Users/Permissions

Mirth® Connect by NextGen Healthcare User Guide

Cures Certification

Mirth® Connect by NextGen Healthcare has received certification under the ONC Health IT Certification Program, which promotes transparency, modern standards, and enhanced health IT capabilities. After you undertsand the certified functionality and extensions required, you can take the necessary actions to support compliance with Cures Certification criteria. ONC Health IT Certification promotes transparency, modern standards, and enhanced health IT capabilities by fostering innovation in the health care technology ecosystem to deliver better information to patients, clinicians, and other users. Mirth® Connect by NextGen Healthcare has received ONC Heath IT Certification in the areas described in this section. For more information regarding the ONC Heath IT Certification, refer to the NextGen Certification Costs and Disclosures page. This document includes information about required extensions, features in Mirth® Connect that support certified functionality, and required actions by the

Mirth® Connect by NextGen Healthcare User Guide

§170.315(d)(1) Authentication, Access Control, Authorization

Cures criteria for §170.315(d)(1) Authentication, Access Control, Authorization. (d)(1) Authentication, Access Control, and Authorization includes limiting access by user name and password, ensuring unique user IDs, and enabling role-based access control. Required Extensions Role-Based Access Control Features that Support the Certification Use of the Role-Based Access Control Extension Validation of username and passwords Prevention of duplicate usernames Creation of user roles that limit/enable viewing and managing different areas of the application Disable user accounts as needed Required Actions Administrator needs to maintain/update valid/invalid users Administrator needs to create roles and assign them to each user based on company’s policies Parent topic: Cures Certification

Mirth® Connect by NextGen Healthcare User Guide

Alert Actions

This section of the Edit Alert View allows you to decide what actions to take after your alert has been triggered. You can take multiple actions all at once for a single trigger event, which may include sending e-mails to multiple users and dispatching messages to multiple channels. Protocols All protocols also support Velocity Variable Replacement, you can use any of the Alert Variables below, or any Global Map variable. Channel: The template is sent as a message to the channel selected in the Recipient column. The subject is not used for this protocol. Email: The subject and template is used to send an e-mail to the address specified in the Recipient column. User: Same as the Email protocol, the e-mail address used is the one configured for the selected user. Role: E-mails will be sent to all users within a particular Role-Based Access Control role. Only visible when User Authorization is installed. Alert Variables Parent topic: Edit Alert View

Mirth® Connect by NextGen Healthcare User Guide

Operational Procedures

Users/Permissions Auditing Users/Permissions It is a good practice to periodically review your list of users and remove any accounts that are old or are no longer in use. Auditing Parent topic: Security Best Practices

Mirth® Connect by NextGen Healthcare User Guide

§170.315(d)(2) Auditable Events and Tamper-Resistance, §170.315(d)(3) Audit Report(s), and §170.315(d)(10) Auditing Actions on Health Information

Cures criteria 170.315(d)(2) Auditable Events and Tamper-Resistance and §170.315(d)(10) Auditing Actions on Health Information. These criteria are interrelated and therefore addressed together. (d)(2) Auditable events and tamper-resistance establishes which actions must be audited, what must be included in the audit records, and required protections around the audit log, including detecting if the audit log has been changed outside of normal processes. (d)(10) Auditing actions on health information establishes which actions must be audited, what must be included in the audit records, and required protections around the audit log, including detecting if the audit log has been changed outside of normal processes. (d)(3) Audit Report(s) requires the ability of health information systems to sort the audit logs. Note: In Mirth® Connect by NextGen Healthcare, the audit log is referred to as Event Log/Browser. Required Extensions Role-Based Access Control Cures Certification Support Features

Mirth® Connect by NextGen Healthcare User Guide

Summary

The following list gives you a snapshot of the current certifications. Select the link in the Criterion Name column to see more details about the certification criterion. Criterion Name Required Extension Electronic Health Information (EHI) Export (b)(10) Enhancement Bundle Role-Based Access Control Authentication, access control, Authorization (d)(1) Role-Based Access Control Auditable events and tamper-resistance (d)(2) Cures Certification Support Role-Based Access Control Automatic access time-out (d)(5) None Emergency access (d)(6) Role-Based Access Control End-user device encryption (d)(7) None Integrity (d)(8) None Trusted connection (d)(9) SSL Manager Auditing actions on health information (d)(10) Cures Certification Support Encrypt authentication credentials (d)(12) None Multi-factor authentication (d)(13) Multi-Factor Authentication Quality Management System (g)(4) None Accessibility-Centered Design (g)(5) Not applicable Parent topic: Cures Certification

Users/Permissions

Recommendations

Cures Certification

§170.315(d)(1) Authentication, Access Control, Authorization

Alert Actions

Operational Procedures

§170.315(d)(2) Auditable Events and Tamper-Resistance, §170.315(d)(3) Audit Report(s), and §170.315(d)(10) Auditing Actions on Health Information

Summary

Users/Permissions

Cures Certification

§170.315(d)(1) Authentication, Access Control, Authorization

Alert Actions

Operational Procedures

§170.315(d)(2) Auditable Events and Tamper-Resistance, §170.315(d)(3) Audit Report(s), and §170.315(d)(10) Auditing Actions on Health Information

Summary