PART 170—HEALTH INFORMATION TECHNOLOGY STANDARDS, IMPLEMENTATION SPECIFICATIONS, AND CERTIFICATION CRITERIA AND CERTIFICATION PROGRAMS FOR HEALTH INFORMATION TECHNOLOGY 

1. The authority citation for part 170 continues to read as follows:  Authority: 42 U.S.C. 300jj-11; 42 U.S.C 300jj-14; 5 U.S.C. 553. 

2. Amend § 170.102 by:  a. Removing definitions for “2015 Edition Base EHR” and “2015 Edition health IT certification criteria”; and  b. Adding definitions for “Base EHR”, “ONC certification criteria for health IT”, “Predictive Decision Support Intervention”, “Provide”, and “Revised certification criterion (or criteria)” in alphabetical order.  The additions read as follows: 
§ 170.102  Definitions. Base EHR means an electronic record of health-related information on an individual that: (1) Includes patient demographic and clinical health information, such as medical history and problem lists; (2) Has the capacity: (i) To provide clinical decision support; (ii) To support physician order entry; (iii) To capture and query information relevant to healthcare quality; (iv) To exchange electronic health information with, and integrate such information from other sources; and (3) Has been certified to the certification criteria adopted by the Secretary in— (i) Section 170.315(a)(1), (2), or (3); (a)(5) and (14), (b)(1), (c)(1), and (g)(7), (9), (10); and (h)(1) or (2); (ii) Section 170.315(a)(9) or (b)(11) for the period up to and including December 31, 2024; and (iii) Section 170.315(b)(11) on and after January 1, 2025.      ONC certification criteria for health IT means the certification criteria in § 170.315.      Predictive Decision Support Intervention or Predictive DSI means technology that supports decision-making based on algorithms or models that derive relationships from training data and then produces an output that results in prediction, classification, recommendation, evaluation, or analysis.      Provide means the action or actions taken by a developer of certified Health IT Modules to make the certified health IT available to its customers.      Revised certification criterion (or criteria) means a certification criterion that meets at least one of the following: (1) Has added or changed the capabilities described in the existing criterion in this part; (2) Has an added or changed standard or implementation specification referenced in the existing criterion in this part; or (3) Is specified through notice and comment rulemaking as an iterative or replacement version of an existing criterion in this part.     * 3. Amend § 170.205 by:  a. Revising paragraph (a)(5); and  b. Adding paragraphs (a)(6) and (t).  The revision and additions read as follows: § 170.205  Content exchange standards and implementation specifications for exchanging electronic health information. (a)    (5) Standard. HL7 CDA® R2 Implementation Guide: C-CDA Templates for Clinical Notes R2.1 Companion Guide, Release 2 (incorporated by reference, see § 170.299). The adoption of this standard expires on January 1, 2026. (6) Standard. HL7® CDA® R2 Implementation Guide: C-CDA Templates for Clinical Notes STU Companion Guide, Release 4.1—US Realm (incorporated by reference, see § 170.299).      (t) Public health—electronic case reporting— (1) Standard. HL7® FHIR® Implementation Guide: Electronic Case Reporting (eCR)—US Realm 2.1.0—STU 2 US (HL7 FHIR eCR IG) (incorporated by reference, see § 170.299). (2) Standard. HL7 CDA® R2 Implementation Guide: Public Health Case Report—the Electronic Initial Case Report (eICR) Release 2, STU Release 3.1—US Realm (HL7 CDA eICR IG) (incorporated by reference, see § 170.299). (3) Standard. HL7® CDA® R2 Implementation Guide: Reportability Response, Release 1, STU Release 1.1—US Realm (HL7 CDA RR IG) (incorporated by reference, see § 170.299). (4) Standard. Reportable Conditions Trigger Codes Value Set for Electronic Case Reporting. (incorporated by reference, see § 170.299). 

4. Amend § 170.207 by:  a. Adding paragraph (a)(1);  b. Removing and reserving paragraph (a)(3);  c. Adding paragraph (c)(1);  d. Removing and reserving paragraph (c)(2);  e. Adding paragraphs (d)(1) and (4);  f. Adding paragraphs (e)(1) and (2), (f)(3)and (m)(2);  g. Revising paragraph (n)(1);  h. Adding paragraphs (n)(2) and (3);  i. Revising paragraphs (o)and (p); and  j. Adding paragraphs (r)(2) and (s)(2).  The additions and revisions read as follows: § 170.207 Vocabulary standards for representing electronic health information. (a)    (1) Standard. SNOMED CT®, U.S. Edition, March 2022 Release (incorporated by reference, see § 170.299).      (c)    (1) Standard. Logical Observation Identifiers Names and Codes (LOINC®) Database Version 2.72, a universal code system for identifying health measurements, observations, and documents produced by the Regenstrief Institute, Inc., February 16, 2022 (incorporated by reference, see § 170.299).      (d)    (1) Standard. RxNorm, a standardized nomenclature for clinical drugs produced by the United States National Library of Medicine, July 5, 2022 (incorporated by reference, see § 170.299).      (4) Standard. The code set specified at 45 CFR 162.1002(b)(2) as referenced in 45 CFR 162.1002(c)(1) for the time period on or after October 1, 2015. (e)    (1) Standard. HL7® Standard Code Set CVX—Vaccines Administered, dated through June 15, 2022 (incorporated by reference, see § 170.299). (2) Standard. National Drug Code Directory (NDC)—Vaccine NDC Linker, dated July 19, 2022 (incorporated by reference, see § 170.299).      (f)    (3) Standard. CDC Race and Ethnicity Code Set Version 1.2 (July 08, 2021) (incorporated by reference, see § 170.299).      (m)    (2) Standard. The Unified Code for Units of Measure, Version 2.1, November 21, 2017 (incorporated by reference, see § 170.299). (n)    (1) Standard. Birth sex must be coded in accordance with HL7® Version 3 Standard, Value Sets for AdministrativeGender and NullFlavor (incorporated by reference, see § 170.299), up until the adoption of this standard expires January 1, 2026, attributed as follows: (i) Male. M; (ii) Female. F; (iii) Unknown. NullFlavor UNK. (2) Standard. Sex must be coded in accordance with, at a minimum, the version of SNOMED CT ® U.S. Edition codes specified in paragraph (a)(1) of this section. (3) Standard. Sex Parameter for Clinical Use must be coded in accordance with, at a minimum, the version of LOINC® codes specified in paragraph (c)(1) of this section. (o) Sexual orientation and gender information —(1) Standard. Sexual orientation must be coded in accordance with, at a minimum, the version of SNOMED-CT® U.S. Edition codes specified in paragraph (a)(4) of this section for paragraphs (o)(1)(i) through (iii) of this section and HL7 Version 3 Standard, Value Sets for AdministrativeGender and NullFlavor (incorporated by reference, see § 170.299), up until the adoption of this standard expires on January 1, 2026, for paragraphs (o)(1)(iv) through (vi) of this section, attributed as follows: (i) Lesbian, gay or homosexual. 38628009 (ii) Straight or heterosexual. 20430005 (iii) Bisexual. 42035005 (iv) Something else, please describe. NullFlavor OTH (v) Don't know. NullFlavor UNK (vi) Choose not to disclose. NullFlavor ASKU (2) Standard. Gender identity must be coded in accordance with, at a minimum, the version of SNOMED-CT® codes specified in paragraph (a)(4) of this section for paragraphs (o)(2)(i) through (v) of this section and HL7® Version 3 Standard, Value Sets for AdministrativeGender and NullFlavor (incorporated by reference in § 170.299), up until the adoption of this standard expires January 1, 2026, for paragraphs (o)(2)(vi) and (vii) of this section, attributed as follows: (i) Male. 446151000124109 (ii) Female. 446141000124107 (iii) Female-to-Male (FTM)/Transgender Male/Trans Man. 407377005 (iv) Male-to-Female (MTF)/Transgender Female/Trans Woman. 407376001 (v) Genderqueer, neither exclusively male nor female. 446131000124102 (vi) Additional gender category or other, please specify. NullFlavor OTH (vii) Choose not to disclose. NullFlavor ASKU (3) Standard. Sexual Orientation and Gender Identity must be coded in accordance with, at a minimum, the version of SNOMED CT® codes specified in paragraph (a)(1) of this section. (4) Standard. Pronouns must be coded in accordance with, at a minimum, the version of LOINC® codes specified in paragraph (c)(1) of this section. (p) Social, psychological, and behavioral data —(1) Financial resource strain. Financial resource strain must be coded in accordance with, at a minimum, the version of LOINC® codes specified in paragraph (c)(1) of this section and attributed with the LOINC® code 76513-1 and LOINC® answer list ID LL3266-5. (2) Education. Education must be coded in accordance with, at a minimum, the version of LOINC® codes specified in paragraph (c)(1) of this section and attributed with LOINC® code 63504-5 and LOINC® answer list ID LL1069-5. (3) Stress. Stress must be coded in accordance with, at a minimum, the version of LOINC® codes specified in paragraph (c)(1) of this section and attributed with the LOINC® code 76542-0 and LOINC® answer list LL3267-3. (4) Depression. Depression must be coded in accordance with, at a minimum, the version of LOINC® codes specified in paragraph (c)(1) of this section and attributed with LOINC® codes 55757-9, 44250-9 (with LOINC® answer list ID LL361-7), 44255-8 (with LOINC® answer list ID LL361-7), and 55758-7 (with the answer coded with the associated applicable unit of measure in the standard specified in paragraph (m)(2) of this section). (5) Physical activity. Physical activity must be coded in accordance with, at a minimum, the version of LOINC® codes specified in paragraph (c)(1) of this section and attributed with LOINC® codes 68515-6 and 68516-4. The answers must be coded with the associated applicable unit of measure in the standard specified in paragraph (m)(2) of this section. (6) Alcohol use. Alcohol use must be coded in accordance with, at a minimum, the version of LOINC® codes specified in paragraph (c)(1) of this section and attributed with LOINC® codes 72109-2, 68518-0 (with LOINC® answer list ID LL2179-1), 68519-8 (with LOINC® answer list ID LL2180-9), 68520-6 (with LOINC® answer list ID LL2181-7), and 75626-2 (with the answer coded with the associated applicable unit of measure in the standard specified in paragraph (m)(2) of this section). (7) Social connection and isolation. Social connection and isolation must be coded in accordance with, at a minimum, the version of LOINC® codes specified in paragraph (c)(1) of this section and attributed with the LOINC® codes 76506-5, 63503-7 (with LOINC® answer list ID LL1068-7), 76508-1 (with the associated applicable unit of measure in the standard specified in paragraph (m)(2) of this section), 76509-9 (with the associated applicable unit of measure in the standard specified in paragraph (m)(2) of this section), 76510-7 (with the associated applicable unit of measure in the standard specified in paragraph (m)(2) of this section), 76511-5 (with LOINC answer list ID LL963-0), and 76512-3 (with the associated applicable unit of measure in the standard specified in paragraph (m)(2) of this section). (8) Exposure to violence (intimate partner violence). Exposure to violence: Intimate partner violence must be coded in accordance with, at a minimum, the version of LOINC® codes specified in paragraph (c)(1) of this section and attributed with the LOINC® code 76499-3, 76500-8 (with LOINC® answer list ID LL963-0), 76501-6 (with LOINC® answer list ID LL963-0), 76502-4 (with LOINC® answer list ID LL963-0), 76503-2 (with LOINC® answer list ID LL963-0), and 76504-0 (with the associated applicable unit of measure in the standard specified in paragraph (m)(2) of this section).      (r)    (2) Standard. Medicare Provider and Supplier Taxonomy Crosswalk, 2021 (incorporated by reference, see § 170.299). (s)   * (2) Standard. Public Health Data Standards Consortium Users Guide for Source of Payment Typology, Version 9.2 (incorporated by reference, see § 170.299). 5. Amend § 170.210 by revising paragraph (g) to read as follows:  § 170.210  Standards for health information technology to protect electronic health information created, maintained, and exchanged.      (g) Synchronized clocks. The date and time recorded utilize a system clock that has been synchronized using any Network Time Protocol (NTP) standard.      6. Revise § 170.213 to read as follows:  § 170.213 United States Core Data for Interoperability. The Secretary adopts the following versions of the United States Core Data for Interoperability standard: (a) Standard. United States Core Data for Interoperability (USCDI), July 2020 Errata, Version 1 (v1) (incorporated by reference, see § 170.299). The adoption of this standard expires on January 1, 2026. (b) Standard. United States Core Data for Interoperability Version 3 (USCDI v3) (incorporated by reference, see § 170.299). 7. Revise § 170.215 to read as follows:  § 170.215 Application Programming Interface Standards. The Secretary adopts the following standards and associated implementation specifications as the available standards for application programming interfaces (API): (a) API base standard. The following are applicable for purposes of standards-based APIs. (1) Standard. HL7® Fast Healthcare Interoperability Resources (FHIR®) Release 4.0.1 (incorporated by reference, see § 170.299). (2) [Reserved] (b) API constraints and profiles. The following are applicable for purposes of constraining and profiling data standards. (1) United States Core Data Implementation Guides— (i) Implementation specification. HL7® FHIR® US Core Implementation Guide STU 3.1.1 (incorporated by reference in § 170.299). The adoption of this standard expires on January 1, 2026. (ii) Implementation Specification. HL7® FHIR® US Core Implementation Guide STU 6.1.0 (incorporated by reference, see § 170.299). (2) [Reserved] (c) Application access and launch. The following are applicable for purposes of enabling client applications to access and integrate with data systems. (1) Implementation specification. HL7® SMART Application Launch Framework Implementation Guide Release 1.0.0, including mandatory support for the “SMART Core Capabilities” (incorporated by reference, see § 170.299). The adoption of this standard expires on January 1, 2026. (2) Implementation specification. HL7® SMART App Launch Implementation Guide Release 2.0.0, including mandatory support for the “Capability Sets” of “Patient Access for Standalone Apps” and “Clinician Access for EHR Launch”; all “Capabilities” as defined in “8.1.2 Capabilities,” excepting the “permission-online” capability; “Token Introspection” as defined in “7 Token Introspection” (incorporated by reference, see § 170.299). (d) Bulk export and data transfer standards. The following are applicable for purposes of enabling access to large volumes of information on a group of individuals. (1) Implementation specification. FHIR® Bulk Data Access (Flat FHIR®) (v1.0.0: STU 1), including mandatory support for the “group-export” “OperationDefinition” (incorporated by reference, see § 170.299). (2) [Reserved] (e) API authentication, security, and privacy. The following are applicable for purposes of authorizing and authenticating client applications. (1) Standard. OpenID Connect Core 1.0, incorporating errata set 1 (incorporated by reference, see § 170.299). (2) [Reserved] 8. Amend § 170.299 by:  a. Revising paragraph (a) and the introductory text of paragraph (d);  b. Adding paragraphs (d)(17) through (19);  c. Revising the introductory text of paragraph (e) and adding paragraph (e)(6)  d. Removing paragraph (j) and redesignating paragraphs (f) through (i) as paragraphs (g) through (j), respectively;  e. Adding new paragraph (f);  f. Revising the introductory text of newly redesignated paragraph (g) and adding paragraphs (g)(35) through (40);  g. Revising the introductory text of paragraph (m) and adding paragraph (m)(6);  h. Revising the introductory text of paragraph (o) and adding paragraph (o)(2);  i. Revising the introductory text of paragraph (p) and adding paragraphs (p)(5) and (6);  j. Revising the introductory text of paragraph (r) and adding paragraphs (r)(8) and (9).  The revisions and additions read as follows: § 170.299  Incorporation by reference. (a) Certain material is incorporated by reference into this part with the approval of the Director of the Federal Register under 5 U.S.C. 552(b) and 1 CFR part 51. All approved incorporation by reference (IBR) material is available for inspection at the U.S. Department of Health and Human Services (HHS) and at the National Archives and Records Administration (NARA). Contact HHS at: U.S. Department of Health and Human Services, Office of the National Coordinator for Health Information Technology, 330 C Street SW, Washington, DC 20201; call ahead to arrange for inspection at 202-690-7151. For information on the availability of this material at NARA, visit www.archives.gov/ federal-register/ cfr/ ibr-locations or email fr.inspection@nara.gov. The material may be obtained from the sources in the following paragraphs of this section.      (d) Centers for Disease Control and Prevention, 2500 Century Parkway, Mailstop E-78, Atlanta, GA 30333; phone: (800) 232-4636); website: www.cdc.gov/ cdc-info/ index.html      (17) HL7® Standard Code Set CVX—Vaccines Administered, dated June 15, 2022; IBR approved for § 170.207(e). (18) National Drug Code Directory (NDC)—Vaccine NDC Linker, dated July 19, 2022; IBR approved for § 170.207(e). (19) CDC Race and Ethnicity Code Set version 1.2 (July 08, 2021); IBR approved for § 170.207(f). (e) Centers for Medicare & Medicaid Services, Office of Clinical Standards and Quality, 7500 Security Boulevard, Baltimore, Maryland 21244; phone: (410) 786-3000; website: www.cms.gov.      (6) Medicare Provider and Supplier Taxonomy Crosswalk, 2021; IBR approved for § 170.207(r). (f) Council of State and Territorial Epidemiologists, 2635 Century Parkway NE, Suite 700, Atlanta, GA 30345; phone: (770) 458-3811; website: www.cste.org/  (1) Reportable Conditions Trigger Codes Value Set for Electronic Case Reporting. RCTC OID: 2.16.840.1.114222.4.11.7508, Release March 29, 2022; IBR approved for § 170.205(t). (2) [Reserved] (g) Health Level Seven, 3300 Washtenaw Avenue, Suite 227, Ann Arbor, MI 48104; phone: (734) 677-7777; website: www.hl7.org/       (35) HL7 CDA® R2 Implementation Guide: C-CDA Templates for Clinical Notes STU Companion Guide, Release 4.1 (US Realm) Standard for Trial Use, Specification Version: 4.1.1, June 2023 (including appendices A and B); IBR approved for § 170.205(a). (36) HL7 FHIR® Implementation Guide: Electronic Case Reporting (eCR)—US Realm, Version 2.1.0—STU 2 US (HL7 FHIR eCR IG), August 31, 2022; IBR approved for § 170.205(t). (37) HL7 CDA® R2 Implementation Guide: Public Health Case Report—the Electronic Initial Case Report (eICR) Release 2, STU Release 3.1—US Realm (HL7 CDA eICR IG), July 2022, volumes 1 and 2; IBR approved for § 170.205(t). (38) HL7 CDA® R2 Implementation Guide: Reportability Response, Release 1, STU Release 1.1—US Realm (HL7 CDA RR IG), July 2022, volumes 1 through 4; IBR approved for § 170.205(t). (39) HL7 FHIR US Core Implementation Guide Version 6.1.0—STU 6, June 19, 2023; IBR approved for § 170.215(b). (40) HL7 FHIR® SMART App Launch [Implementation Guide], 2.0.0—Standard for Trial Use, November 26, 2021; IBR approved for § 170.215(c).      (m) Office of the National Coordinator for Health Information Technology (ONC), 330 C Street SW, Washington, DC 20201; phone: (202) 690-7151; website: https://healthit.gov.      (6) United States Core Data for Interoperability (USCDI), Version 3 (v3), October 2022 Errata; IBR approved for § 170.213(b).      (o) Public Health Data Standards Consortium, 111 South Calvert Street, Suite 2700, Baltimore, MD 21202; phone: (801) 532-2299; website: www.Ph.D.sc.org/ .      (2) Users Guide for Source of Payment Typology, Version 9.2, December 2020; IBR approved for § 170.207(s). (p) Regenstrief Institute, Inc., LOINC® c/o Regenstrief Center for Biomedical Informatics, Inc., 410 West 10th Street, Suite 2000, Indianapolis, IN 46202-3012; phone: (317) 274-9000; website: https://loinc.org/  and https://ucum.org/ ucum.      (5) Logical Observation Identifiers Names and Codes (LOINC®) Database Version 2.72, February 2022; IBR approved for § 170.207(c). (6) The Unified Code for Units of Measure, Version 2.1, November 21, 2017; IBR approved for § 170.207(m).      (r) U.S. National Library of Medicine, 8600 Rockville Pike, Bethesda, MD 20894; phone (301) 594-5983; website: www.nlm.nih.gov/ .      (8) SNOMED CT® [Systematized Nomenclature of Medicine Clinical Terms] U.S. Edition, March 2022 Release; IBR approved for § 170.207(a). (9) RxNorm, Full Update Release, July 5, 2022; IBR approved for § 170.207(d).      9. Amend § 170.315 by:  a. Revising the section heading, introductory text, and paragraphs (a)(5) paragraph heading, (a)(5)(i) introductory text, (a)(5)(i)(A)( 1) and ( 2), (a)(5)(i)(C), (D), and (E); b. Adding paragraphs (a)(5)(i)(F), (G), and (H) and (a)(9)(vi);  c. Revising paragraphs (a)(12), (b)(1)(iii)(A)( 1) and ( 2); (b)(1)(iii)(B)( 2), (b)(1)(iii)(G) introductory text, (b)(1)(iii)(G)( 3), (b)(2)(i) and (ii), (b)(2)(iii)(D), and (b)(2)(iv), (b)(3), (b)(6)(ii)(B)( 2), (b)(9)(ii); d. Adding paragraph (b)(11);  e. Revising paragraphs (c)(4)(iii)(C), (E), (G), (H), and (I);  f. Revising paragraphs (e)(1)(i)(A)( 1) and ( 2), (e)(1)(i)(B)( 1) and ( 2), and adding paragraph (e)(1)(iii); g. Revising paragraphs (f)(1)(i)(B) and (C), (f)(3)(ii), (f)(4)(ii), (f)(5); and  h. Revising paragraphs (g)(3) introductory text, (g)(6)(i)(A) and (B), (g)(9)(i)(A)( 1) and ( 2), (g)(10)(i)(A) and (B), (g)(10)(ii)(A) and (B), (g)(10)(iv)(A) and (B), (g)(10)(v)(A)( 1)(i), ( ii) and (B), ( 2)( i) and ( ii), (g)(10)(vi), and (g)(10)(vii). The revisions and additions read as follows: § 170.315  ONC Certification Criteria for Health IT. The Secretary adopts the following certification criteria for health IT. Health IT must be able to electronically perform the following capabilities in accordance with applicable standards and implementation specifications adopted in this part. For all criteria in this section, a health IT developer with a Health IT Module certified to any revised certification criterion, as defined in § 170.102, shall update the Health IT Module and shall provide such update to their customers in accordance with the dates identified for each revised certification criterion and for each applicable standard in 45 CFR part 170 subpart B. (a)    (5) Patient demographics and observations. (i) Enable a user to record, change, and access patient demographic and observations data including race, ethnicity, preferred language, sex, sex parameter for clinical use, sexual orientation, gender identity, name to use, pronouns, and date of birth. (A)    ( 1) Enable each one of a patient's races to be recorded in accordance with, at a minimum, the standard specified in § 170.207(f)(3) and whether a patient declines to specify race. ( 2) Enable each one of a patient's ethnicities to be recorded in accordance with, at a minimum, the standard specified in § 170.207(f)(3) and whether a patient declines to specify ethnicity.      (C) Sex. Enable sex to be recorded in accordance with the standard specified in § 170.207(n)(1) for the period up to and including December 31, 2025; or § 170.207(n)(2). (D) Sexual orientation. Enable sexual orientation to be recorded in accordance with, at a minimum, the version of the standard specified in § 170.207(o)(1) for the period up to and including December 31, 2025; or § 170.207(o)(3), as well as whether a patient declines to specify sexual orientation. (E) Gender identity. Enable gender identity to be recorded in accordance with, at a minimum, the version of the standard specified in § 170.207(o)(2) for the period up to and including December 31, 2025; or § 170.207(o)(3), as well as whether a patient declines to specify gender identity. (F) Sex Parameter for Clinical Use. Enable at least one sex parameter for clinical use to be recorded in accordance with, at a minimum, the version of the standard specified in § 170.207(n)(3). Conformance with this paragraph is required by January 1, 2026. (G) Name to Use. Enable at least one preferred name to use to be recorded. Conformance with this paragraph is required by January 1, 2026. (H) Pronouns. Enable at least one pronoun to be recorded in accordance with, at a minimum, the version of the standard specified in § 170.207(o)(4). Conformance with this paragraph is required by January 1, 2026.      (9)    (vi) Expiration of Criterion. The adoption of this criterion for purposes of the ONC Health IT Certification Program expires on January 1, 2025.      (12) Family health history. Enable a user to record, change, and access a patient's family health history in accordance with the familial concepts or expressions included in, at a minimum, the version of the standard in § 170.207(a)(1).      (b)    (1)    (iii)    (A)    ( 1) The data classes expressed in the standards in § 170.213 and in accordance with § 170.205(a)(4), (5), and paragraphs (b)(1)(iii)(A)( 3)( i) through ( iii) of this section for the time period up to and including December 31, 2025, or ( 2) The data classes expressed in the standards in § 170.213 and in accordance with § 170.205(a)(4), (6), and paragraphs (b)(1)(iii)(A)( 3)( i) through ( iii) of this section, and      (B)    ( 2) At a minimum, the version of the standard specified in § 170.207(a)(1).      (G) Patient matching data. First name, last name, previous name, middle name (including middle initial), suffix, date of birth, current address, phone number, and sex. The following constraints apply:      ( 3) Sex Constraint: Represent sex with the standards adopted in § 170.207(n)(2). (2)    (i) General Requirements. Paragraphs (b)(2)(ii) and (iii) of this section must be completed based on the receipt of a transition of care/referral summary formatted in accordance with the standards adopted in § 170.205(a)(3) through (5) using the Continuity of Care Document, Referral Note, and (inpatient setting only) Discharge Summary document templates, for time period up to and including December 31, 2025; or in accordance with the standards adopted in § 170.205(a)(3), (4), (6). (ii) Correct patient. Upon receipt of a transition of care/referral summary formatted according to the standards adopted § 170.205(a)(3) through (5) for the period up to and including December 31, 2025; or according to the standards adopted § 170.205(a)(3), (4), and (6), technology must be able to demonstrate that the transition of care/referral summary received can be properly matched to the correct patient. (iii)    (D) Upon a user's confirmation, automatically update the list, and incorporate the following data expressed according to the specified standards:      (iv) System verification. Based on the data reconciled and incorporated, the technology must be able to create a file formatted according to the standard specified in § 170.205(a)(4) using the Continuity of Care Document template and the standard specified in paragraph (a)(5) of this section for the time period up to and including December 31, 2025; or according to the standard specified in § 170.205(a)(4) using the Continuity of Care Document template and the standard specified in paragraph (a)(6) of this section.      (3)    (ii)    (A) Enable a user to perform the following prescription-related electronic transactions in accordance with the standard specified in § 170.205(b)(1) and, at a minimum, the version of the standard specified in § 170.207(d)(1) as follows: (6)    (ii)    (B)    ( 2) At a minimum, the version of the standard specified in § 170.207(a)(1).     * (9)    (ii) The standard in § 170.205(a)(5) for the time period up to and including December 31, 2025; or § 170.205(a)(6).      (11) Decision support interventions — (i) Decision support intervention interaction. Interventions provided to a user must occur when a user is interacting with technology. (ii) Decision support configuration. (A) Enable interventions specified in paragraphs (b)(11)(iii) of this section to be configured by a limited set of identified users based on a user's role. (B) Enable interventions when a patient's medications, allergies and intolerance, and problems are incorporated from a transition of care or referral summary received and pursuant to paragraph (b)(2)(iii)(D) of this section. (C) Enable a user to provide electronic feedback data for evidence-based decision support interventions selected via the capability provided in paragraph (b)(11)(iii)(A) of this section and make available such feedback data to a limited set of identified users for export, in a computable format, including at a minimum the intervention, action taken, user feedback provided (if applicable), user, date, and location. (iii) Decision support intervention selection. Enable a limited set of identified users to select ( i.e., activate) electronic decision support interventions (in addition to drug-drug and drug-allergy contraindication checking) that are: (A) Evidence-based decision support interventions and use any data based on the following data expressed in the standards in § 170.213: ( 1) Problems; ( 2) Medications; ( 3) Allergies and Intolerances; ( 4) At least one demographic specified in paragraph (a)(5)(i) of this section; ( 5) Laboratory; ( 6) Vital Signs; ( 7) Unique Device Identifier(s) for a Patient's Implantable Device(s); and ( 8) Procedures. (B) Predictive Decision Support Interventions and use any data expressed in the standards in § 170.213. (iv) Source attributes. Source attributes listed in paragraphs (b)(11)(iv)(A) and (B) of this section must be supported. (A) For evidence-based decision support interventions: ( 1) Bibliographic citation of the intervention (clinical research or guideline); ( 2) Developer of the intervention (translation from clinical research or guideline); ( 3) Funding source of the technical implementation for the intervention(s) development; ( 4) Release and, if applicable, revision dates of the intervention or reference source; ( 5) Use of race as expressed in the standards in § 170.213; ( 6) Use of ethnicity as expressed in the standards in § 170.213; ( 7) Use of language as expressed in the standards in § 170.213; ( 8) Use of sexual orientation as expressed in the standards in § 170.213; ( 9) Use of gender identity as expressed in the standards in § 170.213; ( 10) Use of sex as expressed in the standards in § 170.213; ( 11) Use of date of birth as expressed in the standards in § 170.213; ( 12) Use of social determinants of health data as expressed in the standards in § 170.213; and ( 13) Use of health status assessments data as expressed in the standards in § 170.213. (B) For Predictive Decision Support Interventions: ( 1) Details and output of the intervention, including: ( i) Name and contact information for the intervention developer; ( ii) Funding source of the technical implementation for the intervention(s) development; ( iii) Description of value that the intervention produces as an output; and ( iv) Whether the intervention output is a prediction, classification, recommendation, evaluation, analysis, or other type of output. ( 2) Purpose of the intervention, including: ( i) Intended use of the intervention; ( ii) Intended patient population(s) for the intervention's use; ( iii) Intended user(s); and ( iv) Intended decision-making role for which the intervention was designed to be used/for ( e.g., informs, augments, replaces clinical management). ( 3) Cautioned out-of-scope use of the intervention, including: ( i) Description of tasks, situations, or populations where a user is cautioned against applying the intervention; and ( ii) Known risks, inappropriate settings, inappropriate uses, or known limitations. ( 4) Intervention development details and input features, including at a minimum: ( i) Exclusion and inclusion criteria that influenced the training data set; ( ii) Use of variables in paragraphs (b)(11)(iv)(A)( 5) through ( 13) of this section as input features; ( iii) Description of demographic representativeness according to variables in paragraphs (b)(11)(iv)(A)( 5) through ( 13) of this section including, at a minimum, those used as input features in the intervention; ( iv) Description of relevance of training data to intended deployed setting; and ( 5) Process used to ensure fairness in development of the intervention, including: ( i) Description of the approach the intervention developer has taken to ensure that the intervention's output is fair; and ( ii) Description of approaches to manage, reduce, or eliminate bias. ( 6) External validation process, including: ( i) Description of the data source, clinical setting, or environment where an intervention's validity and fairness has been assessed, other than the source of training and testing data ( ii) Party that conducted the external testing; ( iii) Description of demographic representativeness of external data according to variables in paragraph (b)(11)(iv)(A)( 5)-( 13) including, at a minimum, those used as input features in the intervention; and ( iv) Description of external validation process. ( 7) Quantitative measures of performance, including: ( i) Validity of intervention in test data derived from the same source as the initial training data; ( ii) Fairness of intervention in test data derived from the same source as the initial training data; ( iii) Validity of intervention in data external to or from a different source than the initial training data; ( i v) Fairness of intervention in data external to or from a different source than the initial training data; ( v) References to evaluation of use of the intervention on outcomes, including, bibliographic citations or hyperlinks to evaluations of how well the intervention reduced morbidity, mortality, length of stay, or other outcomes; ( 8) Ongoing maintenance of intervention implementation and use, including: ( i) Description of process and frequency by which the intervention's validity is monitored over time; ( ii) Validity of intervention in local data; ( iii) Description of the process and frequency by which the intervention's fairness is monitored over time; ( iv) Fairness of intervention in local data; and ( 9) Update and continued validation or fairness assessment schedule, including: ( i) Description of process and frequency by which the intervention is updated; and ( ii) Description of frequency by which the intervention's performance is corrected when risks related to validity and fairness are identified. (v) Source attribute access and modification. (A) Access. ( 1) For evidence-based decision support interventions and Predictive Decision Support Interventions supplied by the health IT developer as part of its Health IT Module, the Health IT Module must enable a limited set of identified users to access complete and up-to-date plain language descriptions of source attribute information specified in paragraphs (b)(11)(iv)(A) and (B) of this section. (2) For Predictive Decision Support Interventions supplied by the health IT developer as part of its Health IT Module, the Health IT Module must indicate when information is not available for review for source attributes in paragraphs (b)(11)(iv)(B)( 6); (b)(11)(iv)(B)( 7)( iii), ( iv), and ( v); (b)(11)(iv)(B)( 8)( ii) and ( iv); and (b)(11)(iv)(B)( 9) of this section. (B) Modify. ( 1) For evidence-based decision support interventions and Predictive Decision Support Interventions, the Health IT Module must enable a limited set of identified users to record, change, and access source attributes in paragraphs (b)(11)(iv)(A) and (B) of this section. ( 2) For Predictive Decision Support Interventions, the Health IT Module must enable a limited set of identified users to record, change, and access additional source attributes not specified in paragraph (b)(11)(iv)(B) of this section. (vi) Intervention risk management. Intervention risk management practices must be applied for each Predictive Decision Support Intervention supplied by the health IT developer as part of its Health IT Module. (A) Risk analysis. The Predictive Decision Support Intervention(s) must be subject to analysis of potential risks and adverse impacts associated with the following characteristics: validity, reliability, robustness, fairness, intelligibility, safety, security, and privacy. (B) Risk mitigation. The Predictive Decision Support Intervention (s) must be subject to practices to mitigate risks, identified in accordance with paragraph (b)(11)(vi)(A) of this section; and (C) Governance. The Predictive Decision Support Intervention(s) must be subject to policies and implemented controls for governance, including how data are acquired, managed, and used. 