ehr onc final certification - Department of Health Care Services

Other commenters also expressed concern that unless TLS is explicitly named, all
example protocols would be required to be supported.
Response. The example list of protocols that would meet the certification
criterion is not intended to be exhaustive or suggest that Complete EHRs or EHR
Modules must be capable of using all of the listed protocols to be certified. The example
list of protocols in the Interim Final Rule was included solely for illustrative purposes.
We have, however, consistent with the way we have restructured the regulatory text for
some standards (to better associate them with the adopted certification criterion that
reference them), modified this standard to simply express that the standard is any
encrypted and integrity protected link.
Comments. Several commenters suggested replacing the functional description of
the encryption standard with a specific reference to FIPS 140-2. These commenters also
noted that HHS had included such a reference in an update to its guidance specifying the
technologies and methodologies that render protected health information unusable,
unreadable, or indecipherable that was included in the Breach Notification for Unsecured
Protected Health Information Interim Final Rule, published on August 24, 2009 (74 FR
42740), and further, requested that we make our standard consistent with this guidance.
Some commenters explicitly recommended that AES be specified as the encryption
algorithm standard.
Response. We have considered these commenters’ points and have decided to
revise our adopted standard to be more flexible regarding the encryption algorithms we
permit EHR Technology to implement to be certified. We have also sought to clarify
how our adopted standard relates to the guidance included in the breach notification
Page 117 of 228