§170.315(a)(9) Clinical decision support (CDS)

Certification Companion Guide (CCG)
Conformance Method

Updated on 03-11-2024

Regulation Text

§ 170.315 (a)(9) Clinical decision support (CDS)—

CDS intervention interaction. Interventions provided to a user must occur when a user is interacting with technology.
CDS configuration.
1. Enable interventions and reference resources specified in paragraphs (a)(9)(iii) and (iv) of this section to be configured by a limited set of identified users (e.g., system administrator) based on a user's role.
2. Enable interventions:
  1. Based on the following data:
    1. Problem list;
    2. Medication list;
    3. Medication allergy list;
    4. At least one demographic specified in paragraph (a)(5)(i) of this section;
    5. Laboratory tests; and
    6. Vital signs.
  2. When a patient's medications, medication allergies, and problems are incorporated from a transition of care/referral summary received and pursuant to paragraph (b)(2)(iii)(D) of this section.
Evidence-based decision support interventions. Enable a limited set of identified users to select (i.e., activate) electronic CDS interventions (in addition to drug-drug and drug-allergy contraindication checking) based on each one and at least one combination of the data referenced in paragraphs (a)(9)(ii)(B)(1)(i) through (vi) of this section.
Linked referential CDS.
1. Identify for a user diagnostic and therapeutic reference information in accordance at least one of the following standards and implementation specifications:
  1. The standard and implementation specifications specified in § 170.204(b)(3).
  2. The standard and implementation specifications specified in § 170.204(b)(4).
2. For paragraph (a)(9)(iv)(A) of this section, technology must be able to identify for a user diagnostic or therapeutic reference information based on each one and at least one combination of the data referenced in paragraphs (a)(9)(ii)(B)(1)(i), (ii), and (iv) of this section.
Source attributes. Enable a user to review the attributes as indicated for all CDS resources:
1. For evidence-based decision support interventions under paragraph (a)(9)(iii) of this section:
  1. Bibliographic citation of the intervention (clinical research/guideline);
  2. Developer of the intervention (translation from clinical research/guideline);
  3. Funding source of the intervention development technical implementation; and
  4. Release and, if applicable, revision date(s) of the intervention or reference source.
2. For linked referential CDS in paragraph (a)(9)(iv) of this section and drug-drug, drug-allergy interaction checks in paragraph (a)(4) of this section, the developer of the intervention, and where clinically indicated, the bibliographic citation of the intervention (clinical research/guideline).
Expiration of Criterion. The adoption of this criterion for purposes of the ONC Health IT Certification Program expires on January 1, 2025.

Standard(s) Referenced

Cross Reference Criteria

§ 170.315(a)(5) (i) Enable a user to record, change, and access patient demographic data including race, ethnicity, preferred language, sex, sexual orientation, gender identity, and date of birth

§ 170.315(b)(2) (iii)(D) Upon a user's confirmation, automatically update the list, and incorporate the following data expressed according to the specified standard(s):

Medications. At a minimum, the version of the standard specified in § 170.207(d)(3);
Medication allergies. At a minimum, the version of the standard specified in §170.207(d)(3); and
Problems. At a minimum, the version of the standard specified in § 170.207(a)(4).

Paragraph (a)(9)(iv)

§ 170.204(b)(3) Health Level 7 (HL7^®) Version 3 Standard: Context Aware Knowledge Retrieval Application. (“Infobutton”), Knowledge Request, Release 2
HL7^® Implementation Guide: Service-Oriented Architecture Implementations of the Context-aware Knowledge Retrieval (Infobutton) Domain, Release 1

§ 170.204(b)(4) HL7^® Version 3 Standard: Context Aware Knowledge Retrieval Application. (“Infobutton”), Knowledge Request, Release 2
HL7^® Version 3 Implementation Guide: Context-Aware Knowledge Retrieval (Infobutton), Release 4

Additional Resources

§ 170.205(a)(3) HL7^® Implementation Guide for CDA^® Release 2: IHE Health Story Consolidation, DSTU Release 1.1 (US Realm) Draft Standard for Trial Use July 2012

§ 170.205(a)(4) HL7^® Implementation Guide for CDA^® Release 2: Consolidated CDA Templates for Clinical Notes (US Realm), Draft Standard for Trial Use Release 2.1, August 2015

Required Update Deadlines

The following outlines deadlines for required updates for this criterion as they relate to changes published in recent ONC final rules. Developers must update their products to the requirements outlined and provide them to their customers by the stated deadlines. These represent one-time deadlines as set by recent regulatory updates and do not encompass ongoing deadlines related to the Conditions and Maintenance of Certification. Please review those requirements for additional compliance activities related to one’s certification under Certification Dependencies.

Deadline: December 31, 2024

Action to be taken: No action is required for developers relating to the expiration of this standard. However, developers certified to this criterion wishing to maintain certification to the base EHR definition, need to update to § 170.315 (b)(11) by December 31, 2024.

Certification Dependencies

Design and Performance: The following design and performance certification criteria (adopted in § 170.315(g)) must also be certified in order for the product to be certified.

Safety-enhanced design (§ 170.315(g)(3)) must be explicitly demonstrated for this criterion.
Quality management system (§ 170.315(g)(4)): When a single quality management system (QMS) is used, the QMS only needs to be identified once. Otherwise, the QMS’ need to be identified for every capability to which it was applied.
Accessibility-centered design (§ 170.315(g)(5)): When a single accessibility-centered design standard is used, the standard only needs to be identified once. Otherwise, the accessibility-centered design standards need to be identified for every capability to which they were applied; or, alternatively, the developer must state that no accessibility-centered design was used.

Privacy & Security Requirements

This certification criterion was adopted at § 170.315(a)(9). As a result, an ONC Authorized Certification Body (ONC-ACB) must ensure that a product presented for certification to a § 170.315(a) criterion includes the privacy and security criteria (adopted in § 170.315(d)) within the overall scope of the certificate issued to the product.

The privacy and security criteria (adopted in § 170.315(d)) do not need to be explicitly tested with this specific paragraph (a) criterion unless it is the only criterion for which certification is requested.
As a general rule, a product presented for certification only needs to be presented once to each applicable privacy and security criterion (adopted in § 170.315(d)) so long as the health IT developer attests that such privacy and security capabilities apply to the full scope of capabilities included in the requested certification. However, exceptions exist for § 170.315(e)(1) “View, download, and transmit to 3rd party (VDT)” and (e)(2) “Secure messaging,” which are explicitly stated.
Health IT presented for certification to this criterion would not have to demonstrate the capabilities required by the Amendments certification criterion (§ 170.315(d)(4)), unless the health IT is presented for certification to another criterion that requires certification to the Amendments criterion under the privacy and security certification framework.
§ 170.315(d)(2)(i)(C) is not required if the scope of the Health IT Module does not have end-user device encryption features.

For more information on the approaches to meet these Privacy and Security requirements, please review the Privacy and Security CCG.

If choosing Approach 1:
If choosing Approach 2:
- For each applicable privacy and security certification criterion not certified for Approach 1, the health IT developer may certify using system documentation which is sufficiently detailed to enable integration such that the Health IT Module has implemented service interfaces the Health IT Module to access external services necessary to meet the requirements of the privacy and security certification criterion. Please see the 21st Century Cures Act: Interoperability, Information Blocking, and the ONC Health IT Certification Program Final Rule at 85 FR 25710 for additional clarification.

Revision History

Version #	Description of Change	Version Date
1.0	Initial publication	03-11-2024

Regulation Text

Regulation Text

§ 170.315 (a)(9) Clinical decision support (CDS)—

CDS intervention interaction. Interventions provided to a user must occur when a user is interacting with technology.
CDS configuration.
1. Enable interventions and reference resources specified in paragraphs (a)(9)(iii) and (iv) of this section to be configured by a limited set of identified users (e.g., system administrator) based on a user's role.
2. Enable interventions:
  1. Based on the following data:
    1. Problem list;
    2. Medication list;
    3. Medication allergy list;
    4. At least one demographic specified in paragraph (a)(5)(i) of this section;
    5. Laboratory tests; and
    6. Vital signs.
  2. When a patient's medications, medication allergies, and problems are incorporated from a transition of care/referral summary received and pursuant to paragraph (b)(2)(iii)(D) of this section.
Evidence-based decision support interventions. Enable a limited set of identified users to select (i.e., activate) electronic CDS interventions (in addition to drug-drug and drug-allergy contraindication checking) based on each one and at least one combination of the data referenced in paragraphs (a)(9)(ii)(B)(1)(i) through (vi) of this section.
Linked referential CDS.
1. Identify for a user diagnostic and therapeutic reference information in accordance at least one of the following standards and implementation specifications:
  1. The standard and implementation specifications specified in § 170.204(b)(3).
  2. The standard and implementation specifications specified in § 170.204(b)(4).
2. For paragraph (a)(9)(iv)(A) of this section, technology must be able to identify for a user diagnostic or therapeutic reference information based on each one and at least one combination of the data referenced in paragraphs (a)(9)(ii)(B)(1)(i), (ii), and (iv) of this section.
Source attributes. Enable a user to review the attributes as indicated for all CDS resources:
1. For evidence-based decision support interventions under paragraph (a)(9)(iii) of this section:
  1. Bibliographic citation of the intervention (clinical research/guideline);
  2. Developer of the intervention (translation from clinical research/guideline);
  3. Funding source of the intervention development technical implementation; and
  4. Release and, if applicable, revision date(s) of the intervention or reference source.
2. For linked referential CDS in paragraph (a)(9)(iv) of this section and drug-drug, drug-allergy interaction checks in paragraph (a)(4) of this section, the developer of the intervention, and where clinically indicated, the bibliographic citation of the intervention (clinical research/guideline).
Expiration of Criterion. The adoption of this criterion for purposes of the ONC Health IT Certification Program expires on January 1, 2025.

Standard(s) Referenced

Cross Reference Criteria

§ 170.315(a)(5) (i) Enable a user to record, change, and access patient demographic data including race, ethnicity, preferred language, sex, sexual orientation, gender identity, and date of birth

§ 170.315(b)(2) (iii)(D) Upon a user's confirmation, automatically update the list, and incorporate the following data expressed according to the specified standard(s):

Medications. At a minimum, the version of the standard specified in § 170.207(d)(3);
Medication allergies. At a minimum, the version of the standard specified in §170.207(d)(3); and
Problems. At a minimum, the version of the standard specified in § 170.207(a)(4).

Paragraph (a)(9)(iv)

Additional Resources

§ 170.205(a)(3) HL7^® Implementation Guide for CDA^® Release 2: IHE Health Story Consolidation, DSTU Release 1.1 (US Realm) Draft Standard for Trial Use July 2012

§ 170.205(a)(4) HL7^® Implementation Guide for CDA^® Release 2: Consolidated CDA Templates for Clinical Notes (US Realm), Draft Standard for Trial Use Release 2.1, August 2015

Required Update Deadlines

Deadline: December 31, 2024

Certification Dependencies

Design and Performance: The following design and performance certification criteria (adopted in § 170.315(g)) must also be certified in order for the product to be certified.

Safety-enhanced design (§ 170.315(g)(3)) must be explicitly demonstrated for this criterion.
Quality management system (§ 170.315(g)(4)): When a single quality management system (QMS) is used, the QMS only needs to be identified once. Otherwise, the QMS’ need to be identified for every capability to which it was applied.
Accessibility-centered design (§ 170.315(g)(5)): When a single accessibility-centered design standard is used, the standard only needs to be identified once. Otherwise, the accessibility-centered design standards need to be identified for every capability to which they were applied; or, alternatively, the developer must state that no accessibility-centered design was used.

Privacy & Security Requirements

The privacy and security criteria (adopted in § 170.315(d)) do not need to be explicitly tested with this specific paragraph (a) criterion unless it is the only criterion for which certification is requested.
As a general rule, a product presented for certification only needs to be presented once to each applicable privacy and security criterion (adopted in § 170.315(d)) so long as the health IT developer attests that such privacy and security capabilities apply to the full scope of capabilities included in the requested certification. However, exceptions exist for § 170.315(e)(1) “View, download, and transmit to 3rd party (VDT)” and (e)(2) “Secure messaging,” which are explicitly stated.
Health IT presented for certification to this criterion would not have to demonstrate the capabilities required by the Amendments certification criterion (§ 170.315(d)(4)), unless the health IT is presented for certification to another criterion that requires certification to the Amendments criterion under the privacy and security certification framework.
§ 170.315(d)(2)(i)(C) is not required if the scope of the Health IT Module does not have end-user device encryption features.

For more information on the approaches to meet these Privacy and Security requirements, please review the Privacy and Security CCG.

If choosing Approach 1:
If choosing Approach 2:
- For each applicable privacy and security certification criterion not certified for Approach 1, the health IT developer may certify using system documentation which is sufficiently detailed to enable integration such that the Health IT Module has implemented service interfaces the Health IT Module to access external services necessary to meet the requirements of the privacy and security certification criterion. Please see the 21st Century Cures Act: Interoperability, Information Blocking, and the ONC Health IT Certification Program Final Rule at 85 FR 25710 for additional clarification.

Revision History

Version #	Description of Change	Version Date
1.0	Initial publication	03-11-2024

Testing components

Attestation: As of September 21, 2017, the testing approach for this criterion is satisfied by attestation.

The archived version of the Test Procedure is attached below for reference.

System Under Test	ONC-ACB Verification
The health IT developer will attest directly to the ONC-ACB to conformance with the § 170.315(a)(9) Clinical decision support requirements.	The ONC-ACB verifies the health IT developer attests conformance to the § 170.315(a)(9) Clinical decision support requirements.

Archived Version:

§170.315(a)(9) Test Procedure

Updated on 03-11-2024

Regulation Text

§ 170.315 (a)(9) Clinical decision support (CDS)—

CDS intervention interaction. Interventions provided to a user must occur when a user is interacting with technology.
CDS configuration.
1. Enable interventions and reference resources specified in paragraphs (a)(9)(iii) and (iv) of this section to be configured by a limited set of identified users (e.g., system administrator) based on a user's role.
2. Enable interventions:
  1. Based on the following data:
    1. Problem list;
    2. Medication list;
    3. Medication allergy list;
    4. At least one demographic specified in paragraph (a)(5)(i) of this section;
    5. Laboratory tests; and
    6. Vital signs.
  2. When a patient's medications, medication allergies, and problems are incorporated from a transition of care/referral summary received and pursuant to paragraph (b)(2)(iii)(D) of this section.
Evidence-based decision support interventions. Enable a limited set of identified users to select (i.e., activate) electronic CDS interventions (in addition to drug-drug and drug-allergy contraindication checking) based on each one and at least one combination of the data referenced in paragraphs (a)(9)(ii)(B)(1)(i) through (vi) of this section.
Linked referential CDS.
1. Identify for a user diagnostic and therapeutic reference information in accordance at least one of the following standards and implementation specifications:
  1. The standard and implementation specifications specified in § 170.204(b)(3).
  2. The standard and implementation specifications specified in § 170.204(b)(4).
2. For paragraph (a)(9)(iv)(A) of this section, technology must be able to identify for a user diagnostic or therapeutic reference information based on each one and at least one combination of the data referenced in paragraphs (a)(9)(ii)(B)(1)(i), (ii), and (iv) of this section.
Source attributes. Enable a user to review the attributes as indicated for all CDS resources:
1. For evidence-based decision support interventions under paragraph (a)(9)(iii) of this section:
  1. Bibliographic citation of the intervention (clinical research/guideline);
  2. Developer of the intervention (translation from clinical research/guideline);
  3. Funding source of the intervention development technical implementation; and
  4. Release and, if applicable, revision date(s) of the intervention or reference source.
2. For linked referential CDS in paragraph (a)(9)(iv) of this section and drug-drug, drug-allergy interaction checks in paragraph (a)(4) of this section, the developer of the intervention, and where clinically indicated, the bibliographic citation of the intervention (clinical research/guideline).
Expiration of Criterion. The adoption of this criterion for purposes of the ONC Health IT Certification Program expires on January 1, 2025.

Standard(s) Referenced

Cross Reference Criteria

§ 170.315(a)(5) (i) Enable a user to record, change, and access patient demographic data including race, ethnicity, preferred language, sex, sexual orientation, gender identity, and date of birth

§ 170.315(b)(2) (iii)(D) Upon a user's confirmation, automatically update the list, and incorporate the following data expressed according to the specified standard(s):

Medications. At a minimum, the version of the standard specified in § 170.207(d)(3);
Medication allergies. At a minimum, the version of the standard specified in §170.207(d)(3); and
Problems. At a minimum, the version of the standard specified in § 170.207(a)(4).

Paragraph (a)(9)(iv)

Additional Resources

§ 170.205(a)(3) HL7^® Implementation Guide for CDA^® Release 2: IHE Health Story Consolidation, DSTU Release 1.1 (US Realm) Draft Standard for Trial Use July 2012

§ 170.205(a)(4) HL7^® Implementation Guide for CDA^® Release 2: Consolidated CDA Templates for Clinical Notes (US Realm), Draft Standard for Trial Use Release 2.1, August 2015

Required Update Deadlines

Deadline: December 31, 2024

Certification Dependencies

Design and Performance: The following design and performance certification criteria (adopted in § 170.315(g)) must also be certified in order for the product to be certified.

Safety-enhanced design (§ 170.315(g)(3)) must be explicitly demonstrated for this criterion.
Quality management system (§ 170.315(g)(4)): When a single quality management system (QMS) is used, the QMS only needs to be identified once. Otherwise, the QMS’ need to be identified for every capability to which it was applied.
Accessibility-centered design (§ 170.315(g)(5)): When a single accessibility-centered design standard is used, the standard only needs to be identified once. Otherwise, the accessibility-centered design standards need to be identified for every capability to which they were applied; or, alternatively, the developer must state that no accessibility-centered design was used.

Privacy & Security Requirements

The privacy and security criteria (adopted in § 170.315(d)) do not need to be explicitly tested with this specific paragraph (a) criterion unless it is the only criterion for which certification is requested.
As a general rule, a product presented for certification only needs to be presented once to each applicable privacy and security criterion (adopted in § 170.315(d)) so long as the health IT developer attests that such privacy and security capabilities apply to the full scope of capabilities included in the requested certification. However, exceptions exist for § 170.315(e)(1) “View, download, and transmit to 3rd party (VDT)” and (e)(2) “Secure messaging,” which are explicitly stated.
Health IT presented for certification to this criterion would not have to demonstrate the capabilities required by the Amendments certification criterion (§ 170.315(d)(4)), unless the health IT is presented for certification to another criterion that requires certification to the Amendments criterion under the privacy and security certification framework.
§ 170.315(d)(2)(i)(C) is not required if the scope of the Health IT Module does not have end-user device encryption features.

For more information on the approaches to meet these Privacy and Security requirements, please review the Privacy and Security CCG.

If choosing Approach 1:
If choosing Approach 2:
- For each applicable privacy and security certification criterion not certified for Approach 1, the health IT developer may certify using system documentation which is sufficiently detailed to enable integration such that the Health IT Module has implemented service interfaces the Health IT Module to access external services necessary to meet the requirements of the privacy and security certification criterion. Please see the 21st Century Cures Act: Interoperability, Information Blocking, and the ONC Health IT Certification Program Final Rule at 85 FR 25710 for additional clarification.

Revision History

Version #	Description of Change	Version Date
1.0	Initial publication	03-11-2024

Regulation Text

Regulation Text

§ 170.315 (a)(9) Clinical decision support (CDS)—

CDS intervention interaction. Interventions provided to a user must occur when a user is interacting with technology.
CDS configuration.
1. Enable interventions and reference resources specified in paragraphs (a)(9)(iii) and (iv) of this section to be configured by a limited set of identified users (e.g., system administrator) based on a user's role.
2. Enable interventions:
  1. Based on the following data:
    1. Problem list;
    2. Medication list;
    3. Medication allergy list;
    4. At least one demographic specified in paragraph (a)(5)(i) of this section;
    5. Laboratory tests; and
    6. Vital signs.
  2. When a patient's medications, medication allergies, and problems are incorporated from a transition of care/referral summary received and pursuant to paragraph (b)(2)(iii)(D) of this section.
Evidence-based decision support interventions. Enable a limited set of identified users to select (i.e., activate) electronic CDS interventions (in addition to drug-drug and drug-allergy contraindication checking) based on each one and at least one combination of the data referenced in paragraphs (a)(9)(ii)(B)(1)(i) through (vi) of this section.
Linked referential CDS.
1. Identify for a user diagnostic and therapeutic reference information in accordance at least one of the following standards and implementation specifications:
  1. The standard and implementation specifications specified in § 170.204(b)(3).
  2. The standard and implementation specifications specified in § 170.204(b)(4).
2. For paragraph (a)(9)(iv)(A) of this section, technology must be able to identify for a user diagnostic or therapeutic reference information based on each one and at least one combination of the data referenced in paragraphs (a)(9)(ii)(B)(1)(i), (ii), and (iv) of this section.
Source attributes. Enable a user to review the attributes as indicated for all CDS resources:
1. For evidence-based decision support interventions under paragraph (a)(9)(iii) of this section:
  1. Bibliographic citation of the intervention (clinical research/guideline);
  2. Developer of the intervention (translation from clinical research/guideline);
  3. Funding source of the intervention development technical implementation; and
  4. Release and, if applicable, revision date(s) of the intervention or reference source.
2. For linked referential CDS in paragraph (a)(9)(iv) of this section and drug-drug, drug-allergy interaction checks in paragraph (a)(4) of this section, the developer of the intervention, and where clinically indicated, the bibliographic citation of the intervention (clinical research/guideline).
Expiration of Criterion. The adoption of this criterion for purposes of the ONC Health IT Certification Program expires on January 1, 2025.

Standard(s) Referenced

Cross Reference Criteria

§ 170.315(a)(5) (i) Enable a user to record, change, and access patient demographic data including race, ethnicity, preferred language, sex, sexual orientation, gender identity, and date of birth

§ 170.315(b)(2) (iii)(D) Upon a user's confirmation, automatically update the list, and incorporate the following data expressed according to the specified standard(s):

Medications. At a minimum, the version of the standard specified in § 170.207(d)(3);
Medication allergies. At a minimum, the version of the standard specified in §170.207(d)(3); and
Problems. At a minimum, the version of the standard specified in § 170.207(a)(4).

Paragraph (a)(9)(iv)

Additional Resources

§ 170.205(a)(3) HL7^® Implementation Guide for CDA^® Release 2: IHE Health Story Consolidation, DSTU Release 1.1 (US Realm) Draft Standard for Trial Use July 2012

§ 170.205(a)(4) HL7^® Implementation Guide for CDA^® Release 2: Consolidated CDA Templates for Clinical Notes (US Realm), Draft Standard for Trial Use Release 2.1, August 2015

Required Update Deadlines

Deadline: December 31, 2024

Certification Dependencies

Design and Performance: The following design and performance certification criteria (adopted in § 170.315(g)) must also be certified in order for the product to be certified.

Safety-enhanced design (§ 170.315(g)(3)) must be explicitly demonstrated for this criterion.
Quality management system (§ 170.315(g)(4)): When a single quality management system (QMS) is used, the QMS only needs to be identified once. Otherwise, the QMS’ need to be identified for every capability to which it was applied.
Accessibility-centered design (§ 170.315(g)(5)): When a single accessibility-centered design standard is used, the standard only needs to be identified once. Otherwise, the accessibility-centered design standards need to be identified for every capability to which they were applied; or, alternatively, the developer must state that no accessibility-centered design was used.

Privacy & Security Requirements

The privacy and security criteria (adopted in § 170.315(d)) do not need to be explicitly tested with this specific paragraph (a) criterion unless it is the only criterion for which certification is requested.
As a general rule, a product presented for certification only needs to be presented once to each applicable privacy and security criterion (adopted in § 170.315(d)) so long as the health IT developer attests that such privacy and security capabilities apply to the full scope of capabilities included in the requested certification. However, exceptions exist for § 170.315(e)(1) “View, download, and transmit to 3rd party (VDT)” and (e)(2) “Secure messaging,” which are explicitly stated.
Health IT presented for certification to this criterion would not have to demonstrate the capabilities required by the Amendments certification criterion (§ 170.315(d)(4)), unless the health IT is presented for certification to another criterion that requires certification to the Amendments criterion under the privacy and security certification framework.
§ 170.315(d)(2)(i)(C) is not required if the scope of the Health IT Module does not have end-user device encryption features.

For more information on the approaches to meet these Privacy and Security requirements, please review the Privacy and Security CCG.

If choosing Approach 1:
If choosing Approach 2:
- For each applicable privacy and security certification criterion not certified for Approach 1, the health IT developer may certify using system documentation which is sufficiently detailed to enable integration such that the Health IT Module has implemented service interfaces the Health IT Module to access external services necessary to meet the requirements of the privacy and security certification criterion. Please see the 21st Century Cures Act: Interoperability, Information Blocking, and the ONC Health IT Certification Program Final Rule at 85 FR 25710 for additional clarification.

Revision History

Version #	Description of Change	Version Date
1.0	Initial publication	03-11-2024

Certification Companion Guide: Clinical decision support (CDS)

This Certification Companion Guide (CCG) is an informative document designed to assist with health IT product certification. The CCG is not a substitute for the requirements outlined in regulation and related ONC final rules. It extracts key portions of ONC final rules’ preambles and includes subsequent clarifying interpretations. To access the full context of regulatory intent please consult the Certification Regulations page for links to all ONC final rules or consult other regulatory references as noted. The CCG is for public use and should not be sold or redistributed.

The below table outlines whether this criterion has additional Maintenance of Certification dependencies, update requirements and/or eligibility for standards updates via SVAP. Review the Certification Dependencies and Required Update Deadline drop-downs above if this table indicates “yes” for any field.

Base EHR Definition	Real World Testing	Insights Condition	SVAP	Requires Updates
Included	No	No	No	Yes

Certification Requirements

Technical Explanations and Clarifications

Applies to entire criterion

Clarifications:

The terms “automatically” and “trigger” have not been included in this criterion in order to clarify that our intent is to encompass all types of CDS interventions without being prescriptive on how the interventions are deployed. [see also 80 FR 62622]
A CDS intervention is not simply an alert, notification, or explicit care suggestion. Rather, it should be more broadly interpreted as the user-facing representation of evidence-based clinical guidance based on relevant patient data. [see also 77 FR 54212]
Health IT developers are encouraged to use standards to retrieve CDS content from external sources rather than “hard coding” CDS interventions to static data in the system. [see also 77 FR 54213]
The National Library of Medicine hosts a publicly available repository of value sets for use in CDS and clinical quality measures that are available as a resource to developers. Please see: https://vsac.nlm.nih.gov/. [see also 77 FR 54213]
This criterion will expire on January 1, 2025.

Applies to entire criterion

Clarifications:

The terms “automatically” and “trigger” have not been included in this criterion in order to clarify that our intent is to encompass all types of CDS interventions without being prescriptive on how the interventions are deployed. [see also 80 FR 62622]
A CDS intervention is not simply an alert, notification, or explicit care suggestion. Rather, it should be more broadly interpreted as the user-facing representation of evidence-based clinical guidance based on relevant patient data. [see also 77 FR 54212]
Health IT developers are encouraged to use standards to retrieve CDS content from external sources rather than “hard coding” CDS interventions to static data in the system. [see also 77 FR 54213]
The National Library of Medicine hosts a publicly available repository of value sets for use in CDS and clinical quality measures that are available as a resource to developers. Please see: https://vsac.nlm.nih.gov/. [see also 77 FR 54213]
This criterion will expire on January 1, 2025.

Paragraph (a)(9)(i) CDS intervention interaction

Technical outcome – CDS configuration (per provision (a)(9)(ii)), CDS activation (per provision (a)(9)(iii)), and reference information (per provision (a)(9)(iv)), occur when a user is interacting with health IT.

Clarifications:

No additional clarifications.

Paragraph (a)(9)(i) CDS intervention interaction

Clarifications:

No additional clarifications.

Paragraph (a)(9)(ii)(A) CDS configuration

Technical outcome – A limited set of identified users can configure interventions per provision (a)(9)(iii) and reference information per provision (a)(9)(iv) based on a user’s role.

Clarifications:

No additional clarifications.

Paragraph (a)(9)(ii)(A) CDS configuration

Technical outcome – A limited set of identified users can configure interventions per provision (a)(9)(iii) and reference information per provision (a)(9)(iv) based on a user’s role.

Clarifications:

No additional clarifications.

Paragraph (a)(9)(ii)(B) Enable interventions

Technical outcome – CDS interventions are based on the data named in (a)(9)(ii)(B)(1)(i)-(vi) and when a patient’s medication, medication allergies, and problems are incorporated from a transition of care/referral summary.

Clarifications:

The demographic data specified at (a)(9)(ii)(B)(1)(iv) are: race, ethnicity, preferred language, sex, sexual orientation, gender identity, and date of birth. [see also § 170.315(a)(5) Demographics CCG]
To meet the requirements of this provision, interventions based on demographics only need to be based on one of the demographics data types (e.g., sex or date of birth). [see also Health IT Certification Program Overview]
The health IT does not need to “trigger” an intervention at the time of incorporation, only demonstrate that CDS interventions can be based on the data incorporated from a transition of care/referral summary. Thus, for the purposes of this certification criterion, ONC clarifies that the technology must be capable of demonstrating that it behaves differently in two states: before and after the incorporation of new information. [see also 77 FR 54214]
For conformance to (a)(9)(ii)(B)(2), health IT must demonstrate that it can enable CDS interventions for incorporated medications, medication allergies, and problems (collectively "data"). The ability to incorporate the data from any content exchange standard is not relevant to conformance with this requirement (i.e., neither tested nor certified).

Paragraph (a)(9)(ii)(B) Enable interventions

Clarifications:

The demographic data specified at (a)(9)(ii)(B)(1)(iv) are: race, ethnicity, preferred language, sex, sexual orientation, gender identity, and date of birth. [see also § 170.315(a)(5) Demographics CCG]
To meet the requirements of this provision, interventions based on demographics only need to be based on one of the demographics data types (e.g., sex or date of birth). [see also Health IT Certification Program Overview]
The health IT does not need to “trigger” an intervention at the time of incorporation, only demonstrate that CDS interventions can be based on the data incorporated from a transition of care/referral summary. Thus, for the purposes of this certification criterion, ONC clarifies that the technology must be capable of demonstrating that it behaves differently in two states: before and after the incorporation of new information. [see also 77 FR 54214]
For conformance to (a)(9)(ii)(B)(2), health IT must demonstrate that it can enable CDS interventions for incorporated medications, medication allergies, and problems (collectively "data"). The ability to incorporate the data from any content exchange standard is not relevant to conformance with this requirement (i.e., neither tested nor certified).

Paragraph (a)(9)(iii) Evidence-based decision support interventions

Technical outcome – A limited set of users can activate CDS interventions based on each data listed in (a)(9)(ii)(B)(1)(i)-(vi), and at least one combination of the data listed in (a)(9)(ii)(B)(1)(i)-(vi).

Clarifications:

For this criterion, “select” means the same as “activate.” [see also 77 FR 54213]
“User” is not constrained to mean just “licensed healthcare professional.” For example, a clerical user or patient user may interact with the certified health IT system. [see also 77 FR 54214]

Paragraph (a)(9)(iii) Evidence-based decision support interventions

Clarifications:

For this criterion, “select” means the same as “activate.” [see also 77 FR 54213]
“User” is not constrained to mean just “licensed healthcare professional.” For example, a clerical user or patient user may interact with the certified health IT system. [see also 77 FR 54214]

Paragraph (a)(9)(iv)(A) Linked referential CDS

Technical outcome – Health IT can identify diagnostic and therapeutic reference information using the HL7® V3 Context Aware Knowledge Retrieval Application (“Infobutton”) standard in combination with one of the following implementation guides:

HL7® Service-Oriented Architecture Implementations of Infobutton.
HL7® V3 Context Aware Knowledge Retrieval.

Clarifications:

ONC clarifies that our certification approach only focuses on capabilities that must be certified to meet this criterion, not that a provider must use these standards or functions. A health IT developer’s product could include other means for identifying diagnostic or therapeutic reference information, but there are no certification requirements for other means for this criterion. [see also 80 FR 62622] While ONC does not certify knowledge publishers, we encourage them to adopt the Infobutton standard to facilitate providing patient and/or provider facing clinical content to health IT products. [see also 77 FR 54214]
This portion of the criterion focuses on Infobutton conformance and performance in relation to health IT’s ability to interact with an Infobutton-enabled source. Additionally, this portion of the criterion provides context as part of the CDS certification criterion as a whole that this specific capability is intended to enable “diagnostic and therapeutic reference information” to be provided to a user via an Infobutton conformant capability. For the purposes of testing and certification, a health IT developer may demonstrate its product’s Infobutton conformance with any Infobutton-enabled content source so long as the capabilities specified in paragraph (a)(9)(iv) and respective data referenced are fully demonstrated (or documented) as part of testing.

Paragraph (a)(9)(iv)(A) Linked referential CDS

HL7® Service-Oriented Architecture Implementations of Infobutton.
HL7® V3 Context Aware Knowledge Retrieval.

Clarifications:

ONC clarifies that our certification approach only focuses on capabilities that must be certified to meet this criterion, not that a provider must use these standards or functions. A health IT developer’s product could include other means for identifying diagnostic or therapeutic reference information, but there are no certification requirements for other means for this criterion. [see also 80 FR 62622] While ONC does not certify knowledge publishers, we encourage them to adopt the Infobutton standard to facilitate providing patient and/or provider facing clinical content to health IT products. [see also 77 FR 54214]
This portion of the criterion focuses on Infobutton conformance and performance in relation to health IT’s ability to interact with an Infobutton-enabled source. Additionally, this portion of the criterion provides context as part of the CDS certification criterion as a whole that this specific capability is intended to enable “diagnostic and therapeutic reference information” to be provided to a user via an Infobutton conformant capability. For the purposes of testing and certification, a health IT developer may demonstrate its product’s Infobutton conformance with any Infobutton-enabled content source so long as the capabilities specified in paragraph (a)(9)(iv) and respective data referenced are fully demonstrated (or documented) as part of testing.

Paragraph (a)(9)(iv)(B) Linked referential CDS

Technical outcome – For the diagnostic or therapeutic reference information identified in provision (a)(9)(iv)(A), technology must be able to base the reference information on each of the following: problem list, medication list, and demographics. Technology must also be able to identify reference information on at least one combination of problem list, medication list, and demographics.

Clarifications:

The demographic data specified at paragraph (a)(9)(ii)(B)(1)(iv) are: race, ethnicity, preferred language, sex, sexual orientation, gender identity, and date of birth. [see also § 170.315(a)(5) Demographics CCG]
ONC does not intend for demographic data to be individually tested or required for certification as part of the “each one” requirement of this specific capability. ONC also understands and clarifies that with respect to demographics data that certain demographic data (e.g., age) can and should be used as a modifier. ONC intends for testing and certification to evaluate this specific capability in that way. [see also Health IT Certification Program Overview]

Paragraph (a)(9)(iv)(B) Linked referential CDS

Clarifications:

The demographic data specified at paragraph (a)(9)(ii)(B)(1)(iv) are: race, ethnicity, preferred language, sex, sexual orientation, gender identity, and date of birth. [see also § 170.315(a)(5) Demographics CCG]
ONC does not intend for demographic data to be individually tested or required for certification as part of the “each one” requirement of this specific capability. ONC also understands and clarifies that with respect to demographics data that certain demographic data (e.g., age) can and should be used as a modifier. ONC intends for testing and certification to evaluate this specific capability in that way. [see also Health IT Certification Program Overview]

Paragraph (a)(9)(v)(A) Source attributes

Technical outcome – A user can review the source attributes for all CDS interventions provided in provision (a)(9)(i).

Clarifications:

ONC does not require the automatic display of the source attributes, just the availability of the information to the end-user.
- For example, additional action may be required for a user to “drill down” or “link out” to view the source attributes of CDS. [see also 77 FR 54215]
ONC also does not require that the EHR technology create the content for the source attributes. [see also 77 FR 54215]
“Bibliographic citation” is a reference (if available) to a publication of clinical research that documents the clinical value of the intervention. If no such reference exists (e.g., locally developed intervention), the health IT product should indicate so. [see also 77 FR 54215]
“Developer of the intervention (translation from clinical research/guideline)” is the team, person, organization, department or other entity that interpreted the clinical research and translated it into computable form (sometimes the knowledge vendor). [see also 77 FR 54215]
“Funding source of the intervention development technical implementation” is the source of funding for the work performed by the “developer of the intervention.” If this information is unknown, the user should have access to know that it is unknown. [see also 77 FR 54215]

Paragraph (a)(9)(v)(A) Source attributes

Technical outcome – A user can review the source attributes for all CDS interventions provided in provision (a)(9)(i).

Clarifications:

ONC does not require the automatic display of the source attributes, just the availability of the information to the end-user.
- For example, additional action may be required for a user to “drill down” or “link out” to view the source attributes of CDS. [see also 77 FR 54215]
ONC also does not require that the EHR technology create the content for the source attributes. [see also 77 FR 54215]
“Bibliographic citation” is a reference (if available) to a publication of clinical research that documents the clinical value of the intervention. If no such reference exists (e.g., locally developed intervention), the health IT product should indicate so. [see also 77 FR 54215]
“Developer of the intervention (translation from clinical research/guideline)” is the team, person, organization, department or other entity that interpreted the clinical research and translated it into computable form (sometimes the knowledge vendor). [see also 77 FR 54215]
“Funding source of the intervention development technical implementation” is the source of funding for the work performed by the “developer of the intervention.” If this information is unknown, the user should have access to know that it is unknown. [see also 77 FR 54215]

Paragraph (a)(9)(v)(B) Source attributes

Technical outcome – A user can review the source attributes (specifically the developer of the intervention, and where clinically indicated, the bibliographic citation of the intervention) for all reference information provided in provision (a)(9)(iv) and all drug-drug, drug-allergy interaction checks.

Clarifications:

Please refer to the CCG for the § 170.315(a)(4) Drug-drug, drug-allergy interaction checks for CPOE certification criterion for more information.
For drug-drug, drug-allergy interaction checks, global citations are permitted in cases where all interventions of a given type are provided by the same reference. [see also 77 FR 54215]

Paragraph (a)(9)(v)(B) Source attributes

Clarifications:

Please refer to the CCG for the § 170.315(a)(4) Drug-drug, drug-allergy interaction checks for CPOE certification criterion for more information.
For drug-drug, drug-allergy interaction checks, global citations are permitted in cases where all interventions of a given type are provided by the same reference. [see also 77 FR 54215]

Paragraph (a)(9)(vi)(A) Expiration of criterion

The adoption of this criterion for purposes of the ONC Health IT Certification Program expires on January 1, 2025.

Paragraph (a)(9)(vi)(A) Expiration of criterion

The adoption of this criterion for purposes of the ONC Health IT Certification Program expires on January 1, 2025.