FAQ: What are the EHR software certification bodies?

Six organizations have received ONC authorization to certify EHR software. This FAQ takes a closer look at these EHR certification bodies and the other services they offer.

Procuring a certified electronic health record system (or certifying your own custom EHR software) is the first step to getting money from the federal government's EHR Incentive Programs. As of March 2011, the Office of the National Coordinator for Health Information Technology has designated six organizations as an Accredited Test and Certification Body. These organizations, known as ONC-ATCBs, are therefore qualified to test and certify EHR systems.

All six ONC-ATCBs use test procedures and criteria for EHR certification that were established by the National Institute of Standards and Technology (NIST). These requirements ensure that an EHR system meets meaningful use requirements as approved by the U.S. Secretary of Health & Human Services.

With the exception of the Certification Commission for Healthcare Information Technology (CCHIT), however, most of the ONC-ATCBs are not well-known in health IT circles. So, you may be asking, "What are these EHR certification bodies?"

This FAQ's purpose is to introduce you to the ONC-ATCBs and their role in testing and certifying EHR systems. Most of them are in the business of helping software vendors extend their market reach through improved interoperability and compliance with industry standards. A few are well-known within the information security market for testing and certifying risk management software. Two are nonprofit organizations. Only one provides EHR certification to vendors free of charge.

IT professionals might be interested in the other services the ONC-ATCBs offer to health care organizations, apart from their role in certifying proprietary electronic health record software. This information is noted where it applies. For example, Drummond Group Inc. offers consulting services to help hospitals determine an EHR certification strategy, and the CCHIT certifies custom EHR software.

When a list is available of the EHR technology products an organization has certified, we've included a link to it.


What is CCHIT?

CCHIT is an independent, nonprofit organization staffed by more than 300 volunteers. Founded in 2004, it has been certifying EHR technology since 2006.

In addition to certifying software as an ONC-ATCB, CCHIT tests and certifies EHR technology for its own, independently developed certification program. CCHIT-certified products are tested for integrated functions, interoperability and security.

As stated, EHR technology must be certified by an ONC-ATCB to qualify for the EHR Incentive Programs. CCHIT will give products both certifications, however, and the organization claims that its CCHIT-certified products give health care providers a more robust use of the technology.

CCHIT also offers a certification for health care providers that develop their own EHR software. Technology certified through the EHR Alternative Certification for Hospitals, or EACH, program qualifies organizations for the EHR Incentive Programs. It is a low-cost certification, but the custom EHR technology must meet the same minimum criteria and standards as commercial products.

Table of Contents

What is Drummond Group?

Drummond Group helps software vendors test and refine their products so they are interoperable with competitors' products. The organization says it applied to become an ONC-ATCB after being approached by a number of health care IT vendors seeking certification.

An independent, privately held interoperability test laboratory, Drummond Group offers additional services to software vendors including quality assurance, conformance testing, Web services testing and consulting. It focuses on software products used in vertical industries, such as health care, automotive, consumer product goods, energy, financial services, government, petroleum, pharmaceutical and retail.

In addition to ONC-ATCB certification for EHR software vendors, Drummond Group offers EHR certification consulting services for hospitals. Drummond Group's EHR Certification Roadmap for Hospitals is designed to help facilities determine which parts of their commercial and custom-built EHR software need to be certified. The roadmap has three milestones: analysis of certification needs, bridging the certification gap, and customized testing. As part of these services, hospitals receive a certification checklist that Drummond Group says will help IT staff identify which software requires ONC-ATCB certification, and explains how to perform a certification gap analysis and carry out an EHR certification strategy.

Table of Contents

What is InfoGard?

  • Scope of authorization: complete EHR systems and EHR modules
  • EHR software certified by InfoGard Laboratories

InfoGard Laboratories Inc. is an independent private laboratory that provides accredited IT security assurance services, and focuses on product and system evaluations and validations. InfoGard says its goal is to help vendors design products that can achieve security certifications in a timely and cost-effective way.

InfoGard has been providing testing and evaluation services for more than 17 years. It is federally accredited by NIST's National Voluntary Laboratory Accreditation Program (NVLAP). (That program evaluates and accredits laboratories in their respective fields using the International Organization for Standardization-International Electrotechnical Commission's ISO-IEC 17025 standard, which sets requirements for the competence of testing and calibration laboratories.)

In addition to doing ONC-ATCB certifications, InfoGard conducts FIPS (Federal Information Processing Standard Publication) 140-2 validations for medical devices used by the U.S. Department of Veterans Affairs. It also provides network security assessments and products for the federal government and for the smart identification card and financial industries.

Table of Contents

What is ISCA Labs?

  • Scope of authorization: complete EHR systems and EHR modules
  • EHR software certified by ICSA Labs

An independent division of Verizon Business, ICSA Labs provides third-party product assurance and conducts vendor-neutral testing and certification, as well as custom testing. Its goal is to increase user and enterprise trust in the products it certifies, it says.

ICSA Labs also manages and facilitates consortia that focus on emerging and established technologies for information exchange and on the development of product testing and certification programs and standards.

In addition to certifying ONC-ATCBs, ICSA Labs tests and certifies computer security technologies including antispam and antispyware software, network intrusion-prevention systems, and Web application firewalls.

Table of Contents

What is SLI Global?

  • Scope of authorization: Complete EHR systems and EHR modules
  • EHR software certified by SLI Global

SLI Global Solutions Inc. was founded in 1996 as SysTest Labs, and renamed in 2010.  Besides certifying ONC-ATCBs, it offers IT planning, quality assurance, and independent verification and validation services. Its focus is on state, local and federal government, as well as on the election and health care sectors.

The company's Corporate Quality System is certified against ISO 9001:2008 standards for quality performance. These certify that SLI applies formalized business processes when it delivers its services. In addition, SLI is a certified laboratory under the NVLAP.

SLI is not new to health IT. Over the past five years, the company has helped state Medicaid agencies with implementing federally certified Medicaid Management Information Systems. SLI also has assessed the technology of large hospital EHR systems and tested them independently.

SLI delivers its ONC-ATCB certification services in partnership with the auditing firm Orion Registrar Inc. SLI tests the EHR software, and Orion certifies them to the applicable standards. According to SLI, "This collaboration provides the requisite independence of testing and certification functions in accordance with ONC expectations."

Table of Contents

What is Surescripts?

  • Scope of authorization: EHR modules for e-prescribing, privacy and security
  • EHR software certified by Surescripts

Surescripts LLC, a privately held company founded in 2001, operates a network that connects health care providers with pharmacies for e-prescribing. In addition to its role as an ONC-ATCB, Surescripts certifies health IT software to operate over its e-prescription network, and offers its own prescription routing and history, and medication history services. Surescripts says its goal is to achieve 100% e-prescribing reliability from the time a provider writes a prescription to the time a pharmacist dispenses it.

Surescripts is the only ONC-ATCB that is not authorized to certify complete EHR systems and every kind of EHR module: The scope of its authorization is limited to e-prescribing and privacy and security modules. This means an EHR system that is certified by Surescripts is likely to be certified by another ONC-ATCB as well. It is also the only ONC-ATCB to offer its certification services free of charge.

It also should be noted that the EHR software that Surescripts certifies as an ONC-ATCB is not necessarily certified for its own e-prescription network. These are two separate certifications.

Table of Contents

About the author:

Crystal Bedell is a technology writer and editor. Her articles, tips and guides help IT professionals evaluate technology, secure and modernize their IT infrastructure, solve business problems, and prepare for IT certification. She can be reached at [email protected].

Dig Deeper on Electronic health record system (EHR) certification