Attachment M

ATTACHMENT M – ACCREDITATION REQUIREMENTS

The Federal Information Security Modernization Act (FISMA) of 2014 requires all Federal agencies to comply with the standards and guidelines developed by the National Institute for Standards and Technology (NIST). VA Directive 6500: VA Cybersecurity Program establishes a VA cybersecurity program to protect and defend VA information and information technology. VA Office Information and Technology (OIT) describes these operational requirements in HYPERLINK "https://www.va.gov/vapubs/viewPublication.asp?Pub_ID=1255"VA Handbook 6500: Risk Management Framework for VA Information Systems and subsequent chapters. Additionally, HIPAA covered entities are bound by the provisions found in the HIPAA Privacy and Security rules (45 CFR Parts 160 & 45 CFR 164); the Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009 and the Patient Protection and Affordable Care Act (PPACA) of 2010. These mandates specifically reference the NIST SP 800-53, NIST SP 800-66 standards and include penalties for failure to comply and/or data breaches. Electronic Healthcare Network Association Commission Healthcare Network Accreditation Program Electronic Health Network (EHNAC HNAP-EHN) certification is the primary EHNAC accreditation program indicating that a company/organization who operates an electronic health network performing claims clearinghouse or EDI gateway functions exceeds industry-established standards and comply with HIPAA regulations. HNAP assesses security infrastructure and data integrity measures including disaster recovery; business continuity; contingency plans; and intrusion detection and response. The program also evaluates transaction processing efficiency; ability to comply with generally-accepted, industry-standard data formats; and audit trail capabilities. (https://www.ehnac.org/healthcare-network/) In addition, the State of Maryland and the State of New Jersey both require electronic healthcare transactions originating in those states to be processed by an EHNAC HNAP-EHN accredited clearinghouse. The Deputy Assistant Secretary for Information Security has concurred with acceptance of the EHNAC HNAP-EHN certification of a HIPAA covered entity as meeting VA OIT A&A requirements without further review (memo dated September 2, 2016). All HIPAA covered entities are required by Federal law to adopt the Phase I and II CAQH-CORE Eligibility & Claim Status Operating rules by January 1, 2013 as per Section 1104 of Public Law 111-148: Patient Protection and Affordable Care Act (PPACA). The Council for Affordable Quality Healthcare (CAQH) Committee on Operating Rules for Information Exchange (CAQH-CORE) provides independent verification that an organization operates in agreement with the operating rules and the underlying standards. CORE certification means an entity has demonstrated that its IT system or product, is operating in conformance with the applicable requirements. (https://www.caqh.org/core/core-certification)