Then there is a 4-hour verbal review where the ITAA evaluates a company's file. But the ITAA certification is based solely on answers from a survey, which isn't necessarily a legitimate reflection of compliance, some industry observers say. Nevertheless, for vendors and system integrators, ITAA certification has become a requirement. STAC's verification costs more than ITAA's certification, but STAC will conduct an audit that can take, on average, three weeks. If a company passes the audit, it gets STAC certification.
Pricing is based on the number of lines of code assessed and the complexity of the system.
It is a valuable contribution to minimize litigation, which could be two times remediation costs. Peterson says that STAC will stand behind its methodology in a court of law if one of the companies it certifies were to get sued. This ability to pin the responsibility elsewhere is what might appeal to executives of large organizations that are feeling pressure from directors or business partners. But for most companies, as time ticks away, the amount of money it would take just to have a scapegoat doesn't make good business sense. Moffatt is responsible for two hospitals in the Carondelet network.