ehr onc final certification - Department of Health Care Services

Response. We intend for this certification criterion to support, at a minimum, the
HIPAA Security Rule implementation specification provided at 45 CFR 164.312(e)(2)(i)
“[i]mplement security measures to ensure that electronically transmitted electronic
protected health information is not improperly modified without detection until disposed
of.” Because this certification criterion specifies a capability that Certified EHR
Technology must include, we do not believe that it is necessary or appropriate for us to
address whether hashing is applicable to public and private networks. Additionally, we
clarify that Certified EHR Technology must include the capability to check the integrity
of health information that has been received through electronic exchange. However,
similar to our approach to many adopted certification criteria, we do not specify the
instances in which this capability needs to be executed. Nevertheless, in response to
public comments we have attempted to clarify this certification criterion. We clarify that
we expect Certified EHR Technology to be capable of creating a message digest and
when in receipt of a message digest, to use the message digest to verify that the contents
of the message have not been altered. We have revised the certification criterion to
clarify our intent.
Additionally, based on these revisions in the certification criterion, we wish to
clarify the wording of the integrity standard specified at 170.210(c). The standard
currently includes the words “or higher” at the end of the standard. To provide more
certainty to the industry of our intended meaning, we are replacing those words with
more accurate terminology. We have modified the standard to read as follows: “A
hashing algorithm with a security strength equal to or greater than SHA-1 must be used to
verify that electronic health information has not been altered.” More information on
Page 112 of 228