Uncovering the ONC-ATCBs: What’s the Difference?

The passage of the HITECH Act under ARRA has brought whirlwind changes and generated many questions in the electronic health record field. The ONC certification program is among the new changes that have impacted the way EHR vendors operate in the current climate. To ensure that their product meets meaningful use criteria, vendors must submit their EHR system for rigorous testing and certification processes by an ONC Authorized Testing and Certification Body (ONC-ATCB). While EHR vendors have quickly realized that their EHRs need to be ONC certified to remain viable in the marketplace, vendors may have trouble understanding which ONC-ATCB to seek these services from. While the six ONC-ATCBs have been approved to administer ONC-approved testing and certification, there are differences between each of them that encourage competition in the marketplace.

Certification Program

The ONC-ATCB 2011/2012 Certification Program was created in response to the requirements of the Health Information Technology for Economic and Clinical Health (HITECH) Act, part of the American Recovery and Reinvestment Act of 2009 (ARRA). The program is designed to certify EHRs that are capable of meeting meaningful use criteria to support Stage 1 incentives for eligible providers and hospitals as outlined by the HITECH Act under ARRA. To become an ONC-ATCB, an organization must apply for and demonstrate its competency and ability to test and certify Complete EHRs and/or EHR Modules. If the organization is successful in attaining ONC-ATCB status, they are given room to operate under competitive market forces as they are free to choose certification processes and pricing structures, among other differentiating factors.

The ONC-ATCBs

As of April 2011, there have been six organizations authorized by the ONC to carry out testing and certification of EHR vendors. They are listed below:

• Surescripts LLC – Based out of Arlington, Virginia, Surescripts was authorized on December 23, 2010. They are registered to certify e-Prescribing, privacy and security.
• ICSA Labs – Based out of Mechanisburg, Pennsylvania, ICSA Labs was authorized on December 10, 2010. They are registered to certify both complete EHR systems and EHR modules.
• SLI Global Solutions – Based out of Denver, Colorado, SLI Gobal Solutions was authorized on December 10, 2010. Like ICSA Labs, they were registered to certify both complete EHR systems and EHR modules.
• InfoGard Laboratories, Inc. – Based out of San Luis Obsipo, California, InfoGard Laboratories was authorized on September 24, 2010. They were registered to certify both complete EHR systems and EHR modules.
• Certification Commission for Health Information Technology (CCHIT) – Based out of Chicago, Illinois, CCHIT was authorized on September 3, 2010. They were registered to certify both complete EHR systems and EHR modules.
• Drummond Group, Inc. (DGI) – Based out of Austin, Texas, Drummond Group was authorized on September 3, 2010. They were registered to certify both complete EHR systems and EHR modules.

As evident, all of the above organizations have been authorized to perform Complete EHR and/or EHR Module testing and certification. Only SureScripts has chosen not to test and certify complete EHR systems, namely due to their expertise in the e-prescribing field. It is important to note that the ONC-ATCBs have no impact on the provisions that define which providers are eligible for incentive payments, how providers can achieve meaningful use goals, or how providers can apply for incentive payments.

Certification Process

While the ONC-ATCBs are given some freedom in choosing how to administer the testing and certification procedures, all are required to adhere to certain guidelines provided by the ONC. In analyzing each of the ONC-ATCB’s certification processes, there ends up being many similarities in how an EHR vendor is taken through the certification route from beginning to end.

There are certain steps that each of the ONC-ATCBs generally follow when conducting a certification procedure. They are as follows:

1. Providing and reviewing application for certification from the EHR vendor
2. Providing pre-testing support; including but not limited to: supplying EHR vendor with test scripts and other guidance materials; maintaining open communication to answer questions and arrange test date; providing pre-loadable patient data for EHR vendor; assessing readiness of EHR vendor prior to testing
3. Testing usually completed over the course of one business day (mostly via remote conferencing)
4. Testing results submitted to an internal, independent certification panel for review

All the ONC-ATCBs are required to follow the testing guidelines provided by the National Institute of Standards and Technology (NIST). However, the ONC-ATCBs are afforded freedom in how to present the NIST test scripts to the EHR vendors. For example, CCHIT, ICSA Labs, and Drummond Group all stated that they have formatted the NIST scripts to be more user-friendly and easier to understand. Other ONC-ATCBs have taken similar steps to support EHR vendors and make certification a much more amiable process.

One differentiating factor between the ONC-ATCBs is the level and type of support that they provide to an EHR vendor. While all of the organizations provide remote testing via web conferencing and telecommunications, a few afford the option to conducting onsite testing. SLI Global, Infogard, ICSA Labs, and Drummond Group all offer onsite testing while CCHIT only conducts remote testing. It is unclear whether SureScripts provides the option for onsite testing.

As for the day of testing itself, the ONC-ATCBs share more similarities than differences. All of the ONC-ATCBs generally conduct testing for a complete EHR system in one business day. EHR modules take less time to test, generally conducted in 2-4 hour increments depending on the system complexity and rigor of testing. Furthermore, while each of the ONC-ATCBs may use their own unique styles for documenting the test results, the general methods are similar. Each of the ONC-ATCB’s test proctors will use some combination of structured freehand documentation, score sheets, screenshot capture, and web conference recordings to accurately detail the EHR testing and certification process.

Pricing

There are some notable differences in pricing between the six ONC-ATCBs. The pricing chart comparison is displayed in Table 1 below. ICSA Labs does not publically release their pricing structures but have stated that they are priced competitively with the other ONC-ATCBs. Surescripts offers their services free of charge while CCHIT possesses the most expensive pricing structure for initial testing.

In the event that an EHR vendor fails a specific criterion, they can elect to re-test for that particular criterion. The ONC-ATCBs differ in their pricing structure when it comes to re-testing. For example, CCHIT charges $1,500 per additional hour of re-testing. Drummond Group charges $6,000 for a complete EHR system re-test and $4,000 for modular re-tests. SLI Global does not charge for the first re-test of any type, but charges $6,000 for additional complete EHR re-tests and $4,000 for additional modular re-tests. Infogard and ICSA Labs have not made their re-testing fees readily available.

What Sets Them Apart?

The six ONC-ATCBs aim to differentiate themselves in ways beyond pricing, often promoting their past experience and deep expertise. CCHIT relies on their six years of experience and expertise in testing and certifying EHRs to attract EHR vendor customers. The Drummond Group has deep experience testing software in many other fields and has simply transitioned into the EHR space. ICSA Labs has over 20 years of experience in providing vendor-neutral testing and certification for hundreds of products, namely in the IT security field. Similarly, InfoGard was the first computer security testing laboratory accredited by National Voluntary Laboratory Program (NVLAP). SLI Global also possesses an extensive background in testing software applications. SureScripts is the leading e-prescribing network in the United States and has leveraged their unique position to test and certify e-prescribing EHR modules.

Three of the organizations in particular offer additional testing and/or certification options. CCHIT offers a comprehensive certification package under their own brand name that focuses on integrated EHR functionality, interoperability, and security according to independently developed criteria. If a vendor chooses to apply for a CCHIT certification, they may also apply for an ONC-ATCB certification at no extra cost. Infogard also provides additional services, termed SecureEHR, aimed to ensure proper security of electronic protected health information (ePHI) according to HIPAA Privacy, Security, and HITECH Breach Notification Rules. Finally, Surescripts maintains their own certification process for e-prescribing software in order to allow prescribers and pharmacies to utilize the SureScripts network in accordance with industry standards.

As EHR vendors continue to apply for ONC certification for Stage 1 and beyond, most will consider a bevy of attributes before selecting a trusted ONC-ATCB partner. Customer service, reputability, experience, expertise, and support are among the chief factors that EHR vendors should consider when choosing an ONC-ATCB.