IHE: What’s up with Certification?

April 10, 2013
I have been watching with interest the outcome of a recent announcement that the Integrating the Healthcare Enterprise (IHE USA) (http://iheusa.org/) has contracted with ICSA Labs, a for-profit division of Verizon (https://www.icsalabs.com/) for certification of IHE profiles. On the surface, this sounds like a good thing, but dig deeper and it raises a number of interesting questions with respect to intent and motive.
I have been watching with interest the outcome of a recent announcement that the Integrating the Healthcare Enterprise (IHE USA) (http://iheusa.org/) has contracted with ICSA Labs, a for-profit division of Verizon (https://www.icsalabs.com/) for certification of IHE profiles.  On the surface, this sounds like a good thing, but dig deeper and it raises a number of interesting questions with respect to intent and motive.

For a number of years the IHE USA has conducted an annual “connectathon” in Chicago.  The latest is scheduled for early next year.  So, it came as a surprise to a number of people in the industry when the IHE USA and ICSA released a joint announcement on the certification initiative (http://newscenter.verizon.com/press-releases/verizon/2012/icsa-labs-and-ihe-usa-team-up.html).  The announcement relays the IHE’s intent to hold the connectathon, and at the same time have ICSA conduct registration and certification of vendor products.  Normally, certification would be a good thing, but there are a number of curiosities about the announcement and ensuing process:

      The planned ICSA certification is separate from the Connectathon process.  As I understand it, a vendor could choose to participate in the Connectathon, but not the certification process.  Therefore, what is the point in having the Connectathon and Certification take place at the same time?
      Certification is to take place by ICSA Lab’s “independent and impartial certification body,” who will administer the certification.  ICSA Labs is known for their certification of security systems, and is also a Meaningful Use ONC-Authorized Testing and Certification Body (ONC-ATCB).  But, does either of these qualify ICSA board members to do IHE certification?  There is no identification yet from either IHE or ICSA Labs as to how the independent and impartial certification body will be assembled.
      ICSA certification of IHE profiles has no impact on the National Coordinator’s Health IT Certification Program, meaning that vendors will be forced to go through ICSA certification as well as ONC certification.  Why can’t IHE certification be rolled into this process and save vendors the added trouble of a separate certification when the whole point of IHE profiles is interoperability with healthcare IT systems?  Just because a vendor secures ICSA certification doesn’t mean it has any bearing on ONC certification – so what’s the point?
      As above, one would have to assume there is some value to IHE certification, but nowhere in the announcement materials does it speak to any value proposition.  If I as a vendor were being asked to pay for certification, I would expect a value proposition, particularly since it appears to have the same result as the current voluntary connectathon.
      Given that there are most likely fees involved for certification, what impact does this have to vendors?  Vendors already incur the expense of connectathon participation, and now they would be asked to incur the additional cost of certification, for what additional value?  Will this become a differentiator where the larger, well-funded vendors can afford certification, and smaller vendors cannot? There will also be an ongoing cost, as any changes a vendor makes will require re-certification.  A fee-based certification may set an expectation that systems will easily interoperate.  Since the certification is not expected to address all profiles, this might be an incorrect assumption!  Again, where is the value over and above the connectathon?
      Why was this announced literally a month before the connectathon?  What is the urgency to initiate certification, and why could it not wait?  It doesn’t seem to have a lot of pre-thought.

I am not alone in questioning the process.  David Clunie, a well-respected physician intimately involved in the process made a number of points in his recent blog (http://dclunie.blogspot.com/2012/12/will-certification-kill-ihe-connectathon.html).  David expressed concern with the cost of the certification process, and is critical of the lack of communication within the IHE community prior to the announcement.  He also weighs the merits of self-certification that has worked so well, and calls into question the financial motives for ICSA Lab’s involvement.

So, as I said, on the surface it seems like a reasonable thing, but perhaps it is the optics of the way it has been handled to date.  The IHE USA and ICSA Labs would be wise to take these questions to heart and provide further clarification on their certification initiative.  A proper explanation of the value proposition of such certification will go a long way toward alleviating industry concerns.

As usual, your comments are welcomed!

Sponsored Recommendations

A Cyber Shield for Healthcare: Exploring HHS's $1.3 Billion Security Initiative

Unlock the Future of Healthcare Cybersecurity with Erik Decker, Co-Chair of the HHS 405(d) workgroup! Don't miss this opportunity to gain invaluable knowledge from a seasoned ...

Enhancing Remote Radiology: How Zero Trust Access Revolutionizes Healthcare Connectivity

This content details how a cloud-enabled zero trust architecture ensures high performance, compliance, and scalability, overcoming the limitations of traditional VPN solutions...

Spotlight on Artificial Intelligence

Unlock the potential of AI in our latest series. Discover how AI is revolutionizing clinical decision support, improving workflow efficiency, and transforming medical documentation...

Beyond the VPN: Zero Trust Access for a Healthcare Hybrid Work Environment

This whitepaper explores how a cloud-enabled zero trust architecture ensures secure, least privileged access to applications, meeting regulatory requirements and enhancing user...