§170.315(f)(1) Transmission to immunization registries
§ 170.315 (f)(1) Transmission to immunization registries—
- Create immunization information for electronic transmission in accordance with:
- The standard and applicable implementation specifications specified in § 170.205(e)(4).
- At a minimum, the version of the standard specified in § 170.207(e)(1) for historical vaccines.
- At a minimum, the version of the standard specified in § 170.207(e)(2) for administered vaccines.
- Enable a user to request, access, and display a patient's evaluated immunization history and the immunization forecast from an immunization registry in accordance with the standard at § 170.205(e)(4).
Paragraph (f)(1)(i)
§ 170.205(e)(4) Health Level 7 (HL7®) 2.5.1 Implementation Specifications. HL7® 2.5.1 Implementation Guide for Immunization Messaging, Release 1.5, October 2014 and HL7® Version 2.5.1 Implementation Guide for Immunization Messaging (Release 1.5)—Addendum, July 2015
§ 170.207(e)(3) HL7® Standard Code Set CVX— Vaccines Administered, updates through August 17, 2015 (Adoption of this standard expires on January 1, 2026)
§ 170.207(e)(1) HL7® Standard Code Set CVX— Vaccines Administered, updates through June 15, 2022 (This standard is required by December 31, 2025)
§ 170.207(e)(4) National Drug Code (NDC) Directory– Vaccine NDC Linker, updates through August 17, 2015 (Adoption of this standard expires on January 1, 2026)
§ 170.207(e)(2) National Drug Code (NDC) Directory– Vaccine NDC Linker, updates through July 19, 2022 (This standard is required by December 31, 2025)
Paragraph (f)(1)(ii)
§ 170.205(e)(4) HL7® 2.5.1 Implementation Specifications. HL7® 2.5.1 Implementation Guide for Immunization Messaging, Release 1.5, October 2014 and HL7® Version 2.5.1 Implementation Guide for Immunization Messaging (Release 1.5)—Addendum, July 2015
Standards Version Advancement Process (SVAP) Version(s) Approved
HL7® Version 2.5.1 Implementation Guide for Immunization Messaging, Release 1.5 2018 Update
For more information, please visit the Standards Version Advancement Process (SVAP) Version(s) page.
The following outlines deadlines for required updates for this criterion as they relate to changes published in recent ONC final rules. Developers must update their products to the requirements outlined and provide them to their customers by the stated deadlines. These represent one-time deadlines as set by recent regulatory updates and do not encompass ongoing deadlines related to the Conditions and Maintenance of Certification. Please review those requirements for additional compliance activities related to one’s certification under Certification Dependencies.
Deadline: December 31, 2025
Action to be taken: Developers certified to this criterion must update their code sets to reflect, at a minimum, the code sets outlined in subparagraph 170.315(f)(1)(i)(B-C).
Conditions and Maintenance of Certification
Real World Testing: Products certified to this criterion must complete requirements outlined for the Real World Testing Conditions and Maintenance of Certification.
Insights: Products certified to this criterion must submit responses for the following measures:
- §170.407(a)(3)(vi) Immunization administrations electronically submitted to immunization information systems through certified health IT (beginning July 2027)
- §170.407(a)(3)(vii) Immunization history and forecasts through certified health IT (beginning July 2028)
Design and Performance: The following design and performance certification criteria (adopted in § 170.315(g)) must also be certified in order for the product to be certified.
- Quality management system (§ 170.315(g)(4)): When a single quality management system (QMS) is used, the QMS only needs to be identified once. Otherwise, the QMS’ need to be identified for every capability to which it was applied.
- Accessibility-centered design (§ 170.315(g)(5)): When a single accessibility-centered design standard is used, the standard only needs to be identified once. Otherwise, the accessibility-centered design standards need to be identified for every capability to which they were applied; or, alternatively, the developer must state that no accessibility-centered design was used.
This certification criterion was adopted at § 170.315(f)(1). As a result, an ONC Authorized Certification Body (ONC-ACB) must ensure that a product presented for certification to a § 170.315(f) criterion includes the privacy and security criteria (adopted in § 170.315(d)) within the overall scope of the certificate issued to the product.
- The privacy and security criteria (adopted in § 170.315(d)) do not need to be explicitly tested with this specific paragraph (f) criterion unless it is the only criterion for which certification is requested.
- As a general rule, a product presented for certification only needs to be tested once to each applicable privacy and security criterion (adopted in § 170.315(d)) so long as the health IT developer attests that such privacy and security capabilities apply to the full scope of capabilities included in the requested certification. However, exceptions exist for § 170.315(e)(1) “View, download, and transmit to 3rd party (VDT)” and (e)(2) “Secure messaging,” which are explicitly stated.
- § 170.315(d)(2)(i)(C) is not required if the scope of the Health IT Module does not have end-user device encryption features.
For more information on the approaches to meet these Privacy and Security requirements, please review the Privacy and Security CCG.
- If choosing Approach 1:
- Authentication, access control, and authorization (§ 170.315(d)(1))
- Auditable events and tamper-resistance (§ 170.315(d)(2))
- Audit reports (§ 170.315(d)(3))
- End-user device encryption (§ 170.315(d)(7))
- Encrypt authentication credentials (§ 170.315(d)(12))
- Multi-factor authentication (MFA) (§ 170.315(d)(13))
- If choosing Approach 2:
- For each applicable privacy and security certification criterion not certified for Approach 1, the health IT developer may certify using system documentation which is sufficiently detailed to enable integration such that the Health IT Module has implemented service interfaces the Health IT Module to access external services necessary to meet the requirements of the privacy and security certification criterion. Please see the 21st Century Cures Act: Interoperability, Information Blocking, and the ONC Health IT Certification Program Final Rule at 85 FR 25710 for additional clarification.
| Version # | Description of Change | Version Date |
|---|---|---|
| 1.0 |
Initial publication |
03-11-2024
|
- Regulation Text
-
Regulation Text
§ 170.315 (f)(1) Transmission to immunization registries—
- Create immunization information for electronic transmission in accordance with:
- The standard and applicable implementation specifications specified in § 170.205(e)(4).
- At a minimum, the version of the standard specified in § 170.207(e)(1) for historical vaccines.
- At a minimum, the version of the standard specified in § 170.207(e)(2) for administered vaccines.
- Enable a user to request, access, and display a patient's evaluated immunization history and the immunization forecast from an immunization registry in accordance with the standard at § 170.205(e)(4).
- Create immunization information for electronic transmission in accordance with:
- Standard(s) Referenced
-
Paragraph (f)(1)(i)
§ 170.205(e)(4) Health Level 7 (HL7®) 2.5.1 Implementation Specifications. HL7® 2.5.1 Implementation Guide for Immunization Messaging, Release 1.5, October 2014 and HL7® Version 2.5.1 Implementation Guide for Immunization Messaging (Release 1.5)—Addendum, July 2015
§ 170.207(e)(3) HL7® Standard Code Set CVX— Vaccines Administered, updates through August 17, 2015 (Adoption of this standard expires on January 1, 2026)
§ 170.207(e)(1) HL7® Standard Code Set CVX— Vaccines Administered, updates through June 15, 2022 (This standard is required by December 31, 2025)
§ 170.207(e)(4) National Drug Code (NDC) Directory– Vaccine NDC Linker, updates through August 17, 2015 (Adoption of this standard expires on January 1, 2026)
§ 170.207(e)(2) National Drug Code (NDC) Directory– Vaccine NDC Linker, updates through July 19, 2022 (This standard is required by December 31, 2025)
Paragraph (f)(1)(ii)
§ 170.205(e)(4) HL7® 2.5.1 Implementation Specifications. HL7® 2.5.1 Implementation Guide for Immunization Messaging, Release 1.5, October 2014 and HL7® Version 2.5.1 Implementation Guide for Immunization Messaging (Release 1.5)—Addendum, July 2015
Standards Version Advancement Process (SVAP) Version(s) Approved
HL7® Version 2.5.1 Implementation Guide for Immunization Messaging, Release 1.5 2018 Update
For more information, please visit the Standards Version Advancement Process (SVAP) Version(s) page.
- Required Update Deadlines
-
The following outlines deadlines for required updates for this criterion as they relate to changes published in recent ONC final rules. Developers must update their products to the requirements outlined and provide them to their customers by the stated deadlines. These represent one-time deadlines as set by recent regulatory updates and do not encompass ongoing deadlines related to the Conditions and Maintenance of Certification. Please review those requirements for additional compliance activities related to one’s certification under Certification Dependencies.
Deadline: December 31, 2025
Action to be taken: Developers certified to this criterion must update their code sets to reflect, at a minimum, the code sets outlined in subparagraph 170.315(f)(1)(i)(B-C).
- Certification Dependencies
-
Conditions and Maintenance of Certification
Real World Testing: Products certified to this criterion must complete requirements outlined for the Real World Testing Conditions and Maintenance of Certification.
Insights: Products certified to this criterion must submit responses for the following measures:
- §170.407(a)(3)(vi) Immunization administrations electronically submitted to immunization information systems through certified health IT (beginning July 2027)
- §170.407(a)(3)(vii) Immunization history and forecasts through certified health IT (beginning July 2028)
Design and Performance: The following design and performance certification criteria (adopted in § 170.315(g)) must also be certified in order for the product to be certified.
- Quality management system (§ 170.315(g)(4)): When a single quality management system (QMS) is used, the QMS only needs to be identified once. Otherwise, the QMS’ need to be identified for every capability to which it was applied.
- Accessibility-centered design (§ 170.315(g)(5)): When a single accessibility-centered design standard is used, the standard only needs to be identified once. Otherwise, the accessibility-centered design standards need to be identified for every capability to which they were applied; or, alternatively, the developer must state that no accessibility-centered design was used.
- Privacy & Security Requirements
-
This certification criterion was adopted at § 170.315(f)(1). As a result, an ONC Authorized Certification Body (ONC-ACB) must ensure that a product presented for certification to a § 170.315(f) criterion includes the privacy and security criteria (adopted in § 170.315(d)) within the overall scope of the certificate issued to the product.
- The privacy and security criteria (adopted in § 170.315(d)) do not need to be explicitly tested with this specific paragraph (f) criterion unless it is the only criterion for which certification is requested.
- As a general rule, a product presented for certification only needs to be tested once to each applicable privacy and security criterion (adopted in § 170.315(d)) so long as the health IT developer attests that such privacy and security capabilities apply to the full scope of capabilities included in the requested certification. However, exceptions exist for § 170.315(e)(1) “View, download, and transmit to 3rd party (VDT)” and (e)(2) “Secure messaging,” which are explicitly stated.
- § 170.315(d)(2)(i)(C) is not required if the scope of the Health IT Module does not have end-user device encryption features.
For more information on the approaches to meet these Privacy and Security requirements, please review the Privacy and Security CCG.
- If choosing Approach 1:
- Authentication, access control, and authorization (§ 170.315(d)(1))
- Auditable events and tamper-resistance (§ 170.315(d)(2))
- Audit reports (§ 170.315(d)(3))
- End-user device encryption (§ 170.315(d)(7))
- Encrypt authentication credentials (§ 170.315(d)(12))
- Multi-factor authentication (MFA) (§ 170.315(d)(13))
- If choosing Approach 2:
- For each applicable privacy and security certification criterion not certified for Approach 1, the health IT developer may certify using system documentation which is sufficiently detailed to enable integration such that the Health IT Module has implemented service interfaces the Health IT Module to access external services necessary to meet the requirements of the privacy and security certification criterion. Please see the 21st Century Cures Act: Interoperability, Information Blocking, and the ONC Health IT Certification Program Final Rule at 85 FR 25710 for additional clarification.
- Testing
-
Testing Tool
Criterion Subparagraph Test Data (f)(1) Refer to the NIST HL7® v2 Immunization Test Suite
- Revision History
-
Version # Description of Change Version Date 1.0 Initial publication
03-11-2024
This Test Procedure illustrates the test steps required to certify a Health IT Module to this criterion. Please consult the most recent ONC Final Rule on the Certification Regulations page for a detailed description of the certification criterion with which these testing steps are associated. ONC also encourages developers to consult the Certification Companion Guide in tandem with the test procedure as it provides clarifications that may be useful for product development and testing.
Note: The test step order does not necessarily prescribe the order in which the tests should take place.
Testing components
Paragraphs (f)(1) (Conditional – For Modules with existing certification to (f)(1))
- Required by December 31, 2025
- The health IT developer of a Health IT Module currently certified to the 170.315(f)(1) Transmission to immunization registries will attest directly to the ONC-ACB to conformance with the updated 170.315(f)(1) requirements outlined in the Health Data, Technology, and Interoperability: Certification Program Updates, Algorithm Transparency, and Information Sharing (HTI-1) Final Rule.
- Required by December 31, 2025
- The ONC-ACB verifies the health IT developer of a Health IT Module certified to the 170.315(f)(1) Transmission to immunization registries attests conformance to updated 170.315(f)(1) criteria requirements.
| System Under Test | Test Lab Verification |
|---|---|
|
|
Paragraphs (f)(1)(i) Create immunization information
- Expires on January 1, 2026
The Health IT Module creates immunization content using ONC-supplied test data for each of the test cases from the Administration Test Group under the ONC Certification Test Plan on the Context-Based Validation Tab of the NIST HL7® v2, Immunization Test Suite. All test cases are required. Input may be performed using manual or automated processes.
For each test case, the Health IT Module generates the indicated HL7® v2.5.1 Z22 VXU immunization information message.
For each test case, the Health IT Module consumes the associated acknowledgement message using the provided test data and according to the § 170.205(e)(4) HL7® 2.5.1 Implementation Guide for Immunization Messaging, Release 1.5.
The vaccines in the historical vaccine records are represented using § 170.207(e)(3) HL7® Standard Code Set CVX— Vaccines Administered.
The vaccines in the administered vaccine records are represented using § 170.207(e)(4) National Drug Code (NDC) Directory– Vaccine NDC Linker.
- Required by December 31, 2025
The Health IT Module creates immunization content using ONC-supplied test data for each of the test cases from the Administration Test Group under the ONC CertificationTest Plan on the Context-Based Validation Tab of the NIST HL7® v2, Immunization Test Suite. All test cases are required. Input may be performed using manual or automated processes.
For each test case, the Health IT Module generates the indicated HL7® v2.5.1 Z22 VXU immunization information message.
For each test case, the Health IT Module consumes the associated acknowledgement message using the provided test data and according to the § 170.205(e)(4) HL7® 2.5.1 Implementation Guide for Immunization Messaging, Release 1.5.
The vaccines in the historical vaccine records are represented using § 170.207(e)(1) HL7® Standard Code Set CVX— Vaccines Administered.
The vaccines in the administered vaccine records are represented using § 170.207(e)(2) National Drug Code (NDC) Directory– Vaccine NDC Linker.
- Expires on January 1, 2026
Using the Normative Test Description section of the Normative Test Process Document:
The tester verifies the Health IT Module creates the source immunization content correctly through visual inspection of the system under test using the test data specification of the Send Administration Message test step associated with the selected test case.
The tester imports the immunization message into the test tool for validation and uses the Validation Report produced by the test tool to verify the Health IT Module passes without error to confirm that the immunization information messages conform to the HL7® v2.5.1 Z22 VXU Unsolicited Vaccine Update message of the § 170.205(e)(4) standard.
The tester verifies that the Health IT Module is able to receive and process a Return an Acknowledgement Z23 message (in response to a "Send Unsolicited Immunization Update Using a VXU" Z22 message) through visual inspection of the system under test using the Juror Document of the Consume Acknowledgement test step associated with the selected test cases.
The tester uses Test Tool Validation Report from (f)(1)(i)(B) test cases and visual inspection of both the Test Tool Validation Report and the Health IT configuration file to verify the historical vaccine records are represented using § 170.207(e)(3) standard.
The tester uses Test Tool Validation Report from (f)(1)(i)(C) test cases and visual inspection of both the Test Tool Validation Report and the Health IT configuration file to verify administered vaccine records are represented using § 170.207(e)(4) standard.
- Required by December 31, 2025
Using the Normative Test Description section of the Normative Test Process Document:
The tester verifies the Health IT Module creates the source immunization content correctly through visual inspection of the system under test using the test data specification of the Send Administration Message test step associated with the selected test case.
The tester imports the immunization message into the test tool for validation and uses the Validation Report produced by the test tool to verify the Health IT Module passes without error to confirm the immunization information messages conform to the HL7® v2.5.1 Z22 VXU Unsolicited Vaccine Update message of the § 170.205(e)(4) standard.
The tester verifies that the Health IT Module is able to receive and process a Return an Acknowledgement Z23 message (in response to a "Send Unsolicited Immunization Update Using a VXU" Z22 message) through visual inspection of the system under test using the Juror Document of the Consume Acknowledgement test step associated with the selected test cases.
The tester uses Test Tool Validation Report from (f)(1)(i)(B) test cases and visual inspection of both the Test Tool Validation Report and the Health IT configuration file to verify the historical vaccine records are represented using § 170.207(e)(1) standard.
The tester uses Test Tool Validation Report from (f)(1)(i)(C) test cases and visual inspection of both the Test Tool Validation Report and the Health IT configuration file to verify administered vaccine records are represented using § 170.207(e)(2) standard.
Paragraph (f)(1)(ii) Enable a user to request, access and display immunization history
- The Health IT Module creates immunization query content using ONC Supplied Test data for each of the test cases from the Evaluate History and Forecast Test Group under the ONC Certification Test Plan on the Context-Based Validation Tab of the NIST HL7® v2 Immunization Test Suite. All test cases are required. Input may be performed using manual or automated processes.
- For each test case, the Health IT Module generates the indicated HL7® v2.5.1 Z44 QBP query message.
- The Health IT Module electronically receives HL7® evaluated immunization history and forecast HL7® v2.5.1 Z42 RSP or HL7® v2.5.1 Z33 RSP response messages returned for each of the test cases from the Evaluated History and Forecast Test Group under the ONC 2015 Test Plan on the Context-Based Validation Tab of the NIST HL7® v2, Immunization Test Suite, which is in the Return response to the HL7® v2.5.1 Z44 QBP query message initiated in (f)(1)(ii) Request above, formatted according to the § 170.205(e)(4) HL7® 2.5.1 Implementation Guide for Immunization Messaging, Release 1.5. The Health IT Module displays the response to the user.
Using the Normative Test Description section of the Normative Test Process Document:
- The tester verifies that the Health IT Module creates the source immunization query content correctly through visual inspection of the system under test using the test data specification of the Send Query test step associated with the selected test case.
- The tester imports the query message into the test tool for validation and uses the Validation Report produced by the test tool to verify that the Health IT Module passes without error to confirm that the query message is conformant to the HL7® v2.5.1 Z44 QBP Query for Evaluated History and Forecast message profile of the § 170.205(e)(4).
- The tester verifies that the Health IT Module can process each of the following Test Case responses through visual inspection of the system under test using the Juror Document of the second test step (the Return response) associated with the selected test case from the NIST HL7® v2 Immunization Test Suite:
- The tester verifies the Health IT Module is able to display a response that contains evaluated history and forecast information for the test patient, through visual inspection of the system under test using the Juror Document of the Return response test step associated with the selected test case.
- The tester verifies the Health IT Module can process a response with a notification indicating that the query for the Evaluated Immunization History and Immunization Forecast is complete but no matching records were found for the person in the query, through visual inspection of the system under test using the Juror Document of the Return response test step associated with the selected test case.
- The tester verifies the Health IT Module can process a response with a notification indicating that the query for the Evaluated Immunization History and Immunization Forecast is complete but too many matches were found for the patient requested through visual inspection of the system under test using the Juror Document of the Return response test step associated with the selected test case.
| System Under Test | Test Lab Verification |
|---|---|
|
Using the Normative Test Description section of the Normative Test Process Document:
|
Alternative Test Method
| Summary | Alternative Test Method File | Test Tool | Updated On |
|---|---|---|---|
|
Supported by CDC, the Healthcare Information and Management Systems Society Immunization Integration Program (HIMSS-IIP) is a collaborative effort of HIMSS, Drummond Group, and Chickasaw Health Consulting, LLC. HIMSS-IIP was approved as an ONC-Approved Alternate Test Method on October 10, 2017 for testing § 170.315(f)(1). |
HIMSS Immunization Integration Program The ONC–Approved Alternative, HIMSS IIP, has its own set of testing artifacts. For additional information, contact HIMSS IIP. |
|
§ 170.315 (f)(1) Transmission to immunization registries—
- Create immunization information for electronic transmission in accordance with:
- The standard and applicable implementation specifications specified in § 170.205(e)(4).
- At a minimum, the version of the standard specified in § 170.207(e)(1) for historical vaccines.
- At a minimum, the version of the standard specified in § 170.207(e)(2) for administered vaccines.
- Enable a user to request, access, and display a patient's evaluated immunization history and the immunization forecast from an immunization registry in accordance with the standard at § 170.205(e)(4).
Paragraph (f)(1)(i)
§ 170.205(e)(4) Health Level 7 (HL7®) 2.5.1 Implementation Specifications. HL7® 2.5.1 Implementation Guide for Immunization Messaging, Release 1.5, October 2014 and HL7® Version 2.5.1 Implementation Guide for Immunization Messaging (Release 1.5)—Addendum, July 2015
§ 170.207(e)(3) HL7® Standard Code Set CVX— Vaccines Administered, updates through August 17, 2015 (Adoption of this standard expires on January 1, 2026)
§ 170.207(e)(1) HL7® Standard Code Set CVX— Vaccines Administered, updates through June 15, 2022 (This standard is required by December 31, 2025)
§ 170.207(e)(4) National Drug Code (NDC) Directory– Vaccine NDC Linker, updates through August 17, 2015 (Adoption of this standard expires on January 1, 2026)
§ 170.207(e)(2) National Drug Code (NDC) Directory– Vaccine NDC Linker, updates through July 19, 2022 (This standard is required by December 31, 2025)
Paragraph (f)(1)(ii)
§ 170.205(e)(4) HL7® 2.5.1 Implementation Specifications. HL7® 2.5.1 Implementation Guide for Immunization Messaging, Release 1.5, October 2014 and HL7® Version 2.5.1 Implementation Guide for Immunization Messaging (Release 1.5)—Addendum, July 2015
Standards Version Advancement Process (SVAP) Version(s) Approved
HL7® Version 2.5.1 Implementation Guide for Immunization Messaging, Release 1.5 2018 Update
For more information, please visit the Standards Version Advancement Process (SVAP) Version(s) page.
The following outlines deadlines for required updates for this criterion as they relate to changes published in recent ONC final rules. Developers must update their products to the requirements outlined and provide them to their customers by the stated deadlines. These represent one-time deadlines as set by recent regulatory updates and do not encompass ongoing deadlines related to the Conditions and Maintenance of Certification. Please review those requirements for additional compliance activities related to one’s certification under Certification Dependencies.
Deadline: December 31, 2025
Action to be taken: Developers certified to this criterion must update their code sets to reflect, at a minimum, the code sets outlined in subparagraph 170.315(f)(1)(i)(B-C).
Conditions and Maintenance of Certification
Real World Testing: Products certified to this criterion must complete requirements outlined for the Real World Testing Conditions and Maintenance of Certification.
Insights: Products certified to this criterion must submit responses for the following measures:
- §170.407(a)(3)(vi) Immunization administrations electronically submitted to immunization information systems through certified health IT (beginning July 2027)
- §170.407(a)(3)(vii) Immunization history and forecasts through certified health IT (beginning July 2028)
Design and Performance: The following design and performance certification criteria (adopted in § 170.315(g)) must also be certified in order for the product to be certified.
- Quality management system (§ 170.315(g)(4)): When a single quality management system (QMS) is used, the QMS only needs to be identified once. Otherwise, the QMS’ need to be identified for every capability to which it was applied.
- Accessibility-centered design (§ 170.315(g)(5)): When a single accessibility-centered design standard is used, the standard only needs to be identified once. Otherwise, the accessibility-centered design standards need to be identified for every capability to which they were applied; or, alternatively, the developer must state that no accessibility-centered design was used.
This certification criterion was adopted at § 170.315(f)(1). As a result, an ONC Authorized Certification Body (ONC-ACB) must ensure that a product presented for certification to a § 170.315(f) criterion includes the privacy and security criteria (adopted in § 170.315(d)) within the overall scope of the certificate issued to the product.
- The privacy and security criteria (adopted in § 170.315(d)) do not need to be explicitly tested with this specific paragraph (f) criterion unless it is the only criterion for which certification is requested.
- As a general rule, a product presented for certification only needs to be tested once to each applicable privacy and security criterion (adopted in § 170.315(d)) so long as the health IT developer attests that such privacy and security capabilities apply to the full scope of capabilities included in the requested certification. However, exceptions exist for § 170.315(e)(1) “View, download, and transmit to 3rd party (VDT)” and (e)(2) “Secure messaging,” which are explicitly stated.
- § 170.315(d)(2)(i)(C) is not required if the scope of the Health IT Module does not have end-user device encryption features.
For more information on the approaches to meet these Privacy and Security requirements, please review the Privacy and Security CCG.
- If choosing Approach 1:
- Authentication, access control, and authorization (§ 170.315(d)(1))
- Auditable events and tamper-resistance (§ 170.315(d)(2))
- Audit reports (§ 170.315(d)(3))
- End-user device encryption (§ 170.315(d)(7))
- Encrypt authentication credentials (§ 170.315(d)(12))
- Multi-factor authentication (MFA) (§ 170.315(d)(13))
- If choosing Approach 2:
- For each applicable privacy and security certification criterion not certified for Approach 1, the health IT developer may certify using system documentation which is sufficiently detailed to enable integration such that the Health IT Module has implemented service interfaces the Health IT Module to access external services necessary to meet the requirements of the privacy and security certification criterion. Please see the 21st Century Cures Act: Interoperability, Information Blocking, and the ONC Health IT Certification Program Final Rule at 85 FR 25710 for additional clarification.
| Version # | Description of Change | Version Date |
|---|---|---|
| 1.0 |
Initial publication |
03-11-2024
|
- Regulation Text
-
Regulation Text
§ 170.315 (f)(1) Transmission to immunization registries—
- Create immunization information for electronic transmission in accordance with:
- The standard and applicable implementation specifications specified in § 170.205(e)(4).
- At a minimum, the version of the standard specified in § 170.207(e)(1) for historical vaccines.
- At a minimum, the version of the standard specified in § 170.207(e)(2) for administered vaccines.
- Enable a user to request, access, and display a patient's evaluated immunization history and the immunization forecast from an immunization registry in accordance with the standard at § 170.205(e)(4).
- Create immunization information for electronic transmission in accordance with:
- Standard(s) Referenced
-
Paragraph (f)(1)(i)
§ 170.205(e)(4) Health Level 7 (HL7®) 2.5.1 Implementation Specifications. HL7® 2.5.1 Implementation Guide for Immunization Messaging, Release 1.5, October 2014 and HL7® Version 2.5.1 Implementation Guide for Immunization Messaging (Release 1.5)—Addendum, July 2015
§ 170.207(e)(3) HL7® Standard Code Set CVX— Vaccines Administered, updates through August 17, 2015 (Adoption of this standard expires on January 1, 2026)
§ 170.207(e)(1) HL7® Standard Code Set CVX— Vaccines Administered, updates through June 15, 2022 (This standard is required by December 31, 2025)
§ 170.207(e)(4) National Drug Code (NDC) Directory– Vaccine NDC Linker, updates through August 17, 2015 (Adoption of this standard expires on January 1, 2026)
§ 170.207(e)(2) National Drug Code (NDC) Directory– Vaccine NDC Linker, updates through July 19, 2022 (This standard is required by December 31, 2025)
Paragraph (f)(1)(ii)
§ 170.205(e)(4) HL7® 2.5.1 Implementation Specifications. HL7® 2.5.1 Implementation Guide for Immunization Messaging, Release 1.5, October 2014 and HL7® Version 2.5.1 Implementation Guide for Immunization Messaging (Release 1.5)—Addendum, July 2015
Standards Version Advancement Process (SVAP) Version(s) Approved
HL7® Version 2.5.1 Implementation Guide for Immunization Messaging, Release 1.5 2018 Update
For more information, please visit the Standards Version Advancement Process (SVAP) Version(s) page.
- Required Update Deadlines
-
The following outlines deadlines for required updates for this criterion as they relate to changes published in recent ONC final rules. Developers must update their products to the requirements outlined and provide them to their customers by the stated deadlines. These represent one-time deadlines as set by recent regulatory updates and do not encompass ongoing deadlines related to the Conditions and Maintenance of Certification. Please review those requirements for additional compliance activities related to one’s certification under Certification Dependencies.
Deadline: December 31, 2025
Action to be taken: Developers certified to this criterion must update their code sets to reflect, at a minimum, the code sets outlined in subparagraph 170.315(f)(1)(i)(B-C).
- Certification Dependencies
-
Conditions and Maintenance of Certification
Real World Testing: Products certified to this criterion must complete requirements outlined for the Real World Testing Conditions and Maintenance of Certification.
Insights: Products certified to this criterion must submit responses for the following measures:
- §170.407(a)(3)(vi) Immunization administrations electronically submitted to immunization information systems through certified health IT (beginning July 2027)
- §170.407(a)(3)(vii) Immunization history and forecasts through certified health IT (beginning July 2028)
Design and Performance: The following design and performance certification criteria (adopted in § 170.315(g)) must also be certified in order for the product to be certified.
- Quality management system (§ 170.315(g)(4)): When a single quality management system (QMS) is used, the QMS only needs to be identified once. Otherwise, the QMS’ need to be identified for every capability to which it was applied.
- Accessibility-centered design (§ 170.315(g)(5)): When a single accessibility-centered design standard is used, the standard only needs to be identified once. Otherwise, the accessibility-centered design standards need to be identified for every capability to which they were applied; or, alternatively, the developer must state that no accessibility-centered design was used.
- Privacy & Security Requirements
-
This certification criterion was adopted at § 170.315(f)(1). As a result, an ONC Authorized Certification Body (ONC-ACB) must ensure that a product presented for certification to a § 170.315(f) criterion includes the privacy and security criteria (adopted in § 170.315(d)) within the overall scope of the certificate issued to the product.
- The privacy and security criteria (adopted in § 170.315(d)) do not need to be explicitly tested with this specific paragraph (f) criterion unless it is the only criterion for which certification is requested.
- As a general rule, a product presented for certification only needs to be tested once to each applicable privacy and security criterion (adopted in § 170.315(d)) so long as the health IT developer attests that such privacy and security capabilities apply to the full scope of capabilities included in the requested certification. However, exceptions exist for § 170.315(e)(1) “View, download, and transmit to 3rd party (VDT)” and (e)(2) “Secure messaging,” which are explicitly stated.
- § 170.315(d)(2)(i)(C) is not required if the scope of the Health IT Module does not have end-user device encryption features.
For more information on the approaches to meet these Privacy and Security requirements, please review the Privacy and Security CCG.
- If choosing Approach 1:
- Authentication, access control, and authorization (§ 170.315(d)(1))
- Auditable events and tamper-resistance (§ 170.315(d)(2))
- Audit reports (§ 170.315(d)(3))
- End-user device encryption (§ 170.315(d)(7))
- Encrypt authentication credentials (§ 170.315(d)(12))
- Multi-factor authentication (MFA) (§ 170.315(d)(13))
- If choosing Approach 2:
- For each applicable privacy and security certification criterion not certified for Approach 1, the health IT developer may certify using system documentation which is sufficiently detailed to enable integration such that the Health IT Module has implemented service interfaces the Health IT Module to access external services necessary to meet the requirements of the privacy and security certification criterion. Please see the 21st Century Cures Act: Interoperability, Information Blocking, and the ONC Health IT Certification Program Final Rule at 85 FR 25710 for additional clarification.
- Revision History
-
Version # Description of Change Version Date 1.0 Initial publication
03-11-20241.1 Standards Referenced updated to reflect 2024 Approved SVAP Standards.
08-19-2024 - Testing
-
Testing Tool
Criterion Subparagraph Test Data (f)(1) Refer to the NIST HL7® v2 Immunization Test Suite
Certification Companion Guide: Transmission to immunization registries
This Certification Companion Guide (CCG) is an informative document designed to assist with health IT product certification. The CCG is not a substitute for the requirements outlined in regulation and related ONC final rules. It extracts key portions of ONC final rules’ preambles and includes subsequent clarifying interpretations. To access the full context of regulatory intent please consult the Certification Regulations page for links to all ONC final rules or consult other regulatory references as noted. The CCG is for public use and should not be sold or redistributed.
The below table outlines whether this criterion has additional Maintenance of Certification dependencies, update requirements and/or eligibility for standards updates via SVAP. Review the Certification Dependencies and Required Update Deadline drop-downs above if this table indicates “yes” for any field.
| Base EHR Definition | Real World Testing | Insights Condition | SVAP | Requires Updates |
|---|---|---|---|---|
| Not Included | Yes | Yes | Yes | Yes |
Applies to entire criterion
Clarifications:
- For the public health certification criteria in § 170.315(f), health IT will only need to be certified to those criteria that are required to meet the measures the provider intends to report on to meet Objective 8: Public Health and Clinical Data Registry Reporting.
- Any health IT can be certified to this criterion if it can meet all the requirements of the criterion, which include context exchange and vocabulary standards. There is no specified transport standard or mechanism required for this criterion. Consequently, any additional products used to facilitate immunization data submission in the manner required by the public health agency are not required to be included as part of the certified EHR technology (CEHRT) implemented by eligible professionals, eligible hospitals, or critical access hospitals for those CMS programs requiring the use of CEHRT. Please consult the Centers for Medicare & Medicaid Services (CMS) regulations for more specific requirements for meeting the CEHRT definition. [see also 80 FR 62663]
- While no transport standard is required for this criterion, an expert panel convened by the CDC and the American Immunization Registry Association (AIRA) has recommended a SOAP-based standard for transport of immunization data. Developers have the discretion to decide which transport standard(s) to implement. [see also 77 FR 54240]
- CDC issued an addendum to the HL7® 2.5.1 Implementation Guide (IG) for Immunization Messaging (IM), Release 1.5. The addendum consolidates the IG IM Release 1.5 information that clarifies the conformance requirements, but does not specify additional substantive requirements. The addendum was adopted with the IG IM Release 1.5 for purposes of testing and certification to this criterion. [80 FR 62663]
- The criterion is not intended to specify when submissions should be made or the periodicity of the submissions. Consequently, submitting batch files to an immunization registry, provided that they are formatted according to the adopted standards referenced by this certification criterion, is not prohibited by this certification criterion and would be acceptable.
- The process for submitting immunization data often differs between public health agencies. ONC recommends developers work with the state or local immunization registry for guidance on how to submit the immunization data.
- ONC provides the following object identifiers (OIDs) to assist developers in the proper identification and exchange of health information coded to certain vocabulary standards.
- HL7® Standard Code Set CVX – Vaccine Administered OID: 2.16.840.1.113883.12.292
- National Drug Code Directory OID: 2.16.840.1.113883.6.69 [80 FR 62612]
- Health IT Modules can present for certification to a more recent version of the CVX – Vaccines Administered and National Drug Code Directory – Vaccine Codes code sets than outlined in regulation per ONC’s policy that permits certification to a more recent version of certain vocabulary standards.
- NIST published a “NIST Clarifications and Validation Guidelines” document, which can be used as a resource during validation testing for this criterion. It is available under “User Documentation” on the NIST Immunization Test Suite page and labeled “NIST Clarifications and Validation Guidelines.”
|
Clarifications:
|
Paragraph (f)(1)(i) Transmission to immunization registries
Technical outcome – The Health IT Module can create immunization information according to the IG IM Release 1.5, and the July 2015 Addendum, using CVX codes for historical vaccines and NDC codes for newly administered vaccines.
Clarifications:
- For the purposes of administered vaccines, when an immunization is reported at the time it is administered and the actual product is known, the NDC code must be sent. ONC clarifies that for when sending historical vaccines and the actual NDC code is not available, CVX codes can be sent as this method would be supported by health IT certified to this criterion. [see also 80 FR 62663-62664]
- Health IT Modules must have the capability to produce a VXU message that contains multiple vaccine records implemented according to the implementation guide at § 170.205(e)(4) but are not prohibited from supporting additional workflows beyond the requirements in § 170.315(f)(5) that enable things like real-time vaccine reporting to support public health.
|
Technical outcome – The Health IT Module can create immunization information according to the IG IM Release 1.5, and the July 2015 Addendum, using CVX codes for historical vaccines and NDC codes for newly administered vaccines. Clarifications:
|
Paragraph (f)(1)(ii) Transmission to immunization registries
Technical outcome – The Health IT Module enables a user to request, access and display the evaluated immunization history and forecast from an immunization registry for a patient in accordance with the HL7® 2.5.1 standard, the HL7® 2.5.1. IG IM Release 1.5, and July 2015 Addendum.
Clarifications:
- Health IT (e.g., EHR products) may sometimes have a version of the immunization history that differs from the history in the immunization registry. Likewise, health IT that includes immunization forecasting capabilities may produce a forecast that differs from one produced by the immunization registry. ONC still believes that it is important for an EHR to receive the history and forecast from the registry. Based on compliance with the Release 1.5 IG, a user would be able to see and compare the history and forecast from the certified health IT with the history and forecast from the immunization registry. However, ONC notes that this criterion does not prescribe a particular workflow or reconciliation requirements. Providers and health IT developers may reconcile forecast and history information in a manner that best meets their needs for workflow and patient safety. [see also 80 FR 62664]
|
Technical outcome – The Health IT Module enables a user to request, access and display the evaluated immunization history and forecast from an immunization registry for a patient in accordance with the HL7® 2.5.1 standard, the HL7® 2.5.1. IG IM Release 1.5, and July 2015 Addendum. Clarifications:
|