A certified health application can interact with technology that has not been certified. That practical fact raised a question of responsibility in ONC's October 2016 oversight policy: how could regulators investigate a harmful interaction without treating one developer as responsible for every connected system? The agency's October 14 explanation drew a boundary around both the object of enforcement and the developer's capacity to act. [onc-release][2016-24908]

ONC said it might examine interactions with uncertified capabilities when evaluating certified health IT. Its direct-review actions would nevertheless focus on the certified technology. It also said developers would not be held responsible for nonconformities outside their reasonable ability to influence or control. This was not a declaration that connections were harmless or that certification guaranteed safe operation in every setting. [onc-release][2016-24908]

The final rule published October 19 supplied the counterpart to that limit: ONC could investigate suspected failures involving serious public health or safety risks or obstacles to certification-body oversight. Corrective plans had to address affected customers and explain how identified problems would be resolved. The regulations were effective December 19. Those provisions concerned technology in the certification program, rather than all digital tools used in care. [onc-release][2016-24908]

Our ethical reading is that accountability requires both a remedy and a defensible account of who can deliver it. Blaming an unreachable cause would not repair software; ignoring interactions would leave relevant risks unexamined. The agency announcement and final rule form a shared policy record, not two independent demonstrations of safety. They set expectations for responsible investigation, without establishing that those expectations had already been met. [onc-release][2016-24908]

Source documents

  1. ONC direct review process announcementhttps://healthit.gov/blog/healthit-certification/highlights-supporting-reliability-safety-certified-health-onc-direct-review-process/
  2. ONC Health IT Certification Program: Enhanced Oversight and Accountabilityhttps://www.govinfo.gov/content/pkg/FR-2016-10-19/html/2016-24908.htm