An ONC-ATL shall:
- (a) Maintain its NVLAP accreditation for the ONC Health IT Certification Program, including accreditation to ISO/IEC 17025 (incorporated by reference, see § 170.599);
- (b) Attend all mandatory ONC training and program update sessions;
- (c) Maintain a training program that includes documented procedures and training requirements to ensure its personnel are competent to test health IT;
(d) Report to ONC within 15 days any changes that materially affect its:
- (1) Legal, commercial, organizational, or ownership status;
- (2) Organization and management including key testing personnel;
- (3) Policies or procedures;
- (4) Location;
- (5) Personnel, facilities, working environment or other resources;
- (6) ONC authorized representative (point of contact); or
- (7) Other such matters that may otherwise materially affect its ability to test health IT.
- (e) Allow ONC, or its authorized agent(s), to periodically observe on site (unannounced or scheduled), during normal business hours, any testing performed pursuant to the ONC Health IT Certification Program;
(f) Records retention:
- (1) Retain all records related to the testing of Complete EHRs and/or Health IT Modules to an edition of certification criteria for a minimum of 3 years from the effective date that removes the applicable edition from the Code of Federal Regulations; and
- (2) Make the records available to HHS upon request during the retention period described in paragraph (f)(1) of this section;
- (g) Only test health IT using test tools and test procedures approved by the National Coordinator; and
(h) Promptly refund any and all fees received for:
- (1) Requests for testing that are withdrawn while its operations are suspended by the National Coordinator;
- (2) Testing that will not be completed as a result of its conduct; and
- (3) Previous testing that it performed if its conduct necessitates the retesting of Complete EHRs and/or Health IT Modules.
[81 FR 72465, Oct. 19, 2016]