ehr onc final certification - Department of Health Care Services

SHA-1 and other secure hash algorithms can be found in FIPS 180-3 5 while more
information on the security strength of certain hashing algorithms can be found in NIST
Special Publication 800-107. 6
Comments. Some commenters noted that §170.302(s)(2) refers to the use of the
adopted standard which specifies the use of hashing to detect audit log alteration or
deletion and that such a requirement is inappropriate. Other commenters recommended
that hashing should not, at the present time, be used for detecting alterations to data at
rest.
Response. We have considered these comments and agree with these commenters
that this requirement requires further clarification. We note that part of this requirement
as adopted in the Interim Final Rule (“detect … deletion of electronic health
information”) is redundant with the standard we specify for audit logs which requires that
deletions of electronic health information be recorded. For this reason, we have removed
the reference to the detection of deleted electronic health information and have opted for
a more concise requirement that alterations to audit logs be detected. In response to
public comment, we have chosen not to specify a standard for detecting alterations to
audit logs at this time.
Comment. One commenter requested clarification as to how message hashing
should work when messages are part of a multi-part transmission process, e.g., through
switches, clearinghouses, and other brokers.
Response. We expect Certified EHR Technology to be capable of generating a
hash of electronic health information and upon receipt of such information, verifying that
5 http://csrc.nist.gov/publications/fips/fips180-3/fips180-3_final.pdf
6 http://csrc.nist.gov/publications/nistpubs/800-107/NIST-SP-800-107.pdf
Page 113 of 228