Manage Learn to apply best practices and optimize your operations.

How to obtain EHR certification for a custom-built system

Meaningful use requires certified EHR software. Many hospitals have built their own system or combined commercial ones. Here's how hospitals can get custom EHR systems certified.

For hospitals seeking meaningful use incentive payments, there is more than one route to eligibility. Unfortunately,...

the most efficient route -- procuring and installing certified commercial electronic health record (EHR) software -- is also an unlikely one for most hospitals.

Many hospitals have legacy electronic health record software, customized commercial applications, self-developed systems or a combination thereof. For these hospitals, obtaining EHR certification requires going down a different road -- the road to self-certification.

"Most hospital systems are complex and rarely deploy one vendor's system exclusively. They may be a mix of commercial and in-house software or an interconnected system of systems," Patricia Becker said during a recent HITECH Answers webinar. Becker is the product manager and commissioner for the EHR Alternative Certification for Healthcare Providers, or EACH, program offered by the Certification Commission for Health Information Technology (CCHIT).

In order to qualify for meaningful use incentive payments, a hospital must possess EHR technology that is certified against 20 of the meaningful use criteria -- all 15 of the core, or required, criteria, plus five of the 10 menu, or optional, criteria. EHR certification is issued by one of six Authorized Testing and Certified Bodies recognized by the Office of the National Coordinator for Health IT; these organizations are colloquially referred to as ONC-ATCBs.

It is a hospital’s responsibility to determine which criteria have been met by certified commercial technologies and to obtain EHR certification for the remaining legacy applications, customized commercial applications or self-developed applications, Becker said.

In addition to the specific meaningful use criteria that a homegrown system is intended to address, it may also need to be tested for the required privacy and security criteria.

"For example, if the discharge patient application uses its own user access control and permission settings apart from the central EHR server, we have to ensure the discharge application meets the required privacy and security criteria, and thus it would be additionally tested," Kyle Meadors, director of EHR testing at Drummond Group Inc., said in an email interview.

"Testing and certification can be a little daunting for hospitals, since it is not their primary focus."

Kyle Meadors, director of EHR testing, Drummond Group Inc.

Further complicating matters is the fact that software certification is new territory for most hospitals. "Frankly, testing and certification can be a little daunting for hospitals, since it is not their primary focus," Meadors said. "However, it can certainly be done, and it can be very rewarding, as hospitals get a clear and precise sense of the functionality contained within their EHR solutions and a confidence it can meet the requirements of meaningful use."

With this in mind, here are five tips for hospitals aiming to obtain certification for their EHR systems:

  • Familiarize yourself with the ONC Final Rule for Standards and Certification Criteria. "The most difficult part in the [EHR] certification process for hospitals is determining what software needs to be certified or what certified criteria is missing" from their homegrown systems, Meadors said. These criteria, which map to the various Centers for Medicare & Medicaid services measures that are required for meaningful use attestation, are identified in sections 170.302.a-v and 170-306.a-i of the final rule.
  • Since certifying EHR software against all required criteria is a significant undertaking, take it piece by piece. Start with the National Institute of Standards and Technology (NIST) test scripts, which correspond directly to the required meaningful use criteria, and go through them one by one, Meadors said. "All ONC-ATCBs must utilize the NIST test scripts for their certification, which means all vendors or hospitals that self-develop must adhere to their requirements. These scripts…are a great source for readiness preparation of [EHR] certification."
  • Resolve deficiencies, such as functional requirements that the system cannot currently satisfy, that are identified while performing the NIST test scripts. Doing so will require further development of the in-house system or the purchase of a certified EHR module that can address the outstanding meaningful use criteria, Meadors noted. (The ONC Certified Health IT Product List, or CHPL, is a searchable compilation of all certified EHR technology.)
  • When preparing to present a home-grown product for EHR certification, think like a vendor. To make it onto the ONC CHPL, the product needs a name and a version number, Meadors pointed out. This also means it needs version control. "Consequently," he added, "if the hospital changes the code -- for example, it modifies its certified [computerized physician order entry] module to enhance ordering capabilities -- it is required to be recertified and possibly retested. The hospital needs at least to be able to track and identify software changes that affect the functionality of the relevant criteria."
  • Finally, seek assistance from an ONC-ATCB such as Drummond Group or CCHIT. Both organizations offer services to help hospitals identify technologies that need to meet meaningful use criteria and certify their custom EHR software.

Crystal Bedell is a technology writer and editor. Her articles, tips and guides help IT professionals evaluate technology, secure and modernize their IT infrastructure, solve business problems, and prepare for IT certification. She can be reached at

Dig Deeper on Organizing health care staff and networks

Start the conversation

Send me notifications when other members comment.

Please create a username to comment.