Monday, February 27, 2012

Summary of Meaningful Use Stage 2 Certification

Updated 6/12 to provide links to text in the Federal Register.

Before I get into details, here's a quick overview of what's new and interesting:
  • Direct and Exchange
  • The HL7 CDA Consolidation guide replaces CCD 1.0 for most uses of summary information as expected.
  • InfoButtons are required to support access to reference information by providers
  • HL7 2.3.1 is no longer an option for reporting to public health, and the expected guides have been included.
  • The CDC Cancer Registry reporting guide (using CDA) has been incorporated into the requirements for ambulatory reporting to cancer registries.
  • RxNORM, LOINC, SNOMED and ICD-10 are the vocabularies to use for medications, labs, and problems
If you want a bookmarked copy of the rule, thank Corey Spears of McKesson for providing one.  Thanks Corey!

If you want the crosswalks, see Certification to Standards, and Objectives to Certification just posted. 
Stage 2 Standards §170.200-299
Transport (§170.202)
  1. The DIRECT Protocol
    No big surprise here
  2. External Data Representation and Cross-Enterprise Document Media Interchange for Direct Messaging
    IHE XDM!
  3. Simple Object Access Protocol (SOAP)-Based Secure Transport Requirements Traceability Matrix (RTM) version 1.0
    the title is VERY misleading, what I think it really means is the Exchange specifications, but I cannot find any link.
 Functional Standards (§170.204)
  1. Web Content Accessibility Guidelines
    Basically used for patient engagement view access of records
  2. Health Level Seven Context-Aware Knowledge Retrieval (Infobutton)
    A surprise in some ways, but a welcome one.
  3. National Quality Forum (NQF) Quality Data Model (QDM)
    Used in section 314(c) for quality measures, probably "overused" a bit, and will likely be misunderstood.
Content (§170.205)
  1. Summaries §170.205(a)(3): HL7 Implementation Guide for Clinical Document Architecture, Release 2.0 Consolidated CDA
  2. Syndromic Surveillance §170.205(d)(3)PHIN Messaging Guide for Syndromic Surveillance: Emergency Department and Urgent Care Data HL7 Version 2.5.1
    No surprises here, this was what replaced the broken guide originally issued in Stage 1 and was then withdrawn.  See my comments on it here  
  3. Immunization Reporting §170.205(e)(3):  HL7 2.5.1 Implementation Guide for Immunization Messaging Release 1.3
  4. Lab Reporting to Public Health §170.205(g):  HL7 Version 2.5.1 Implementation Guide: Electronic Laboratory Reporting to Public Health, Release 1
  5. Cancer Information §170.205(i):  Implementation Guide for Healthcare Provider Reporting to Central Cancer Registries
    A surprise entry from Cancer Registries, using not HL7 2.5.1, but CDA.  A welcome change, but it isn't clear whether folks are ready for it yet.
  6. Imaging §170.205(j)Digital Imaging and Communications in Medicine (DICOM) PS 3—2011.
    Is there something else you would use for imaging?
  7. Electronic incorporation and transmission of lab results §170.205(k):  HL7 Version 2.5.1 Implementation Guide: Standards and Interoperability Framework Lab Results Interface, Release 1
    Another win for S&I Framework.
Vocabulary (§170.207)
  1. Problems §170.207(a)(3): SNOMED CT 2012 Edition
    They basically updated the version of SNOMED
  2. Procedures §170.207(b)(3): HIPAA Code Sets at 42 CFR 162.1002(c)(3)
    And added a new line for ICD-10-PCS
  3. Race and Ethnicity §170.207(f):  The OMB Directive on Race and Ethnicity
    I don't see any real change here, I'm not sure why it's there.
  4. Laboratory Tests  §170.207(g):  LOINC
    Added version 2.38, otherwise, no real change from 207(c)
  5. Medications §170.207(h):  RxNORM
    As you might recall, Stage 1 said "any standard that was an RxNORM data source". Stage 2 says to USE RxNORM
  6. Immunizations §170.207(i):  HL7 Standard Code Set CVX - Vaccines Administered, August 15, 2011
    This also seems to just be a version update.
  7. Preferred language §170.207(j):  ISO 639-1:2002
    Another DUH, but necessary I would guess.
  8. Preliminary determination of cause of death §170.207(k):  The code set specified at 45 CFR 162.1002(c)(2)
    ICD-10-CM for cause of death
  9. Smoking status §170.207(l):  Smoking status types must include: current every day smoker; current some day smoker; former smoker; never smoker; smoker, current status unknown; and unknown if ever smoked.
  10. Encounter diagnoses §170.207(m):  The code set specified at 45 CFR 162.1002(c)(2) for the indicated conditions.
    Again, ICD-10-CM
Security (§170.210)
  1. §170.210(e) (Audit) Record actions updated to reflect additional auditing for enabling/disabling audit or encryption of external devices, and incorporation of time synchronization standards
    IHE ATNA is a great resources for auditing.
  2. §170.210(f) (Encryption and Hashing) FIPS 140-2 Annex A
    Consolidates Encryption/Decryption/Hashing to use appropriate algorithms in Annex A, and doesn't call out SHA version specifically.
  3. §170.210(g) (Time) Synchronize your clocks using NTP (RFC 1305) or NTPv4 (RFC 5905)
    Anyone heard of the IHE CT Profile?  And BTW, they should have named SNTP, not NTP, because NTP isn't always needed.
Stage 2 Certification Criteria (§170.314)
The numbers in the list below are lined up with 42 CFR Part 170 Section 314:
  1. §170.314(a) Clinical Requirements
    1. §170.314(a)(1) †  Record, Change and Access Medication, Laboratory and Imaging orders
      no major change from Stage 1
    2. §170.314(a)(2) † Enable med/med and med/allergy interaction checks before an order is placed, and adjust severity of messages by appropriate users.
      Again, no major changes here.
    3. §170.314(a)(3) Enable capture of demograpics, including preferred language (ISO 639-1), gender, race & ethnicity (OMB Race and Ethnicity), and date of birth, and preliminary cause of death in inpatient settings.
      Language is in ISO 639-1, preliminary cause of death is in ICD-10-CM, and Race and Ethnicity must follow OMB Guidelines.  Nothing major here.
    4. §170.314(a)(4) Capture vital signs: Height, Weight, BP, calculate BMI, and optionally plot growth charts
      Plot and display growth charts seems to have become optional now.
    5. §170.314(a)(5) Capture problem list using SNOMED CT 2012 edition
      The shift to SNOMED CT is not a big surprise, but only if you've been paying attention.
    6. §170.314(a)(6) † Record, change, and access medication list.
      I don't see any vocabulary mentioned here, but there wasn't any in Stage 1 either
    7. §170.314(a)(7) † Record, change, and access allergy list.
      I don't see any vocabulary mentioned here, but there wasn't any in Stage 1 either
    8. §170.314(a)(8) † Provide Clinical Decision Support based on (some combination of) problems, medications, allergies, demographics, lab results, and vital signs.
      Lots of clarification in this section, needs a deeper read
      1. Enable a user to access reference information on  problems, medications, allergies, demographics, lab results, and vital signs using InfoButton (not clear whether one category or all are required to be supported).
    9. §170.314(a)(9) Record, change, access and search electronic notes.
      No big changes from Stage 1
    10. §170.314(a)(10) Drug formulary checks.
      No big changes from Stage 1
    11. §170.314(a)(11) Record, change and access smoking status.
      No big changes from Stage 1
    12. §170.314(a)(12) Enable electronic access to imaging results and status
      New criteria!  See IHE Cardiology's Image Enable Office profile.
    13. §170.314(a)(13) Record, change and access family history.
      New criteria!
    14. §170.314(a)(14) Select, sort, access and create patient lists based on problems, medications, demographics and lab results.
      No big changes from Stage 1
    15. §170.314(a)(15) (Ambulatory only) Create patient reminder lists based on problems, medications, allergies, demographics and lab results.
      No big changes from Stage 1
    16. §170.314(a)(16) Provide patient specific resources on each of problems, medications, and laboratory results using InfoButton.
      New criteria!
    17. §170.314(a)(17) † (Inpatient only) Allow user to verify right patient, medication, dose and route and record time synchronized with NTP
      New criteria
    18. §170.314(a)(18) (Inpatient only) Record whether patient has an advanced directive
      No big changes from Stage 1
  2. §170.314(b) Care Coordination
    1. §170.314(b)(1) Incorporate data received from a Consolidated CDA Document into the EHR upon receipt, including: demographics; smoking status; vital signs; medications; medication allergies; problems; procedures; laboratory tests and values/results; provider information, hospital admission and discharge dates and locations; discharge instructions; reason(s) for hospitalization; care plan, including goals and instructions;
      Replaces CCD with Consolidated CDA, and adds requirements for provider information, hospitalization data, and care plans.
    2. §170.314(b)(2) Generate a summary of care record using a Consolidated CDA document, including patient demographics, provider information, care plan, and all the stuff above (hospitalization details are inpatient only) and Transmit it using Direct (required) or via Exchange (optional)
    3. §170.314(b)(3) † ePrescribe
      Using NCPDP and RxNORM
    4. §170.314(b)(4) † Reconcile meds, problems and allergies
      Reconciliation is not just for medications any more!  See the IHE Reconciliation of Diagnoses, Allergies and Medications profile.
    5. §170.314(b)(5) Incorporate lab results using LRI and LOINC (ambulatory setting only), or as structured data (inpatient setting only), display in human readable format, and show CLIA required data
    6. §170.314(b)(6) (Inpatient only) Transmit lab tests/results to ambulatory providers using LRI and LOINC.
      This one is a bit bogus.  They keep conflating a hospital-based lab and their information systems with a hospital.  They aren't the same system.
  3. §170.314(c) Quality Measures
    1. §170.314(c)(1) Electronically record and export all data elements present in the NQF QDM Standard.
      OK, I really need to spend some time with QDM.  I think the data element list is probably too big
    2. §170.314(c)(2) Incorporate and calculate measures in the EHR technology, and
      See my posts on Query Health for some help on calculating measures. 
    3. §170.314(c)(3) Export a data file using a CMS specified data file format
      CMS has to specify it, but they haven't yet, or there'd be a reference to it.  This is underspecified for a requirement.
  4. §170.314(d) Privacy and Security
    I'll leave it to John Moehrke to provide comments on this section.
    1. Authenticate users and establish appropriate access controls for them
    2. Enable audit events by default, protect the audit log from alteration, and detect alterations
    3. Generate an audit report
    4. Support amendment of the health record, preserving original content, via user or using patient supplied information
    5. Terminate login session after a predetermined time-out.
    6. Permit emergency access
    7. Encrypt data at rest on "end-user" devices.
    8. Create a message digest
    9. Optionally record an accounting of disclosures
  5. §170.314(e) Patient Engagement
    1. §170.314(e)(1) Enable a patient to view (via the web in an accessible fashion), download (in a human readable format, or using Consolidated CDA), or images using DICOM, and transmit using Direct and Exchange standards.
      The AND is emphasized for a reason.  Apparently you have to support BOTH.  Fortunately, you can do so using IHE XDS messages and a HISP that accepts XDR.
    2. §170.314(e)(2) (Ambulatory setting only) Enable a user to provide patient summaries using Consolidated CDA to the patient
      OK, if I go to the hospital, I want my summaries from there also.
    3. §170.314(e)(3) (Ambulatory setting only) Enable a user to send and receive messages from a patient using a secure channel
      And it sure would help if my hospital based provider could receive information from my patient advocate.  Also, this needs to include "authorized representative"
  6. §170.314(f) Public Health
    1. §170.314(f)(1) Enable a user to record, change and access immunization information
    2. §170.314(f)(2) And transmit it to Public Health using the HL7 2.5.1 Immuniziation Guide from the CDC.
    3. §170.314(f)(3) Enable a user to record, change and access syndromic surveillance information, 
    4. §170.314(f)(4) And transmit it to public health using HL7 2.5.1, and if in an inpatient setting, using Syndromic Surveillance guide (also allowed in ambulatory settings, but not required).
    5. §170.314(f)(5) (Inpatient setting only) Enable a user to record, change and access laboratory information, 
    6. §170.314(f)(6) (Inpatient setting only) And transmit it to public health using the HL7 2.5.1 ELR Guide
    7. §170.314(f)(7) (Ambulatory setting only)  Enable a user to record, change and access cancer information, 
    8. §170.314(f)(8) (Ambulatory setting only)  And transmit it to public health using the CDC Cancer Registry Reporting Guide (CDA)
  7. §170.314(g) Utilization
    1. §170.314(g)(1) Automate numerator recording for each percentage-based MU objective
    2. §170.314(g)(2) Automate measure calculation for each  percentage-based MU objective
    3. §170.314(g)(3) Record date and time of use for each non-percentage-based MU objective where the capability was enabled, disabled or executed and provide a report of it.
    4. §170.314(g)(4) Ensure that user-centered design processes are applied to capabilities described in §170.314(a)(1); §170.314(a)(2); §170.314(a)(6); §170.314(a)(7); §170.314(a)(8); §170.314(a)(17); §170.314(b)(3); and §170.314(b)(4).
† Requires use of User Centered Design principals (see g.4 above)


  1. Stage 2 Standards §170.200-299
    Transport (§170.202)

    Simple Object Access Protocol (SOAP)-Based Secure Transport Requirements Traceability Matrix (RTM) version 1.0

    This refers to the NwHIN Exchange Modular Specification. This specification is out-of-date regarding what the Exchange has adopted.

  2. This is excellent, Keith. Thanks.

  3. Hi Keith,
    I updated the bookmarked files so that the work with Internet Explorer.
    If people download both now into the same folder (file name unchanged), they will be able to click MU Objective reference links from the ONC cert document and will be sent right to the MU Objective in the CMS MU 2 NPRM. Might be handy for cross-referencing a bit faster.

    Bookmarked CMS MU Stage 2 available here:

    Bookmarked ONC MU Stage 2 Certification & standards available here:

    1. Hi there,

      I would like to use your bookmarks, but I'm having trouble with. I accessed both docs via the URLs you provided and saved them into a folder on my desktop, but they don't seem to cross reference each other. In other words, nothing happens when I click on the blue bookmarks in the MU Stage 2 Cert doc. Could you please give me some suggestions?



  4. Keith, the proposed requirement to export all data elements in the QDM could be a biggie, as it implicitly creates "data capture" requirements, in addition to "exchange" requirements (the export is an exchange), in addition to the expected "calculate" and "report." They ask whether QRDA or Consolidated CDA could be used as a standardized export format, since they didn't propose a standard for the export. I'd be interested in your thoughts about that, especially since Query Health I think discussed the concept of CCD as an exchange format to measure calculators.

    1. David, I agree, and will be looking at the alternatives they propose in the rule. I think this needs to be a smaller set, and I understand Jacob Reider has a spreadsheet that might help us evaluate it.

  5. Keith, what are your thoughts regarding the incorporation of the Consolidated CDA into the EHR? The IFR focus and metrics all seem to be on generation and transmission. While that implies someone is receiving, it's not clear (to me at least) whether the receiver can just persist the CDA or if they have to parse and "incorporate it" as you phrased it. Thorough incorporation would seem to imply reconciliation, which is language I only see around medications. Thanks.

    1. I love the incorporation of the CDA Consolidation Guide. I spent more than half a decade working on the content that went into it.

      The wording I used comes from the regulatory text at page 169 in the proposed rule. Reconciliation (on page 170) includes problems, medications and allergies.

    2. Yup, right where you said it was. I was only looking at the CMS proposed rule, not ONC. Thanks.

  6. I'm looking for steps to get Encrypted ccd document via DIRECT XDR using .NET (C#). So that i can receive the ccd document at my end and decrypt and save to my local folder.

    do we've number of steps to achieve this or source code in C# (.NET)? If it is available in JAVA for DIRCT XDR, then i can try to translate it.

    I see the code for XDS but not sure what is the difference between xDR and xds. I could be reached at


  7. Race and Ethnicity §170.207(f): The OMB Directive on Race and Ethnicity
    I don't see any real change here, I'm not sure why it's there.

    The change here is that they removed Multiple Races as an acceptable Race and are forcing the Medical Facility to collect all races that match their demographic.

  8. On the subject of sending Cancer, Immunization, and Patient Summary Reports, should they be sent to registries specific to the state where an EHR vendor customer is located? Or, could the EHR vendor design software that just sends this information to the registries in their state.

    If my first question is true, that means EHR vendors would need to work with registries in all states.

  9. Thank for this comprehensive list!!

    I have one confusion, on whether the vital signs & procedure for 2014 stage 2 certification follow SNOMED CT codes? Could you please help me on this?


  10. Is 130.314 g(4) safety enhanced design is must for MU2 certification. In 2011, we have certified the measures specified in 130.314 g(4) (ie, CPOE, Medication reconcille, Drug interaction, EPrescripion etc..) as part of MU1. So do we need to certify these measures again for MU2. I think 130.314 g(4) need to follow if we are going to certify for those 8 measure in MU2. If it is required, what is the procedures and formalities to be follow?

  11. Great post . It takes me almost half an hour to read the whole post. Definitely this one of the informative and useful post to me. Thanks for the share.I also provide this service plz visit my site. Accounting Software In essence, a Certified Public Accountant can be best described as a licensed professional that provides accounting, tax, auditing.