Source: https://www.healthit.gov/test-method/trusted-connection
Timestamp: 2020-05-26 21:41:28
Document Index: 759120529

Matched Legal Cases: ['§170', '§170', '§170', '§170', '§ 170', '§ 170', '§ 170', '§ 170', '§ 170', '§ 170']

Trusted connection | HealthIT.gov
§170.315 (d)(9) Trusted connection—
Establish a trusted connection using one of the following methods:
Message-level. Encrypt and integrity protect message contents in accordance with the standards specified in §170.210(a)(2) and (c)(2).
Transport-level. Use a trusted connection in accordance with the standards specified in §170.210(a)(2) and (c)(2).
§170.315(d)(9) Test Procedure
Clarification added on what must be demonstrated during testing of the trusted connection for transport.
Updated to reference ‘HTTPS’ in paragraph (d)(9)(ii).
Certification Companion Guide: Trusted connection
This certification criterion at § 170.315(d)(9) is required as part of the 2015 Edition privacy & security approach for the certification criteria at § 170.315(e)(1), (e)(2), (e)(3), (g)(7), (g)(8), and (g)(9). This certification criterion at § 170.315(d)(9) must be explicitly demonstrated with § 170.315(e)(1) and (e)(2) because of the specific capabilities for secure electronic transmission and secure electronic messaging included in each of these two criteria, respectively. For the other certification criteria (§ 170.315(e)(3), (g)(7), (g)(8), and (g)(9)), this criterion at § 170.315(d)(9) only needs to be demonstrated once as part of the overall scope of the certificate sought.
Health IT needs to provide a level of trusted connection using either 1) encrypted and integrity message protection or 2) a trusted connection for transport. Either of these methods must be demonstrated in accordance with the following standards: Annex A: FIPS Publication 140-2, Security Requirements for Cryptographic Modules and FIPS PUB 180-4, Secure Hash Standard, 180-4.
Paragraph (d)(9)(i)
Technical outcome – The health IT offers a user encrypted and integrity message protection.
Paragraph (d)(9)(ii)
Technical outcome – The health IT provides the user a trusted connection for transport.
The tester is required to view the encryption handshake to ensure that the digital certificates, where used, are being invoked during the connection. Developers have freedom to demonstrate the encryption handshake based on the technology they are using. For example, if a developer has a browser-based module that uses HTTPS, the developer could demonstrate the "lock" icon in the browser that indicates that HTTPS is present and working properly.
The verification step is verifying that the transport is conducted using a trusted connection configured to conform to the required level of encryption and hashing standard. The communication content is not examined, only the configuration and the handshake, and where used, the digital certificates. The messages are not examined as with alternative 1. The lab does not need to verify the messages, only the trusted connection.