The criteria specified in paragraphs (c) and (d) of this section are optional for 2017 and 2018 for EPs, eligible hospitals, and CAHs that have successfully demonstrated meaningful use in a prior year. The criteria specified in paragraph (d) of this section are applicable for all EPs for 2019 and subsequent years, and for eligible hospitals and CAHs attesting to a State for the Medicaid Promoting Interoperability Program for 2019 and subsequent years. The criteria specified in paragraph (e) of this section are applicable for eligible hospitals and CAHs attesting to CMS for 2019 through 2022. The criteria specified in paragraph (f) of this section are applicable for eligible hospitals and CAHs attesting to CMS for 2023 and subsequent years.

1. (a) Stage 3 criteria for EPs—(1) General rule regarding Stage 3 criteria for meaningful use for EPs. Except as specified in paragraphs (a)(2) and (3) of this section, EPs must meet all objectives and associated measures of the Stage 3 criteria specified in paragraph (d) of this section to meet the definition of a meaningful EHR user.

2. (2) Selection of measures for specified objectives in paragraph (d) of this section. An EP may meet the criteria for 2 out of the 3 measures associated with an objective, rather than meeting the criteria for all 3 of the measures, if the EP meets all of the following requirements:

   1. (i) Must ensure that the objective in paragraph (d) of this section includes an option to meet 2 out of the 3 associated measures.
   2. (ii) Meets the threshold for 2 out of the 3 measures for that objective.
   3. (iii) Attests to all 3 of the measures for that objective.

3. (3) Exclusion for non-applicable objectives and measures.

   1. (i) An EP may exclude a particular objective that includes an option for exclusion contained in paragraph (d) of this section, if the EP meets all of the following requirements:

      1. (A) Meets the criteria in the applicable objective that would permit the exclusion.
      2. (B) Attests to the exclusion.

   2. (ii) An EP may exclude a measure within an objective which allows for a provider to meet the threshold for 2 of the 3 measures, as outlined in paragraph (a)(2) of this section, in the following manner:

      1. (A) (1) Meets the criteria in the applicable measure or measures that would permit the exclusion; and

         (2) Attests to the exclusion or exclusions.

      2. (B) (1) Meets the threshold; and

         (2) Attests to any remaining measure or measures.

4. (4) Exception for Medicaid EPs who adopt, implement or upgrade in their first payment year. For Medicaid EPs who adopt, implement, or upgrade its CEHRT in their first payment year, the meaningful use objectives and associated measures of the Stage 3 criteria specified in paragraph (d) of this section apply beginning with the second payment year, and do not apply to the first payment year.

5. (5) Objectives and associated measures in paragraph (d) of this section that rely on measures that count unique patients or actions.

   1. (i) If a measure (or associated objective) in paragraph (d) of this section references paragraph (a)(5) of this section, the measure may be calculated by reviewing only the actions for patients whose records are maintained using CEHRT. A patient's record is maintained using CEHRT if sufficient data were entered in the CEHRT to allow the record to be saved, and not rejected due to incomplete data.
   2. (ii) If the objective and associated measure does not reference paragraph (a)(5) of this section, the measure must be calculated by reviewing all patient records, not just those maintained using CEHRT.
   3. (b) Stage 3 criteria for meaningful use for eligible hospitals and CAHs—(1) General rule. Except as specified in paragraphs (b)(2) and (3) of this section, eligible hospitals and CAHs must meet all objectives and associated measures of the Stage 3 criteria specified in paragraphs (c) and (d) of this section, as applicable, to meet the definition of a meaningful EHR user.

   4. (2) Selection of measures for specified objectives in paragraphs (c) and (d) of this section. An eligible hospital or CAH may meet the criteria for 2 out of the 3 measures associated with an objective, rather than meeting the criteria for all 3 of the measures, if the eligible hospital or CAH meets all of the following requirements:

      1. (i) Must ensure that the objective in paragraph (c) or (d) of this section, as applicable, includes an option to meet 2 out of the 3 associated measures.
      2. (ii) Meets the threshold for 2 out of the 3 measures for that objective.
      3. (iii) Attests to all 3 of the measures for that objective.

   5. (3) Exclusion for nonapplicable objectives and measures.

      1. (i) An eligible hospital or CAH may exclude a particular objective that includes an option for exclusion contained in paragraph (c) or (d) of this section, as applicable, if the eligible hospital or CAH meets all of the following requirements:

         1. (A) Meets the criteria in the applicable objective that would permit the exclusion.
         2. (B) Attests to the exclusion.

      2. (ii) An eligible hospital or CAH may exclude a measure within an objective which allows for a provider to meet the threshold for 2 of the 3 measures, as outlined in paragraph (b)(2) of this section, in the following manner:

         1. (A) (1) Meets the criteria in the applicable measure or measures that would permit the exclusion; and

            (2) Attests to the exclusion or exclusions.

         2. (B) (1) Meets the threshold; and

            (2) Attests to any remaining measure or measures.

   6. (4) Exception for Medicaid eligible hospitals or CAHs that adopt, implement or upgrade in their first payment year. For Medicaid eligible hospitals or CAHs that adopt, implement or upgrade CEHRT in their first payment year, the meaningful use objectives and associated measures of the Stage 3 criteria specified in paragraph (c) or (d) of this section apply beginning with the second payment year, and do not apply to the first payment year.

   7. (5) Objectives and associated measures in paragraph (c) or (d) of this section that rely on measures that count unique patients or actions.

      1. (i) If a measure (or associated objective) in paragraph (c) or (d) of this section, as applicable, references paragraph (b)(5) of this section, the measure may be calculated by reviewing only the actions for patients whose records are maintained using CEHRT. A patient's record is maintained using CEHRT if sufficient data were entered in the CEHRT to allow the record to be saved, and not rejected due to incomplete data.
      2. (ii) If the objective and associated measure does not reference this paragraph (b)(5) of this section, the measure must be calculated by reviewing all patient records, not just those maintained using CEHRT.
      3. (c) Stage 3 objectives and measures for eligible hospitals and CAHs attesting to CMS—(1) Protect patient health information—(i) Objective. Protect electronic protected health information (ePHI) created or maintained by the CEHRT through the implementation of appropriate technical, administrative, and physical safeguards.
      4. (ii) Security risk analysis measure. Conduct or review a security risk analysis in accordance with the requirements under 45 CFR 164.308(a)(1), including addressing the security (including encryption) of data created or maintained by CEHRT in accordance with requirements under 45 CFR 164.312(a)(2)(iv) and 45 CFR 164.306(d)(3), implement security updates as necessary, and correct identified security deficiencies as part of the provider's risk management process.
      5. (2) Electronic prescribing—(i) Objective. Generate and transmit permissible discharge prescriptions electronically (eRx).
      6. (ii) e-Prescribing measure. Subject to paragraph (b)(5) of this section, more than 25 percent of hospital discharge medication orders for permissible prescriptions (for new and changed prescriptions) are queried for a drug formulary and transmitted electronically using CEHRT.
      7. (iii) Exclusions in accordance with paragraph (b)(3) of this section. Any eligible hospital or CAH that does not have an internal pharmacy that can accept electronic prescriptions and there are no pharmacies that accept electronic prescriptions within 10 miles at the start of the eligible hospital or CAH's EHR reporting period.
      8. (3) -(4) [Reserved]
      9. (5) Patient electronic access to health information—(i) Objective. The eligible hospital or CAH provides patients (or patient-authorized representative) with timely electronic access to their health information and patient-specific education.

      10. (ii) Measures. Eligible hospitals and CAHs must meet the following two measures:

          1. (A) Provide patient access measure. For more than 50 percent of all unique patients discharged from the eligible hospital or CAH inpatient or emergency department (POS 21 or 23):

             (1) The patient (or patient-authorized representative) is provided timely access to view online, download, and transmit his or her health information; and

             (2) The provider ensures the patient's health information is available for the patient (or patient-authorized representative) to access using any application of their choice that is configured to meet the technical specifications of the API in the provider's CEHRT.

          2. (B) Patient-specific education measure. The eligible hospital or CAH must use clinically relevant information from CEHRT to identify patient-specific educational resources and provide electronic access to those materials to more than 10 percent of unique patients discharged from the eligible hospital or CAH inpatient or emergency department (POS 21 or 23) during the EHR reporting period.
      11. (iii) Exclusion in accordance with paragraph (b)(3) of this section. Any eligible hospital or CAH that is located in a county that does not have 50 percent or more of its housing units with 4Mbps broadband availability according to the latest information available from the FCC on the first day of the EHR reporting period is excluded from the measures specified in paragraphs (c)(5)(ii)(A) and (B) of this section.
   8. (6) Coordination of care through patient engagement—(i) Objective. Use CEHRT to engage with patients or their authorized representatives about the patient's care.

   9. (ii) Measures. In accordance with paragraph (b)(2) of this section, an eligible hospital or CAH must satisfy 2 of the 3 following measures in paragraphs (c)(6)(ii)(A), (B), and (C) of this section, except those measures for which an eligible hospital or CAH qualifies for an exclusion under paragraph (b)(3) of this section.

      1. (A) View, download or transmit (VDT) measure. During the EHR reporting period, at least one unique patient (or their authorized representatives) discharged from the eligible hospital or CAH inpatient or emergency department (POS 21 or 23) actively engage with the electronic health record made accessible by the provider and one of the following:

         (1) View, download or transmit to a third party their health information.

         (2) Access their health information through the use of an API that can be used by applications chosen by the patient and configured to the API in the provider's CEHRT; or

         (3) A combination of paragraphs (c)(6)(ii)(A)(1) and (2) of this section.

      2. (B) Secure messaging measure. During the EHR reporting period, more than 5 percent of all unique patients discharged from the eligible hospital or CAH inpatient or emergency department (POS 21 or 23) during the EHR reporting period, a secure message was sent using the electronic messaging function of CEHRT to the patient (or the patient authorized representative), or in response to a secure message sent by the patient (or the patient authorized representative).
      3. (C) Patient generated health data. Patient generated health data or data from a non-clinical setting is incorporated into the CEHRT for more than 5 percent of unique patients discharged from the eligible hospital or CAH inpatient or emergency department (POS 21 or 23) during the EHR reporting period.
   10. (iii) Exclusions under paragraph (b)(3) of this section. Any eligible hospital or CAH operating in a location that does not have 50 percent or more of its housing units with 4Mbps broadband availability according to the latest information available from the FCC on the first day of the EHR reporting period may exclude from the measures specified in paragraphs (c)(6)(ii)(A) through (C) of this section.
   11. (7) Health information exchange—(i) Objective. The eligible hospital or CAH provides a summary of care record when transitioning or referring their patient to another setting of care, receives or retrieves a summary of care record upon the receipt of a transition or referral or upon the first patient encounter with a new patient, and incorporates summary of care information from other providers into their EHR using the functions of CEHRT.

   12. (ii) Measures. In accordance with paragraph (b)(2) of this section, a eligible hospital or CAH must attest to all 3 measures, but must meet the threshold for 2 of the 3 measures in paragraphs (e)(7)(ii)(A) through (C) of this section. Subject to paragraph (b)(5) of this section—

       1. (A) Send a summary of care measure. For more than 10 percent of transitions of care and referrals, the eligible hospital or CAH that transitions or refers its patient to another setting of care or provider of care—

          (1) Creates a summary of care record using CEHRT; and

          (2) Electronically exchanges the summary of care record.

       2. (B) Request/accept summary of care measure. For more than 10 percent of transitions or referrals received and patient encounters in which the provider has never before encountered the patient, the eligible hospital or CAH incorporates into the patient's EHR an electronic summary of care document.

       3. (C) Clinical information reconciliation measure. For more than 50 percent of transitions or referrals received and patient encounters in which the provider has never before encountered the patient, the eligible hospital or CAH performs a clinical information reconciliation. The provider must implement clinical information reconciliation for the following three clinical information sets:

          (1) Medication. Review of the patient's medication, including the name, dosage, frequency, and route of each medication.

          (2) Medication allergy. Review of the patient's known allergic medications.

          (3) Current problem list. Review of the patient's current and active diagnoses.

   13. (iii) Exclusions in accordance with paragraph (b)(3) of this section.

       1. (A) Any eligible hospital or CAH for whom the total of transitions or referrals received and patient encounters in which the provider has never before encountered the patient, is fewer than 100 during the EHR reporting period may be excluded from paragraphs (c)(7)(ii)(B) and (C) of this section.
       2. (B) Any eligible hospital or CAH operating in a location that does not have 50 percent or more of its housing units with 4Mbps broadband availability according to the latest information available from the FCC on the first day of the EHR reporting period may be excluded from the measures specified in paragraphs (e)(7)(ii)(A) and (B) of this section.
       3. (8) Public health and clinical data registry reporting—(i) Objective. The eligible hospital or CAH is in active engagement with a public health agency (PHA) or clinical data registry (CDR) to submit electronic public health data in a meaningful way using CEHRT, except where prohibited, and in accordance with applicable law and practice.

       4. (ii) Measures. In order to meet the objective under paragraph (c)(8)(i) of this section, an eligible hospital or CAH must choose from measures 1 through 6 (as described in paragraphs (c)(8)(ii)(A) through (F) of this section) and must successfully attest to any combination of three measures. These measures may be met by any combination, including meeting the measure specified in paragraphs (c)(8)(ii)(D) and (E) of this section multiple times, in accordance with applicable law and practice:

          1. (A) Immunization registry reporting measure. The eligible hospital or CAH is in active engagement with a public health agency to submit immunization data and receive immunization forecasts and histories from the public health immunization registry/immunization information system (IIS).
          2. (B) Syndromic surveillance reporting measure. The eligible hospital or CAH is in active engagement with a public health agency to submit syndromic surveillance data from an urgent care setting.
          3. (C) Electronic case reporting measure. The eligible hospital or CAH is in active engagement with a public health agency to submit case reporting of reportable conditions.
          4. (D) Public health registry reporting measure. The eligible hospital or CAH is in active engagement with a public health agency to submit data to public health registries.
          5. (E) Clinical data registry reporting measure. The eligible hospital or CAH is in active engagement to submit data to a clinical data registry.
          6. (F) Electronic reportable laboratory result reporting measure. The eligible hospital or CAH is in active engagement with a public health agency to submit electronic reportable laboratory results.

       5. (iii) Exclusions in accordance with paragraph (b)(3) of this section.

          1. (A) Any eligible hospital or CAH meeting one or more of the following criteria may be excluded from the immunization registry reporting measure specified in paragraph (c)(8)(ii)(A) of this section if the eligible hospital or CAH—

             (1) Does not administer any immunizations to any of the populations for which data is collected by its jurisdiction's immunization registry or immunization information system during the EHR reporting period.

             (2) Operates in a jurisdiction for which no immunization registry or immunization information system is capable of accepting the specific standards required to meet the CEHRT definition at the start of the EHR reporting period.

             (3) Operates in a jurisdiction where no immunization registry or immunization information system has declared readiness to receive immunization data as of 6 months prior to the start of the EHR reporting period.

          2. (B) Any eligible hospital or CAH meeting one or more of the following criteria may be excluded from the syndromic surveillance reporting measure specified in paragraph (c)(8)(ii)(B) of this section if the eligible hospital or CAH—

             (1) Does not have an emergency or urgent care department.

             (2) Operates in a jurisdiction for which no public health agency is capable of receiving electronic syndromic surveillance data in the specific standards required to meet the CEHRT definition at the start of the EHR reporting period.

             (3) Operates in a jurisdiction where no public health agency has declared readiness to receive syndromic surveillance data from eligible hospitals or CAHs as of 6 months prior to the start of the EHR reporting period.

          3. (C) Any eligible hospital or CAH meeting one or more of the following criteria may be excluded from the case reporting measure specified in paragraph (e)(8)(ii)(C) of this section if the eligible hospital or CAH—

             (1) Does not treat or diagnose any reportable diseases for which data is collected by their jurisdiction's reportable disease system during the EHR reporting period.

             (2) Operates in a jurisdiction for which no public health agency is capable of receiving electronic case reporting data in the specific standards required to meet the CEHRT definition at the start of their EHR reporting period.

             (3) Operates in a jurisdiction where no public health agency has declared readiness to receive electronic case reporting data as of 6 months prior to the start of the EHR reporting period.

          4. (D) Any eligible hospital or CAH meeting at least one of the following criteria may be excluded from the public health registry reporting measure specified in paragraph (c)(8)(ii)(D) of this section if the eligible hospital or CAH—

             (1) Does not diagnose or directly treat any disease or condition associated with a public health registry in its jurisdiction during the EHR reporting period.

             (2) Operates in a jurisdiction for which no public health agency is capable of accepting electronic registry transactions in the specific standards required to meet the CEHRT definition at the start of the EHR reporting period.

             (3) Operates in a jurisdiction where no public health registry for which the eligible hospital or CAH is eligible has declared readiness to receive electronic registry transactions as of 6 months prior to the start of the EHR reporting period.

          5. (E) Any eligible hospital or CAH meeting at least one of the following criteria may be excluded from the clinical data registry reporting measure specified in paragraph (c)(8)(ii)(E) of this section if the eligible hospital or CAH—

             (1) Does not diagnose or directly treat any disease or condition associated with a clinical data registry in their jurisdiction during the EHR reporting period.

             (2) Operates in a jurisdiction for which no clinical data registry is capable of accepting electronic registry transactions in the specific standards required to meet the CEHRT definition at the start of the EHR reporting period.

             (3) Operates in a jurisdiction where no clinical data registry for which the eligible hospital or CAH is eligible has declared readiness to receive electronic registry transactions as of 6 months prior to the start of the EHR reporting period.

          6. (F) Any eligible hospital or CAH meeting one or more of the following criteria may be excluded from the electronic reportable laboratory result reporting measure specified in paragraph (c)(8)(ii)(F) of this section if the eligible hospital or CAH—

             (1) Does not perform or order laboratory tests that are reportable in its jurisdiction during the EHR reporting period.

             (2) Operates in a jurisdiction for which no public health agency that is capable of accepting the specific ELR standards required to meet the CEHRT definition at the start of the EHR reporting period.

             (3) Operates in a jurisdiction where no public health agency has declared readiness to receive electronic reportable laboratory results from an eligible hospital or CAH as of 6 months prior to the start of the EHR reporting period.

          7. (d) Stage 3 objectives and measures for all EPs for 2019 and subsequent years, and for eligible hospitals and CAHs attesting to a State for the Medicaid Promoting Interoperability Program for 2019 and subsequent years—(1) Protect patient health information—(i) EP protect patient health information—(A) Objective. Protect electronic protected health information (ePHI) created or maintained by the CEHRT through the implementation of appropriate technical, administrative, and physical safeguards.
          8. (B) Measure. Conduct or review a security risk analysis in accordance with the requirements under 45 CFR 164.308(a)(1), including addressing the security (including encryption) of data created or maintained by CEHRT in accordance with requirements under 45 CFR 164.312(a)(2)(iv) and 45 CFR 164.306(d)(3), implement security updates as necessary, and correct identified security deficiencies as part of the provider's risk management process.
          9. (ii) Eligible hospital/CAH protect patient health information—(A) Objective. Protect electronic protected health information (ePHI) created or maintained by the CEHRT through the implementation of appropriate technical, administrative, and physical safeguards.
          10. (B) Measure. Conduct or review a security risk analysis in accordance with the requirements under 45 CFR 164.308(a)(1), including addressing the security (including encryption) of data created or maintained by CEHRT in accordance with requirements under 45 CFR 164.312(a)(2)(iv) and 45 CFR 164.306(d)(3), implement security updates as necessary, and correct identified security deficiencies as part of the provider's risk management process.
          11. (2) Electronic Prescribing—(i) EP Electronic Prescribing—(A) Objective. Generate and transmit permissible prescriptions electronically (eRx).
          12. (B) Measure. Subject to paragraph (a)(5) of this section, more than 60 percent of all permissible prescriptions written by the EP are queried for a drug formulary and transmitted electronically using CEHRT.

          13. (C) Exclusions in accordance with paragraph (a)(3) of this section. (1) Any EP who writes fewer than 100 permissible prescriptions during the EHR reporting period; or

              (2) Any EP who does not have a pharmacy within its organization and there are no pharmacies that accept electronic prescriptions within 10 miles of the EP's practice location at the start of his/her EHR reporting period.

          14. (ii) Eligible hospital/CAH electronic prescribing—(A) Objective. Generate and transmit permissible discharge prescriptions electronically (eRx).
          15. (B) Measure. Subject to paragraph (b)(5) of this section, more than 25 percent of hospital discharge medication orders for permissible prescriptions (for new and changed prescriptions) are queried for a drug formulary and transmitted electronically using CEHRT.
          16. (C) Exclusions in accordance with paragraph (b)(3) of this section. Any eligible hospital or CAH that does not have an internal pharmacy that can accept electronic prescriptions and there are no pharmacies that accept electronic prescriptions within 10 miles at the start of the eligible hospital or CAH's EHR reporting period.
          17. (3) Clinical decision support—(i) EP clinical decision support—(A) Objective. Implement clinical decision support (CDS) interventions focused on improving performance on high-priority health conditions.

          18. (B) Measures. (1) Implement five clinical decision support interventions related to four or more clinical quality measures at a relevant point in patient care for the entire EHR reporting period. Absent four clinical quality measures related to an EP's scope of practice or patient population, the clinical decision support interventions must be related to high-priority health conditions; and

              (2) The EP has enabled and implemented the functionality for drug-drug and drug-allergy interaction checks for the entire EHR reporting period.

          19. (C) Exclusion in accordance with paragraph (a)(3) of this section for paragraph (d)(3)(i)(B)(2) of this section. An EP who writes fewer than 100 medication orders during the EHR reporting period.
          20. (ii) Eligible hospital/CAH clinical decision support—(A) Objective. Implement clinical decision support (CDS) interventions focused on improving performance on high-priority health conditions.

          21. (B) Measures. (1) Implement five clinical decision support interventions related to four or more clinical quality measures at a relevant point in patient care for the entire EHR reporting period. Absent four clinical quality measures related to an eligible hospital or CAH's patient population, the clinical decision support interventions must be related to high-priority health conditions; and

              (2) The eligible hospital or CAH has enabled and implemented the functionality for drug-drug and drug-allergy interaction checks for the entire EHR reporting period.

          22. (4) Computerized provider order entry (CPOE)—(i) EP CPOE—(A) Objective. Use computerized provider order entry (CPOE) for medication, laboratory, and diagnostic imaging orders directly entered by any licensed healthcare professional, credentialed medical assistant, or a medical staff member credentialed to and performing the equivalent duties of a credentialed medical assistant, who can enter orders into the medical record per state, local, and professional guidelines.

          23. (B) Measures. Subject to paragraph (a)(5) of this section—

              (1) More than 60 percent of medication orders created by the EP during the EHR reporting period are recorded using computerized provider order entry;

              (2) More than 60 percent of laboratory orders created by the EP during the EHR reporting period are recorded using computerized provider order entry; and

              (3) More than 60 percent of diagnostic imaging orders created by the EP during the EHR reporting period are recorded using computerized provider order entry.

          24. (C) Exclusions in accordance with paragraph (a)(3) of this section. (1) For the measure specified in paragraph (d)(4)(i)(B)(1) of this section, any EP who writes fewer than 100 medication orders during the EHR reporting period.

              (2) For the measure specified in paragraph (d)(4)(i)(B)(2) of this section, any EP who writes fewer than 100 laboratory orders during the EHR reporting period.

              (3) For the measure specified in paragraph (d)(4)(i)(B)(3) of this section, any EP who writes fewer than 100 diagnostic imaging orders during the EHR reporting period.

          25. (ii) Eligible hospital and CAH CPOE—(A) Objective. Use computerized provider order entry (CPOE) for medication, laboratory, and diagnostic imaging orders directly entered by any licensed healthcare professional, credentialed medical assistant, or a medical staff member credentialed to and performing the equivalent duties of a credentialed medical assistant; who can enter orders into the medical record per State, local, and professional guidelines.

          26. (B) Measures. Subject to paragraph (b)(5) of this section—

              (1) More than 60 percent of medication orders created by authorized providers of the eligible hospital's or CAH's inpatient or emergency department (POS 21 or 23) during the EHR reporting period are recorded using computerized provider order entry;

              (2) More than 60 percent of laboratory orders created by authorized providers of the eligible hospital's or CAH's inpatient or emergency department (POS 21 or 23) during the EHR reporting period are recorded using computerized provider order entry; and

              (3) More than 60 percent of diagnostic imaging orders created by authorized providers of the eligible hospital's or CAH's inpatient or emergency department (POS 21 or 23) during the EHR reporting period are recorded using computerized provider order entry.

          27. (5) Patient electronic access to health information—(i) EP patient electronic access to health information—(A) Objective. The EP provides patients (or patient-authorized representative) with timely electronic access to their health information and patient-specific education.

          28. (B) Measures. EPs must meet the following two measures:

              (1) For more than 80 percent of all unique patients seen by the EP—

              (i) The patient (or the patient-authorized representative) is provided timely access to view online, download, and transmit his or her health information; and

              (ii) The provider ensures the patient's health information is available for the patient (or patient-authorized representative) to access using any application of their choice that is configured to meet the technical specifications of the API in the provider's CEHRT.

              (2) The EP must use clinically relevant information from CEHRT to identify patient-specific educational resources and provide electronic access to those materials to more than 35 percent of unique patients seen by the EP during the EHR reporting period.

          29. (C) Exclusions in accordance with paragraph (a)(3) of this section. (1) Any EP who has no office visits during the reporting period may exclude from the measures specified in paragraphs (d)(5)(i)(B)(1) and (2) of this section.

              (2) Any EP that conducts 50 percent or more of his or her patient encounters in a county that does not have 50 percent or more of its housing units with 4Mbps broadband availability according to the latest information available from the FCC on the first day of the EHR reporting period may exclude from the measures specified in paragraphs (d)(5)(i)(B)(1) and (2) of this section.

          30. (ii) Eligible hospital and CAH patient electronic access to health information—(A) Objective. The eligible hospital or CAH provides patients (or patient-authorized representative) with timely electronic access to their health information and patient-specific education.

          31. (B) Measures. Eligible hospitals and CAHs must meet the following two measures:

              (1) For more than 80 percent of all unique patients discharged from the eligible hospital or CAH inpatient or emergency department (POS 21 or 23):

              (i) The patient (or patient-authorized representative) is provided timely access to view online, download, and transmit his or her health information; and

              (ii) The provider ensures the patient's health information is available for the patient (or patient-authorized representative) to access using any application of their choice that is configured to meet the technical specifications of the API in the provider's CEHRT.

              (2) The eligible hospital or CAH must use clinically relevant information from CEHRT to identify patient-specific educational resources and provide electronic access to those materials to more than 35 percent of unique patients discharged from the eligible hospital or CAH inpatient or emergency department (POS 21 or 23) during the EHR reporting period.

          32. (C) Exclusion in accordance with paragraph (b)(3) of this section. Any eligible hospital or CAH that is located in a county that does not have 50 percent or more of its housing units with 4Mbps broadband availability according to the latest information available from the FCC on the first day of the EHR reporting period is excluded from the measures specified in paragraphs (d)(5)(ii)(B)(1) and (2) of this section.
6. (6) Coordination of care through patient engagement—(i) EP coordination of care through patient engagement—(A) Objective. Use CEHRT to engage with patients or their authorized representatives about the patient's care.

7. (B) Measures. In accordance with paragraph (a)(2) of this section, an EP must satisfy 2 out of the 3 following measures in paragraphs (d)(6)(i)(B)(1) through (3) of this section except those measures for which an EP qualifies for an exclusion under paragraph (a)(3) of this section.

   (1) During the EHR reporting period, more than 5 percent of all unique patients (or their authorized representatives) seen by the EP actively engage with the electronic health record made accessible by the provider and do either of the following:

   (i) View, download or transmit to a third party their health information;

   (ii) Access their health information through the use of an API that can be used by applications chosen by the patient and configured to the API in the provider's CEHRT; or

   (iii) A combination of paragraphs (d)(6)(i)(B)(1)(i) and (ii) of this section.

   (2) A secure message was sent using the electronic messaging function of CEHRT to the patient (or their authorized representatives), or in response to a secure message sent by the patient, for more than 5 percent of all unique patients seen by the EP during the EHR reporting period.

   (3) Patient generated health data or data from a nonclinical setting is incorporated into the CEHRT for more than 5 percent of all unique patients seen by the EP during the EHR reporting period.

8. (C) Exclusions in accordance with paragraph (a)(3) of this section. (1) Any EP who has no office visits during the reporting period may exclude from the measures specified in paragraphs (d)(6)(i)(B)(1) through (3) of this section.

   (2) Any EP that conducts 50 percent or more of his or her patient encounters in a county that does not have 50 percent or more of its housing units with 4Mbps broadband availability according to the latest information available from the FCC on the first day of the EHR reporting period may exclude from the measures specified in paragraphs (d)(6)(i)(B)(1) through (3) of this section.

9. (ii) Eligible hospital and CAH coordination of care through patient engagement—(A) Objective. Use CEHRT to engage with patients or their authorized representatives about the patient's care.

10. (B) Measures. In accordance with paragraph (b)(2) of this section, an eligible hospital or CAH must satisfy 2 of the 3 following measures in paragraphs (d)(6)(ii)(B)(1) through (3) of this section, except those measures for which an eligible hospital or CAH qualifies for an exclusion under paragraph (b)(3) of this section.

    (1) During the EHR reporting period, more than 10 percent of all unique patients (or their authorized representatives) discharged from the eligible hospital or CAH inpatient or emergency department (POS 21 or 23) actively engage with the electronic health record made accessible by the provider and one of the following:

    (i) View, download or transmit to a third party their health information.

    (ii) Access their health information through the use of an API that can be used by applications chosen by the patient and configured to the API in the provider's CEHRT.

    (iii) A combination of paragraphs (d)(6)(ii)(B)(1)(i) and (ii) of this section.

    (iv) For an EHR reporting period in 2017 and 2018, an eligible hospital or CAH may meet a threshold of 5 percent instead of 10 percent for the measure at paragraph (d)(6)(ii)(B)(1) of this section.

    (2) During the EHR reporting period—

    (i) For an EHR reporting period in 2017 and 2018, for more than 5 percent of all unique patients discharged from the eligible hospital or CAH inpatient or emergency department (POS 21 or 23) during the EHR reporting period, a secure message was sent using the electronic messaging function of CEHRT to the patient (or their authorized representatives), or in response to a secure message sent by the patient (or their authorized representatives).

    (ii) For an EHR reporting period other than 2017 and 2018, for more than 25 percent of all unique patients discharged from the eligible hospital or CAH inpatient or emergency department (POS 21 or 23) during the EHR reporting period, a secure message was sent using the electronic messaging function of CEHRT to the patient (or their authorized representatives), or in response to a secure message sent by the patient (or their authorized representatives).

    (3) Patient generated health data or data from a non-clinical setting is incorporated into the CEHRT for more than 5 percent of unique patients discharged from the eligible hospital or CAH inpatient or emergency department (POS 21 or 23) during the EHR reporting period.

11. (C) Exclusions under paragraph (b)(3) of this section. Any eligible hospital or CAH operating in a location that does not have 50 percent or more of its housing units with 4Mbps broadband availability according to the latest information available from the FCC on the first day of the EHR reporting period may exclude from the measures specified in paragraphs (d)(6)(ii)(B)(1) through (3) of this section.
12. (7) Health information exchange—(i) EP health information exchange—(A) Objective. The EP provides a summary of care record when transitioning or referring their patient to another setting of care, receives or retrieves a summary of care record upon the receipt of a transition or referral or upon the first patient encounter with a new patient, and incorporates summary of care information from other providers into their EHR using the functions of CEHRT.

13. (B) Measures. In accordance with paragraph (a)(2) of this section, an EP must attest to all 3 measures, but must meet the threshold for 2 of the 3 measures in paragraphs (d)(7)(i)(B)(1) through (3) of this section, in order to meet the objective. Subject to paragraph (c) of this section—

    (1) Measure 1. For more than 50 percent of transitions of care and referrals, the EP that transitions or refers their patient to another setting of care or provider of care—

    (i) Creates a summary of care record using CEHRT; and

    (ii) Electronically exchanges the summary of care record.

    (2) Measure 2. For more than 40 percent of transitions or referrals received and patient encounters in which the provider has never before encountered the patient, the EP incorporates into the patient's EHR an electronic summary of care document.

    (3) Measure 3. For more than 80 percent of transitions or referrals received and patient encounters in which the provider has never before encountered the patient, the EP performs clinical information reconciliation. The EP must implement clinical information reconciliation for the following three clinical information sets:

    (i) Medication. Review of the patient's medication, including the name, dosage, frequency, and route of each medication.

    (ii) Medication allergy. Review of the patient's known allergic medications.

    (iii) Current problem list. Review of the patient's current and active diagnoses.

14. (C) Exclusions in accordance with paragraph (a)(3) of this section. An EP must be excluded when any of the following occur:

    (1) Any EP who transfers a patient to another setting or refers a patient to another provider less than 100 times during the EHR reporting period must be excluded from paragraph (d)(7)(i)(B)(1) of this section.

    (2) Any EP for whom the total of transitions or referrals received and patient encounters in which the provider has never before encountered the patient, is fewer than 100 during the EHR reporting period may be excluded from paragraphs (d)(7)(i)(B)(2) and (3) of this section.

    (3) Any EP that conducts 50 percent or more of his or her patient encounters in a county that does not have 50 percent or more of its housing units with 4Mbps broadband availability according to the latest information available from the FCC on the first day of the EHR reporting period may exclude from the measures specified in paragraphs (d)(7)(i)(B)(1) and (2) of this section.

15. (ii) Eligible hospitals and CAHs health information exchange—(A) Objective. The eligible hospital or CAH provides a summary of care record when transitioning or referring their patient to another setting of care, receives or retrieves a summary of care record upon the receipt of a transition or referral or upon the first patient encounter with a new patient, and incorporates summary of care information from other providers into their EHR using the functions of CEHRT.

16. (B) Measures. In accordance with paragraph (b)(2) of this section, an eligible hospital or CAH must attest to all three measures, but must meet the threshold for 2 of the 3 measures in paragraphs (d)(7)(ii)(B)(1) through (3) of this section. Subject to paragraph (b)(5) of this section—

    (1) Measure 1. For more than 50 percent of transitions of care and referrals, the eligible hospital or CAH that transitions or refers its patient to another setting of care or provider of care—

    (i) Creates a summary of care record using CEHRT; and

    (ii) Electronically exchanges the summary of care record.

    (2) Measure 2. For more than 40 percent of transitions or referrals received and patient encounters in which the provider has never before encountered the patient, the eligible hospital or CAH incorporates into the patient's EHR an electronic summary of care document from a source other than the provider's EHR system.

    (3) Measure 3. For more than 80 percent of transitions or referrals received and patient encounters in which the provider has never before encountered the patient, the eligible hospital or CAH performs a clinical information reconciliation. The provider must implement clinical information reconciliation for the following three clinical information sets:

    (i) Medication. Review of the patient's medication, including the name, dosage, frequency, and route of each medication.

    (ii) Medication allergy. Review of the patient's known allergic medications.

    (iii) Current problem list. Review of the patient's current and active diagnoses.

17. (C) Exclusions in accordance with paragraph (b)(3) of this section. (1) Any eligible hospital or CAH for whom the total of transitions or referrals received and patient encounters in which the provider has never before encountered the patient, is fewer than 100 during the EHR reporting period may be excluded from paragraphs (d)(7)(i)(B)(2) and (3) of this section.

    (2) Any eligible hospital or CAH operating in a location that does not have 50 percent or more of its housing units with 4Mbps broadband availability according to the latest information available from the FCC on the first day of the EHR reporting period may exclude from the measures specified in paragraphs (d)(7)(ii)(B)(1) and (2) of this section.

18. (8) Public Health and Clinical Data Registry Reporting—(i) EP Public Health and Clinical Data Registry: Reporting objective—(A) Objective. The EP is in active engagement with a public health agency or clinical data registry to submit electronic public health data in a meaningful way using CEHRT, except where prohibited, and in accordance with applicable law and practice.

19. (B) Measures. In order to meet the objective under paragraph (d)(8)(i)(A) of this section, an EP must choose from measures 1 through 5 (paragraphs (d)(8)(i)(B)(1) through (5) of this section) and must successfully attest to any combination of two measures. These measures may be met by any combination, including meeting measure specified in paragraph (d)(8)(i)(B)(4) or (5) of this section multiple times, in accordance with applicable law and practice:

    (1) Immunization registry reporting. The EP is in active engagement with a public health agency to submit immunization data and receive immunization forecasts and histories from the public health immunization registry/immunization information system (IIS).

    (2) Syndromic surveillance reporting. The EP is in active engagement with a public health agency to submit syndromic surveillance data from an urgent care setting, or from any other setting from which ambulatory syndromic surveillance data are collected by the state or a local public health agency.

    (3) Electronic case reporting. The EP is in active engagement with a public health agency to submit case reporting of reportable conditions.

    (4) Public health registry reporting. The EP is in active engagement with a public health agency to submit data to public health registries.

    (5) Clinical data registry reporting. The EP is in active engagement to submit data to a clinical data registry.

20. (C) Exclusions in accordance with paragraph (a)(3) of this section. (1) Any EP meeting one or more of the following criteria may be excluded from the immunization registry reporting measure in paragraph (d)(8)(i)(B)(1) of this section if the EP—

    (i) Does not administer any immunizations to any of the populations for which data is collected by their jurisdiction's immunization registry or immunization information system during the EHR reporting period.

    (ii) Operates in a jurisdiction for which no immunization registry or immunization information system is capable of accepting the specific standards required to meet the CEHRT definition at the start of its EHR reporting period.

    (iii) Operates in a jurisdiction where no immunization registry or immunization information system has declared readiness to receive immunization data as of 6 months prior to the start of the EHR reporting period.

    (2) Any EP meeting one or more of the following criteria may be excluded from the syndromic surveillance reporting measure described in paragraph (d)(8)(i)(B)(2) of the section if the EP—

    (i) Is not in a category of providers from which ambulatory syndromic surveillance data is collected by their jurisdiction's syndromic surveillance system.

    (ii) Operates in a jurisdiction for which no public health agency is capable of receiving electronic syndromic surveillance data in the specific standards required to meet the CEHRT definition at the start of the EHR reporting period.

    (iii) Operates in a jurisdiction where no public health agency has declared readiness to receive syndromic surveillance data from EPs as of 6 months prior to the start of the EHR reporting period.

    (3) Any EP meeting one or more of the following criteria may be excluded from the case reporting measure at paragraph (d)(8)(i)(B)(3) of this section if the EP:

    (i) Does not treat or diagnose any reportable diseases for which data is collected by their jurisdiction's reportable disease system during the EHR reporting period.

    (ii) Operates in a jurisdiction for which no public health agency is capable of receiving electronic case reporting data in the specific standards required to meet the CEHRT definition at the start of the EHR reporting period.

    (iii) Operates in a jurisdiction where no public health agency has declared readiness to receive electronic case reporting data as of 6 months prior to the start of the EHR reporting period.

    (4) Any EP meeting at least one of the following criteria may be excluded from the public health registry reporting measure specified in paragraph (d)(8)(i)(B)(4) of this section if the EP—

    (i) Does not diagnose or directly treat any disease or condition associated with a public health registry in the EP's jurisdiction during the EHR reporting period.

    (ii) Operates in a jurisdiction for which no public health agency is capable of accepting electronic registry transactions in the specific standards required to meet the CEHRT definition at the start of the EHR reporting period.

    (iii) Operates in a jurisdiction where no public health registry for which the EP, eligible hospital, or CAH is eligible has declared readiness to receive electronic registry transactions as of 6 months prior to the start of the EHR reporting period.

    (5) Any EP meeting at least one of the following criteria may be excluded from the clinical data registry reporting measure specified in paragraph (d)(8)(i)(B)(5) of this section if the EP—

    (i) Does not diagnose or directly treat any disease or condition associated with a clinical data registry in their jurisdiction during the EHR reporting period.

    (ii) Operates in a jurisdiction for which no clinical data registry is capable of accepting electronic registry transactions in the specific standards required to meet the CEHRT definition at the start of the EHR reporting period.

    (iii) Operates in a jurisdiction where no clinical data registry for which the EP, eligible hospital, or CAH is eligible has declared readiness to receive electronic registry transactions as of 6 months prior to the start of the EHR reporting period.

21. (ii) Eligible hospital and CAH Public Health and Clinical Data Registry: Reporting objective—(A) Objective. The eligible hospital or CAH is in active engagement with a public health agency (PHA) or clinical data registry (CDR) to submit electronic public health data in a meaningful way using CEHRT, except where prohibited, and in accordance with applicable law and practice.

22. (B) Measures. In order to meet the objective under paragraph (d)(8)(ii)(A) of this section, an eligible hospital or CAH must choose from measures 1 through 6 (as described in paragraphs (d)(8)(ii)(B)(1) through (6) of this section) and must successfully attest to any combination of four measures. These measures may be met by any combination, including meeting the measure specified in paragraph (d)(8)(ii)(B)(4) or (5) of this section multiple times, in accordance with applicable law and practice:

    (1) Immunization registry reporting. The eligible hospital or CAH is in active engagement with a public health agency to submit immunization data and receive immunization forecasts and histories from the public health immunization registry/immunization information system (IIS).

    (2) Syndromic surveillance reporting. The eligible hospital or CAH is in active engagement with a public health agency to submit syndromic surveillance data from an urgent care setting.

    (3) Case reporting. The eligible hospital or CAH is in active engagement with a public health agency to submit case reporting of reportable conditions.

    (4) Public health registry reporting. The eligible hospital or CAH is in active engagement with a public health agency to submit data to public health registries.

    (5) Clinical data registry reporting. The eligible hospital or CAH is in active engagement to submit data to a clinical data registry.

    (6) Electronic reportable laboratory result reporting. The eligible hospital or CAH is in active engagement with a public health agency to submit electronic reportable laboratory results.

23. (C) Exclusions in accordance with paragraph (b)(3) of this section. (1) Any eligible hospital or CAH meeting one or more of the following criteria may be excluded from to the immunization registry reporting measure specified in paragraph (d)(8)(ii)(B)(1) of this section if the eligible hospital or CAH—

    (i) Does not administer any immunizations to any of the populations for which data is collected by its jurisdiction's immunization registry or immunization information system during the EHR reporting period.

    (ii) Operates in a jurisdiction for which no immunization registry or immunization information system is capable of accepting the specific standards required to meet the CEHRT definition at the start of the EHR reporting period.

    (iii) Operates in a jurisdiction where no immunization registry or immunization information system has declared readiness to receive immunization data as of 6 months prior to the start of the EHR reporting period.

    (2) Any eligible hospital or CAH meeting one or more of the following criteria may be excluded from the syndromic surveillance reporting measure specified in paragraph (d)(8)(ii)(B)(2) of this section if the eligible hospital or CAH—

    (i) Does not have an emergency or urgent care department.

    (ii) Operates in a jurisdiction for which no public health agency is capable of receiving electronic syndromic surveillance data in the specific standards required to meet the CEHRT definition at the start of the EHR reporting period.

    (iii) Operates in a jurisdiction where no public health agency has declared readiness to receive syndromic surveillance data from eligible hospitals or CAHs as of 6 months prior to the start of the EHR reporting period.

    (3) Any eligible hospital or CAH meeting one or more of the following criteria may be excluded from the case reporting measure specified in paragraph (d)(8)(ii)(B)(3) of this section if the eligible hospital or CAH—

    (i) Does not treat or diagnose any reportable diseases for which data is collected by their jurisdiction's reportable disease system during the EHR reporting period.

    (ii) Operates in a jurisdiction for which no public health agency is capable of receiving electronic case reporting data in the specific standards required to meet the CEHRT definition at the start of their EHR reporting period.

    (iii) Operates in a jurisdiction where no public health agency has declared readiness to receive electronic case reporting data as of 6 months prior to the start of the EHR reporting period.

    (4) Any eligible hospital or CAH meeting at least one of the following criteria may be excluded from the public health registry reporting measure specified in paragraph (d)(8)(ii)(B)(4) of this section if the eligible hospital or CAH—

    (i) Does not diagnose or directly treat any disease or condition associated with a public health registry in its jurisdiction during the EHR reporting period.

    (ii) Operates in a jurisdiction for which no public health agency is capable of accepting electronic registry transactions in the specific standards required to meet the CEHRT definition at the start of the EHR reporting period.

    (iii) Operates in a jurisdiction where no public health registry for which the eligible hospital or CAH is eligible has declared readiness to receive electronic registry transactions as of 6 months prior to the start of the EHR reporting period.

    (5) Any eligible hospital or CAH meeting at least one of the following criteria may be excluded from the clinical data registry reporting measure specified in paragraph (d)(8)(ii)(B)(5) of this section if the eligible hospital or CAH—

    (i) Does not diagnose or directly treat any disease or condition associated with a clinical data registry in their jurisdiction during the EHR reporting period.

    (ii) Operates in a jurisdiction for which no clinical data registry is capable of accepting electronic registry transactions in the specific standards required to meet the CEHRT definition at the start of the EHR reporting period.

    (iii) Operates in a jurisdiction where no clinical data registry for which the eligible hospital or CAH is eligible has declared readiness to receive electronic registry transactions as of 6 months prior to the start of the EHR reporting period.

    (6) Any eligible hospital or CAH meeting one or more of the following criteria may be excluded from the electronic reportable laboratory result reporting measure specified in paragraph (d)(8)(ii)(B)(6) of this section if the eligible hospital or CAH—

    (i) Does not perform or order laboratory tests that are reportable in its jurisdiction during the EHR reporting period.

    (ii) Operates in a jurisdiction for which no public health agency that is capable of accepting the specific ELR standards required to meet the CEHRT definition at the start of the EHR reporting period.

    (iii) Operates in a jurisdiction where no public health agency has declared readiness to receive electronic reportable laboratory results from an eligible hospital or CAH as of 6 months prior to the start of the EHR reporting period.

24. (e) Stage 3 objectives and measures for eligible hospitals and CAHs attesting to CMS for 2019 through 2022—(1) General rule.

    1. (i) Except as specified in paragraph (e)(2) of this section, eligible hospitals and CAHs must do all of the following as part of meeting the definition of a meaningful EHR user under § 495.4:

       1. (A) Meet all objectives and associated measures of the Stage 3 criteria specified in this paragraph (e).
       2. (B) In 2019, 2020, and 2021, earn a total score of at least 50 points.
       3. (C) In 2022, earn a total score of at least 60 points.
    2. (ii) Beginning in CY 2020, the numerator and denominator of measures increment based on actions occurring during the EHR reporting period selected by the eligible hospital or CAH, unless otherwise indicated.

    3. (2) Exclusion for nonapplicable measures.

       1. (i) An eligible hospital or CAH may exclude a particular measure that includes an option for exclusion contained in this paragraph (e) if the eligible hospital or CAH meets the following requirements:

          1. (A) Meets the criteria in the applicable measure that would permit the exclusion.
          2. (B) Attests to the exclusion.
       2. (ii) Distribution of points for nonapplicable measures. For eligible hospitals or CAHs that claim such exclusion, the points assigned to the excluded measure will be distributed to other measures as outlined in this paragraph (e).

    4. (3) Objectives and associated measures in this paragraph (e) that rely on measures that count unique patients or actions.

       1. (i) If a measure (or associated objective) in this paragraph (e) references paragraph (e)(3) of this section, the measure may be calculated by reviewing only the actions for patients whose records are maintained using CEHRT. A patient's record is maintained using CEHRT if sufficient data were entered in the CEHRT to allow the record to be saved, and not rejected due to incomplete data.
       2. (ii) If the objective and associated measure does not reference this paragraph (e)(3), the measure must be calculated by reviewing all patient records, not just those maintained using CEHRT.
    5. (4) Protect patient health information—(i) Objective. Protect electronic protected health information (ePHI) created or maintained by the CEHRT through the implementation of appropriate technical, administrative, and physical safeguards.
    6. (ii) Measure scoring. Eligible hospitals and CAHs are required to report on the security risk analysis measure in paragraph (e)(4)(iii) of this section, but no points are available for this measure. In 2022, eligible hospitals and CAHs are required to report on the SAFER Guides measure in paragraph (e)(4)(iv) of this section, but no points are available for this measure.
    7. (iii) Security risk analysis measure. Conduct or review a security risk analysis in accordance with the requirements under 45 CFR 164.308(a)(1), including addressing the security (including encryption) of data created or maintained by CEHRT in accordance with requirements under 45 CFR 164.312(a)(2)(iv) and 45 CFR 164.306(d)(3), implement security updates as necessary, and correct identified security deficiencies as part of the provider's risk management process. Actions included in the security risk analysis measure may occur any time during the calendar year in which the EHR reporting period occurs.
    8. (iv) SAFER Guides measure. Conduct an annual self- assessment using all nine SAFER Guides at any point during the calendar year in which the EHR reporting period occurs.
    9. (5) Electronic prescribing—(i) Objective. Generate and transmit permissible discharge prescriptions electronically (eRx).

    10. (ii) Measures scoring.

        1. (A) In 2019, eligible hospitals and CAHs must meet the e-Prescribing measure in paragraph (e)(5)(iii)(A) of this section and have the option to report on the query of PDMP measure and verify opioid treatment agreement measure in paragraphs (e)(5)(iii)(B) and (C) of this section. The electronic prescribing objective in paragraph (e)(5)(i) of this section is worth up to 20 points.

        2. (B) In 2020 through 2022, eligible hospitals and CAHs must meet the e-Prescribing measure in paragraph (e)(5)(iii)(A) of this section, and have the option to report on the query of PDMP measure in paragraph (e)(5)(iii)(B) of this section.

           (1) In 2020 and 2021, the electronic prescribing objective in paragraph (e)(5)(i) of this section is worth up to 15 points.

           (2) In 2022, the electronic prescribing objective in paragraph (e)(5)(i) of this section is worth up to 20 points.

    11. (iii) Measures—(A) e-Prescribing measure. Subject to paragraph (e)(3) of this section, at least one hospital discharge medication order for permissible prescriptions (for new and changed prescriptions) is queried for a drug formulary and transmitted electronically using CEHRT. This measure is worth up to 10 points in CY 2019 through CY 2022.

    12. (B) Query of prescription drug monitoring program (PDMP) measure. Subject to paragraph (e)(3) of this section, for at least one Schedule II opioid electronically prescribed using CEHRT during the EHR reporting period, the eligible hospital or CAH uses data from CEHRT to conduct a query of a Prescription Drug Monitoring Program (PDMP) for prescription drug history, except where prohibited and in accordance with applicable law. This measure is worth—

        (1) 5 bonus points in CYs 2019, 2020, and 2021; and

        (2) 10 bonus points in CY 2022.

    13. (C) Verify opioid treatment agreement measure. Subject to paragraph (e)(3) of this section, for at least one unique patient for whom a Schedule II opioid was electronically prescribed by the eligible hospital or CAH using CEHRT during the EHR reporting period, if the total duration of the patient's Schedule II opioid prescriptions is at least 30 cumulative days within a 6-month look-back period, the eligible hospital or CAH seeks to identify the existence of a signed opioid treatment agreement and incorporates it into the patient's electronic health record using CEHRT. This measure is worth 5 bonus points in CY 2019.
    14. (iv) Exclusions in accordance with paragraph (e)(2) of this section and redistribution of points. An exclusion claimed under paragraph (e)(5)(v) of this section will redistribute 10 points in CY 2019 and CY 2020 equally among the measures associated with the health information exchange objective under paragraph (e)(6) of this section.
    15. (v) Exclusion in accordance with paragraph (e)(2) of this section. For the EHR reporting periods in CY 2019 through CY 2022, any eligible hospital or CAH that does not have an internal pharmacy that can accept electronic prescriptions and there are no pharmacies that accept electronic prescriptions within 10 miles at the start of the eligible hospital or CAH's EHR reporting period may be excluded from the measure specified in paragraph (e)(5)(iii)(A) of this section.
    16. (6) Health information exchange—(i) Objective. The eligible hospital or CAH provides a summary of care record when transitioning or referring their patient to another setting of care, receives or retrieves a summary of care record upon the receipt of a transition or referral or upon the first patient encounter with a new patient, and incorporates summary of care information from other providers into their EHR using the functions of CEHRT.

    17. (ii) Measures. For CYs 2019, 2020, and 2021, eligible hospitals and CAHs must meet both of the measures specified in paragraphs (e)(6)(ii)(A) and (B) of this section (each worth up to 20 points). For CY 2022, eligible hospitals and CAHs either must meet both of the measures specified in paragraphs (e)(6)(ii)(A) and (B) of this section (each worth up to 20 points) or must meet the measure specified in paragraph (e)(6)(ii)(C) of this section (worth 40 points).

        1. (A) Support electronic referral loops by sending health information measure: Subject to paragraph (e)(3) of this section, for at least one transition of care or referral, the eligible hospital or CAH that transitions or refers its patient to another setting of care or provider of care—

           (1) Creates a summary of care record using CEHRT; and

           (2) Electronically exchanges the summary of care record.

        2. (B) Support electronic referral loops by receiving and reconciling health information measure. Subject to paragraph (e)(3) of this section, for at least one electronic summary of care record received using CEHRT for patient encounters during the EHR reporting period for which an eligible hospital or CAH was the receiving party of a transition of care or referral, or for patient encounters during the EHR reporting period in which the eligible hospital or CAH has never before encountered the patient, the eligible hospital or CAH conducts clinical information reconciliation for medication, medication allergy, and current problem list using CEHRT.

        3. (C) Health information exchange (HIE) bi-directional exchange measure. Subject to paragraph (e)(3) of this section, the eligible hospital or CAH must attest to the following:

           (1) Participating in an HIE in order to enable secure, bi-directional exchange of information to occur for all unique patients discharged from the eligible hospital or CAH inpatient or emergency department (POS 21 or 23), and all unique patient records stored or maintained in the EHR for these departments, during the EHR reporting period in accordance with applicable law and policy.

           (2) Participating in an HIE that is capable of exchanging information across a broad network of unaffiliated exchange partners including those using disparate EHRs, and not engaging in exclusionary behavior when determining exchange partners.

           (3) Using the functions of CEHRT to support bi-directional exchange with an HIE.

    18. (iii) Exclusions in accordance with paragraph (e)(2) of this section. Any eligible hospital or CAH that is unable to implement the support electronic referral loops by receiving and incorporating health information measure under paragraph (e)(6)(ii)(B) of this section for an EHR reporting period in 2019 may be excluded from that measure. Claiming the exclusion will redistribute 20 points to the support electronic referral loops by sending health information measure under paragraph (e)(6)(ii)(A) of this section.
    19. (7) Provider to patient exchange—(i) Objective. The eligible hospital or CAH provides patients (or patient-authorized representative) with timely electronic access to their health information.

    20. (ii) Provide patients electronic access to their health information measure. Eligible hospitals and CAHs must meet the following measure, and could receive up to 40 points for this objective for CY 2019 through CY 2022. For at least one unique patient discharged from the eligible hospital or CAH inpatient or emergency department (POS 21 or 23) all of the following:

        1. (A) The patient (or patient-authorized representative) is provided timely access to view online, download, and transmit his or her health information.
        2. (B) The eligible hospital or CAH ensures the patient's health information is available for the patient (or patient-authorized representative) to access using any application of their choice that is configured to meet the technical specifications of the API in the eligible hospital or CAH's CEHRT.
        3. (8) Public health and clinical data exchange.—(i) Objective. The eligible hospital or CAH is in active engagement with a public health agency (PHA) or clinical data registry (CDR) to submit electronic public health data in a meaningful way using CEHRT, except where prohibited, and in accordance with applicable law and practice.

        4. (ii) Measures. For CYs 2019, 2020, and 2021, eligible hospitals and CAHs could receive a total of 10 points for the objective under paragraph (e)(8)(i) of this section. In order to meet the objective under paragraph (e)(8)(i) of this section, an eligible hospital or CAH must meet any two measures specified in paragraphs (e)(8)(ii)(A) through (F) of this section. For CY 2022, eligible hospitals and CAHs could receive a total of 15 points for the objective under paragraph (e)(8)(i) of this section. In order to meet the objective under paragraph (e)(8)(i) of this section and receive 10 points, an eligible hospital or CAH must meet each of the four measures specified in paragraphs (e)(8)(ii)(A), (B), (C), and (F) of this section. An eligible hospital or CAH receives a bonus of 5 points for this objective if they meet one of the measures specified in paragraph (e)(8)(ii)(D) or (E).

           1. (A) Syndromic surveillance reporting measure. For CYs 2019, 2020, and 2021, the eligible hospital or CAH is in active engagement with a public health agency to submit syndromic surveillance data from an urgent care setting. For CY 2022, the eligible hospital or CAH is in active engagement with a public health agency to submit syndromic surveillance data from an emergency department setting (POS 23).
           2. (B) Immunization registry reporting measure. The eligible hospital or CAH is in active engagement with a public health agency to submit immunization data and receive immunization forecasts and histories from the public health immunization registry/immunization information system (IIS).
           3. (C) Electronic case reporting measure. The eligible hospital or CAH is in active engagement with a public health agency to submit case reporting of reportable conditions.
           4. (D) Public health registry reporting measure. The eligible hospital or CAH is in active engagement with a public health agency to submit data to public health registries.
           5. (E) Clinical data registry reporting measure. The eligible hospital or CAH is in active engagement to submit data to a clinical data registry.
           6. (F) Electronic reportable laboratory result reporting measure. The eligible hospital or CAH is in active engagement with a public health agency to submit electronic reportable laboratory results.

        5. (iii) Exclusions in accordance with paragraph (e)(2) of this section. For CYs 2019, 2020, and 2021, if an exclusion is claimed under paragraphs (e)(8)(iii)(A) through (F) of this section for each of the two measures selected for reporting, the 10 points for the objective specified in paragraph (e)(8)(i) of this section will be redistributed to the provide patients electronic access to their health information measure under paragraph (e)(7)(ii) of this section. For CY 2022, if an exclusion is claimed under paragraphs (e)(8)(iii)(A) through (F) of this section for each of the four measures required for reporting, the 10 points for the objective specified in paragraph (e)(8)(i) of this section will be redistributed to the provide patients electronic access to their health information measure under paragraph (e)(7)(ii) of this section.

           1. (A) Any eligible hospital or CAH meeting one or more of the following criteria may be excluded from the syndromic surveillance reporting measure specified in paragraph (e)(8)(ii)(A) of this section if the eligible hospital or CAH—

              (1) For CYs 2019, 2020 and 2021, does not have an emergency or urgent care department.

              (2) For CY 2022, does not have an emergency department.

              (3) Operates in a jurisdiction where no public health agency has declared readiness to receive syndromic surveillance data from eligible hospitals or CAHs as of 6 months prior to the start of the EHR reporting period.

           2. (B) Any eligible hospital or CAH meeting one or more of the following criteria may be excluded from to the immunization registry reporting measure specified in paragraph (e)(8)(ii)(B) of this section if the eligible hospital or CAH—

              (1) Does not administer any immunizations to any of the populations for which data is collected by its jurisdiction's immunization registry or immunization information system during the EHR reporting period.

              (2) Operates in a jurisdiction for which no immunization registry or immunization information system is capable of accepting the specific standards required to meet the CEHRT definition at the start of the EHR reporting period.

              (3) Operates in a jurisdiction where no immunization registry or immunization information system has declared readiness to receive immunization data as of 6 months prior to the start of the EHR reporting period.

           3. (C) Any eligible hospital or CAH meeting one or more of the following criteria may be excluded from the electronic case reporting measure specified in paragraph (e)(8)(ii)(C) of this section if the eligible hospital or CAH—

              (1) Does not treat or diagnose any reportable diseases for which data is collected by their jurisdiction's reportable disease system during the EHR reporting period.

              (2) Operates in a jurisdiction for which no public health agency is capable of receiving electronic case reporting data in the specific standards required to meet the CEHRT definition at the start of their EHR reporting period.

              (3) Operates in a jurisdiction where no public health agency has declared readiness to receive electronic case reporting data as of 6 months prior to the start of the EHR reporting period.

           4. (D) (1) For CYs 2019, 2020, and 2021, any eligible hospital or CAH meeting at least one of the following criteria may be excluded from the public health registry reporting measure specified in paragraph (e)(8)(ii)(D) of this section if the eligible hospital or CAH:

              (i) Does not diagnose or directly treat any disease or condition associated with a public health registry in its jurisdiction during the EHR reporting period.

              (ii) Operates in a jurisdiction for which no public health agency is capable of accepting electronic registry transactions in the specific standards required to meet the CEHRT definition at the start of the EHR reporting period.

              (iii) Operates in a jurisdiction where no public health registry for which the eligible hospital or CAH is eligible has declared readiness to receive electronic registry transactions as of 6 months prior to the start of the EHR reporting period.

              (2) For CY 2022, the exclusions specified in paragraph (D)(1) of this paragraph are no longer available.

           5. (E) (1) For CYs 2019, 2020, and 2021, any eligible hospital or CAH meeting at least one of the following criteria may be excluded from the clinical data registry reporting measure specified in paragraph (e)(8)(ii)(E) of this section if the eligible hospital or CAH:

              (i) Does not diagnose or directly treat any disease or condition associated with a clinical data registry in their jurisdiction during the EHR reporting period.

              (ii) Operates in a jurisdiction for which no clinical data registry is capable of accepting electronic registry transactions in the specific standards required to meet the CEHRT definition at the start of the EHR reporting period.

              (iii) Operates in a jurisdiction where no clinical data registry for which the eligible hospital or CAH is eligible has declared readiness to receive electronic registry transactions as of 6 months prior to the start of the EHR reporting period.

              (2) For CY 2022, the exclusions specified in paragraph (E)(1) of this paragraph are no longer available.

           6. (F) Any eligible hospital or CAH meeting one or more of the following criteria may be excluded from the electronic reportable laboratory result reporting measure specified in paragraph (e)(8)(ii)(F) of this section if the eligible hospital or CAH—

              (1) Does not perform or order laboratory tests that are reportable in its jurisdiction during the EHR reporting period.

              (2) Operates in a jurisdiction for which no public health agency that is capable of accepting the specific ELR standards required to meet the CEHRT definition at the start of the EHR reporting period.

              (3) Operates in a jurisdiction where no public health agency has declared readiness to receive electronic reportable laboratory results from an eligible hospital or CAH as of 6 months prior to the start of the EHR reporting period.

25. (f) Stage 3 objectives and measures for eligible hospitals and CAHs attesting to CMS for 2023 and subsequent years—(1) General rule.

    1. (i) Except as specified in paragraph (f)(2) of this section, eligible hospitals and CAHs must do all of the following as part of meeting the definition of a meaningful EHR user under § 495.4:

       1. (A) Meet all objectives and associated measures selected by CMS under section 1886(n)(3) of the Act for an EHR reporting period.
       2. (B) In 2023 and 2024, earn a total score of at least 60 points.
       3. (C) In 2025 earn a total score of at least 70 points.
       4. (D) In 2026 and subsequent years, earn a total score of at least 80 points.
    2. (ii) The numerator and denominator of the measures increment based on actions occurring during the EHR reporting period selected by the eligible hospital or CAH, unless otherwise indicated.

    3. (2) Exclusion for nonapplicable measures.

       1. (i) Exclusion of a particular measure. An eligible hospital or CAH may exclude a particular measure that includes an option for exclusion if the eligible hospital or CAH meets the following requirements:

          1. (A) Meets the criteria in the applicable measure that would permit the exclusion.
          2. (B) Attests to the exclusion.
       2. (ii) Distribution of points for nonapplicable measures. For eligible hospitals or CAHs that claim such exclusion, the points assigned to the excluded measure are distributed to other measures as specified by CMS for an EHR reporting period.

    4. (3) Beginning with the EHR reporting period in CY 2026, if certain circumstances occur that impact CMS's assessment of the performance of eligible hospitals and CAHs on a measure selected as described in paragraph (f)(1)(i)(A) of this section, CMS may, in its sole discretion, suppress the affected measure by excluding it from CMS' assessment of performance while allocating the maximum points available or providing full credit for the affected measure as long as the affected measure is reported, resulting in a suppressed measure contributing to the Medicare Promoting Interoperability Program objective score in paragraph (f)(1)(i)(D) of this section; or excluding it from the determination of a meaningful EHR user if the affected measure is not scored. CMS determines whether certain circumstances exist warranting suppression of a measure based on CMS' consideration of one or more of the following factors:

       1. (i) The nature, breadth, and duration of the circumstance's effect on eligible hospitals' and CAHs' ability to fulfill the measure requirement.
       2. (ii) The availability of certified health IT modules to fulfill the measure.
       3. (iii) The circumstance affects the measure such that calculating the measure score would lead to misleading or inaccurate results, which may include performance or compliance.
       4. (iv) Out-of-date or conflicting technical standards.
       5. (v) Technical and operational capacity of required partners.
       6. (vi) Other factors as determined by CMS.

[81 FR 79884, Nov. 14, 2016, as amended at 82 FR 38517, August 14, 2017; 82 FR 46143, Oct. 4, 2017; 83 FR 41707, Aug. 17, 2018; 83 FR 60096, Nov. 23, 2018; 84 FR 42616, Aug. 16, 2019; 85 FR 59026, Sept. 18, 2020; 86 FR 45522, Aug. 13, 2021; 87 FR 49410, Aug. 10, 2022; 89 FR 69914, Aug. 28, 2024; 89 FR 80131, Oct. 2, 2024; 90 FR 50021, Nov. 5, 2025]