user can record, change, access, create, and receive care plan information according to the Care Plan document template in the HL7® Implementation Guide for CDA® Release 2: Consolidated CDA Templates for Clinical Notes (US Realm), Draft Standard for Trial Use Release 2.1, including the Health Status Evaluations and Outcomes Section and Interventions Section (V2). Clarifications:
|
Archived Version: