Cybersecurity Policy Report, HHS proposes to align HIT procurement with interoperability standards, (Aug 13, 2024)

By WK Editorial Staff

HIT interoperability focus of new proposed regulation.

In order to streamline health information technology (HIT) activities across HHS, the department has proposed a rule to amend the Health and Human Services Acquisition Regulation (HHSAR). The proposal would aim to ensure fair and consistent government procurements, delivering overall best value while operating under a known set of rules. The impetus for the proposed rule is HHS’ July 2022 Memorandum, which mandates HHS agencies to align health IT-related activities with HHS health IT and interoperability goals. The move addresses the investment in health IT spurred by the HITECH Act's $40 billion infusion and the critical need for interoperable data following the COVID-19 pandemic (Proposed rule, 89 Fed. Reg. 65303 (Aug. 9, 2024)).

The proposed rule would eliminate ad-hoc health IT and data silos which according to HHS are costly, lack synergies, and impose significant burdens on healthcare providers and stakeholders. To counter this, HHS has directed agencies to develop standard language for use in grants, cooperative agreements, or contracts, emphasizing the utilization of health IT that meets adopted standards under Section 3004 of the Public Health Service Act (PHSA), or, where no applicable standards exist, other HHS-identified or consensus-based standards.

HITECH Act sections 13111 and 13112 would be central to this policy, requiring that health IT systems used for the direct exchange of individually identifiable health information between agencies and non-Federal entities, or in contracts with healthcare providers, health plans, or health insurance issuers, comply with adopted standards and implementation specifications.

The rule proposes that all solicitations and contracts involving the implementation, acquisition, or upgrading of health IT must adhere to the standards and implementation specifications adopted by ONC under section 3004 of the PHSA. Additionally, contracting officers cannot award contracts involving health IT unless the technology meets the adopted standards or is certified under the ONC Health Information Technology Certification Program.

To swiftly implement these requirements, HHS issued a Class Deviation (2023–01) from part 339, Acquisition of Information Technology; Standards for Health Information Technology. The proposed rule adds a new HHSAR subpart 339.70, which outlines definitions, policy, and prescribes a new HHSAR clause to enforce the HITECH Act's requirements.

FederalRegisterIssuances: ProposedRules FederalLegislation CMSNews EHRNews GeneralNews HITNews CyberPrivacyFeed DataSecurity DataPrivacy