Please consult the Notice of Proposed Rulemaking (NPRM) entitled: 2015 Edition Health Information Technology (Health
IT) Certification Criteria, 2015 Edition Base Electronic Health Record (EHR) Definition, and ONC Health IT Certification
Program Modifications for a detailed description of the proposed certification criterion with which these testing steps
are associated.
1. Required Tests
Note: The order in which the test steps are listed reflects the sequence of the certification criterion and does not necessarily
prescribe the order in which the test should take place.
1.1 Document Templates
Evaluate the Health IT Module’s ability to create electronic medical documents for submission, including diagnostic
imaging reports, unstructured documents, enhanced operative note documents, enhanced procedure note
documents, interval documents, and enhanced encounter documents for the ambulatory setting and enhanced
hospitalization documents for the inpatient setting in accordance with the HL7 Implementation Guide for CDA
Release 2: Consolidated CDA Templates for Clinical Notes, Draft Standard for Trial Use, Release 2.0 AND the HL7
Implementation Guide for CDA Release 2: Additional CDA R2 Templates – Clinical Documents for Payers – Set 1,
Release 1 – US Realm.
Item #
1
Technical Outcome
Test Lab Verification
Test Approach
The following electronic medical
documents are created for
submission to CMS:
• diagnostic imaging report;
• unstructured document,;
• enhanced operative note;
• enhanced procedure note;
• interval document;
• enhanced encounter
document (ambulatory setting
only); and
• enhanced hospitalization
document (inpatient setting
only).
The tester verifies that the following document
types can be created:
• diagnostic imaging report;
• unstructured document;
• enhanced operative note;
• enhanced procedure note;
• interval document;
• enhanced encounter document (ambulatory
setting only); and
• enhanced hospitalization document (inpatient
setting only).
Test data, visual
inspection, and
test tool.
Each document must be formatted according to the
standard and implementation specifications adopted
at §170.205(a)(4) and at §170.205(a)(5)(i)., and that
the documents are accurate and without omission.
1
1.2 Digital Signature
Evaluate the Health IT Module’s ability to apply a digital signature and to demonstrate that it can support the method
for delegation of rights assertions. Furthermore, the Health IT Module must be able to validate a digital signature that
has been applied to a document in accordance with the HL7 Implementation Guide for CDA Release 2: Digital
Signatures and Delegation of Rights, Release 1.
Item #
1
Technical Outcome
Test Lab Verification
Test Approach
A digital signature is
applied to a document and
right assertions are
delegated.
The tester verifies that digital signature has been
correctly applied in accordance with §
170.205(a)(5)(ii) to a document formatted
according to § 170.205(a)(4) and § 170.205(5)(i).
Attestation/
documentation and
visual inspection.
The tester verifies that the cryptographic module
used meets or exceeds FIPS 140-2 Level 1 and
includes a digital signature system and hashing
that are compliant with FIPS 186-2 and FIPS 1802; and stores the private key in a FIPS-140-2 Level
1, using a FIPS-approved encryption algorithm.
The tester verifies that the Health IT Module
supports multi-factor authentication that meets
or exceeds Level 3 assurance as defined in NIST
Special Publication 800-63-2.
The tester verifies that after ten minutes of
inactivity, the Health IT Module requires the
certificate holder to re-authenticate to access the
private key.
If implemented as a software function, the tester
verifies that the Health IT Module must clear the
plain text private key from the system memory to
prevent the unauthorized access to, or use of, the
private key when the signing module is
deactivated.
The Health IT Module verifies that the time and
date is recorded as specified with the standard
adopted at § 170.210(g).
2
The digital signature that
has been applied to a
document is verified.
The tester verifies that the Health IT Module can
validate a digital signature that has been applied
to a document according to the according to
implementation specifications adopted at §
170.205(a)(5)(ii).
Attestation/
documentation and
visual inspection.
1.3 Author of Record Level 1
Evaluate the Health IT Module’s ability to apply an Author of Record Level 1 in order to digitally sign single or bundles
of documents in accordance with the Author of Record Level 1: Implementation Guide.
2
Item #
1
Technical Outcome
Test Lab Verification
Test Approach
A digital signature is applied
to a single or bundles of
documents formatted
according to §170.205(a)(4)
and §170.205(5)(i).
The tester verifies that author of record level 1
signature is in accordance with the
implementation specification adopted at §
170.205(a)(5)(iii) to single or bundles of
documents.
Attestation/
documentation and
visual inspection.
The tester verifies per the same system
capabilities specified in Section 1.2 Item #1.
1.4 Transactions
Evaluate the capability of the Health IT Module to apply a digital signature to a transaction and include the signature
as accompanying metadata in the signed transaction in accordance with the Provider Profiles Authentication:
Registration Implementation Guide.
Item #
1
Technical Outcome
Test Lab Verification
Test Approach
A digital signature is applied
to transactions and is
included as accompanying
metadata in the signed
transaction.
The tester verifies that the digital signature
applied to a transaction in accordance with the
implementation specification adopted at §
170.205(a)(5)(iv) and that the signature is
included as an accompanying metadata in the
signed transaction.
Attestation/
documentation and
visual inspection.
The tester verifies per the same system
capabilities specified in Section 1.2 Item #1.
2. Document History
Version Number
Description of Change
Date
1.0
Released for Public Comment
March 31, 2015
3. Dependencies
For all related and required criteria, please refer to the Master Table of Related and Required Criteria.
3