Source: https://www.healthit.gov/test-method/security-tags-summary-care-send-0
Timestamp: 2020-08-14 11:09:45
Document Index: 189843077

Matched Legal Cases: ['§170', '§170', '§170', '§170', '§ 170', '§ 170', '§ 170', '§ 170', '§ 170', '§ 170', '§ 170', '§ 170', '§ 170', '§ 170', '§ 170', '§ 170', '§ 170', '§ 170', '§ 170', '§ 170', '§ 170', '§ 170', '§ 170', '§ 170', '§ 170', '§ 170', '§ 170', '§ 170', '§ 170', '§ 170', '§ 170', '§ 170']

Security tags - summary of care – send | HealthIT.gov
Data segmentation for privacy – send
§170.315(b)(7) Security tags - summary of care – send
2015 Edition Cures Update CCG
2015 Edition Cures Update Test Procedure
Version 1.2 Updated on 01-10-2017
Added supplied test data and respective steps.
Removed step 6 under TLV to remove redundancy.
The General Header constraint bullet from TLV step 5 was removed.
Updated TLV step 3 and 4 from ‘Health IT developer-supplied data’ to ‘ONC-supplied data’.
§170.315(b)(7) Data segmentation for privacy – send—
Enable a user to create a summary record formatted in accordance with the standard adopted in §170.205(a)(4) that is document-level tagged as restricted and subject to restrictions on re-disclosure according to the standard adopted in §170.205(o)(1).
§ 170.205(o)(1) HL7 Implementation Guide: Data Segmentation for Privacy (DS4P), Release 1
Inpatient setting: 170.315_b7_ds4p_imp_sample1_*.pdf
Ambulatory setting: 170.315_b7_ds4p_amb_sample1_*.pdf
Paragraph (b)(7)
Using the ETT: Message Validators – C-CDA R2.1 Validator, the health IT developer downloads the ONC-supplied data instructions through the sender download selections of the “170.315_b7_DS4P Amb” or “170.315_b7_DS4P_Inp” criteria and one of the DS4P instruction documents and executes the download.
Using the ONC-supplied DS4P instruction document downloaded in step 1, a user enters the information as appropriate into the Health IT Module including the DS4P tags and notices.
The user will generate a summary record document(s) from the Health IT Module and submit the document(s) to the tester for verification. The generated summary record includes the following data elements:
Document Level Confidentiality Code constrained in accordance with the standard specified in § 170.205(o)(1) HL7 Implementation Guide: Data Segmentation for Privacy (DS4P), Release 1;
Document Level Author Element;
Document Level Provenance Element; and
Privacy and Security Markings Section with Re-disclosure notice.
A summary record document must be submitted for each health IT setting being certified.
Using the ETT: Message Validators – C-CDA R2.1 Validator, the tester uploads the submitted summary record(s) with restrictions (xml file) from step 4 of the SUT, through the sender upload selection of the “Data Segmentation for Privacy –send – Ambulatory” or ” “Data Segmentation for Privacy –send – Inpatient” criteria and executes the upload of the submitted file(s) to the ETT: Message Validators.
The tester uses the Validation Report(s) created by the ETT: Message Validators in step 1 to verify the Health IT Module passes without error in order to confirm that the document is conformant to each of the standards adopted in § 170.205(a)(4).
If the summary record(s) submitted includes unstructured text data elements, the tester uses the ONC-supplied data instructions and the Message Content Report to verify the additional checks for equivalent text for the content of all section level narrative text.
Using the ETT: Message Validators Message Content Report, the tester verifies that the summary record(s) submitted is accurate and without omission using the ONC-supplied data instructions.
Using the ETT: Message Validators Message Content Report, the tester verifies that the summary record(s) indicates that the document(s) is restricted and subject to restrictions on re-disclosure. The resulting document retains these tags according to the standard adopted at § 170.205(o)(1):
Privacy Segmented Document Template;
CDA Mandatory Document Provenance;
CDA Mandatory Document Assigned Author Template;
If a document contains information protected by specific privacy policies, CDA Privacy Markings Section with text indicating the nature of the explicit notice to the provider receiving the disclosed information; and
A Confidentiality Code with the value “R.”
Version 1.3 Updated on 09-21-2018
Certification Companion Guide: Security tags - summary of care – send
Privacy and Security: This certification criterion was adopted at § 170.315(b)(7). As a result, an ONC-ACB must ensure that a product presented for certification to a § 170.315(b) “paragraph (b)” criterion includes the privacy and security criteria (adopted in § 170.315(d)) within the overall scope of the certificate issued to the product.
Technical outcome – The health IT can create a summary record (formatted to Consolidated CDA (C-CDA) Release 2.1) that is tagged at the document-level as restricted and subject to re-disclosure restrictions using the HL7 Implementation Guide: Data Segmentation for Privacy (DS4P), Release 1.
This certification criterion at § 170.315(b)(7) focuses on a Health IT Module’s ability to tag a C-CDA document as restricted and subject to re-disclosure restrictions using the HL7 DS4P standard, not on the content of the C-CDA document. As such, this certification criterion is not subject to the Consolidated CDA creation performance certification criterion (§ 170.315(g)(6)) because testing for § 170.315(g)(6) focuses on the content of the C-CDA document. We established a certification criterion for Consolidated CDA creation performance to promote the interoperability of C-CDA documents during exchange by testing conformance of the C-CDA’s content to the variation permitted by the HL7 standard. [see also 80 FR 16859]
In order to mitigate potential interoperability errors and inconsistent implementation of the HL7 Implementation Guide for CDA® Release 2: Consolidated CDA Templates for Clinical Notes, Draft Standard for Trial Use, Release 2.1, ONC assesses, approves, and incorporates corrections as part of required testing and certification to this criterion. [see Health IT Certification Program Overview] Certified health IT adoption and compliance with the following corrections are necessary because they implement updates to vocabularies, update rules for cardinality and conformance statements, and promote proper exchange of C-CDA documents. There is a 90-day delay from the time the CCG has been updated with the ONC-approved corrections to when compliance with the corrections will be required to pass testing (i.e., C-CDA 2.1 Validator). Similarly, there will be an 18-month delay before a finding of a correction’s absence in certified health IT during surveillance would constitute a non-conformity under the Program.
Version 1.1 Updated on 08-03-2020
Corrected information in the Privacy & Security section
§ 170.315 (b)(7) Security tags - summary of care – send.
Enable a user to create a summary record formatted in accordance with the standard adopted in § 170.205(a)(4) that is tagged as restricted and subject to restrictions on re-disclosure according to the standard adopted in § 170.205(o)(1) at the:
Document, section, and entry (data element) level; or
Document level for the period until May 2, 2022.
§ 170.205(a)(4) HL7 Implementation Guide for CDA Release 2 Consolidation CDA Templates for Clinical Notes (US Realm), Draft Standard for Trial Use Release 2.1 C-CDA 2.1, August 2015, June 2019 (with Errata)
Edge Testing Tool (ETT): Message Validators - Cures Update C-CDA R2.1 Validator
Certification Companion Guide: Security tags - summary of care - send
This Certification Companion Guide (CCG) is an informative document designed to assist with health IT product development. The CCG is not a substitute for the 21st Century Cures Act: Interoperability, Information Blocking, and the ONC Health IT Certification Program Final Rule (ONC Cures Act Final Rule). It extracts key portions of the rule’s preamble and includes subsequent clarifying interpretations. To access the full context of regulatory intent please consult the ONC Cures Act Final Rule or other included regulatory reference. The CCG is for public use and should not be sold or redistributed.
As a general rule, a product presented for certification only needs to be tested once to each applicable privacy and security criterion (adopted in § 170.315(d)) so long as the health IT developer attests that such privacy and security capabilities apply to the full scope of capabilities included in the requested certification. However, exceptions exist for § 170.315(e)(1) “VDT ” and (e)(2) “secure messaging,” which are explicitly stated.
Encrypt user credentials (§ 170.315(d)(12))
Multi-factor authentication (§ 170.315(d)(13))
For each applicable P&S certification criterion not certified for Approach 1, the health IT developer may certify using system documentation which is sufficiently detailed to enable integration such that the Health IT Module has implemented service interfaces that enable the Health IT Module to access external services necessary to meet the requirements of the P&S certification criterion. Please see the ONC Cures Act Final Rule at 85 FR 25710 for additional clarification.
When a single quality management system (QMS) is used, the QMS only needs to be identified once. Otherwise, when different QMS’ are used, each QMS needs to be separately identified for every capability to which it was applied.
2015 Edition Cures Update Technical outcome – The health IT can create a summary record (formatted to Consolidated- Clinical Document Architecture (C-CDA) Release 2.1) that is tagged at the document,-section, and entry level as restricted and subject to re-disclosure restrictions using the HL7 Implementation Guide: Data Segmentation for Privacy (DS4P), Release 1.
This certification criterion in § 170.315(b)(7) focuses on a Health IT Module’s ability to tag a C-CDA document as restricted and subject to re-disclosure restrictions using the HL7 DS4P standard, not on the content of the C-CDA document. As such, this certification criterion is not subject to the Consolidated CDA creation performance certification criterion (§ 170.315(g)(6)) because testing for § 170.315(g)(6) focuses on the content of the C-CDA document. We established a certification criterion for Consolidated CDA creation performance to promote the interoperability of C-CDA documents during exchange by testing conformance of the C-CDA’s content to the variation permitted by the HL7 standard. [see also 80 FR 16859]
In order to mitigate potential interoperability errors and inconsistent implementation of the HL7 Implementation Guide for CDA® Release 2: Consolidated CDA Templates for Clinical Notes, Draft Standard for Trial Use, Release 2.1, ONC assesses, approves, and incorporates corrections as part of required testing and certification to this criterion. [see the Health IT Certification Program Overview] Certified health IT adoption and compliance with the following corrections are necessary because they implement updates to vocabularies, update rules for cardinality and conformance statements, and promote proper exchange of C-CDA documents. There is a 90-day delay from the time the CCG has been updated with the ONC-approved corrections to when compliance with the corrections will be required to pass testing (i.e., Edge Testing Tool: Message Validators- Cures Update C-CDA R2.1 Validator). Similarly, there will be an 18-month delay before a finding of a correction’s absence in certified health IT during surveillance would constitute a non-conformity under the Program.
Version 1.0 Updated on 06-01-2020
Please consult the Final Rule entitled 21st Century Cures Act Interoperability, Information Blocking, and the ONC Health IT Certification Program for a detailed description of the certification criterion with which these testing steps are associated. Developers are encouraged to consult the Certification Companion Guide in tandem with the Test Procedure, as they both provide clarifications that may be useful for product development and testing.
Paragraph (b)(7) – (Conditional – For Modules Certified to 2015 Edition (b)(7))
A health IT developer of a Health IT Module currently certified to the 2015 Edition § 170.315(b)(7) Security tags -summary of care- send will attest directly to the ONC-ACB to conformance with the updated § 170.315(b)(7) requirements outlined in the 21st Century Cures Act: Interoperability, Information Blocking, and the ONC Health IT Certification Program Final Rule.
The ONC-ACB verifies the health IT developer of a Health IT Module certified to 2015 Edition § 170.315(b)(7) Security tags- summary of care- send attests conformance to 2015 Edition Cures Update § 170.315(b)(7) criteria requirements.
ONC-ACB Verification
Using the Edge Testing Tool (ETT): Message Validators – Cures Update C-CDA R2.1 Validator, the health IT developer downloads the ONC-supplied data instructions through the sender download selections of the “170.315_b7_DS4P Amb” or “170.315_b7_DS4P_Inp” criteria and one of the DS4P instruction documents and executes the download.
Using the ONC-supplied DS4P instruction document(s) the user enters the information as appropriate into the Health IT Module including the DS4P tags and notices.
Document Level Confidentiality Code, constrained in accordance with the standard specified in § 170.205(o)(1) HL7 Implementation Guide: Data Segmentation for Privacy (DS4P), Release 1;
Document Level Provenance Element;
Privacy and Security Markings Section with Re-disclosure Notice;
Privacy Segmented Section(s);
Privacy Markings Entry(ies); and
Mandatory Entry Provenance Element(s).
A summary record document created by the Health IT Module must be submitted for each health IT setting being certified.
The tester verifies that the health IT developer can download the ONC-supplied instruction document for the summary of care with security tags.
The tester verifies that the user can enter all of the summary of care with the required security tags as outlined in the ONC supplied Security tags – summary of care instruction document returned in step 1.
Using the ETT: Message Validators – Cures Update C-CDA R2.1 Validator, the tester uploads the submitted summary record(s) with restrictions (xml file) from step 4 of the System Under Test, through the sender upload selection of the “Data Segmentation for Privacy –send – Ambulatory” or “Data Segmentation for Privacy –send – Inpatient” criteria and executes the upload of the submitted file(s) to the ETT: Message Validators – Cures Update C-CDA R2.1 Validator. The tester uses the validation report(s) created by the ETT: Message Validators – Cures Update C-CDA R2.1 Validator to verify the Health IT Module passes without error in order to confirm that the document is conformant to each of the standards adopted in § 170.205(a)(4). Using the ETT: Message Validators Message Content Report, the tester verifies that:
If the summary record(s) submitted includes unstructured text data elements, the tester uses the ONC-supplied data instructions and the Message Content Report to verify the additional checks for equivalent text for the content of all section level narrative text;
The summary record(s) submitted is accurate and without omission using the ONC-supplied data instructions; and
The summary record(s) indicates that the document(s) is restricted and subject to restrictions on re-disclosure. The resulting document retains these tags according to the standard adopted at § 170.205(o)(1):
Privacy Segmented Section Template(s);
Privacy Markings Entry Template(s);
Clinical Document Architecture (CDA) Mandatory Document Provenance;
Mandatory Entry Provenance Template(s);
If a document, section or entry contains information protected by specific privacy policies, CDA Privacy Markings Section with text indicating the nature of the explicit notice to the provider receiving the disclosed information;
If the metadata for a section is different than the overall document, the confidentiality levels and provenance information should be maintained; and
For each of the health IT setting(s) to be certified, the tester repeats steps 2-3.
Content last reviewed on August 13, 2020