§ 170.315(f)(2)
Transmission to public health agencies — syndromic surveillance
Get Email Updates
Certification Companion Guide
Test Procedure
Certification Companion Guide
v1.3
View Changelog
Issued Date:
03-11-2024
02-23-2026
This Certification Companion Guide (CCG) is an informative document designed to assist with health IT product certification. The CCG is not a substitute for the requirements outlined in regulation and related ONC final rules. It extracts key portions of ONC final rules’ preambles and includes subsequent clarifying interpretations. To access the full context of regulatory intent please consult the
Certification Regulations
page for links to all ONC final rules or consult other regulatory references as noted. The CCG is for public use and should not be sold or redistributed.
Quick Overview
Required Updates
None
Design and Performance
Additional Criterion Information
Base EHR Definition
Not Included
Real World Testing
Yes
Insights Condition
No
SVAP Versions
Yes
CLARIFICATIONS
REGULATORY
STANDARDS
DEPENDENCIES
RESOURCES
CHANGELOG
IN THIS SECTION
Certification Clarifications
Technical Explanations and Clarifications
Search and Filter
Search Here...
Filter By Paragraph
All
Sort:
Technical outcome – The health IT is able to create syndrome-based public health surveillance information for electronic transmission to public health agencies according to the HL7 2.5.1 standard, the Public Health Information Network (PHIN) Messaging Guide for Syndromic Surveillance Release 2.0, and the August 2015 Erratum to the PHIN Messaging Guide.
Clarifications:
For the public health certification criteria in § 170.315(f), health IT will only need to be certified to those criteria that are required to meet the measures the provider intends to report on to meet Objective 8: Public Health and Clinical Data Registry Reporting.
Health IT is not required to comply with the implementation guide’s requirement that a sender’s system (Health IT Module) support the ICD-9-CM value set.
Health IT must be tested and certified to only one of the value sets for the implementation guide’s “submitted messages” requirement. More specifically, this means that a Health IT Module can use either the ICD-10-CM or SNOMED CT® value sets in the submitted messages for all of the test steps in the Syndromic Surveillance Test Suite. The tool provides test data that includes codes for both value sets. Where the tool does not have test data that supports the Health IT Module’s value set (either ICD-10-CM or SNOMED CT®), the developer of the Health IT Module must provide the codes and testers must perform a visual inspection of the messages for these test steps to ensure that equivalent and valid ICD-10-CM or SNOMED CT® are used to populate the messages.
It is appropriate to distinguish between ambulatory settings and emergency department, urgent care and inpatient settings. This criterion requires the use of the HL7® 2.5.1 standard, PHIN Messaging Guide Release 2.0, and August 2015 Erratum to the PHIN Messaging Guide for the inpatient setting (which includes emergency departments).
There is no certification requirement for the ambulatory setting. ONC notes that the PHIN Messaging Guide Release 2.0 and Erratum does support the urgent care ambulatory setting and would be appropriate to use to that particular setting. [see also
80 FR 62665
The 2024 SVAP version includes test cases for both an urgent care ambulatory setting as well as for routine ambulatory care.
The CDC published an erratum to the PHIN Messaging Guide Release 2.0 (August 2015). The Erratum consolidates Release 2.0 information and clarifies existing conformance requirements of the implementation guide. ONC refers developers to the addendum for specific information about the clarifications it includes. [see also
80 FR 62665
NIST has published, in collaboration with CDC,
Errata and Clarification Guidelines
to clarify conformance requirements of the 2024 SVAP implementation guide.
The 2024 SVAP implementation guide includes business rules for timeliness as well as for timestamp and identifier consistency. Visual inspection test cases have been included in the SVAP test tool to verify conformance to these business rules.
There is no transport standard required for this criterion. Developers have the flexibility to determine the transport standard(s) to implement. [see also
77 FR 54243
STANDARDS REFERENCED
§ 170.205(d)(4)
HL7® 2.5.1. Implementation specifications
PHIN Messaging Guide for Syndromic Surveillance: Emergency Department, Urgent, Care, Inpatient and Ambulatory Care, and Inpatient Settings, Release 2.0, April 21, 2015
Erratum to the CDC PHIN 2.0 Implementation Guide, August 2015
Regulation Text
§ 170.315 (f)(2) Transmission to public health agencies – syndromic surveillance—
Create syndrome-based public health surveillance information for electronic transmission in accordance with the standard (and applicable implementation specifications) specified in § 170.205(d)(4).
Standards & References
The following standards are referenced within the certification criteria for:
§ 170.315(f)(2) Transmission to public health agencies — syndromic surveillance
Applies to entire criterion
§ 170.205(d)(4)
Health Level 7 (HL7
) 2.5.1
Implementation specifications
PHIN Messaging Guide for Syndromic Surveillance: Emergency Department, Urgent, Care, Inpatient and Ambulatory Care Settings, Release 2.0, April 21, 2015
and
Erratum to the CDC PHIN 2.0 Implementation Guide, August 2015
Standards Version Advancement Process (SVAP) Version(s) Approved
HL7® Version 2.5.1 Implementation Guide: Syndromic Surveillance, Release 1 - US Realm Standard for Trial Use, July 2019
For more information, please visit the
Standards Version Advancement Process (SVAP) Version(s) page
Certification Dependencies
IN THIS SECTION
§ 170.405
Real World Testing
Products certified to this criterion must complete requirements outlined for the Real World Testing Conditions and Maintenance of Certification.
Note: Enforcement discretion has been issued for CY 2025–2026. Refer to the
Enforcement Discretion Notices
for full details.
Privacy and Security
This certification criterion was adopted at § 170.315(f)(2). As a result, an ONC Authorized Certification Body (ONC-ACB) must ensure that a product presented for certification to a § 170.315(f) criterion includes the privacy and security criteria (adopted in § 170.315(d)) within the overall scope of the certificate issued to the product.
The privacy and security criteria (adopted in § 170.315(d)) do not need to be explicitly tested with this specific paragraph (f) criterion unless it is the only criterion for which certification is requested.
As a general rule, a product presented for certification only needs to be tested once to each applicable privacy and security criterion (adopted in § 170.315(d)) so long as the health IT developer attests that such privacy and security capabilities apply to the full scope of capabilities included in the requested certification. However, exceptions exist for § 170.315(e)(1) “View, download, and transmit to 3rd party (VDT)” and (e)(2) “Secure messaging,” which are explicitly stated.
§ 170.315(d)(2)(i)(C) is not required if the scope of the Health IT Module does not have end-user device encryption features.
For more information on the approaches to meet these Privacy and Security requirements, please download the Privacy and Security CCG below:
Privacy and Security CCG
If choosing
Approach 1
Authentication, access control, and authorization (§ 170.315(d)(1))
Auditable events and tamper-resistance (§ 170.315(d)(2))
Audit reports (§ 170.315(d)(3))
End-user device encryption (§ 170.315(d)(7))
Encrypt authentication credentials (§ 170.315(d)(12))
Multi-factor authentication (MFA) (§ 170.315(d)(13))
If choosing
Approach 2
For each applicable privacy and security certification criterion not certified for Approach 1, the health IT developer may certify using system documentation that is sufficiently detailed to enable integration such that the Health IT Module has implemented service interfaces for each applicable privacy and security certification criterion that enable the Health IT Module to access external services necessary to meet the requirements of the privacy and security certification criterion. Please see the
21st Century Cures Act: Interoperability, Information Blocking, and the ONC Health IT Certification Program
Final Rule at
85 FR 25710
for additional clarification.
Design and Performance
The following design and performance certification criteria (adopted in § 170.315(g)) must also be certified in order for the product to be certified.
Quality management system (§ 170.315(g)(4))
: When a single quality management system (QMS) is used, the QMS only needs to be identified once. Otherwise, the QMS’ need to be identified for every capability to which it was applied.
Accessibility-centered design (§ 170.315(g)(5))
: When a single accessibility-centered design standard is used, the standard only needs to be identified once. Otherwise, the accessibility-centered design standards need to be identified for every capability to which they were applied; or, alternatively, the developer must state that no accessibility-centered design was used.
Resources
The following resources can offer assistance or additional information:
§ 170.315(f)(2) Transmission to public health agencies — syndromic surveillance
PDF DOCUMENT
Real World Testing Resource Guide
2024-11-27
PDF DOCUMENT
Real World Testing Fact Sheet
Certification Companion Guide Changelog
The following changelog applies to:
§ 170.315(f)(2)Transmission to public health agencies — syndromic surveillance
Changelog functionality is not available.
Revision History
Version #
Description of Change
Version Date
1.0
Initial publication
03-11-2024
1.1
Standards Referenced updated to reflect 2024 Approved SVAP Standards
08-19-2024
1.2
Added update to Certification Dependencies section to reflect recent Real World Testing enforcement discretion notice.
07-23-2025
1.3
Updated Clarifications for 2024 SVAP Standards.
02-23-2026
Test Procedure
v1.1
View Changelog
Issued Date:
03-11-2024
02-23-2026
This Test Procedure illustrates the test steps required to certify a Health IT Module to this criterion. Please consult the most recent ONC Final Rule on the
Certification Regulations
page for a detailed description of the certification criterion with which these testing steps are associated. ONC also encourages developers to consult the Certification Companion Guide in tandem with the test procedure as it provides clarifications that may be useful for product development and testing.
Quick Overview
Required Updates
None
Design and Performance
Additional Criterion Information
Base EHR Definition
Not Included
Real World Testing
Yes
Insights Condition
No
SVAP Versions
Yes
TESTING STEPS
TOOLS AND DATA
TESTING COMPONENTS
CHANGELOG
IN THIS SECTION
View Regulation Text
Testing Steps
Note: The test step order does not necessarily prescribe the order in which the tests should take place.
Search and Filter
Search Here...
Filter By Paragraph
Filter By Date
Sort:
Testing Steps
System Under Test
The health IT developer identifies which of the health care setting(s) (Emergency Department, Inpatient, Urgent Care, Ambulatory) is applicable to the system under test. The Health IT Module creates syndromic surveillance content using ONC-supplied test data for each of the test cases for the identified health care setting(s) under the ONC Certification Test Plan on the Context-Based Validation Tab of the NIST HL7
v2 Syndromic Surveillance Test Suite (or of the NIST Syndromic Surveillance Test Suite Edition 2 for SVAP). All test cases are required that apply to the health care setting(s) supported by the system under test. Input may be performed using manual or automated processes.
For each test case, the Health IT Module generates the indicated HL7
v2.5.1 ADT message type containing the Syndromic Surveillance information and using the provided test data and according to the § 170.205(d)(4) PHIN Messaging Guide for Syndromic Surveillance: Emergency Department, Urgent, Care, Inpatient and Ambulatory Care, and Inpatient Settings, Release 2.0 and associated Erratum (or according to the HL7® Version 2.5.1 Implementation Guide: Syndromic Surveillance, Release 1 - US Realm Standard for Trial Use, July 2019 for 2024 SVAP).
Approved SVAP Version(s)
HL7® Version 2.5.1 Implementation Guide: Syndromic Surveillance, Release 1 - US Realm Standard for Trial Use, July 2019
Test Lab Verification
Using the
Normative Test Description section of the Normative Test Process Document:
The tester verifies the Health IT Module creates the source syndromic surveillance content correctly and without omission through visual inspection of the system under test using the test data specification of each Test Step associated with the selected test case.
The tester imports the syndromic surveillance message into the NIST HL7
v2 Syndromic Surveillance Test Suite and uses the Validation Report produced by the test tool to verify the Health IT Module passes without error to confirm that the syndromic surveillance message is conformant to the HL7
v2.5.1 ADT message type in the § 170.205(d)(4) standard and associated Erratum or SVAP standard.
For 2024 SVAP, the tester performs visual inspection to verify business rule conformance for timeliness and timestamp consistency.
TEST TOOL DOCUMENTATION
Testing Tools
§ 170.315(f)(2) Transmission to public health agencies — syndromic surveillance
NIST HL7® v2 Syndromic Surveillance Test Suite
The NIST Syndromic Surveillance Test Suite supports the testing of HL7 v2.5.1 messages in support of the Syndromic Surveillance Community.
NIST HL7® v2 Syndromic Surveillance Test Suite Edition 2 (2024 SVAP)
The NIST Syndromic Surveillance Test Suite Edition 2 supports the testing of HL7 v2.5.1 messages in support of the Syndromic Surveillance Community.
Test Data
Test data for implementation and validation.
(f)(2)
Refer to the
NIST HL7® v2 Syndromic Surveillance Test Suite
Refer to the
NIST HL7® v2 Syndromic Surveillance Test Suite Edition 2
(2024 SVAP)
Testing Components
§ 170.315(f)(2) Transmission to public health agencies — syndromic surveillance
Documentation may be used as a method to demonstrate conformance but is not required for this criterion. Health IT developers may optionally provide documentation to supplement other testing methods.
Visual inspection is an approved method to demonstrate conformance. Most commonly, this will be accomplished via a live demonstration of functionality that meets the criterion.
Testing tools indicate that a test tool(s) exists and must be used to test a portion or all of a Health IT Module's conformance to the criterion.
Indicates that the Standards Version Advancement Process (SVAP) is applicable to the criterion.
Test Data
The test data for this criterion is provided within the testing tools tab. Click the link below to be directed to the testing tools tab.
Review Test Data
Test Method Changelog
The following changelog applies to:
§ 170.315(f)(2)Transmission to public health agencies — syndromic surveillance
Changelog functionality is not available.
Revision History
Version #
Description of Change
Version Date
1.0
Initial publication
03-11-2024
1.1
Revised publication to add 2024 SVAP
02-23-2026
The following design and performance certification criteria (adopted in § 170.315(g)) must also be certified in order for the product to be certified.
Additional Criteria:
§ 170.315(g)(4)
Quality management system
Description:
When a single quality management system (QMS) is used, the QMS only needs to be identified once. Otherwise, when different QMS are used, each QMS needs to be separately identified for every capability to which it was applied.
§ 170.315(g)(5)
Accessibility-centered design
Description:
When a single accessibility-centered design standard is used, the standard only needs to be identified once. Otherwise, the accessibility-centered design standards need to be identified for every capability to which they were applied; or, alternatively, the developer must state that no accessibility-centered design was used.
Loading Privacy & Security content...
Standards Version Advancement Process (SVAP)
The Standards Version Advancement Process (SVAP) permits health IT developers to voluntarily update health IT products certified under the ONC Health IT Certification Program (Certification Program) to newer versions of adopted standards as part of the "Real World Testing" Condition and Maintenance of Certification requirement (§ 170.405) of the 21st Century Cures Act.
Learn More About SVAP
SVAP Approved Version:
JULY 2019
HL7® Version 2.5.1 Implementation Guide: Syndromic Surveillance, Release 1 - US Realm Standard for Trial Use
Related to standard reference: § 170.205(d)(4)
External Link Notice
Welcome to HealthIT.gov!
Thank you for visiting the HealthIT.gov website! We welcome your feedback using the "Submit Feedback" button at the bottom of the page to help us improve your experience!