CMS added a new measure to the Protect Patient Health Information objective. Starting 2022, hospitals must attest to whether they completed an annual self assessment of all nine Safety Assurance Factors for EHR Resilience (SAFER) Guides. The new SAFER Guides measure requirement comes in addition to the existing requirement to complete an annual security risk analysis.

SAFER Guides required, but not scored in 2022
While the SAFER Guides measure is required in 2022, it will not be scored. This means reporting either “yes” or “no” will not affect your PI score for 2022. This policy could change across the next few years, subject to future rulemaking.
Assess potential EHR safety risks annually
The SAFER Guides aim to prepare hospitals for planned and unplanned events that may lead to EHR unavailability and safety risks, such as system disruption, failure, or natural disasters. The self assessments help hospitals raise awareness of potential risks and learn about practices to mitigate these risks. Completing the assessments does not require an organization to confirm that it has fully implemented each practice described in the guides.
Hospitals should engage a multidisciplinary team to conduct the self assessments that includes stakeholders from clinical, nursing, health information management, and IT departments. Broadly, the team should consist of staff responsible for implementing and maintaining internal technology systems and external data connections, such as a health information exchange.