by Joseph Ingemi

I must admit I am disappointed in the Meaningful Use Regulations (45 CFR Part 170) because of the high cost of compliance. The regulators themselves admit to the favoritism showed to larger software developers. So I went to Regulations.gov and submitted the following feedback.

The irony is that we hear a lot from Washington, DC about growing small businesses. Yet here we have developed a regulation that strikes a blow to those very small businesses that need help.

Here are the comments I submitted:

"This regulation, meant to define meaningful use, proves to be far too cumbersome and creates a barrier to entry for small companies based on the cost of certification of EHRs. The regulation (in the impact statement) cites the cost of certification and compliance for developers to be in the hundreds of thousands to millions of dollars. Additionally, the drafters admit that this regulation favors larger software development companies and pre-existing software. While there is a need to define meaningful use and a method for compliance also is necessary, the regulation as drafted will stifle the innovation that can come from small businesses.

"The regulation should take the form of risk-based, bottom-up compliance rather than a "one-size fits all" approach. Performance standards should be maintained while the technical and security standards should be integrated generally into the performance standards. For example, security and privacy should be encapsulated into general standards such as:

* Maintain HIPAA compliance.
* Ensure secure transmission of records.

"Providers would have the responsibility of compliance with the performance standards. Providers would be required to:

* Identify the performance standard.
* Indicate how their Electronic Healthcare Record System complies.
* Evaluate the risk with this compliance solution.
* Describe mitigation strategies against this risk.

"Software developers would design their offerings around this methodology. Providers could choose software that makes compliance easier at the cost of customization. Another option for more technically savvy providers would be purchase software that can be customized to their operations but assume more responsibility for compliance.

"In recent weeks, we have heard a lot of about assisting small businesses. If the federal government is sincere about assisting small businesses, then Meaningful Use regulations should be simplified. Such an action would allow small businesses to enter into a growing market."

So what's your take? Have you submitted your comments yet?

Joseph Ingemi is a Certified Information Systems Auditor and certified Project Management Professional who writes about healthcare IT issues at his blog, Health IT Politics. He also consults on project management and audit services in area of healthcare IT implementation and compliance through his company, Pinarus Technologies.