OIG: ONC’s EHR certification process not ensuring PHI security

The ONC has not done enough to ensure electronic health records certified by authorized entities adequately protect patient health information, according to a new report from HHS’ Office of the Inspector General.

Advertisement

CMS has paid out more than $25 billion in incentives to spur providers to purchase and use certified EHR technology. In order to be certified by an ONC-authorized testing and certification body, an EHR system must meet certain privacy and security standards. However, the OIG claims the ONC did not make sure the certifying bodies had procedures to evaluate whether certified EHRs continued to meet these standards and did not make sure personnel working for the certifying bodies were qualified to test EHRs’ data security abilities.

In response, the ONC says certification is now performed by separate entities in the ONC Health IT Certification Program and the new 2014 Edition criteria includes more robust testing procedures for data security. However, the OIG says this is not enough to address the agency’s security concerns.

More articles on EHRs:

Conflicting views on Epic’s interoperability
11 recent EHR go-lives
Stanford launches first ACGME-accredited clinical informatics fellowship

Becker’s 3rd Annual Fall Chief Pharmacy Officer Summit is the top tier event that the people leading the future of pharmacy convene. This 3-day event is built specifically for Chief Pharmacy Officers and senior pharmacy leaders. The sessions examine the workforce, financial and clinical priorities shaping pharmacy today. Becker’s is where candid discussions flourish and new ideas thrive. Becker's 3rd Annual Fall Chief Pharmacy Officer Summit

Advertisement

Next Up in Health IT

Advertisement

Comments are closed.