§170.315(a)(10) Drug-formulary and preferred drug list checks
§ 170.315 (a)(10) Drug-formulary and preferred drug list checks—
The requirements specified in one of the following paragraphs (that is, paragraphs (a)(10)(i) and (a)(10)(ii) of this section) must be met to satisfy this certification criterion:
- Drug formulary checks. Automatically check whether a drug formulary exists for a given patient and medication.
- Preferred drug list checks. Automatically check whether a preferred drug list exists for a given patient and medication.
None
| Version # | Description of Change | Version Date |
|---|---|---|
| 1.0 |
Final Test Procedure |
01-08-2016
|
| 1.1 |
As of September 21, 2017, Test Procedure has been moved to Attestation/Developer self-declaration only. |
09-21-2017
|
| 1.2 |
Changed language from self-declaration to attestation |
08-25-2021
|
- Regulation Text
-
Regulation Text
§ 170.315 (a)(10) Drug-formulary and preferred drug list checks—
The requirements specified in one of the following paragraphs (that is, paragraphs (a)(10)(i) and (a)(10)(ii) of this section) must be met to satisfy this certification criterion:
- Drug formulary checks. Automatically check whether a drug formulary exists for a given patient and medication.
- Preferred drug list checks. Automatically check whether a preferred drug list exists for a given patient and medication.
- Standard(s) Referenced
-
None
- Revision History
-
Version # Description of Change Version Date 1.0 Final Test Procedure
01-08-20161.1 As of September 21, 2017, Test Procedure has been moved to Attestation/Developer self-declaration only.
09-21-20171.2 Changed language from self-declaration to attestation
08-25-2021
Testing components
Attestation: As of September 21, 2017, the testing approach for this criterion is satisfied by attestation.
The archived version of the Test Procedure is attached below for reference.
|
System Under Test |
ONC-ACB Verification |
|---|---|
|
The health IT developer will attest directly to the ONC-ACB to conformance with the §170.315(a)(10) Drug-formulary and preferred drug list checks requirements. |
The ONC-ACB verifies the health IT developer attests conformance to the §170.315(a)(10) Drug-formulary and preferred drug list checks requirements. |
§ 170.315 (a)(10) Drug-formulary and preferred drug list checks—
The requirements specified in one of the following paragraphs (that is, paragraphs (a)(10)(i) and (a)(10)(ii) of this section) must be met to satisfy this certification criterion:
- Drug formulary checks. Automatically check whether a drug formulary exists for a given patient and medication.
- Preferred drug list checks. Automatically check whether a preferred drug list exists for a given patient and medication.
None
| Version # | Description of Change | Version Date |
|---|---|---|
| 1.0 |
Final Test Procedure |
01-08-2016
|
| 1.1 |
As of September 21, 2017, Test Procedure has been moved to Attestation/Developer self-declaration only. |
09-21-2017
|
| 1.2 |
Changed language from self-declaration to attestation |
08-25-2021
|
- Regulation Text
-
Regulation Text
§ 170.315 (a)(10) Drug-formulary and preferred drug list checks—
The requirements specified in one of the following paragraphs (that is, paragraphs (a)(10)(i) and (a)(10)(ii) of this section) must be met to satisfy this certification criterion:
- Drug formulary checks. Automatically check whether a drug formulary exists for a given patient and medication.
- Preferred drug list checks. Automatically check whether a preferred drug list exists for a given patient and medication.
- Standard(s) Referenced
-
None
- Revision History
-
Version # Description of Change Version Date 1.0 Initial Publication
10-22-20151.1 Added clarification regarding drug formulary files if the Health IT Module is using the NCPDP Formulary and Benefit Standard v3.0.
12-18-20151.2 Revised as a result of further analysis of the applicability of the 2015 Edition “amendments” certification criterion (§ 170.315(d)(4)) to health IT capabilities that would not necessarily have any patient data for which a request for an amendment would be relevant.
04-24-20171.3 Removal of Amendments (§ 170.315(d)(4)) under Approach 1 in the Privacy and Security section of the table.
05-08-20171.4 Updated 'CEHRT Definition' value from "No" to "Yes" to match regulation text.
02-22-20181.5 Added clarification for time-limited certification to this criterion per the 21st Century Cures Act: Interoperability, Information Blocking, and the ONC Health IT Certification Program Final Rule.
06-15-20201.6 Corrected information in the Privacy & Security Section
08-03-2020
Certification Companion Guide: Drug-formulary and preferred drug list checks
This Certification Companion Guide (CCG) is an informative document designed to assist with health IT product development. The CCG is not a substitute for the 2015 Edition final regulation. It extracts key portions of the rule’s preamble and includes subsequent clarifying interpretations. To access the full context of regulatory intent please consult the 2015 Edition final rule or other included regulatory reference. The CCG is for public use and should not be sold or redistributed.
| Base EHR Definition | In Scope for CEHRT Definition |
|---|---|
| Not Included | Yes |
Privacy and Security: This certification criterion was adopted at § 170.315(a)(10). As a result, an ONC Authorized Certification Body (ONC-ACB) must ensure that a product presented for certification to a § 170.315(a) criterion includes the privacy and security criteria (adopted in § 170.315(d)) within the overall scope of the certificate issued to the product.
- The privacy and security criteria (adopted in § 170.315(d)) do not need to be explicitly tested with this specific paragraph (a) criterion unless it is the only criterion for which certification is requested.
- As a general rule, a product presented for certification only needs to be presented once to each applicable privacy and security criterion (adopted in § 170.315(d)) so long as the health IT developer attests that such privacy and security capabilities apply to the full scope of capabilities included in the requested certification. However, exceptions exist for § 170.315(e)(1) “View, download, and transmit to 3rd party (VDT)” and (e)(2) “Secure messaging,” which are explicitly stated.
- Health IT presented for certification to this criterion would not have to demonstrate the capabilities required by the 2015 Edition “Amendments” certification criterion (§ 170.315(d)(4)), unless the health IT is presented for certification to another criterion that requires certification to the 2015 Edition “Amendments” criterion under the privacy and security certification framework.
- If choosing Approach 1:
- Authentication, access control, and authorization (§ 170.315(d)(1))
- Auditable events and tamper-resistance (§ 170.315(d)(2))
- Audit reports (§ 170.315(d)(3))
- Automatic access time-out (§ 170.315(d)(5))
- Emergency access (§ 170.315(d)(6))
- End-user device encryption (§ 170.315(d)(7))
- Encrypt authentication credentials (§ 170.315(d)(12))
- Multi-factor authentication (§ 170.315(d)(13))
- If choosing Approach 2:
- For each applicable privacy and security certification criterion not certified using Approach 1, the health IT developer may certify using system documentation which is sufficiently detailed to enable integration such that the Health IT Module has implemented service interfaces to access external services necessary to meet the requirements of the privacy and security certification criterion. Please see the ONC Cures Act Final Rule at 85 FR 25710 for additional clarification.
Design and Performance: The following design and performance certification criteria (adopted in § 170.315(g)) must also be certified in order for the product to be certified.
- When a single quality management system (QMS) is used, the QMS only needs to be identified once. Otherwise, the QMS’ need to be identified for every capability to which it was applied.
- When a single accessibility-centered design standard is used, the standard only needs to be identified once. Otherwise, the accessibility-centered design standards need to be identified for every capability to which they were applied; or, alternatively, the developer must state that no accessibility-centered design was used.
Privacy and Security: This certification criterion was adopted at § 170.315(a)(10). As a result, an ONC Authorized Certification Body (ONC-ACB) must ensure that a product presented for certification to a § 170.315(a) criterion includes the privacy and security criteria (adopted in § 170.315(d)) within the overall scope of the certificate issued to the product.
- The privacy and security criteria (adopted in § 170.315(d)) do not need to be explicitly tested with this specific paragraph (a) criterion unless it is the only criterion for which certification is requested.
- As a general rule, a product presented for certification only needs to be presented once to each applicable privacy and security criterion (adopted in § 170.315(d)) so long as the health IT developer attests that such privacy and security capabilities apply to the full scope of capabilities included in the requested certification. However, exceptions exist for § 170.315(e)(1) “View, download, and transmit to 3rd party (VDT)” and (e)(2) “Secure messaging,” which are explicitly stated.
- Health IT presented for certification to this criterion would not have to demonstrate the capabilities required by the 2015 Edition “Amendments” certification criterion (§ 170.315(d)(4)), unless the health IT is presented for certification to another criterion that requires certification to the 2015 Edition “Amendments” criterion under the privacy and security certification framework.
Design and Performance: The following design and performance certification criteria (adopted in § 170.315(g)) must also be certified in order for the product to be certified.
- When a single quality management system (QMS) is used, the QMS only needs to be identified once. Otherwise, the QMS’ need to be identified for every capability to which it was applied.
- When a single accessibility-centered design standard is used, the standard only needs to be identified once. Otherwise, the accessibility-centered design standards need to be identified for every capability to which they were applied; or, alternatively, the developer must state that no accessibility-centered design was used.
- If choosing Approach 1:
- Authentication, access control, and authorization (§ 170.315(d)(1))
- Auditable events and tamper-resistance (§ 170.315(d)(2))
- Audit reports (§ 170.315(d)(3))
- Automatic access time-out (§ 170.315(d)(5))
- Emergency access (§ 170.315(d)(6))
- End-user device encryption (§ 170.315(d)(7))
- Encrypt authentication credentials (§ 170.315(d)(12))
- Multi-factor authentication (§ 170.315(d)(13))
- If choosing Approach 2:
- For each applicable privacy and security certification criterion not certified using Approach 1, the health IT developer may certify using system documentation which is sufficiently detailed to enable integration such that the Health IT Module has implemented service interfaces to access external services necessary to meet the requirements of the privacy and security certification criterion. Please see the ONC Cures Act Final Rule at 85 FR 25710 for additional clarification.
Applies to entire criterion
Clarifications:
- There is no standard required for this certification criterion. We encourage the industry to accelerate its work on a real-time individual patient-level standard for drug-formulary checking, which we will consider proposing in future rulemaking. [see also 80 FR 62623]
- Health IT needs to demonstrate either the ability to automatically check whether 1) a drug formulary exists or 2) whether a preferred drug list exists, for a given patient and medication.
- ONC-ACBs are permitted to issue certificates for this criterion up until January 1, 2022 to align with the requirements of the CMS Medicaid Promoting Interoperability (PI) Program, as this criterion is associated with measures under the Medicaid program that will continue through 2021; after 2021 there will be no further incentives under the Medicaid PI Program. [see also 84 FR 42592] ONC has not finalized a proposal to remove the criterion from the CFR but included a provision in § 170.550(m)(1) to only allow ONC-ACBs to issue certificates for this criterion until January 1, 2022. [see also 80 FR 25661]
|
Clarifications:
|
Paragraph (a)(10)(i)
Technical outcome – The health IT automatically checks for a drug formulary for a given patient and medication.
Clarifications:
- No standard is required for drug formulary checks. However, National Council for Prescription Drug Programs (NCPDP) Formulary and Benefit Standard v3.0 is widely implemented today in support of Medicare Part D requirements. Note that drug formulary files should be downloaded and incorporated into the health IT system if using the NCPDP Formulary and Benefit Standard v3.0.
- Health IT will not satisfy this provision if it provides a hyperlink to a patient’s drug formulary that a user would have to manually open and navigate. The health IT must perform an automated check for a drug formulary for a specific patient and the medication to be prescribed. [see also 77 FR 54204]
- An internally managed drug formulary is acceptable for the automatic checking. [see also 77 FR 54204]
|
Technical outcome – The health IT automatically checks for a drug formulary for a given patient and medication. Clarifications:
|
Paragraph (a)(10)(ii)
Technical outcome – The health IT automatically checks for a preferred drug list for a specific patient and medication to be prescribed.
Clarifications:
- No additional clarifications.
|
Technical outcome – The health IT automatically checks for a preferred drug list for a specific patient and medication to be prescribed. Clarifications:
|