The Office of the National Coordinator for Health Information Technology's Oversight of the Testing and Certification of Electronic Health Records

ONC's oversight of the authorized testing and certification bodies (ATCBs) did not fully ensure that test procedures and standards could adequately secure and protect electronic patient information contained in electronic health records (EHRs). Specifically, ONC did not ensure that the ATCBs (1) developed procedures to periodically evaluate whether certified EHRs continued to meet Federal standards and (2) developed a training program to ensure that their personnel were competent to test and certify EHRs and to secure proprietary or sensitive EHR information.

The ATCBs' standards and procedures for testing and certifying EHRs met all National Institute of Standards and Technology (NIST) test procedure requirements that ONC approved. However, those NIST test procedures were not sufficient to ensure that EHRs would adequately secure and protect patient health information; in particular, the procedures allowed ATCBs to certify EHRs that demonstrated the use of a single-character password during testing. In addition, the NIST test procedures did not address common security issues, such as, but not limited to, password complexity and/or logging emergency access or user privilege changes.

To ensure that each patient's health information in EHRs is secure and protected, we recommended that ONC require the ATCBs to (1) develop procedures to periodically evaluate whether certified EHRs continue to meet Federal standards and (2) develop a training program to ensure that their personnel are competent to test and certify EHRs and to secure proprietary or sensitive EHR information. We also recommended that ONC work with NIST to strengthen EHR test procedure requirements so that ATCBs can ensure during testing that EHR vendors incorporate a baseline set of security and privacy features into the development of EHRs to address common security issues. ONC stated that ATCBs are no longer active in the ONC Certification Program and that testing and certification functions are now performed by separate entities in the ONC Health Information Technology Certification Program. ONC also stated that it currently is using new certification criteria.