Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

8/25/2011
01:37 PM
50%
50%

HIE Accreditation Service Offered To Software Vendors

The Electronic Healthcare Network Accreditation Commission announces a privacy and security testing program to accompany existing health information exchange accreditation.

12 Advances In Medical Robotics
(click image for larger view)
Slideshow: 12 Advances In Medical Robotics
A group that accredits health information exchanges for privacy and security adherence is extending its service to vendors of HIE technology. The Electronic Healthcare Network Accreditation Commission (EHNAC), based in Farmington, Conn., this week announced its Outsourced Services Accreditation Program for Health Information Exchange Services, a vendor-focused accompaniment to its existing Health Information Exchange Accreditation Program.

"We're clearly trying to focus on privacy, security [and], confidentiality of data flowing through the HIE," EHNAC Executive Director Lee Barrett said in an interview with InformationWeek Healthcare. "We're trying to provide the trust factor among all the different players." That includes both protected health information as defined by the Health Insurance Portability and Accountability Act (HIPAA) and sensitive financial data.

The advantage of this new program is that it simplifies the accreditation program for HIEs that purchase accredited software and hosting services, according to Barrett. The current HIE accreditation involves a self-assessment, then a site visit from EHNAC personnel to verify claims in the self-assessment. But those with accredited vendor products will be able to skip the site review, saving the HIE time and money, Barrett said.

EHNAC accreditation differs from the federally sanctioned electronic health records (EHR) certification program in that the latter only includes a test for functionality, and does not require site visits to corroborate the application. "It adds another quality-control factor," Barrett said of the EHNAC site visits that evaluate privacy and security protections.

Barrett said he would like HIE and HIE vendor accreditation to get the federal government's stamp of approval, much like the Office of the National Coordinator for Health Information Technology (ONC) and the National Institute of Standards and Technology (NIST) sanction EHR certification. However, federal control of EHR certification is statutory, authorized by the 2009 American Recovery and Reinvestment Act.

Barrett confirmed that EHNAC has had discussions with ONC and NIST about earning some sort of official stamp of approval, and he said he'd be happy if the HIE and vendor accreditation programs became even a de facto standard.

EHNAC soon will publish draft criteria for vendor accreditation and will open a 60-day comment period on Sept. 26. The organization will beta-test the new program in the fall in preparation for a full launch in January.

Find out how health IT leaders are dealing with the industry's pain points, from allowing unfettered patient data access to sharing electronic records. Also in the new, all-digital issue of InformationWeek Healthcare: There needs to be better e-communication between technologists and clinicians. Download the issue now. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
I 'Hacked' My Accounts Using My Mobile Number: Here's What I Learned
Nicole Sette, Director in the Cyber Risk practice of Kroll, a division of Duff & Phelps,  11/19/2019
DevSecOps: The Answer to the Cloud Security Skills Gap
Lamont Orange, Chief Information Security Officer at Netskope,  11/15/2019
Attackers' Costs Increasing as Businesses Focus on Security
Robert Lemos, Contributing Writer,  11/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-13157
PUBLISHED: 2019-11-22
nsGreen.dll in Naver Vaccine 2.1.4 allows remote attackers to overwrite arbitary files via directory traversal sequences in a filename within nsz archive.
CVE-2012-2079
PUBLISHED: 2019-11-22
A cross-site request forgery (CSRF) vulnerability in the Activity module 6.x-1.x for Drupal.
CVE-2019-11325
PUBLISHED: 2019-11-21
An issue was discovered in Symfony before 4.2.12 and 4.3.x before 4.3.8. The VarExport component incorrectly escapes strings, allowing some specially crafted ones to escalate to execution of arbitrary PHP code. This is related to symfony/var-exporter.
CVE-2019-18887
PUBLISHED: 2019-11-21
An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. The UriSigner was subject to timing attacks. This is related to symfony/http-kernel.
CVE-2019-18888
PUBLISHED: 2019-11-21
An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. If an application passes unvalidated user input as the file for which MIME type validation should occur, then arbitrary arguments are passed to the underlying file command. T...