Summary

Criterion Name	Required Extension
Electronic Health Information (EHI) Export (b)(10)	Enhancement Bundle Role-Based Access Control
Authentication, access control, Authorization (d)(1)	Role-Based Access Control
Auditable events and tamper-resistance (d)(2)	Cures Certification Support Role-Based Access Control
Automatic access time-out (d)(5)	None
Emergency access (d)(6)	Role-Based Access Control
End-user device encryption (d)(7)	None
Integrity (d)(8)	None
Trusted connection (d)(9)	SSL Manager
Auditing actions on health information (d)(10)	Cures Certification Support
Encrypt authentication credentials (d)(12)	None
Multi-factor authentication (d)(13)	Multi-Factor Authentication
Quality Management System (g)(4)	None
Accessibility-Centered Design (g)(5)	Not applicable

Mirth® Connect by NextGen Healthcare User Guide

Cures Certification

An overview of Cures and the Mirth® Connect extensions required to comply with Cures certification criteria. ONC Health IT Certification promotes transparency, modern standards, and enhanced health IT capabilities by fostering innovation in the health care technology ecosystem to deliver better information to patients, clinicians, and other users. Mirth® Connect by NextGen Healthcare has received ONC Heath IT Certification in the areas described in this section. The Health IT modules are compliant with the ONC Certification Criteria for Health IT and has been certified by an ONC-ACB in accordance with the applicable certification criteria adopted by the Secretary of Health and Human Services. This certification does not represent an endorsement by the U.S. Department of Health and Human Services. Holds Certificate No: 15.05.05.2054.NGM2.02.01.1.231213, Certification Date: December 13, 2023 Modules Tested: 170.315 (b)(10); (d)(1-3); (d)(5-10); (d)(12-13); (g)(4,5) Clinical Quality Measu

Mirth® Connect by NextGen Healthcare User Guide

§170.315(b)(10) Electronic Health Information (EHI) Export

Cures criteria for 170.315(b)(10) Electronic Health Information (EHI) Export. (b)(10) Electronic Health Information (EHI) Export gives the user the capability to efficiently export single and multi-patient EHI in a secure and timely manner. Note: Mirth® Connect by NextGen Healthcare is an interoperability engine and is not exposed to full patient data; instead it passes messages from one entity to another and saves only the information in the message. Note: The CURES(b)(10) criteria requires that no psychotherapy data is included in the export. Since Mirth® Connect only passes data, it is the user's responsibility to exclude all psychotherapy data from the export. Required Extensions: Role-Based Access Control Enhancement Bundle Features that Support the Certification Use of the Role-Based Access Control extension to limit access to protected health information (PHI). Ability to view and search for messages on multiple channels. Required Actions Administrator needs to create roles and

Mirth® Connect by NextGen Healthcare User Guide

§170.315(d)(1) Authentication, Access Control, Authorization

Cures criteria for §170.315(d)(1) Authentication, Access Control, Authorization. (d)(1) Authentication, Access Control, and Authorization includes limiting access by user name and password, ensuring unique user IDs, and enabling role-based access control. Required Extensions Role-Based Access Control Features that Support the Certification Use of the Role-Based Access Control Extension Validation of username and passwords Prevention of duplicate usernames Creation of user roles that limit/enable viewing and managing different areas of the application Disable user accounts as needed Required Actions Administrator needs to maintain/update valid/invalid users Administrator needs to create roles and assign them to each user based on company’s policies Parent topic: Cures Certification

Mirth® Connect by NextGen Healthcare User Guide

Services and Extensions

A Mirth® Connect license includes: Support Services: Our team of highly intelligent and broadly capable interoperability experts are dedicated to ensuring your experience is smooth and secure. We provide assistance with troubleshooting, resolving any issues you may face, and offering guidance to optimize your use of our platform. Additionally, we manage hosted upgrades and security updates, ensuring your system remains up-to-date and protected. Whether you need technical assistance or guidance on optimization, our expert team is here to support you every step of the way. Professional Services : Our team provides a full suite of Implementation, Consulting, and Training Services to help organizations maximize the value of Mirth Connect and ensure seamless healthcare operability. With a flexible approach tailored to your organization’s needs, our services ensure that you implement with confidence, optimize with precision, and operate with expertise. Implementation Services: Our structured

Mirth® Connect by NextGen Healthcare User Guide

§170.315(d)(12) Encrypt Authentication Credentials

(d)(12) Encrypt authentication credentials requires encryption of stored authentication credentials. Required Extensions None Features that Support the Certification SHA256 is the default algorithm used by Mirth® Connect by NextGen Healthcare that creates salted hash values for user passwords. This value is stored in the database, not the user password. SHA256 is approved for Cures, as are SHA384 and SHA512. If a different algorithm is desired, the mirth.properties file can be modified using the digest.algorithm property. For example: digest.algorithm = SHA384 Required Actions None Parent topic: Cures Certification

Mirth® Connect by NextGen Healthcare User Guide

§170.315(d)(2) Auditable Events and Tamper-Resistance, §170.315(d)(3) Audit Report(s), and §170.315(d)(10) Auditing Actions on Health Information

Cures criteria 170.315(d)(2) Auditable Events and Tamper-Resistance and §170.315(d)(10) Auditing Actions on Health Information. These criteria are interrelated and therefore addressed together. (d)(2) Auditable events and tamper-resistance establishes which actions must be audited, what must be included in the audit records, and required protections around the audit log, including detecting if the audit log has been changed outside of normal processes. (d)(10) Auditing actions on health information establishes which actions must be audited, what must be included in the audit records, and required protections around the audit log, including detecting if the audit log has been changed outside of normal processes. (d)(3) Audit Report(s) requires the ability of health information systems to sort the audit logs. Note: In Mirth® Connect by NextGen Healthcare, the audit log is referred to as Event Log/Browser. Required Extensions Role-Based Access Control Cures Certification Support Features

Summary

Recommendations

Cures Certification

§170.315(b)(10) Electronic Health Information (EHI) Export

§170.315(d)(1) Authentication, Access Control, Authorization

Services and Extensions

§170.315(d)(12) Encrypt Authentication Credentials

§170.315(d)(2) Auditable Events and Tamper-Resistance, §170.315(d)(3) Audit Report(s), and §170.315(d)(10) Auditing Actions on Health Information

Cures Certification

§170.315(b)(10) Electronic Health Information (EHI) Export

§170.315(d)(1) Authentication, Access Control, Authorization

Services and Extensions

§170.315(d)(12) Encrypt Authentication Credentials

§170.315(d)(2) Auditable Events and Tamper-Resistance, §170.315(d)(3) Audit Report(s), and §170.315(d)(10) Auditing Actions on Health Information