Source: https://www.healthit.gov/test-method/data-segmentation-privacy-receive
Timestamp: 2019-04-26 10:24:34+00:00

Document:
Added supplied test data that includes content validation for DS4P.
View the restricted document without incorporating any of the data from the document.
Summary records in accordance with the test steps below, based on the health IT setting(s), are provided by the Edge Testing Tool.
The health IT developer identifies the policies associated with the handling of the Data Segmentation for Privacy documents.
If a document contains information protected by specific privacy policies, the CDA Privacy Markings Section.
Confidentiality Code constrained in accordance with the standard specified in § 170.205(o)(1) HL7 Implementation Guide: Data Segmentation for Privacy (DS4P), Release 1.
Using the Health IT Module, a user receives a summary record document(s) formatted in accordance with the standard specified at § 170.205(a)(4) HL7 Implementation Guide for CDA® Release 2: Consolidated CDA Templates for Clinical Notes, DSTU Release 2.1, without any restrictions.
The tester creates a human readable version for each of the documents received in steps 3-5 of the SUT to be used for verification.
The tester verifies that a Health IT Module can receive a summary record document formatted in accordance with the standard specified at § 170.205(a)(4) that is document-level tagged as restricted and contains restrictions on re-disclosure according to the standard adopted at § 170.205(o)(1) for each health IT setting being certified, using visual inspection.
The tester verifies that a Health IT Module can receive a summary record document formatted in accordance with the standard specified at § 170.205(a)(4) that is not document-level tagged as restricted for each health IT setting being certified, using visual inspection.
Using the restricted document received in (b)(8)(i), and the Health IT Module, a user demonstrates the ability to associate the restricted document to a patient’s record, but sequester it from other health IT developer supplied summary documents formatted in accordance to the standard specified at § 170.205(a)(4) HL7 Implementation Guide for CDA® Release 2: Consolidated CDA Templates for Clinical Notes, DSTU Release 2.1 that have been received for that specific patient but are not restricted.
Negative Testing: Using the setup from step 1, the user demonstrates that an unauthorized user does not have access to the restricted document received in (b)(8)(i).
The tester verifies that based upon the policies identified in (b)(8)(i), the Health IT Module can sequester a document–level tagged document, formatted in accordance to the standard specified at § 170.205(a)(4), with restrictions on re-disclosure according to the standard adopted at § 170.205(o)(1) from other summary documents formatted in accordance to the standard specified at § 170.205(a)(4) for a specific patient, using visual inspection.
Negative Testing: The tester verifies that based upon the policies identified in (b)(8)(i), an unauthorized user does not have access to a sequestered document using visual inspection.
The Health IT Module creates users on the system that are authorized to review sequestered documentation and users that are not authorized to review sequestered documentation.
Using the sequestered document identified in (b)(8)(ii) and the Health IT Module, authorized users view the document data without incorporating the data into the patient’s record as discrete data elements.
Negative Testing: The user demonstrates that an unauthorized user cannot view the documents sequestered in (b)(8)(ii).
The tester verifies that the Health IT Module allows an authorized user to view the data in the restricted document without incorporating it into the patient’s record (e.g. medications, medication allergies, problems) using visual inspection.
If a document contains information protected by specific privacy policies, text indicating the nature of the explicit notice to the provider receiving the disclosed information.
If the author of document sections is different than the document author, using the health IT developer-identified health IT function(s), the tester verifies that the Health IT Module provides the correct data provenance.
Negative Testing: The tester verifies that the Health IT Module does not allow unauthorized users to access or view restricted data or documents.
Provides notification of March 2017 Validator Update of C-CDA 2.1 Corrections adoption and compliance requirements within paragraph (b)(8)(i).
Provides notification of April 2018 Validator Update of C-CDA 2.1 Corrections adoption and compliance requirements within paragraph (b)(8)(i). Note: Due to an error in calculation ONC is also updating the dates for compliance with the March 2017 Validator Update of C-CDA 2.1 Corrections that were adopted September 29, 2017.
Provides notification of August 2018 Validator Update of C-CDA 2.1 Corrections adoption and compliance requirements within paragraph (b)(8)(i).
Privacy and Security: This certification criterion was adopted at § 170.315(b)(8). As a result, an ONC-ACB must ensure that a product presented for certification to a § 170.315(b) “paragraph (b)” criterion includes the privacy and security criteria (adopted in § 170.315(d)) within the overall scope of the certificate issued to the product.
Technical outcome – The health IT must be able to receive a summary record (formatted to Consolidated CDA Release 2.1) that is document-level tagged as restricted and subject to re-disclosure restrictions using the HL7 Implementation Guide: Data Segmentation for Privacy (DS4P), Release 1.
Technical outcome – A user must be to separate the document-level tagged document from other documents received.
“Sequester” in this case means that only authorized users will have the ability to view the document. Once document-level tagged documents are received and stored in the Health IT Module they must only be accessible and viewable by authorized users and separated from other documents. The developer has full design and development discretion to implement a solution which handles this capability properly. Specific functionality other than authorized user access is not required, but if a developer opts to implement a more complex solution than described that is permissible and acceptable.
Technical outcome – A user must be able to view the restricted document without having to incorporate any of the data from the document.

References: § 170
 § 170
 § 170
 § 170
 § 170
 § 170
 § 170
 § 170
 § 170
 § 170
 § 170
 § 170