§170.315(d)(7) End-User Device Encryption

Mirth® Connect by NextGen Healthcare User Guide

§170.315(d)(12) Encrypt Authentication Credentials

(d)(12) Encrypt authentication credentials requires encryption of stored authentication credentials. Required Extensions None Features that Support the Certification SHA256 is the default algorithm used by Mirth® Connect by NextGen Healthcare that creates salted hash values for user passwords. This value is stored in the database, not the user password. SHA256 is approved for Cures, as are SHA384 and SHA512. If a different algorithm is desired, the mirth.properties file can be modified using the digest.algorithm property. For example: digest.algorithm = SHA384 Required Actions None Parent topic: Cures Certification

Mirth® Connect by NextGen Healthcare User Guide

§170.315(d)(9) Trusted Connection

(d)(9) Trusted connection requires the ability to encrypt messages and send through a trusted connection. Required Extensions SSL Manager Features that Support the Certification The SSL Manager extension provides options that ensure encryption and connectivity validation through the use of SSL certificates. Required Actions In your Mirth® Connect channels, enable SSL to establish trusted connections between endpoints. Parent topic: Cures Certification

Mirth® Connect by NextGen Healthcare User Guide

§170.315(d)(13) Multi-Factor Authentication

(d)(13) Multi-factor authentication requires that the system mandates access with multi-factor authentication. Required Extensions Multi-Factor Authentication Features that Support the Certification Multi-Factor Authentication Extension Required Actions Using the Mirth® Connect Multi-Factor Authentication Extension with Duo or TOTP, set up all users to be required to use the selected authentication method. Parent topic: Cures Certification

Mirth® Connect by NextGen Healthcare User Guide

Summary

The following list gives you a snapshot of the current certifications. Select the link in the Criterion Name column to see more details about the certification criterion. Criterion Name Required Extension Electronic Health Information (EHI) Export (b)(10) Enhancement Bundle Role-Based Access Control Authentication, access control, Authorization (d)(1) Role-Based Access Control Auditable events and tamper-resistance (d)(2) Cures Certification Support Role-Based Access Control Automatic access time-out (d)(5) None Emergency access (d)(6) Role-Based Access Control End-user device encryption (d)(7) None Integrity (d)(8) None Trusted connection (d)(9) SSL Manager Auditing actions on health information (d)(10) Cures Certification Support Encrypt authentication credentials (d)(12) None Multi-factor authentication (d)(13) Multi-Factor Authentication Quality Management System (g)(4) None Accessibility-Centered Design (g)(5) Not applicable Parent topic: Cures Certification

Mirth® Connect by NextGen Healthcare User Guide

§170.315(g)(5) Accessibility-Centered Design

(g)(5) 170.315 Accessibility-Centered Design (ACD) is an optional requirement that focuses on certified products using ACD standards in developing, testing, implementing, and maintaining certified functionality. Currently, Mirth® Connect does not use accessibility-centered design for certified functions. Parent topic: Cures Certification

Mirth® Connect by NextGen Healthcare User Guide

§170.315(d)(1) Authentication, Access Control, Authorization

Cures criteria for §170.315(d)(1) Authentication, Access Control, Authorization. (d)(1) Authentication, Access Control, and Authorization includes limiting access by user name and password, ensuring unique user IDs, and enabling role-based access control. Required Extensions Role-Based Access Control Features that Support the Certification Use of the Role-Based Access Control Extension Validation of username and passwords Prevention of duplicate usernames Creation of user roles that limit/enable viewing and managing different areas of the application Disable user accounts as needed Required Actions Administrator needs to maintain/update valid/invalid users Administrator needs to create roles and assign them to each user based on company’s policies Parent topic: Cures Certification

§170.315(d)(7) End-User Device Encryption

Required Extensions

Features that Support the Certification

Required Actions

Recommendations

§170.315(d)(12) Encrypt Authentication Credentials

§170.315(d)(9) Trusted Connection

§170.315(d)(13) Multi-Factor Authentication

Summary

§170.315(g)(5) Accessibility-Centered Design

§170.315(d)(1) Authentication, Access Control, Authorization

§170.315(d)(12) Encrypt Authentication Credentials

§170.315(d)(9) Trusted Connection

§170.315(d)(13) Multi-Factor Authentication

Summary

§170.315(g)(5) Accessibility-Centered Design

§170.315(d)(1) Authentication, Access Control, Authorization