§170.315(a)(15) Social, psychological, and behavioral data
| Version # | Description of Change | Version Date |
|---|---|---|
| 1.0 |
Final Test Procedure |
01-08-2016
|
| 1.1 |
Corrected Typo for paragraph (a)(15)(iv) Depression rule language from stress to depression. |
06-03-2016
|
| 1.2 |
As of September 21, 2017, Test Procedure has been moved to Attestation/Developer self-declaration only. |
09-21-2017
|
| 1.3 |
Changed language from self-declaration to attestation |
08-25-2021
|
§ 170.315 (a)(15) Social, psychological, and behavioral data—
Enable a user to record, change, and access the following patient social, psychological, and behavioral data:
- Financial resource strain. Enable financial resource strain to be recorded in accordance with the standard specified in §170.207(p)(1) and whether a patient declines to specify financial resource strain.
- Education. Enable education to be recorded in accordance with the standard specified in §170.207(p)(2) and whether a patient declines to specify education.
- Stress. Enable stress to be recorded in accordance with the standard specified in §170.207(p)(3) and whether a patient declines to specify stress.
- Depression. Enable depression to be recorded in accordance with the standard specified in §170.207(p)(4) and whether a patient declines to specify depression.
- Physical activity. Enable physical activity to be recorded in accordance with the standard specified in §170.207(p)(5) and whether a patient declines to specify physical activity.
- Alcohol use. Enable alcohol use to be recorded in accordance with the standard specified in §170.207(p)(6) and whether a patient declines to specify alcohol use.
- Social connection and isolation. Enable social connection and isolation to be recorded in accordance the standard specified in §170.207(p)(7) and whether a patient declines to specify social connection and isolation.
- Exposure to violence (intimate partner violence). Enable exposure to violence (intimate partner violence) to be recorded in accordance with the standard specified in §170.207(p)(8) and whether a patient declines to specify exposure to violence (intimate partner violence).
Applies to entire criterion
§ 170.207(m)(1) The Unified Code of Units of Measure, Revision 1.9
Paragraph (a)(15)(i)
§ 170.207(p)(1) Financial resource strain. Financial resource strain must be coded in accordance with, at a minimum, the version of LOINC® codes specified in § 170.207(c)(3) and attributed with the LOINC® code 76513-1 and LOINC® answer list ID LL3266-5.
Paragraph (a)(15)(ii)
§ 170.207(p)(2) Education. Education must be coded in accordance with, at a minimum, the version of LOINC® codes specified in § 170.207(c)(3) and attributed with LOINC® code 63504-5 and LOINC® answer list ID LL1069-5.
Paragraph (a)(15)(iii)
§ 170.207(p)(3) Stress. Stress must be coded in accordance with, at a minimum, the version of LOINC® codes specified in § 170.207(c)(3) and attributed with the LOINC® code 76542-0 and LOINC® answer list LL3267-3.
Paragraph (a)(15)(iv)
§ 170.207(p)(4) Depression. Depression must be coded in accordance with, at a minimum, the version of LOINC® codes specified in § 170.207(c)(3) and attributed with LOINC® codes 55757-9, 44250-9 (with LOINC® answer list ID LL358-3), 44255-8 (with LOINC® answer list ID LL358-3), and 55758-7 (with the answer coded with the associated applicable unit of measure in the standard specified in § 170.207(m)(1)).
Paragraph (a)(15)(v)
§ 170.207(p)(5) Physical activity. Physical activity must be coded in accordance with, at a minimum, the version of LOINC® codes specified in § 170.207(c)(3) and attributed with LOINC® codes 68515-6 and 68516-4. The answers must be coded with the associated applicable unit of measure in the standard specified in § 170.207(m)(1).
Paragraph (a)(15)(vi)
§ 170.207(p)(6) Alcohol use. Alcohol use must be coded in accordance with, at a minimum, the version of LOINC® codes specified in § 170.207(c)(3) and attributed with LOINC® codes 72109-2, 68518-0 (with LOINC® answer list ID LL2179-1), 68519-8 (with LOINC® answer list ID LL2180-9), 68520-6 (with LOINC® answer list ID LL2181-7), and 75626-2.
Paragraph (a)(15)(vii)
§ 170.207(p)(7) Social connection and isolation. Social connection and isolation must be coded in accordance with, at a minimum, the version of LOINC® codes specified in § 170.207(c)(3) and attributed with the LOINC® codes 76506-5, 63503-7 (with LOINC answer list ID LL1068-7), 76508-1 (with the associated applicable unit of measure in the standard specified in § 170.207(m)(1)), 76509-9 (with the associated applicable unit of measure in the standard specified in § 170.207(m)(1)), 76510-7 (with the associated applicable unit of measure in the standard specified in § 170.207(m)(1)), 76511-5 (with LOINC answer list ID LL963-0), and 76512-3 (with the associated applicable unit of measure in the standard specified in § 170.207(m)(1)).
Paragraph (a)(15)(viii)
§ 170.207(p)(8) Exposure to violence (intimate partner violence). Exposure to violence: intimate partner violence must be coded in accordance with, at a minimum, the version of LOINC® codes specified in § 170.207(c)(3) and attributed with the LOINC® code 76499-3, 76500-8 (with LOINC® answer list ID LL963-0), 76501-6 (with LOINC® answer list ID LL963-0), 76502-4 (with LOINC® answer list ID LL963-0), 76503-2 (with LOINC® answer list ID LL963-0), and 76504-0 (with the associated applicable unit of measure in the standard specified in § 170.207(m)(1)).
- Resource Documents
- Revision History
-
Version # Description of Change Version Date 1.0 Final Test Procedure
01-08-20161.1 Corrected Typo for paragraph (a)(15)(iv) Depression rule language from stress to depression.
06-03-20161.2 As of September 21, 2017, Test Procedure has been moved to Attestation/Developer self-declaration only.
09-21-20171.3 Changed language from self-declaration to attestation
08-25-2021 - Regulation Text
-
Regulation Text
§ 170.315 (a)(15) Social, psychological, and behavioral data—
Enable a user to record, change, and access the following patient social, psychological, and behavioral data:
- Financial resource strain. Enable financial resource strain to be recorded in accordance with the standard specified in §170.207(p)(1) and whether a patient declines to specify financial resource strain.
- Education. Enable education to be recorded in accordance with the standard specified in §170.207(p)(2) and whether a patient declines to specify education.
- Stress. Enable stress to be recorded in accordance with the standard specified in §170.207(p)(3) and whether a patient declines to specify stress.
- Depression. Enable depression to be recorded in accordance with the standard specified in §170.207(p)(4) and whether a patient declines to specify depression.
- Physical activity. Enable physical activity to be recorded in accordance with the standard specified in §170.207(p)(5) and whether a patient declines to specify physical activity.
- Alcohol use. Enable alcohol use to be recorded in accordance with the standard specified in §170.207(p)(6) and whether a patient declines to specify alcohol use.
- Social connection and isolation. Enable social connection and isolation to be recorded in accordance the standard specified in §170.207(p)(7) and whether a patient declines to specify social connection and isolation.
- Exposure to violence (intimate partner violence). Enable exposure to violence (intimate partner violence) to be recorded in accordance with the standard specified in §170.207(p)(8) and whether a patient declines to specify exposure to violence (intimate partner violence).
- Standard(s) Referenced
-
Applies to entire criterion
§ 170.207(m)(1) The Unified Code of Units of Measure, Revision 1.9
Paragraph (a)(15)(i)
§ 170.207(p)(1) Financial resource strain. Financial resource strain must be coded in accordance with, at a minimum, the version of LOINC® codes specified in § 170.207(c)(3) and attributed with the LOINC® code 76513-1 and LOINC® answer list ID LL3266-5.
Paragraph (a)(15)(ii)
§ 170.207(p)(2) Education. Education must be coded in accordance with, at a minimum, the version of LOINC® codes specified in § 170.207(c)(3) and attributed with LOINC® code 63504-5 and LOINC® answer list ID LL1069-5.
Paragraph (a)(15)(iii)
§ 170.207(p)(3) Stress. Stress must be coded in accordance with, at a minimum, the version of LOINC® codes specified in § 170.207(c)(3) and attributed with the LOINC® code 76542-0 and LOINC® answer list LL3267-3.
Paragraph (a)(15)(iv)
§ 170.207(p)(4) Depression. Depression must be coded in accordance with, at a minimum, the version of LOINC® codes specified in § 170.207(c)(3) and attributed with LOINC® codes 55757-9, 44250-9 (with LOINC® answer list ID LL358-3), 44255-8 (with LOINC® answer list ID LL358-3), and 55758-7 (with the answer coded with the associated applicable unit of measure in the standard specified in § 170.207(m)(1)).
Paragraph (a)(15)(v)
§ 170.207(p)(5) Physical activity. Physical activity must be coded in accordance with, at a minimum, the version of LOINC® codes specified in § 170.207(c)(3) and attributed with LOINC® codes 68515-6 and 68516-4. The answers must be coded with the associated applicable unit of measure in the standard specified in § 170.207(m)(1).
Paragraph (a)(15)(vi)
§ 170.207(p)(6) Alcohol use. Alcohol use must be coded in accordance with, at a minimum, the version of LOINC® codes specified in § 170.207(c)(3) and attributed with LOINC® codes 72109-2, 68518-0 (with LOINC® answer list ID LL2179-1), 68519-8 (with LOINC® answer list ID LL2180-9), 68520-6 (with LOINC® answer list ID LL2181-7), and 75626-2.
Paragraph (a)(15)(vii)
§ 170.207(p)(7) Social connection and isolation. Social connection and isolation must be coded in accordance with, at a minimum, the version of LOINC® codes specified in § 170.207(c)(3) and attributed with the LOINC® codes 76506-5, 63503-7 (with LOINC answer list ID LL1068-7), 76508-1 (with the associated applicable unit of measure in the standard specified in § 170.207(m)(1)), 76509-9 (with the associated applicable unit of measure in the standard specified in § 170.207(m)(1)), 76510-7 (with the associated applicable unit of measure in the standard specified in § 170.207(m)(1)), 76511-5 (with LOINC answer list ID LL963-0), and 76512-3 (with the associated applicable unit of measure in the standard specified in § 170.207(m)(1)).
Paragraph (a)(15)(viii)
§ 170.207(p)(8) Exposure to violence (intimate partner violence). Exposure to violence: intimate partner violence must be coded in accordance with, at a minimum, the version of LOINC® codes specified in § 170.207(c)(3) and attributed with the LOINC® code 76499-3, 76500-8 (with LOINC® answer list ID LL963-0), 76501-6 (with LOINC® answer list ID LL963-0), 76502-4 (with LOINC® answer list ID LL963-0), 76503-2 (with LOINC® answer list ID LL963-0), and 76504-0 (with the associated applicable unit of measure in the standard specified in § 170.207(m)(1)).
Testing components
Attestation: As of September 21, 2017, the testing approach for this criterion is satisfied by attestation.
The archived version of the Test Procedure is attached below for reference.
|
System Under Test |
ONC-ACB Verification |
|---|---|
|
The health IT developer will attest directly to the ONC-ACB to conformance with the §170.315(a)(15) Social, psychological, and behavioral data requirements. |
The ONC-ACB verifies the health IT developer attests conformance to the §170.315(a)(15) Social, psychological, and behavioral data requirements. |
| Version # | Description of Change | Version Date |
|---|---|---|
| 1.0 |
Initial Publication |
10-27-2015
|
| 1.1 |
Removed § 170.315(g)(3) reference from design and performance. |
12-08-2016
|
| 1.2 |
Added clarification regarding "decline to specify". |
03-17-2017
|
| 1.3 |
Added clarifications about the applicability of questionnaires and instruments for testing and certification. Also added flexibility for the testing and certification of health IT to the physical activity domain. |
07-07-2017
|
| 1.4 |
Updated Security requirements per 21st Century Cures Act. |
06-08-2020
|
§ 170.315 (a)(15) Social, psychological, and behavioral data—
Enable a user to record, change, and access the following patient social, psychological, and behavioral data:
- Financial resource strain. Enable financial resource strain to be recorded in accordance with the standard specified in §170.207(p)(1) and whether a patient declines to specify financial resource strain.
- Education. Enable education to be recorded in accordance with the standard specified in §170.207(p)(2) and whether a patient declines to specify education.
- Stress. Enable stress to be recorded in accordance with the standard specified in §170.207(p)(3) and whether a patient declines to specify stress.
- Depression. Enable depression to be recorded in accordance with the standard specified in §170.207(p)(4) and whether a patient declines to specify depression.
- Physical activity. Enable physical activity to be recorded in accordance with the standard specified in §170.207(p)(5) and whether a patient declines to specify physical activity.
- Alcohol use. Enable alcohol use to be recorded in accordance with the standard specified in §170.207(p)(6) and whether a patient declines to specify alcohol use.
- Social connection and isolation. Enable social connection and isolation to be recorded in accordance the standard specified in §170.207(p)(7) and whether a patient declines to specify social connection and isolation.
- Exposure to violence (intimate partner violence). Enable exposure to violence (intimate partner violence) to be recorded in accordance with the standard specified in §170.207(p)(8) and whether a patient declines to specify exposure to violence (intimate partner violence).
Applies to entire criterion
§ 170.207(m)(1) The Unified Code of Units of Measure, Revision 1.9
Paragraph (a)(15)(i)
§ 170.207(p)(1) Financial resource strain. Financial resource strain must be coded in accordance with, at a minimum, the version of LOINC® codes specified in § 170.207(c)(3) and attributed with the LOINC® code 76513-1 and LOINC® answer list ID LL3266-5.
Paragraph (a)(15)(ii)
§ 170.207(p)(2) Education. Education must be coded in accordance with, at a minimum, the version of LOINC® codes specified in § 170.207(c)(3) and attributed with LOINC® code 63504-5 and LOINC® answer list ID LL1069-5.
Paragraph (a)(15)(iii)
§ 170.207(p)(3) Stress. Stress must be coded in accordance with, at a minimum, the version of LOINC® codes specified in § 170.207(c)(3) and attributed with the LOINC® code 76542-0 and LOINC® answer list LL3267-3.
Paragraph (a)(15)(iv)
§ 170.207(p)(4) Depression. Depression must be coded in accordance with, at a minimum, the version of LOINC® codes specified in § 170.207(c)(3) and attributed with LOINC® codes 55757-9, 44250-9 (with LOINC® answer list ID LL358-3), 44255-8 (with LOINC® answer list ID LL358-3), and 55758-7 (with the answer coded with the associated applicable unit of measure in the standard specified in § 170.207(m)(1)).
Paragraph (a)(15)(v)
§ 170.207(p)(5) Physical activity. Physical activity must be coded in accordance with, at a minimum, the version of LOINC® codes specified in § 170.207(c)(3) and attributed with LOINC® codes 68515-6 and 68516-4. The answers must be coded with the associated applicable unit of measure in the standard specified in § 170.207(m)(1).
Paragraph (a)(15)(vi)
§ 170.207(p)(6) Alcohol use. Alcohol use must be coded in accordance with, at a minimum, the version of LOINC® codes specified in § 170.207(c)(3) and attributed with LOINC® codes 72109-2, 68518-0 (with LOINC® answer list ID LL2179-1), 68519-8 (with LOINC® answer list ID LL2180-9), 68520-6 (with LOINC® answer list ID LL2181-7), and 75626-2.
Paragraph (a)(15)(vii)
§ 170.207(p)(7) Social connection and isolation. Social connection and isolation must be coded in accordance with, at a minimum, the version of LOINC® codes specified in § 170.207(c)(3) and attributed with the LOINC® codes 76506-5, 63503-7 (with LOINC answer list ID LL1068-7), 76508-1 (with the associated applicable unit of measure in the standard specified in § 170.207(m)(1)), 76509-9 (with the associated applicable unit of measure in the standard specified in § 170.207(m)(1)), 76510-7 (with the associated applicable unit of measure in the standard specified in § 170.207(m)(1)), 76511-5 (with LOINC answer list ID LL963-0), and 76512-3 (with the associated applicable unit of measure in the standard specified in § 170.207(m)(1)).
Paragraph (a)(15)(viii)
§ 170.207(p)(8) Exposure to violence (intimate partner violence). Exposure to violence: intimate partner violence must be coded in accordance with, at a minimum, the version of LOINC® codes specified in § 170.207(c)(3) and attributed with the LOINC® code 76499-3, 76500-8 (with LOINC® answer list ID LL963-0), 76501-6 (with LOINC® answer list ID LL963-0), 76502-4 (with LOINC® answer list ID LL963-0), 76503-2 (with LOINC® answer list ID LL963-0), and 76504-0 (with the associated applicable unit of measure in the standard specified in § 170.207(m)(1)).
- Resource Documents
- Revision History
-
Version # Description of Change Version Date 1.0 Initial Publication
10-27-20151.1 Removed § 170.315(g)(3) reference from design and performance.
12-08-20161.2 Added clarification regarding "decline to specify".
03-17-20171.3 Added clarifications about the applicability of questionnaires and instruments for testing and certification. Also added flexibility for the testing and certification of health IT to the physical activity domain.
07-07-20171.4 Updated Security requirements per 21st Century Cures Act.
06-08-2020 - Regulation Text
-
Regulation Text
§ 170.315 (a)(15) Social, psychological, and behavioral data—
Enable a user to record, change, and access the following patient social, psychological, and behavioral data:
- Financial resource strain. Enable financial resource strain to be recorded in accordance with the standard specified in §170.207(p)(1) and whether a patient declines to specify financial resource strain.
- Education. Enable education to be recorded in accordance with the standard specified in §170.207(p)(2) and whether a patient declines to specify education.
- Stress. Enable stress to be recorded in accordance with the standard specified in §170.207(p)(3) and whether a patient declines to specify stress.
- Depression. Enable depression to be recorded in accordance with the standard specified in §170.207(p)(4) and whether a patient declines to specify depression.
- Physical activity. Enable physical activity to be recorded in accordance with the standard specified in §170.207(p)(5) and whether a patient declines to specify physical activity.
- Alcohol use. Enable alcohol use to be recorded in accordance with the standard specified in §170.207(p)(6) and whether a patient declines to specify alcohol use.
- Social connection and isolation. Enable social connection and isolation to be recorded in accordance the standard specified in §170.207(p)(7) and whether a patient declines to specify social connection and isolation.
- Exposure to violence (intimate partner violence). Enable exposure to violence (intimate partner violence) to be recorded in accordance with the standard specified in §170.207(p)(8) and whether a patient declines to specify exposure to violence (intimate partner violence).
- Standard(s) Referenced
-
Applies to entire criterion
§ 170.207(m)(1) The Unified Code of Units of Measure, Revision 1.9
Paragraph (a)(15)(i)
§ 170.207(p)(1) Financial resource strain. Financial resource strain must be coded in accordance with, at a minimum, the version of LOINC® codes specified in § 170.207(c)(3) and attributed with the LOINC® code 76513-1 and LOINC® answer list ID LL3266-5.
Paragraph (a)(15)(ii)
§ 170.207(p)(2) Education. Education must be coded in accordance with, at a minimum, the version of LOINC® codes specified in § 170.207(c)(3) and attributed with LOINC® code 63504-5 and LOINC® answer list ID LL1069-5.
Paragraph (a)(15)(iii)
§ 170.207(p)(3) Stress. Stress must be coded in accordance with, at a minimum, the version of LOINC® codes specified in § 170.207(c)(3) and attributed with the LOINC® code 76542-0 and LOINC® answer list LL3267-3.
Paragraph (a)(15)(iv)
§ 170.207(p)(4) Depression. Depression must be coded in accordance with, at a minimum, the version of LOINC® codes specified in § 170.207(c)(3) and attributed with LOINC® codes 55757-9, 44250-9 (with LOINC® answer list ID LL358-3), 44255-8 (with LOINC® answer list ID LL358-3), and 55758-7 (with the answer coded with the associated applicable unit of measure in the standard specified in § 170.207(m)(1)).
Paragraph (a)(15)(v)
§ 170.207(p)(5) Physical activity. Physical activity must be coded in accordance with, at a minimum, the version of LOINC® codes specified in § 170.207(c)(3) and attributed with LOINC® codes 68515-6 and 68516-4. The answers must be coded with the associated applicable unit of measure in the standard specified in § 170.207(m)(1).
Paragraph (a)(15)(vi)
§ 170.207(p)(6) Alcohol use. Alcohol use must be coded in accordance with, at a minimum, the version of LOINC® codes specified in § 170.207(c)(3) and attributed with LOINC® codes 72109-2, 68518-0 (with LOINC® answer list ID LL2179-1), 68519-8 (with LOINC® answer list ID LL2180-9), 68520-6 (with LOINC® answer list ID LL2181-7), and 75626-2.
Paragraph (a)(15)(vii)
§ 170.207(p)(7) Social connection and isolation. Social connection and isolation must be coded in accordance with, at a minimum, the version of LOINC® codes specified in § 170.207(c)(3) and attributed with the LOINC® codes 76506-5, 63503-7 (with LOINC answer list ID LL1068-7), 76508-1 (with the associated applicable unit of measure in the standard specified in § 170.207(m)(1)), 76509-9 (with the associated applicable unit of measure in the standard specified in § 170.207(m)(1)), 76510-7 (with the associated applicable unit of measure in the standard specified in § 170.207(m)(1)), 76511-5 (with LOINC answer list ID LL963-0), and 76512-3 (with the associated applicable unit of measure in the standard specified in § 170.207(m)(1)).
Paragraph (a)(15)(viii)
§ 170.207(p)(8) Exposure to violence (intimate partner violence). Exposure to violence: intimate partner violence must be coded in accordance with, at a minimum, the version of LOINC® codes specified in § 170.207(c)(3) and attributed with the LOINC® code 76499-3, 76500-8 (with LOINC® answer list ID LL963-0), 76501-6 (with LOINC® answer list ID LL963-0), 76502-4 (with LOINC® answer list ID LL963-0), 76503-2 (with LOINC® answer list ID LL963-0), and 76504-0 (with the associated applicable unit of measure in the standard specified in § 170.207(m)(1)).
Certification Companion Guide: Social, psychological, and behavioral data
This Certification Companion Guide (CCG) is an informative document designed to assist with health IT product development. The CCG is not a substitute for the 2015 Edition final regulation. It extracts key portions of the rule’s preamble and includes subsequent clarifying interpretations. To access the full context of regulatory intent please consult the 2015 Edition final rule or other included regulatory reference. The CCG is for public use and should not be sold or redistributed.
| Base EHR Definition | In Scope for CEHRT Definition | Real World Testing | USCDI | SVAP |
|---|---|---|---|---|
| Not Included | No | No | No | No |
Privacy and Security: This certification criterion was adopted at § 170.315(a)(15). As a result, an ONC Authorized Certification Body (ONC-ACB) must ensure that a product presented for certification to a § 170.315(a) criterion includes the privacy and security criteria (adopted in § 170.315(d)) within the overall scope of the certificate issued to the product.
- The privacy and security criteria (adopted in § 170.315(d)) do not need to be explicitly tested with this specific paragraph (a) criterion unless it is the only criterion for which certification is requested.
- As a general rule, a product presented for certification only needs to be presented once to each applicable privacy and security criterion (adopted in § 170.315(d)) so long as the health IT developer attests that such privacy and security capabilities apply to the full scope of capabilities included in the requested certification. However, exceptions exist for § 170.315(e)(1) “View, download, and transfer to 3rd party (VDT)” and (e)(2) “Secure messaging,” which are explicitly stated.
- § 170.315(d)(2)(i)(C) is not required if the scope of the Health IT Module does not have end-user device encryption features.
- If choosing Approach 1:
- Authentication, access control, and authorization (§ 170.315(d)(1))
- Auditable events and tamper-resistance (§ 170.315(d)(2))
- Audit reports (§ 170.315(d)(3))
- Amendments (§ 170.315(d)(4))
- Automatic access time-out (§ 170.315(d)(5))
- Emergency access (§ 170.315(d)(6))
- End-user device encryption (§ 170.315(d)(7))
- Encrypt authentication credentials (§ 170.315(d)(12))
- Multi-factor authentication (MFA) (§ 170.315(d)(13))
- If choosing Approach 2:
- For each applicable privacy and security certification criterion not certified for Approach 1, the health IT developer may certify using system documentation which is sufficiently detailed to enable integration such that the Health IT Module has implemented service interfaces the Health IT Module to access external services necessary to meet the requirements of the privacy and security certification criterion. Please see the 21st Century Cures Act: Interoperability, Information Blocking, and the ONC Health IT Certification Program Final Rule at 85 FR 25710 for additional clarification.
Design and Performance: The following design and performance certification criteria (adopted in § 170.315(g)) must also be certified in order for the product to be certified.
- When a single quality management system (QMS) is used, the QMS only needs to be identified once. Otherwise, the QMS needs to be identified for every capability to which it was applied.
- When a single accessibility-centered design standard is used, the standard only needs to be identified once. Otherwise, the accessibility- centered design standards need to be identified for every capability to which they were applied; or, alternatively, the developer must state that no accessibility-centered design was used.
Privacy and Security: This certification criterion was adopted at § 170.315(a)(15). As a result, an ONC Authorized Certification Body (ONC-ACB) must ensure that a product presented for certification to a § 170.315(a) criterion includes the privacy and security criteria (adopted in § 170.315(d)) within the overall scope of the certificate issued to the product.
- The privacy and security criteria (adopted in § 170.315(d)) do not need to be explicitly tested with this specific paragraph (a) criterion unless it is the only criterion for which certification is requested.
- As a general rule, a product presented for certification only needs to be presented once to each applicable privacy and security criterion (adopted in § 170.315(d)) so long as the health IT developer attests that such privacy and security capabilities apply to the full scope of capabilities included in the requested certification. However, exceptions exist for § 170.315(e)(1) “View, download, and transfer to 3rd party (VDT)” and (e)(2) “Secure messaging,” which are explicitly stated.
- § 170.315(d)(2)(i)(C) is not required if the scope of the Health IT Module does not have end-user device encryption features.
Design and Performance: The following design and performance certification criteria (adopted in § 170.315(g)) must also be certified in order for the product to be certified.
- When a single quality management system (QMS) is used, the QMS only needs to be identified once. Otherwise, the QMS needs to be identified for every capability to which it was applied.
- When a single accessibility-centered design standard is used, the standard only needs to be identified once. Otherwise, the accessibility- centered design standards need to be identified for every capability to which they were applied; or, alternatively, the developer must state that no accessibility-centered design was used.
- If choosing Approach 1:
- Authentication, access control, and authorization (§ 170.315(d)(1))
- Auditable events and tamper-resistance (§ 170.315(d)(2))
- Audit reports (§ 170.315(d)(3))
- Amendments (§ 170.315(d)(4))
- Automatic access time-out (§ 170.315(d)(5))
- Emergency access (§ 170.315(d)(6))
- End-user device encryption (§ 170.315(d)(7))
- Encrypt authentication credentials (§ 170.315(d)(12))
- Multi-factor authentication (MFA) (§ 170.315(d)(13))
- If choosing Approach 2:
- For each applicable privacy and security certification criterion not certified for Approach 1, the health IT developer may certify using system documentation which is sufficiently detailed to enable integration such that the Health IT Module has implemented service interfaces the Health IT Module to access external services necessary to meet the requirements of the privacy and security certification criterion. Please see the 21st Century Cures Act: Interoperability, Information Blocking, and the ONC Health IT Certification Program Final Rule at 85 FR 25710 for additional clarification.
Applies to entire criterion
Clarifications:
- In order to certify to this criterion, a Health IT Module must be certified to all eight domains in paragraphs (a)(15)(i)-(viii). These eight domains together provide a comprehensive picture of the patient that can facilitate care management and coordination. [see also 80 FR 62631]
- We provide the following OID to assist developers in the proper identification and exchange of health information coded to certain vocabulary standards.
- LOINC® OID: 2.16.840.1.113883.6.1 [see also 80 FR 62612]
- Health IT Modules can present for certification to a more recent version of LOINC® than version 2.52 per ONC’s policy that permits certification to a more recent version of certain vocabulary standards. [see also 80 FR 62620]
- In addition to the privacy and security requirements for this criterion, ONC recommends that institutions develop and maintain policies for the collection and dissemination of the social, psychological, and behavioral data consistent with applicable federal and state laws. [see also 80 FR 62631]
- This criterion does not require that users capture social, psychological, and behavioral data beyond the specified types of data listed in the criterion and only in accordance with the specified standards.
- Certified Health IT Modules must allow all actions to be performed at the questionnaire level. Actions include enabling a user to record, change, and access the patient social, psychological, and behavioral data outlined in this certification criterion.
- A Certified Health IT Module is required to enable a user to record whether the patient declined to specify (i.e., respond/provide) the requested information at the third paragraph level. Paragraphs (a)(15)(i) through (viii) are at the third paragraph level. Therefore, as an example, a Health IT Module is required to enable a user to record whether a patient declined to provide information regarding depression (§ 170.315(a)(15)(iv)) for the purposes of testing and certification. Specification of patient actions in terms of compliance with the standard (i.e., whether the patient declined to respond to a question in a questionnaire) is beyond the scope of testing and certification, but may also jeopardize the validity of the questionnaire.
- The criterion requires Certified Health IT Modules to be capable of capturing specific LOINC® codes associated with the identified domain questions and answers. Specific questionnaires, tools, or other documents were not adopted as part of this criterion. Accordingly, they are not within the scope of certification.
- ONC acknowledges that the LOINC® codes adopted for the physical activity domain questions are attributed to the Substance Abuse and Mental Health Services Administration (SAMHSA). Several health IT developers wishing to develop the capabilities outlined in this criterion have commented that these questions differ slightly from the questions that comprise the Kaiser Permanente-developed Exercise Vital Sign (EVS) instrument. ONC acknowledges these differences exist. ONC also acknowledges that the EVS has been recommended as a screening tool by the American College of Sports Medicine’s Exercise is Medicine initiative and received the highest available rating by the Institute of Medicine (IOM) as an available standard and for its usefulness and feasibility (see also “Capturing Social and Behavioral Domains and Measures in Electronic Health Records: Phase 2” report: Records Phase 2 Report, page 212). Further, in the 2015 Edition proposed rule, ONC expressed a desire to align with the IOM “Phase 2” report (80 FR 16826). LOINC® codes are currently in development by the standards developing organization (Regenstrief Institute) for the EVS questions. When they become available, ONC will provide certification to those LOINC® codes in lieu of the current question LOINC® codes for the physical activity domain. In the interim, health IT developers may choose to proceed with the testing and certification of their Health IT Modules that supports the EVS instrument by demonstrating that the health IT can capture the appropriate EVS questions and associate them with the adopted answer LOINC® codes for the physical activity domain. Health IT developers will be responsible for updating their health IT within six months of the publishing of the LOINC® codes for the EVS questions. After expiration of this time period and during surveillance, a health IT product would be found non-conforming if it could not produce the proper LOINC® codes for the EVS questions. Health IT Modules already certified to this criterion will not be required to retest or recertify to the new LOINC® codes aligned with EVS. Health IT developers may also continue to choose to test and certify to the adopted LOINC® codes for “SAMHSA” questions in lieu of the EVS questions.
Applies to entire criterion
|
Clarifications:
|
Paragraph (a)(15)(i)
Technical outcome – A user can record, change, and access financial resource strain using the specified LOINC® codes and whether the patient declines to specify financial resource strain.
|
LOINC® Code(s) for Question(s) |
LOINC® Question Text |
LOINC® Answer List ID |
LOINC® Answer Text and ID |
|---|---|---|---|
|
76513-1 |
How hard is it for you to pay for the very basics like food, housing, medical care, and heating? [CARDIA] |
LL3266-5 |
Very hard - LA15832-1 Hard - LA14745-6 Somewhat hard - LA22683-9 Not very hard - LA22682-1 |
Paragraph (a)(15)(i)
|
Technical outcome – A user can record, change, and access financial resource strain using the specified LOINC® codes and whether the patient declines to specify financial resource strain.
|
Paragraph (a)(15)(ii)
Technical outcome – A user can record, change, and access education using the specified LOINC® codes and whether the patient declines to specify education.
|
LOINC® Code(s) for Question(s) |
LOINC® Question Text |
LOINC® Answer List ID |
LOINC® Answer Text and ID |
|---|---|---|---|
|
63504-5 |
What is the highest grade or level of school you have completed or the highest degree you have received? [NHANES] |
LL1069-5 |
Never attended/kindergarten only – LA15606-9 |
Paragraph (a)(15)(ii)
|
Technical outcome – A user can record, change, and access education using the specified LOINC® codes and whether the patient declines to specify education.
|
Paragraph (a)(15)(iii)
Technical outcome – A user can record, change, and access stress using the specified LOINC® codes and whether the patient declines to specify stress.
|
LOINC® Code(s) for Question(s) |
LOINC® Question Text |
LOINC® Answer List ID |
LOINC® Answer Text and ID |
|---|---|---|---|
|
76542-0 |
Do you feel stress - tense, restless, nervous, or anxious, or unable to sleep at night because your mind is troubled all the time - these days? |
LL3267-3 |
Not at all – LA6568-5 Only a little – LA22687-0 To some extent – LA22686-2 Rather much – LA22685-4 Very much – LA13914-9 |
Paragraph (a)(15)(iii)
|
Technical outcome – A user can record, change, and access stress using the specified LOINC® codes and whether the patient declines to specify stress.
|
Paragraph (a)(15)(iv)
Technical outcome – A user can record, change, and access depression using the specified LOINC® codes and whether the patient declines to specify depression.
|
LOINC® Code(s) for Question(s) |
LOINC® Question Text |
LOINC® Answer List ID |
LOINC® Answer Text and ID |
|---|---|---|---|
|
55757-9 |
Patient Health Questionnaire 2 item (PHQ-2) [Reported] |
N/A |
N/A |
|
44250-9 |
(Q1) Little interest or pleasure in doing things? |
LL358-3 |
Not at all – LA6568-5 Several days – LA6569-3 More than half the days – LA6570-1 Nearly every day – LA6571-9 |
|
44255-8 |
(Q2) Feeling down, depressed, or hopeless? |
LL358-3 |
Not at all – LA6568-5 Several days – LA6569-3 More than half the days – LA6570-1 Nearly every day – LA6571-9 |
| 55758-7 | Patient Health Questionnaire 2 item (PHQ-2) total score | With the answer coded with the associated applicable unit of measure using § 170.207(m)(1) The Unified Code of Units for Measure, Revision 1.9 | N/A |
Paragraph (a)(15)(iv)
|
Technical outcome – A user can record, change, and access depression using the specified LOINC® codes and whether the patient declines to specify depression.
|
Paragraph (a)(15)(v)
Technical outcome – A user can record, change, and access physical activity using the specified LOINC® codes and whether the patient declines to specify physical activity.
|
LOINC® Code(s) for Question(s) |
LOINC® Question Text |
LOINC® Answer List ID |
LOINC® Answer Text and ID |
|---|---|---|---|
|
68515-6 |
How many days of moderate to strenuous exercise, like a brisk walk, did you do in the last 7D [SAMHSA] | With the answer coded with the associated applicable unit of measure using § 170.207(m)(1) The Unified Code of Units for Measure, Revision 1.9 | N/A |
|
68516-4 |
On those days that you engage in moderate to strenuous exercise, how many minutes, on average, do you exercise? [SAMHSA] |
With the answer coded with the associated applicable unit of measure using § 170.207(m)(1) The Unified Code of Units for Measure, Revision 1.9 | N/A |
Paragraph (a)(15)(v)
|
Technical outcome – A user can record, change, and access physical activity using the specified LOINC® codes and whether the patient declines to specify physical activity.
|
Paragraph (a)(15)(vi)
Technical outcome – A user can record, change, and access alcohol use using the specified LOINC® codes and whether the patient declines to specify alcohol use.
|
LOINC® Code(s) for Question(s) |
LOINC® Question Text |
LOINC® Answer List ID |
LOINC® Answer Text and ID |
|---|---|---|---|
|
72109-2 |
Alcohol Use Disorder Identification Test - Consumption [AUDIT-C] | N/A | N/A |
| 68518-0 | How often do you have a drink containing alcohol? | LL2179-1 |
Never – LA6270-8 Monthly or less – LA18926-8 2-4 times a month – LA18927-6 2-3 times a week – LA18928-4 4 or more times a week – LA18929-2 |
| 68519-8 | How many standard drinks containing alcohol do you have on a typical day? | LL2180-9 |
1 or 2 - LA15694-5 3 or 4 – LA15695-2 5 or 6 – LA18930-0 7 to 9 – LA18931-8 10 or more – LA18932-6 |
| 68520-6 | How often do you have 6 or more drinks on 1 occasion? | LL2181-7 |
Never – LA6270-8 Less than monthly – LA18933-4 Monthly – LA18876-5 Weekly – LA18891-4 Daily or almost daily – LA18934-2 |
| 75626-2 | Total score [AUDIT-C] | N/A | N/A |
Paragraph (a)(15)(vi)
|
Technical outcome – A user can record, change, and access alcohol use using the specified LOINC® codes and whether the patient declines to specify alcohol use.
|
Paragraph (a)(15)(vii)
Technical outcome – A user can record, change, and access social connection and isolation using the specified LOINC® codes and whether the patient declines to specify social connection and isolation.
|
LOINC® Code(s) for Question(s) |
LOINC® Question Text |
LOINC® Answer List ID |
LOINC® Answer Text and ID |
|---|---|---|---|
|
76506-5 |
Social connection and isolation panel | N/A | N/A |
| 63503-7 | Are you now married, widowed, divorced, separated, never married or living with a partner? | LL1068-7 |
Married – LA48-4 Widowed – LA49-2 Divorced – LA51-8 Separated – LA4288-2 Never married – LA47-6 Living with partner – LA15605-1 Refused – LA4389-8 Don't know – LA12688-0 |
| 76508-1 | In a typical week, how many times do you talk on the telephone with family, friends, or neighbors [NHANES III] | With the answer coded with the associated applicable unit of measure using § 170.207(m)(1) The Unified Code of Units for Measure, Revision 1.9 |
N/A |
| 76509-9 | How often do you get together with friends or relatives [NHANES III] | With the answer coded with the associated applicable unit of measure using § 170.207(m)(1) The Unified Code of Units for Measure, Revision 1.9 |
N/A |
| 76510-7 | How often do you attend church or religious services [NHANES] | With the answer coded with the associated applicable unit of measure using § 170.207(m)(1) The Unified Code of Units for Measure, Revision 1.9 | N/A |
| 76511-5 | Do you belong to any clubs or organizations such as church groups unions, fraternal or athletic groups, or school groups [NHANES III] | LL963-0 |
Yes – LA33-6 No – LA32-8 |
| 76512-3 | Social isolation score [NHANES] | With the answer coded with the associated applicable unit of measure using § 170.207(m)(1) The Unified Code of Units for Measure, Revision 1.9 | N/A |
Paragraph (a)(15)(vii)
|
Technical outcome – A user can record, change, and access social connection and isolation using the specified LOINC® codes and whether the patient declines to specify social connection and isolation.
|
Paragraph (a)(15)(viii)
Technical outcome – A user can record, change, and access exposure to violence (intimate partner violence) using the specified LOINC® codes and whether the patient declines to specify exposure to violence (intimate partner violence).
|
LOINC® Code(s) for Question(s) |
LOINC® Question Text |
LOINC® Answer List ID |
LOINC® Answer Text and ID |
|---|---|---|---|
|
76499-3 |
Humiliation, Afraid, Rape, and Kick questionnaire [HARK] | N/A | N/A |
| 76500-8 | Within the last year, have you been humiliated or emotionally abused in other ways by your partner or ex-partner [HARK] | LL963-0 |
Yes – LA33-6 No – LA32-8 |
| 76501-6 | Within the last year, have you been afraid of your partner or ex-partner [HARK] | LL963-0 |
Yes – LA33-6 No – LA32-8 |
| 76502-4 | Within the last year, have you been raped or forced to have any kind of sexual activity by your partner or ex-partner [HARK] | LL963-0 |
Yes – LA33-6 No – LA32-8 |
| 76503-2 | Within the last year, have you been kicked, hit, slapped, or otherwise physically hurt by your partner or ex-partner [HARK] | LL963-0 |
Yes – LA33-6 No – LA32-8 |
| 76504-0 | Total score [HARK] | With the answer coded with the associated applicable unit of measure using § 170.207(m)(1) The Unified Code of Units for Measure, Revision 1.9 |
N/A |
Paragraph (a)(15)(viii)
|
Technical outcome – A user can record, change, and access exposure to violence (intimate partner violence) using the specified LOINC® codes and whether the patient declines to specify exposure to violence (intimate partner violence).
|