§ 170.524 Principles of proper conduct for ONC-ATLs.

An ONC-ATL shall: (a) Accreditation. Maintain its NVLAP accreditation for the ONC Health IT Certification Program, including accreditation to ISO/IEC 17025 (incorporated by reference, see § 170.599); (b) Mandatory training. Attend all mandatory ONC training and program update sessions; (c) Training program. Maintain a training program that includes documented procedures and training requirements to ensure its personnel are competent to test health IT; (d) Reporting. Report to ONC within 15 days any changes that materially affect its: (1) Legal, commercial, organizational, or ownership status; (2) Organization and management including key testing personnel; (3) Policies or procedures; (4) Location; (5) Personnel, facilities, working environment or other resources; (6) ONC authorized representative (point of contact); or (7) Other such matters that may otherwise materially affect its ability to test health IT. (e) Onsite observation. Allow ONC, or its authorized agent(s), to periodically observe on site (unannounced or scheduled), during normal business hours, any testing performed pursuant to the ONC Health IT Certification Program; (f) Records retention. (1) Retain all records related to the testing of Health IT Modules to the ONC Certification Criteria for Health IT beginning with the codification of those certification criteria in the Code of Federal Regulations through a minimum of three years after the end of calendar year that included the effective date of the removal of those certification criteria from the Code of Federal Regulations; and (2) Make the records available to HHS upon request during the retention period described in paragraph (f)(1) of this section; (g) Approved testing methods. Only test health IT using test tools and test procedures approved by the National Coordinator; and (h) Refunds. Promptly refund any and all fees received for: (1) Requests for testing that are withdrawn while its operations are suspended by the National Coordinator; (2) Testing that will not be completed as a result of its conduct; and (3) Previous testing that it performed if its conduct necessitates the retesting of Health IT Modules.