2014 Edition Test Script

ICSA Labs 2014 Edition Test Script Derived from ONC-Approved 2014 Edition and 2014 Edition Release 2 Test Methods

October 27, 2016 www.icsalabs.com ICSA Labs 2014 Edition Test Scripts Introduction Preparing for the Test In our experience, successful customers complete a minimum of 5 mock test sessions with their team before scheduling their official test. This includes generating sample files and self-testing using the corresponding conformance test tools, as applicable. Conducting mock test sessions helps you better understand the test flow and often uncovers additional questions surrounding test requirements which the healthcare team at ICSA Labs can help clarify. It is important that the individual(s) presenting on the day of the test have been involved in each of these mock test sessions.

It is anticipated that you will have questions or need clarifications about the test procedure requirements as you complete these mock test sessions. You are strongly encouraged to contact the ICSA Labs healthcare team as these questions arise for guidance. As you prepare for testing, we recommend you follow these steps: 1. Review the Testing Manual. The Testing Manual contains a comprehensive overview of the test process and you should familiarize yourself with its contents. 2. Practice with the test script. ICSA Labs has developed this customized test script, and it is provided to you to use during your mock test sessions and to use during the actual test(s). 3. Read the embedded guidance. The guidance for each criterion was created to help you understand the minimum testing requirements for the program in which you are testing. The guides provide an overview of each test procedure, references to the appropriate implementation guides, standards bodies, relevant excerpts from the Final Rule, as well as important tips and common pitfalls. Links to our guidance can be found in the heading of each criterion in the test script below or on our Guidance Directory web page located at https://icsalabs.s3.amazonaws.com/2014guidance.html. 4. Use the test tools. Some interoperability criteria have ONC-approved test tools which must be used to validate generated files. A link to the appropriate conformance tool is found within the relevant section of the test script. Any additional instructions regarding the use of these tools can be found in the guidance file. Note that these are the same tools ICSA Labs will use when validating conformance during the actual test, so you should use them prior to your test to ensure all errors have been resolved. 5. Study the sample data. ICSA Labs provides sample test data for applicable test steps. Make sure to study the test data sets to better understand the requirements. Depending on the test step, some patient data can and should be entered prior to the test, while other data will be entered as part of the demonstration during the test session. Please review the Setup section of the test script to determine which data should be pre-entered. 6. Ask questions. The experienced and knowledgeable healthcare program team at ICSA Labs is available to help. We will help clarify demonstration or conformance testing requirements, interpret validation results of test tools, and answer any other questions you may have with regards to the testing. Please remember that ICSA Labs is prohibited from providing consulting services. Assistance is limited to clarifications around the test procedures and criteria, using validation tools and interpreting results, and other questions specific to the test process, as opposed to implementing or designing functionality for a customer product.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts How to Use the Test Script The ICSA Labs Test Script is derived wholly from the ONC-approved test procedures, any associated errata, and provided test data and test tools. This test script includes the test procedures for all of the criteria applicable to the Inpatient and Ambulatory domains and lists the criteria in the order we prefer to use for testing purposes.

The Test Script document is an all-inclusive form used by you to understand how to demonstrate the required actions and expected outcomes for each step and by the Proctor to score compliance, document any deviations or exceptions to test data, explain the reason for a failure, record the test data set and standard used, and other pertinent information. A snippet of the test procedure for Drug Formulary Checks is below to help illustrate how to use this document.

1. Name of the criterion. 2. Setup refers to the steps you must complete prior to the test session. 3. All ONC Test Data and Procedure, including the ONC-approved test procedure, errata and test data can be accessed in this area. Although the ICSA Labs test scripts are based wholly on these procedures, the format has been changed for better usability and clarity. There are also times when the ONC-provided test data has been reformatted to present the identical information in a different view. Either view can be used for testing purposes. 4. Any and all guidance relevant to a particular test procedure can be found in this section. Additionally, if ONC-approved conformance test tools exist, they can be accessed here.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts 5. Steps should be performed sequentially following the action listed. It is possible to reorder or combine steps, depending on the product’s workflow. This is permissible so long as the Proctor is notified which order you will be demonstrating to allow for congruent scoring. 6. The Expected Outcome is what the system must achieve to render compliance with a particular step. 7. The Reference column contains mappings from the Step number listed in the ICSA Labs test script to the TE (Test Requirement) and IN (Inspection Test Guide) statements found within the relevant ONC Test Procedure. 8. This area is used by the Proctor to document any notes or test data deviations that occur during a test. Whenever possible, ICSA Labs should be notified prior to your test of any deviations from the ONC-provided test data. 9. The Proctor uses this drop down to select the product’s overall compliance with the test procedure. The product must be able to pass all steps within a procedure in order to be deemed compliant with that criterion. Available options include: a. Pass – product is fully compliant with the criterion upon an initial attempt b. Fail – product has failed one or more portions of the test procedure upon an initial attempt c. Not Applied For – product has not applied for this criterion d. Retest Not Required – only used during retests and identifies a criterion listed on the script that is not being retested because it was conformant during the original test session e. Inherited – product has inherited compliance with this criterion from a prior test session 10.This space is used by the Proctor to document any other pertinent observations regarding the criterion. Formatting Tips: You may elect to hide all test procedures that are unrelated to your test event by highlighting them and selecting the Hidden option from the Font menu of Microsoft Word. You may also invoke the Navigation Pane on the View ribbon to quickly move from one criterion to another – similar to how a Table of Contents might function.

Submitting Files on Test Day ICSA Labs must observe the retrieval and submission of all interoperability/security files during the test session to maintain the integrity of the test. Files must be submitted for validation purposes when testing any of the following criteria: . 170.314(b)(2) Transitions of care – create and transmit . 170.314(b)(3) ePrescribing* . 170.314(b)(6) Transmission of electronic lab tests and values/results to ambulatory providers [INP only] . 170.314(b)(7) Data portability . 170.314(c)(1) CQM – capture and export . 170.314(c)(3) CQM – electronic submission . 170.314(d)(8) Integrity . 170.314(e)(1) View, download, and transmit to 3rd party . 170.314(e)(2) Clinical summaries [AMB only] . 170.314(f)(2) Transmission to immunization registries . 170.314(f)(3) Transmission to public health agencies

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts . 170.314(f)(4) Transmission of reportable lab tests and values/results [INP only] . 170.314(f)(6) Transmission to cancer registries [AMB only—optional]

*If relying on a 3rd party ePrescribing vendor to pull the NCPDP message, you must arrange for a representative from that organization to join the test session to ensure that the messages are not manually modified prior to submitting them for validation. Files are submitted after the demonstration of each criterion, using a web link that will be provided to you on the day of your test. Along with the files, you will also include a .txt file that contains relevant information related to each message being submitted. Please use the below specifications for understanding the information that should be included in the .txt files. ICSA Labs has already created the template .txt files for you and those can be found at https://icsalabs.s3.amazonaws.com/downloads/txt%20templates.zip. During the test there may be additional information (e.g. data that was changed) that will need to be included prior to submission. The .txt file and associated messages should be saved as a .zip file on the day of your test for uploading. NOTE: files submitted for c1 and c3 do not require a corresponding .txt file. FILENAME INFORMATION INCLUDED IN BODY OF FILE Any Criterion # Optional and Customer Data Set / Test Case Additional Information to Specify Standards Name used b2 b3 Identify whether XML or EDIFACT is used b6 Identify the LRI profile Identify the name of the ONC-supplied test patient selected by the Proctor and b7 the names of the 5 other patients Send data that was hashed and resulting message digest; identify the hashing d8 algorithm that was used e1 e2 Identify the data the Proctor asked to be excluded from the 2nd CCDA f2 Identify the test data that was changed Identify the test data that was changed f3 AMB only: Identify if testing against optional PHIN Messaging Guide f4 Identify the test data that was changed

f6 Identify the test data that was changed

In addition to the files that are submitted, some criteria require a copy of results emails received from the test tools be submitted to ICSA Labs. The results emails must be submitted to ICSA Labs at the email address [email protected]. All results

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts emails must contain the organization name and criterion number in the subject line of the email. Criteria requiring such submission are clearly identified within the test script.

Sample Files Sample files have been provided for your convenience and can be accessed at https://icsalabs.s3.amazonaws.com/downloads/Sample %20Files.zip. This file contains samples for criteria b2, b7, c3 (QRDA Category III only), e1, e2, f3 (without PHIN only), and f6. Sample QRDA Category I files can be downloaded directly from the Cypress test tool and sample f3 messages using the PHIN Messaging Guide can be obtained from the Syndromic Surveillance test tool.

Protected Health Information (PHI) ICSA Labs discourages the use of protected health information (PHI) during a test session. When preparing for your test, you should not use live patient data, even if it is your own. Using PHI may result in additional charges being assessed for the testing process to help mitigate HIPAA exposure risks. Please notify ICSA Labs immediately if you cannot create test data in your system or otherwise prevent disclosure of existing PHI.

Product Name Version/Release

Test Date Tester ID

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts Test Script – Clinical Focus 170.314(b)(3) ePrescribing Setup ONC Test Guidance and Test Tool . Create patient records for all test Data and . Guidance from ICSA Labs patients identified in the ONC- Procedure . Test Tool provided test data . Test . Google Groups Test Tool Support Site or Email Data availab . NCPDP Script Implementation Recommendations le throug h the Contex t- Based Validat ion section of the Test Tool . ONC Test Proced ure Step # Action to Perform Expected Outcome Ref ere Notes / Deviations nce 1 Notify the Proctor of which message type is being Proctor documents the NCPDP SCRIPT v10.6 message used (XML or EDIFACT). type being used for the test (XML or EDIFACT).

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE1.0 2 Proctor identifies the test data set to use. Open Prescription is entered accurately and completely as 1-1.02 the appropriate patient’s record and enter the reflected in the Prescription Information section of the prescription data. Test data is located at: Test Data Specification tab. 1. Open Test Tool 2. Select EDI or XML Validation link Proctor documents the prescription entered. 3. Select Context-Based Validation tab 4. Expand [NEWRX-MU] field to view the available test data TE1.0 3 Submit the prescription entered at Step 2 Prescription submitted electronically. 3 electronically. TE1.0 4 Proctor identifies the test data set to use. Open Prescription is entered accurately and completely as 1-1.02 the appropriate patient’s record and enter the reflected in the Prescription Information section of the prescription data. Test Data Specification tab.

Proctor documents the prescription entered. TE1.0 5 Submit the prescriptions entered at Step 4 Prescription submitted electronically. 3 electronically. 6 Access the XML or EDIFACT message for both Zip file containing the XML or EDIFACT messages for prescriptions and the b3 .txt file and zip them both prescriptions is uploaded using the correct together per the instructions at Submitting Files filename. on Test Day. Upload the zip file to ICSA Labs using the URL provided by the Proctor. Uploaded zip files must include the organization name and criterion number in the filename (e.g. b3_ABCompany).

Resubmissions during the same test session MUST modify the .zip filename to include the word ‘Retest’, as in b3_ABCompany_Retest1, b3_ABCompany_Retest2, etc. TE1.0 7 File validation performed to determine compliance File is conformant to NCPDP SCRIPT v10.6 and 3-1.05 with the required specifications. RxNorm specifications. IN1.01 -1.03

This step performed outside of the demonstration. This step scored on the Conformance Worksheet.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts Select Document any other pertinent observations below: Test Result 170.314(f)(2) Transmission to Immunization Registries Setup ONC Test Guidance and Test Tool . Create patient records for and input all Data and . Guidance from ICSA Labs data for each of the provided test data Procedure . Test Tool sets . Test . Google Groups Test Tool Support Site or Email Data avail able throu gh the Cont ext- Base d Valid ation secti on of the Test Tool . ONC Test Proc edur e Step # Action to Perform Expected Outcome Ref ere Notes / Deviations nce

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE1.0 1 Open the patient record for the data set selected The immunization test data is entered. 1-1.02 by the Proctor for the Administration for Child test case and display the immunization test data Proctor documents the test data set (e.g. 1.1, 1.2 or previously entered. Test data found at: 1.3). 1. Open Test Tool 2. Select Context-Based Validation tab 3. Expand the Test Case fields to view the available test data TE1.0 2 Proctor identifies one or more test data elements Test data is modified per the Proctor’s instructions using 2 to change (e.g. substance expiration date or other one of the Changeable Data elements identified on the IN1.02 Changeable Data). Message Content tab within the test tool.

Proctor documents the data that was changed. TE1.0 3 Generate the immunization message for the Immunization message is generated. 3 patient based on HL7 v2.5.1, the Implementation Guide for Immunization Messaging and the CVX code set. TE1.0 4 Open the patient record for the data set selected The immunization test data is entered. 1-1.02 by the Proctor for the Administration for Adult test case and display the immunization test data Proctor documents the test data set. previously entered. TE1.0 5 Proctor identifies one or more test data elements Test data is modified per the Proctor’s instructions using 2 to change (e.g. patient DOB or other Changeable one of the Changeable Data elements identified on the IN1.02 Data). Message Content tab within the test tool.

Proctor documents the data that was changed. TE1.0 6 Generate the immunization message for the Immunization message is generated. 3 patient based on the standard specified in Step 2. TE1.0 7 Open the patient record for the data set selected The immunization test data is entered. 1-1.02 by the Proctor for the Historical for Child test case and display the immunization test data Proctor documents the test data set. previously entered. TE1.0 8 Proctor identifies one or more test data elements Test data is modified per the Proctor’s instructions using 2 to change (e.g. date/time start of administration or one of the Changeable Data elements identified on the IN1.02 other Changeable Data). Message Content tab within the test tool.

Proctor documents the data that was changed. Page 11 of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE1.0 9 Generate the immunization message for the Immunization message is generated. 3 patient based on the standard specified in Step 2. TE1.0 10 Open the patient record for the data set selected The immunization test data is entered. 1-1.02 by the Proctor for the Consented Child test case Proctor documents the test data set. and display the immunization test data previously entered. TE1.0 11 Proctor identifies one or more test data elements Test data is modified per the Proctor’s instructions using 2 to change (e.g. patient name or other Changeable one of the Changeable Data elements identified on the IN1.02 Data). Message Content tab within the test tool.

Proctor documents the data that was changed. TE1.0 12 Generate the immunization message for the Immunization message is generated. 3 patient based on the standard specified in Step 2. TE1.0 13 Open the patient record for the data set selected The immunization test data is entered. 1-1.02 by the Proctor for the Refused Toddler test case and display the immunization test data previously Proctor documents the test data set. entered. TE1.0 14 Proctor identifies one or more test data elements Test data is modified per the Proctor’s instructions using 2 to change (e.g. date/time start of administration or one of the Changeable Data elements identified on the IN1.02 other Changeable Data). Message Content tab within the test tool.

Proctor documents the data that was changed. TE1.0 15 Generate the immunization message for the Immunization message is generated. 3 patient based on the standard specified in Step 2. TE1.0 16 Open the patient record for the data set selected The immunization test data is entered. 1-1.02 by the Proctor for the Varicella History Child test case and display the immunization test data Proctor documents the test data set. previously entered. TE1.0 17 Proctor identifies one or more test data elements Test data is modified per the Proctor’s instructions using 2 to change (e.g. patient DOB or other Changeable one of the Changeable Data elements identified on the IN1.02 Data). Message Content tab within the test tool.

Proctor documents the data that was changed. TE1.0 18 Generate the immunization message for the Immunization message is generated. 3 patient based on the standard specified in Step 2.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE1.0 19 Open the patient record for the data set selected The immunization test data is entered. 1-1.02 by the Proctor for the Complete Record test case and display the immunization test data previously Proctor documents the test data set. entered. TE1.0 20 Proctor identifies one or more test data elements Test data is modified per the Proctor’s instructions using 2 to change (e.g. OBX.3.2 or other Changeable one of the Changeable Data elements identified on the IN1.02 Data). Message Content tab within the test tool.

Proctor documents the data that was changed. TE1.0 21 Generate the immunization message for the Immunization message is generated. 3 patient based on the standard specified in Step 2. 22 Access all 7 immunization messages and the f2 Zip file containing all 7 immunization messages is .txt file and zip them together per the instructions uploaded using the correct filename. at Submitting Files on Test Day. Upload the zip file to ICSA Labs using the URL provided by the Proctor. Uploaded zip files must include the organization name and criterion number in the filename (e.g. f2_ABCompany).

Resubmissions during the same test session MUST modify the .zip filename to include the word ‘Retest’, as in f2_ABCompany_Retest1, f2_ABCompany_Retest2, etc. TE1.0 23 File validation performed to determine compliance Each of the 7 files contains the appropriate immunization 3-1.04 with the required specifications. information and is conformant to the HL7 v2.5.1 and IN1.01 CVX code specifications. -1.02 This step performed outside of the demonstration. This step scored on the Conformance Worksheet. Select Document any other pertinent observations below: Test Result

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts 170.314(f)(3) Transmission to Public Health Agencies – Syndromic Surveillance Setup Guidance and Test Tool . INP: Create patient records for and input all data for Step 1 of each of the . Guidance from ICSA Labs provided test data sets for all the test cases . Test Tool . AMB systems using the optional PHIN Messaging Guide: Create patient . Google Groups Test Tool Support Site or Email records for and input all data for Step 1 of each of the provided test data sets for the UC Visit test case. . AMB systems NOT using the optional PHIN Messaging Guide: Pre-enter a syndromic event for one patient Step # Action to Perform Expected Outcome Ref ere Notes / Deviations nce ☐ Steps 1-3 performed by all Ambulatory systems NOT electing to test against the optional PHIN Messaging Guide TE1.0 1 Open the patient’s record and display the The presence of syndromic surveillance data is 1 [AMB] syndromic surveillance data previously entered. confirmed.

Proctor documents the syndromic event. TE1.0 2 Generate the syndromic message for this patient Syndromic surveillance message is generated. The zip 2 [AMB] based on the HL7 v2.5.1 standard, access the file containing the syndromic surveillance message is f3 .txt file and zip the messages together per the uploaded using the correct filename. instructions at Submitting Files on Test Day. Upload the zip file to ICSA Labs using the URL provided by the Proctor. Uploaded zip files must include the organization name and criterion number in the filename (e.g. f3_ABCompany).

Resubmissions during the same test session MUST modify the .zip filename to include the word ‘Retest’, as in f3_ABCompany_Retest1, f3_ABCompany_Retest2, etc. TE1.0 3 File validation performed to determine compliance The message contains the required information and is 3 [AMB] with the required specification. conformant to the HL7 v2.5.1 specification. IN1.01

This step performed outside of the demonstration. This step scored on the Conformance Worksheet. ☐ Steps 4-8 by Ambulatory systems electing to test against the optional PHIN Messaging Guide and by all Inpatient systems

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE2.0 4 Proctor selects 1 test case from the Urgent Care Syndromic surveillance test data is entered. 1-2.02 Visit category. Test Data located at: [AMB] TE3.0 1. Open Test Tool Proctor documents which test case was selected (e.g. 1-3.02 [INP] 2. Select Context-Based Validation tab 1.1, 1.2, 1.3). 3. Select the UC Visit test case selected by the Proctor 4. Expand the Test Case fields to view the available test data Open the patient record and display the syndromic surveillance test data previously entered for the data set selected by the Proctor for the UC Visit-Step 1 test case. IN2.02 5 Proctor identifies one or more test data elements Test data is modified per the Proctor’s instructions. [AMB] to change (e.g. ethnic group or other Changeable IN3.02 Data). [INP] Proctor documents the data that was changed. TE2.0 6 Generate the syndromic message for the test Syndromic surveillance message is generated. 3 encounter based on the HL7 v2.5.1 standard and [AMB] the PHIN Messaging Guide for Syndromic TE3.0 3 [INP] Surveillance. TE2.0 7 Using the same test case from Step 4, open the Syndromic surveillance test data is entered. 2 patient record for the same encounter and enter [AMB] the syndromic surveillance test data for the UC TE2.0 5 Visit-Step 2 test case. [AMB] TE3.0 2 [INP] TE3.0 5 [INP] TE2.0 8 Generate the syndromic message for the test Syndromic surveillance message is generated. 3 encounter based on the identified standard. [AMB] TE2.0 AMB: The syndromic messages are submitted. 5 [AMB] AMB: Submit both syndromic messages to ICSA TE3.0 Labs. 3 [INP] TE3.0 5 [INP] ☐ Steps 9-25 only performed by Inpatient systems

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE3.0 9 Proctor selects 1 test case from the Patient Dies Syndromic surveillance test data is entered. 1-3.02 [INP] category. Proctor documents which test case was selected. Open the patient record and display the syndromic surveillance test data previously entered for the data set selected by the Proctor for the Patient Dies-Step 1 test case. IN2.02 10 Proctor identifies one or more test data elements Test data is modified per the Proctor’s instructions. [AMB] [INP] to change (e.g. race or other Changeable Data). IN3.02 [INP] Proctor documents the data that was changed. TE3.0 11 Generate the syndromic message for the test Syndromic surveillance message is generated. 3 [INP] encounter based on the identified standard. TE3.0 12 Using the same test case from Step 9, open the Syndromic surveillance test data is entered. 2 [INP] patient record for the same encounter and enter TE3.0 the syndromic surveillance test data for the 5 Patient Dies-Step 2 test case. TE3.0 13 Generate the syndromic message for the test Syndromic surveillance message is generated. 3 [INP] encounter based on the identified standard. TE3.0 5 TE3.0 14 Using the same test case from Step 9, open the Syndromic surveillance test data is entered. 2 [INP] patient record for the same encounter and enter TE3.0 the syndromic surveillance test data for the 5 Patient Dies-Step 3 test case. TE3.0 15 Generate the syndromic message for the test Syndromic surveillance message is generated. 3 [INP] encounter based on the identified standard. TE3.0 5 TE3.0 16 Proctor selects 1 test case from the Emergency Syndromic surveillance test data is entered. 1-3.02 [INP] Department Visit category. Proctor documents which test case was selected. Open the patient record and display the syndromic surveillance test data previously entered for the data set selected by the Proctor for the ED Visit-Step 1 test case. IN2.02 17 Proctor identifies one or more test data elements Test data is modified per the Proctor’s instructions. [AMB] [INP] to change (e.g. OBX-3 OBX.5-CWE.9 or other IN3.02 Changeable Data). [INP] Proctor documents the data that was changed.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE3.0 18 Generate the syndromic message for the test Syndromic surveillance message is generated. 3 [INP] encounter based on the identified standard. TE3.0 19 Using the same test case from Step 16, open the Syndromic surveillance test data is entered. 2 [INP] patient record for the same encounter and enter TE3.0 the syndromic surveillance test data for the ED 5 Visit-Step 2 test case. TE3.0 20 Generate the syndromic message for the test Syndromic surveillance message is generated. 3 [INP] encounter based on the identified standard. TE3.0 5 TE3.0 21 Using the same test case from Step 16, open the Syndromic surveillance test data is entered. 2 [INP] patient record for the same encounter and enter TE3.0 the syndromic surveillance test data for the ED 5 Visit-Step 3 test case. TE3.0 22 Generate the syndromic message for the test Syndromic surveillance message is generated. 3 [INP] encounter based on the identified standard. TE3.0 23 Using the same test case from Step 16, open the Syndromic surveillance test data is entered. 2 [INP] patient record for the same encounter and enter TE3.0 the syndromic surveillance test data for the ED 5 Visit-Step 4 test case. TE3.0 24 Generate the syndromic message for the test Syndromic surveillance message is generated. 3 [INP] encounter based on the identified standard. TE3.0 5 25 Access all 9 syndromic surveillance messages Zip file containing all 9 syndromic surveillance messages [INP] and the f3 .txt file and zip them together per the is uploaded using the correct filename. instructions at Submitting Files on Test Day. Upload the zip file to ICSA Labs using the URL provided by the Proctor. Uploaded zip files must include the organization name and criterion number in the filename (e.g. f3_ABCompany).

Resubmissions during the same test session MUST modify the .zip filename to include the word ‘Retest’, as in f3_ABCompany_Retest1, f3_ABCompany_Retest2, etc. Step 26 required to be performed by all systems

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE2.0 26 File validation performed to determine compliance Files are generated with the appropriate syndromic 3-2.04 with the required specifications. surveillance information and are conformant to the HL7 [AMB] v2.5.1 standard and, when applicable, the PHIN IN2.01 [AMB] Messaging Guide for Syndromic Surveillance. TE3.0 This step performed outside of the demonstration. 3-3.04 [INP] This step scored on the Conformance Worksheet. IN3.01 [INP] Select Document any other pertinent observations below: Test Result

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts 170.314(f)(6) Transmission to Cancer Registries [Ambulatory Only--Optional] Setup ONC Test Guidance and Test Tool . Create patient records for and input all Data and . Guidance from ICSA Labs data for each of the provided test data Procedur . Test Tool sets e . Google Groups Test Tool Support Site or Email . ON C Tes t Dat a - Ref orm atte d and avai labl e in test tool . ON C Tes t Pro ced ure Step # Action to Perform Expected Outcome Ref ere Notes / Deviations nce

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE1.0 1 Open the patient record for the data set selected Cancer case test data marked as SHALL are entered 1-1.02 [AMB] by the Proctor for Category 1 and display the correctly and without omission. cancer test data previously entered. Test Data located at: Proctor documents the Case number used. 1. Open Test Tool 2. Click the link to the appropriate test case and category 3. To view another category, click the Back button on the browser, or click Meaningful Use (Cancer Registry) from the top of the page TE1.0 2 Generate a cancer case message for the patient Cancer case message is generated correctly and 3 [AMB] based on the following standards: without omission. . HL7 CDA, Release 2.0, Normative Edition . Implementation Guide for Ambulatory Healthcare Provider Reporting to Central Cancer Registries, HL7 CDA . IHTSDO SNOMED-CT International Release July 2012 and US Extension to SNOMED-CT March 2012 Release . LOINC v2.40 TE1.0 3 Open the patient record for the data set selected Cancer case test data marked as SHALL are entered 1-1.02 [AMB] by the Proctor for Category 2 and display the correctly and without omission. cancer test data previously entered. Proctor documents the Case number used. TE1.0 4 Generate a cancer case message for the patient Cancer case message is generated correctly and 3 [AMB] based on the identified standards. without omission. TE1.0 5 Open the patient record for the data set selected Cancer case test data marked as SHALL are entered 1-1.02 [AMB] by the Proctor for Category 3 and display the correctly and without omission. cancer test data previously entered. Proctor documents the Case number used. TE1.0 6 Generate a cancer case message for the patient Cancer case message is generated correctly and 3 [AMB] based on the identified standards. without omission.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE1.0 7 Open the patient record for the data set selected Cancer case test data marked as SHALL are entered 1-1.02 [AMB] by the Proctor for Category 4 and display the correctly and without omission. cancer test data previously entered. Proctor documents the Case number used. TE1.0 8 Generate a cancer case message for the patient Cancer case message is generated correctly and 3 [AMB] based on the identified standards. without omission. TE1.0 9 Open the patient record for the data set selected Cancer case test data marked as SHALL are entered 1-1.02 [AMB] by the Proctor for Category 5 and display the correctly and without omission. cancer test data previously entered. Proctor documents the Case number used. TE1.0 10 Generate a cancer case message for the patient Cancer case message is generated correctly and 3 [AMB] based on the identified standards. without omission. TE1.0 11 Open the patient record for the data set selected Cancer case test data marked as SHALL are entered 1-1.02 [AMB] by the Proctor for Category 6 and display the correctly and without omission. cancer test data previously entered. Proctor documents the Case number used. Guideli 12 Proctor identifies one or more test data elements Test data is modified per the Proctor’s instructions. nes for to change, ensuring the test data is still clinically Pre- [AMB] Loadin relevant. g Test Proctor documents the data that was changed. Data TE1.0 13 Generate a cancer case message for the patient Cancer case message is generated correctly and 3 [AMB] based on the identified standards. without omission. 14 Access all 6 files and the f6 .txt file and zip them Zip file containing all cancer case messages is uploaded [AMB] together per the instructions at Submitting Files using the correct filename. on Test Day. Upload the zip file to ICSA Labs using the URL provided by the Proctor. Uploaded zip files must include the organization name and criterion number in the filename (e.g. f6_ABCompany).

Resubmissions during the same test session MUST modify the .zip filename to include the word ‘Retest’, as in f6_ABCompany_Retest1, f6_ABCompany_Retest2, etc.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE1.0 15 File validation performed to determine compliance File contains the correct content and is conformant to 4-1.05 [AMB] with the required specifications. the required specifications. IN1.01 -1.02

This step performed outside of the demonstration. This step scored on the Conformance Worksheet. Select Document any other pertinent observations below: Test Result

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts 170.314(f)(4) Transmission of Reportable Lab Tests and Values/Results [Inpatient Only] Setup ONC Test Guidance and Test Tool . Create patient records for and input all Data and . Guidance from ICSA Labs data for each of the provided test data Procedur . Test Tool sets e . Google Groups Test Tool Support Site or Email . Tes t Dat a avai labl e thro ugh the Con text - Bas ed Vali dati on sect ion of the Tes t Too l . ON C Tes t Pro ced ure

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts Step # Action to Perform Expected Outcome Ref ere Notes / Deviations nce TE1.0 1 Open the patient record for the data set selected Lab tests and values/results data is entered. 1-1.02 [INP] by the Proctor for the Maximally Populated Final Quantitative Results test case and display the Proctor documents the test data set (e.g. 1.1, 1.2, or lab tests and values/results data previously 1.3). entered. Test Data located at: 1. Open Test Tool 2. Select Context-Based Validation tab 3. Expand the Test Case fields to view the available test data 2 Proctor identifies one or more test data elements Test data is modified per the Proctor’s instructions. IN1.02 [INP] to change (e.g. patient name or other Changeable Data). Proctor documents the data that was changed. TE1.0 3 Generate an HL7 v.2.5.1: ORU^R01 message The message is generated correctly and without 3 [INP] based on the Receiver Profile, SNOMED-CT, and omission. LOINC. TE1.0 4 Open the patient record for the data set selected Lab tests and values/results data is entered. 1-1.02 [INP] by the Proctor for the Final Quantitative Result test case and display the lab tests and Proctor documents the test data set. values/results data previously entered. 5 Proctor identifies one or more test data elements Test data is modified per the Proctor’s instructions. IN1.02 [INP] to change (e.g. specimen received date/time or other Changeable Data). Proctor documents the data that was changed. TE1.0 6 Generate a message based on the standards The message is generated correctly and without 3 [INP] specified in Step 2. omission. TE1.0 7 Open the patient record for the data set selected Lab tests and values/results data is entered. 1-1.02 [INP] by the Proctor for the Preliminary Multiple Coded Culture Results test case and display the Proctor documents the test data set. lab tests and values/results data previously entered. 8 Proctor identifies one or more test data elements Test data is modified per the Proctor’s instructions. IN1.02 [INP] to change (e.g. patient’s street or mailing address or other Changeable Data). Proctor documents the data that was changed.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE1.0 9 Generate a message based on the standards The message is generated correctly and without 3 [INP] specified in Step 2. omission. TE1.0 10 Open the patient record for the data set selected Lab tests and values/results data is entered. 1-1.02 [INP] by the Proctor for the Final Single Coded Culture Result with Susceptibility Testing test Proctor documents the test data set. case and display the lab tests and values/results data previously entered. 11 Proctor identifies one or more test data elements Test data is modified per the Proctor’s instructions. IN1.02 [INP] to change (e.g. patient’s phone number or other Changeable Data). Proctor documents the data that was changed. TE1.0 12 Generate a message based on the standards The message is generated correctly and without 3 [INP] specified in Step 2. omission.

13 Open the patient record for the data set selected Lab tests and values/results data is entered. TE1.0 1-1.02 [INP] by the Proctor for the Final Quantitative Result with Reflex Testing test case and display the lab Proctor documents the test data set and indicates tests and values/results data previously entered. whether Test Scenario 5A, 5B, or both were attempted.

NOTE: Compliance with Test Scenario 5A or 5B is required, though systems may demonstrate both. 14 Proctor identifies one or more test data elements Test data is modified per the Proctor’s instructions. IN1.02 [INP] to change (e.g. observation date/time or other Changeable Data). Proctor documents the data that was changed. TE1.0 15 Generate a message based on the standards The message is generated correctly and without 3 [INP] specified in Step 2. omission. TE1.0 16 Open the patient record for the data set selected Lab tests and values/results data is entered. 1-1.02 [INP] by the Proctor for the Final Titer Result test case and display the lab tests and values/results data Proctor documents the test data set. previously entered. 17 Proctor identifies one or more test data elements Test data is modified per the Proctor’s instructions. IN1.02 [INP] to change (e.g. ordering provider or other Changeable Data). Proctor documents the data that was changed. TE1.0 18 Generate a message based on the standards The message is generated correctly and without 3 [INP] specified in Step 2. omission.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE1.0 19 Open the patient record for the data set selected Lab tests and values/results data is entered. 1-1.02 [INP] by the Proctor for the Final Qualitative Result test case and display the lab tests and Proctor documents the test data set. values/results data previously entered. 20 Proctor identifies one or more test data elements Test data is modified per the Proctor’s instructions. IN1.02 [INP] to change (e.g. order callback phone number or other Changeable Data). Proctor documents the data that was changed. TE1.0 21 Generate a message based on the standards The message is generated correctly and without 3 [INP] specified in Step 2. omission. TE1.0 22 Open the patient record for the data set selected Lab tests and values/results data is entered. 1-1.02 [INP] by the Proctor for the Final Multiple Qualitative Results test case and display the lab tests and Proctor documents the test data set. values/results data previously entered. 23 Proctor identifies one or more test data elements Test data is modified per the Proctor’s instructions. IN1.02 [INP] to change (e.g. ordering facility/organization name or other Changeable Data). Proctor documents the data that was changed. TE1.0 24 Generate a message based on the standards The message is generated correctly and without 3 [INP] specified in Step 2. omission. TE1.0 25 Open the patient record for the data set selected Lab tests and values/results data is entered. 1-1.02 [INP] by the Proctor for the Final Single Coded Culture Result test case and display the lab tests Proctor documents the test data set. and values/results data previously entered. 26 Proctor identifies one or more test data elements Test data is modified per the Proctor’s instructions. IN1.02 [INP] to change (e.g. performing facility/organization name or other Changeable Data). Proctor documents the data that was changed. TE1.0 27 Generate a message based on the standards The message is generated correctly and without 3 [INP] specified in Step 2. omission.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts 28 Access all 9 (10 if demonstrated 5A and 5B) lab Zip file containing all lab messages is uploaded using [INP] messages and the f4 .txt file and zip them the correct filename. together per the instructions at Submitting Files on Test Day. Upload the zip file to ICSA Labs using the URL provided by the Proctor. Uploaded zip files must include the organization name and criterion number in the filename (e.g. f4_ABCompany).

Resubmissions during the same test session MUST modify the .zip filename to include the word ‘Retest’, as in f4_ABCompany_Retest1, f4_ABCompany_Retest2, etc. TE1.0 29 File validation performed to determine compliance Files are conformant to the required specifications. 3-1.04 [INP] with the required specifications. IN1.01 -1.02 This step scored on the Conformance Worksheet. This step performed outside of the demonstration. Select Document any other pertinent observations below: Test Result 170.314(e)(2) Clinical Summaries [Ambulatory Only] Setup ONC Test Guidance and Test Tool . Create a patient record for and input Data and . Guidance from ICSA Labs all data for the provided test data Procedure . Edge Testing Tool (ETT) . ONC . ETT Google Groups Support Site or Email Test Data . ONC Test Proc edur e Step # Action to Perform Expected Outcome Ref ere Notes / Deviations nce

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE1.0 1 Open the patient record and display the test data Patient record is opened and test data was entered 1 [AMB] previously entered. correctly and without omission. TE1.0 2 Electronically generate a clinical summary CCDA clinical summary is generated. 2 [AMB] according to the CCDA standard and named vocabulary standards for the Common MU Data Set and the following data elements: . Provider’s name and office contact info . Date and location of visit . Reason for visit . Immunizations and/or medications administered during the visit . Diagnostic tests pending . Clinical instructions . Future appointments . Referrals to other providers . Future scheduled tests . Recommended patient decision aids TE1.0 3 Electronically generate a clinical summary in Proctor verifies that a human-readable clinical summary 2 [AMB] human-readable format, including the is generated, is complete and accurate and contains all TE1.0 requirements specified at Step 2. required data elements. 4 IN1.03 TE2.0 4 In the same patient’s record, begin the process to Data is selected for inclusion and exclusion in the clinical 1 [AMB] generate another clinical summary. Proctor summary. identifies the data to be excluded from the clinical summary using one of the data elements from Proctor documents the data that was excluded. Step 2. TE2.0 5 Electronically generate a clinical summary in CCDA clinical summary is generated. 2 [AMB] CCDA format, including the requirements specified at Step 2. TE2.0 6 Electronically generate a clinical summary in Proctor verifies that a human-readable clinical summary 2-2.03 [AMB] human-readable format, including the is generated, is complete and accurate and does not IN2.02 requirements specified at Step 2. contain the data identified for exclusion at Step 4.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts 7 Access both CCDAs and the e2 .txt file and zip Zip file containing the CCDAs is uploaded using the [AMB] them together per the instructions at Submitting correct filename. Files on Test Day. Upload the zip file to ICSA Labs using the URL provided by the Proctor. Uploaded zip files must include the organization name and criterion number in the filename (e.g. e2_ABCompany).

Resubmissions during the same test session MUST modify the .zip filename to include the word ‘Retest’, as in e2_ABCompany_Retest1, e2_ABCompany_Retest2, etc. TE1.0 8 File validation performed to determine compliance Files contain the required data elements and are in 3 [AMB] with the required specifications. conformance with the required specifications and the TE1.0 named vocabulary standards. 5 IN1.01 This step performed outside of the demonstration. -1.02 TE2.0 Clinical summaries generated at Steps 2 and 5 are 4-2.05 accurate and complete and summary generated at Step IN2.01 5 excludes the data identified at Step 4. IN2.03

This step scored on the Conformance Worksheet. Select Document any other pertinent observations below: Test Result

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts 170.314(c)(3) Clinical Quality Measures – Electronic Submission Setup ONC Test Guidance and Test Tool . Create patient records for and Data and . Guidance from ICSA Labs input all Cypress data Procedure . Step-by-Step Instructions for using Cypress . ICSA . Cypress Test Tool Labs will send the . Cypress JIRA Support Site or Email Cypress . Alternative Google Groups Test Tool Support Site or Email test data 5 . Test Tool Announcements business days before the test . ONC Test Procedure Step # Action to Perform Expected Outcome Ref ere Notes / Deviations nce VE1.1. 1 Identify the name and version of any optional Proctor documents the name and version of any optional 01 modules installed in the EHR technology at the modules installed in the EHR. time of the test and the operating system and version on which the EHR is running. Proctor documents the operating system and version on which the EHR is running.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts 2 Export the Cypress CQM patient data in QRDA Data is exported and submitted in both of the specified Category I and Category III format. Zip all QRDA formats. Category I and III files together. Do NOT include data from patients outside of those provided by A single zip file for all of the QRDA Category I Cypress. Upload the zip files to ICSA Labs using documents for each of the test patients that fall into the the URL provided by the Proctor. Uploaded zip initial patient population (IPP) for each of the CQMs files must include the organization name and being tested are electronically exported (e.g. 1 zip per criterion number in the filename (e.g. CQM). Each of these zip files will be used to report the c3_ABCompany). results of each CQM under test.

Resubmissions during the same test session The zip file containing the QRDA Category I and MUST modify the .zip filename to include the Category III files is uploaded using the correct filenames. word ‘Retest’, as in c3_ABCompany_Retest1, c3_ABCompany_Retest2, etc.

NOTE: If also testing c1, the same set of QRDA Cat 1 files may be used for both criteria. TE1.3. 3 File validation performed to determine compliance File is conformant to the specifications. 03- with the required specifications. 1.3.04 This step scored on the Conformance Worksheet. This step performed outside of the demonstration. Select Document any other pertinent observations below: Test Result

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts 170.314(c)(1) Clinical Quality Measures – Capture and Export Setup ONC Test Guidance and Test Tool . Create patient records for and input all Data and . Guidance from ICSA Labs Cypress data if manually entering the Procedure . Step-by-Step Instructions for using Cypress data . ICSA . Cypress Test Tool Labs will . Cypress JIRA Support Site or Email send . Alternative Google Groups Test Tool Support Site or Email the Cypr . Test Tool Announcements ess test data 5 busi ness days befor e the test . ONC Test Proc edur e Step # Action to Perform Expected Outcome Ref ere Notes / Deviations nce ☐ Step 1 required only by systems importing the Cypress test data in an automated fashion 1 Electronically import the CQM data using the CQM data is electronically imported and stored correctly [Conditional] QRDA Category I format. within the EHR. Steps 2-3 required for all systems

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE2.1. 2 Electronically export the patient test data in A single zip file for all of the QRDA Category I 03 QRDA Category I format for the CQMs being documents for each of the test patients that fall into the tested. Zip all QRDA Category I files together. Do initial patient population (IPP) for each of the CQMs NOT include data from patients outside of those being tested are electronically exported (e.g. 1 zip per provided by Cypress. Upload the zip file to ICSA CQM). Each of these zip files will be used to report the Labs using the URL provided by the Proctor. results of each CQM under test. Uploaded zip files must include the organization name and criterion number in the filename (e.g. The zip file containing the QRDA Category I files is c1_ABCompany). uploaded using the correct filename.

Resubmissions during the same test session MUST modify the .zip filename to include the word ‘Retest’, as in c1_ABCompany_Retest1, c1_ABCompany_Retest2, etc.

NOTE: If also testing c3, the same set of QRDA Cat 1 files may be used for both criteria. TE2.3. 3 File validation performed to determine compliance File is conformant to the specifications. 01- with the required specifications. 2.3.02 This step scored on the Conformance Worksheet. This step performed outside of the demonstration. Select Document any other pertinent observations below: Test Result 170.314(c)(2) Clinical Quality Measures – Import and Calculate Setup Guidance and Test Tool . Create patient records for all Cypress data . Guidance from ICSA Labs . Systems testing all 3 CQM criteria may load data manually prior to the test; all other systems must electronically import that data using QRDA Category I on the day of the test

Step # Action to Perform Expected Outcome Ref ere Notes / Deviations nce ☐ Step 1 required only by EHR Modules that are not testing all 3 CQM criteria

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE1.2. 1 Electronically import the CQM data using the CQM data is electronically imported and stored correctly 06 [Conditional] QRDA Category I format. within the EHR. Steps 2-4 required for all systems VE1.1. 2 Identify the name and version of any optional Proctor documents the name and version of any optional 01 modules installed in the EHR technology at the modules installed in the EHR. time of the test and the operating system and version on which the EHR is running. Proctor documents the operating system and version on which the EHR is running. TE1.2. 3 Electronically calculate the CQMs that are being CQMs are electronically calculated correctly as 07- tested and display the results. described including numerators, denominators, 1.2.08 exceptions and exclusions. IN1.2. 09 IN1.2. 4 Describe how the calculations for the specified Logic used to determine the numerator, denominator 09 CQMs were created. and exclusions for each CQM is described.

NOTE: If also testing c3, these calculations will additionally be validated using the QRDA Cat 3 file generated during the c3 test. Select Document any other pertinent observations below: Test Result

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts 170.314(b)(6) Transmission of Electronic Lab Tests and Values/Results to Ambulatory Providers [Inpatient Only]

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts Setup ONC Guidance and Test Tool . Create patient records for and input all Test . Guidance from ICSA Labs data for each of the provided test data Data . LIS Context-Based Validation Tool sets and . Google Groups Test Tool Support Site or Email Proced ure . T e st D at a a v ail a bl e th ro u g h th e LI S C o nt e xt - B a s e d V ali d Page 36 of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts Step # Action to Perform Expected Outcome Ref ere Notes / Deviations nce 1 Notify Proctor which LRI profile will be used for Proctor documents the LRI profile being used. LRI Profile: [INP] testing. Available options include: . GU/RU Proctor documents the test tool version. Test Tool v . GU/RN . NG/RU . NG/RN TE1.0 2 Open the patient’s record to be used for Proctor confirms that the test data is entered. Test data 1-1.02 [INP] transmitting the Final Sed Rate message and found at: show the Proctor that the test data has been 1. Select GU or NG entered correctly. 2. Select LRI_1_Sed_Rate 3. Select LRI_1.0_Sed_Rate 4. Select LRI_1.0-GU_Final (or NG) 5. Test Data Specification tab 3 Proctor identifies one or more test data elements Test data is modified per the Proctor’s instructions. IN1.02 [INP] to change (e.g. relevant clinical information or other Changeable Data). Proctor documents the data that was changed.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE1.0 4 Generate the indicated LRI HL7 v2.5.1 ORU^R01 LRI HL7 v2.5.1 ORU^R01 message is generated and is 3 [INP] Final Sed Rate message and send it directly to received by the LRI Test Tool. the tool using the tool’s “receive” feature or by downloading the file and uploading it to the LIS Context-Based Validation Tool.

Auto-Send Instructions: 1. Select GU or NG 2. Select LRI_1_Sed_Rate 3. Select LRI_1.0_Sed_Rate 4. Select LRI_1.0-GU_Final (or NG) 5. Click ‘Select’ 6. Click ‘Receive’ 7. Click ‘Start’ NOTE: You will have 60 seconds to send the message to the test tool after clicking ‘Start’.

Download/Direct Send Instructions: 1. Download message from EHR 2. Open LIS Context-Based Validation Tool 3. Select GU or NG 4. Select LRI_1_Sed_Rate 5. Select LRI_1.0_Sed_Rate 6. Select LRI_1.0-GU_Final (or NG) 7. Click ‘Select’ to load the test case 8. Click ‘Browse’ and upload the file 5 Download the generated Message Validation Message Validation Result is saved in PDF format with [INP] Result as a PDF. filename FinalSedRate. TE1.0 6 Open the patient’s record to be used for Proctor confirms that the test data is entered. 1-1.02 [INP] transmitting the Corrected Sed Rate message and show the Proctor that the test data has been entered correctly.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE1.0 7 Generate the indicated LRI HL7 v2.5.1 ORU^R01 LRI HL7 v2.5.1 ORU^R01 message is generated and is 3 [INP] Corrected Sed Rate message and send it received by the LRI Test Tool. directly to the tool using the tool’s “receive” feature or by downloading the file and uploading it to the LIS Context-Based Validation Tool. 8 Download the generated Message Validation Message Validation Result is saved in PDF format with [INP] Result as a PDF. filename CorrectedSedRate. TE1.0 9 Open the patient’s record to be used for Proctor confirms that the test data is entered. 1-1.02 [INP] transmitting the Rejected Sed Rate message and show the Proctor that the test data has been entered correctly. 10 Proctor identifies one or more test data elements Test data is modified per the Proctor’s instructions. IN1.02 [INP] to change (e.g. patient name or other Changeable Data). Proctor documents the data that was changed. TE1.0 11 Generate the indicated LRI HL7 v2.5.1 ORU^R01 LRI HL7 v2.5.1 ORU^R01 message is generated and is 3 [INP] Rejected Sed Rate message and send it directly received by the LRI Test Tool. to the tool using the tool’s “receive” feature or by downloading the file and uploading it to the LIS Context-Based Validation Tool. 12 Download the generated Message Validation Message Validation Result is saved in PDF format with [INP] Result as a PDF. filename RejectedSedRate. TE1.0 13 Open the patient’s record to be used for Proctor confirms that the test data is entered. 1-1.02 [INP] transmitting the CBC message and show the Proctor that the test data has been entered correctly. 14 Proctor identifies one or more test data elements Test data is modified per the Proctor’s instructions. IN1.02 [INP] to change (e.g. performing facility/organization name or other Changeable Data). Proctor documents the data that was changed. TE1.0 15 Generate the indicated LRI HL7 v2.5.1 ORU^R01 LRI HL7 v2.5.1 ORU^R01 message is generated and is 3 [INP] CBC message and send it directly to the tool received by the LRI Test Tool. using the tool’s “receive” feature or by downloading the file and uploading it to the LIS Context-Based Validation Tool. 16 Download the generated Message Validation Message Validation Result is saved in PDF format with [INP] Result as a PDF. filename CBC.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE1.0 17 Open the patient’s record to be used for Proctor confirms that the test data is entered. 1-1.02 [INP] transmitting the Lipid Panel message and show the Proctor that the test data has been entered correctly. 18 Proctor identifies one or more test data elements Test data is modified per the Proctor’s instructions. IN1.02 [INP] to change (e.g. date/time of the observation or other Changeable Data). Proctor documents the data that was changed. TE1.0 19 Generate the indicated LRI HL7 v2.5.1 ORU^R01 LRI HL7 v2.5.1 ORU^R01 message is generated and is 3 [INP] Lipid Panel message and send it directly to the received by the LRI Test Tool. tool using the tool’s “receive” feature or by downloading the file and uploading it to the LIS Context-Based Validation Tool. 20 Download the generated Message Validation Message Validation Result is saved in PDF format with [INP] Result as a PDF. filename LipidPanel. TE1.0 21 Open the patient’s record to be used for Proctor confirms that the test data is entered. 1-1.02 [INP] transmitting the Culture and Susceptibility Parent message and show the Proctor that the test data has been entered correctly. 22 Proctor identifies one or more test data elements Test data is modified per the Proctor’s instructions. IN1.02 [INP] to change (e.g. results report/status change – date/time or other Changeable Data). Proctor documents the data that was changed. TE1.0 23 Generate the indicated LRI HL7 v2.5.1 ORU^R01 LRI HL7 v2.5.1 ORU^R01 message is generated and is 3 [INP] Culture and Susceptibility Parent message and received by the LRI Test Tool. send it directly to the tool using the tool’s “receive” feature or by downloading the file and uploading it to the LIS Context-Based Validation Tool. 24 Download the generated Message Validation Message Validation Result is saved in PDF format with [INP] Result as a PDF. filename CultureandSusceptibilityParent. TE1.0 25 Open the patient’s record to be used for Proctor confirms that the test data is entered. 1-1.02 [INP] transmitting the Culture and Susceptibility Parent/Child message and show the Proctor that the test data has been entered correctly. 26 Proctor identifies one or more test data elements Test data is modified per the Proctor’s instructions. IN1.02 [INP] to change (e.g. patient gender or other Changeable Data). Proctor documents the data that was changed.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE1.0 27 Generate the indicated LRI HL7 v2.5.1 ORU^R01 LRI HL7 v2.5.1 ORU^R01 message is generated and is 3 [INP] Culture and Susceptibility Parent/Child received by the LRI Test Tool. message and send it directly to the tool using the tool’s “receive” feature or by downloading the file and uploading it to the LIS Context-Based Validation Tool. 28 Download the generated Message Validation Message Validation Result is saved in PDF format with [INP] Result as a PDF. filename CultureandSusceptibilityParent_Child. TE1.0 29 Open the patient’s record to be used for Proctor confirms that the test data is entered. 1-1.02 [INP] transmitting the Reflex-Hepatitis message and show the Proctor that the test data has been entered correctly. 30 Proctor identifies one or more test data elements Test data is modified per the Proctor’s instructions. IN1.02 [INP] to change (e.g. patient DOB or other Changeable Data). Proctor documents the data that was changed. TE1.0 31 Generate the indicated LRI HL7 v2.5.1 ORU^R01 LRI HL7 v2.5.1 ORU^R01 message is generated and is 3 [INP] Reflex-Hepatitis message and send it directly to received by the LRI Test Tool. the tool using the tool’s “receive” feature or by downloading the file and uploading it to the LIS Context-Based Validation Tool. 32 Download the generated Message Validation Message Validation Result is saved in PDF format with [INP] Result as a PDF. filename Reflex-Hepatitis. 33 Access all 8 Message Validation Reports and the Zip file containing all 8 Message Validation Reports is [INP] b6 .txt file and zip them together per the uploaded using the correct filename. instructions at Submitting Files on Test Day. Upload the zip file to ICSA Labs using the URL provided by the Proctor. Uploaded zip files must include the organization name and criterion number in the filename (e.g. b6_ABCompany).

Resubmissions during the same test session MUST modify the .zip filename to include the word ‘Retest’, as in b6_ABCompany_Retest1, b6_ABCompany_Retest2, etc. TE1.0 34 File validation performed to determine compliance Files are conformant to the required specifications. 3-1.04 [INP] with the required specifications. IN1.01 -1.02 This step scored on the Conformance Worksheet. This step performed outside of the demonstration. Page 41 of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts Select Document any other pertinent observations below: Test Result 170.314(b)(7) Data Portability Setup Guidance and Test Tool . Enter all test data provided for Encounters A and B for all 3 ONC- . Guidance from ICSA Labs supplied patients; Encounter C entered on test day . Edge Testing Tool (ETT) . Create at least 5 more patient records that each include the . TTT Google Groups Support Site or Email minimum test data for an export summary and at least 2 encounters

Step # Action to Perform Expected Outcome Ref ere Notes / Deviations nce TE1.0 1 Open the ONC-supplied patient record selected Test data for Encounters A and B were entered correctly 1-1.03 by the Proctor and display the test data entered and without omission. [INP] TE2.0 for Encounters A and B. 1-2.03 [AMB] Proctor documents the test patient used. TE1.0 2 Create a new encounter and enter the Encounter Encounter C test data is entered correctly and without 4-1.05 C test data provided for the patient selected at omission and incorporates the clinical values identified [INP] TE2.0 Step 1. by the Proctor. 4-2.05 [AMB] The clinical values in the test data that are italicized and bolded will be chosen by the Proctor.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE1.0 3 Open 5 more patient records and show that they A total of 5 patients are present in the EHR and include 6 [INP] include the minimum test data required for an the minimum test data for an export summary and TE2.0 export summary and a minimum of 2 encounters: include a minimum of 2 encounters. 6 [AMB] . Immunizations, . Encounter diagnoses, and . the Common MU Data Set and the following data elements: . Cognitive status . Functional status . Reason for referral [AMB] . Referring or transitioning provider’s name and office contact information [AMB] . Discharge instructions [INP] TE1.0 4 Electronically generate a set of export summaries The set of export summaries (e.g. batch export) for all 7 [INP] for all patients in the EHR, including the 6 patients patients in the EHR are electronically generated. The zip IN1.01 identified in Steps 1-3 according to the CCDA file containing only the 6 patients identified in Steps 1-3 [INP] TE2.0 standard and named vocabulary standards. is uploaded using the correct filename. 7 [AMB] IN2.01 Access the export summaries for the 6 patients [AMB] identified in Steps 1-3 and the b7 .txt file and zip them together per the instructions at Submitting Files on Test Day. Upload the zip file to ICSA Labs using the URL provided by the Proctor. Uploaded zip files must include the organization name and criterion number in the filename (e.g. b7_ABCompany).

Resubmissions during the same test session MUST modify the .zip filename to include the word ‘Retest’, as in b7_ABCompany_Retest1, b7_ABCompany_Retest2, etc.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE1.0 5 File validation performed to determine compliance Files are complete and accurate and are in conformance 8-1.11 with the required specifications against the ONC- with the CCDA specifications and the named vocabulary [INP] supplied test patient and at least 2 other standards for the ONC-supplied test patient and 2 other IN1.02 -1.04 summaries selected at random. test patients. [INP] TE2.0 8-2.11 This step performed outside of the demonstration. This step scored on the Conformance Worksheet. [AMB] IN2.02 -2.04 [AMB] Select Document any other pertinent observations below: Test Result 170.314(b)(5) Incorporate Lab Tests and Values/Results Setup Guidance and Test Tool . AMB: Create patient records based on the . Guidance from ICSA Labs demographics for each of the provided test data sets to . AMB: EHR Context-Based Validation Tool allow for linking/associating the LRI message . AMB: Google Groups Test Tool Support Site or Email . INP: Select 1 of the provided test data sets and create the message file to be used for this test procedure . INP: No test tool exists

Step # Action to Perform Expected Outcome Ref ere Notes / Deviations nce ☐ Steps 1-34 only performed by Ambulatory systems; Inpatient systems skip to Step 35 1 Notify Proctor which LRI profile will be used for Proctor documents the LRI profile being used. LRI Profile: [AMB] testing. Available options include: . GU/RU Proctor documents the test tool version. Test Tool v . GU/RN . NG/RU . NG/RN

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE1.0 2 Open the patient’s record to be used for Patient’s record does not include the incorporated lab 1 [AMB] incorporating the Final Sed Rate message and tests and values/results. show the Proctor that the lab tests and values/results are not yet incorporated.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE1.0 3 Open the EHR Context-Based Validation test tool, Test case is loaded and the message is sent to the 2-1.04 [AMB] load the test case for Final Sed Rate using the EHR. identified profile and send the message to the EHR directly from the tool’s “send” feature or by NOTE: If using the download/direct send method, the downloading the file and sending it directly to the system must be able to directly send the message to the system using another utility. EHR. It would not be permissible, for example, to download the message, open the patient’s record, and Auto-Send Instructions: manually upload/attach the message for incorporation. Some utility that directly sends the message (e.g. 1. Select GU or NG interface engine) must be used. 2. Select LRI_1_Sed_Rate 3. Select LRI_1.0_Sed_Rate 4. Select LRI_1.0-GU_Final (or NG) 5. If needed, enter PID.3 information on the ‘Configuration’ tab 6. Click ‘Select’ to load the test case 7. Click ‘Send’ and enter the required EHR Configuration information 8. Click ‘Start’ to send the message using MLLP over TCP/IP

Download/Direct Send Instructions: 1. Select GU or NG 2. Select LRI_1_Sed_Rate 3. Select LRI_1.0_Sed_Rate 4. Select LRI_1.0-GU_Final (or NG) 5. If needed, enter PID.3 information on the ‘Configuration’ tab 6. Click ‘Select’ to load the test case 7. Click ‘Save Message’ and save the file to the appropriate location on your computer 8. Send the message directly to the EHR using customer-defined utility

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE1.0 4 Demonstrate that the EHR received and Using the Juror Document, the Proctor verifies that the 5-1.07 [AMB] incorporated the lab tests and values/results: lab test results are complete and accurate, are displayed 1. Can be displayed in human-readable in human-readable format associated with the correct TE3.0 patient’s record or lab order, and using the Message 1 format; Or Content tab of the test tool verifies the LOINCs are valid TE3.0 2. Are attributed/linked/associated with the and correct. Juror Document and Message Content 2 patient’s record or laboratory order; and information can be found at: IN1.01 3. LOINCs are received and incorporated. 1. Select GU or NG IN3.01 2. Select LRI_1_Sed_Rate NOTE: The method for 3. Select LRI_1.0_Sed_Rate attributing/linking/associating can be manual or automated. 4. Select LRI_1.0-GU_Final (or NG) 5. Select ‘Juror Document’ tab or ‘Message Content’ tab TE2.0 5 From within the patient’s record or laboratory Using the Juror Document, the Proctor confirms that the 1-2.02 [AMB] order, display the received lab test and Lab Test Report is accurate and complete and includes IN2.01 values/results in a Lab Test Report. all of the following sections and information: . Patient’s name and ID number, or a unique patient ID and ID number . Name and address of the laboratory location where the test was performed . Test report date . Test performed . Specimen source, when appropriate . Test result and, if applicable, the units of measurement or interpretation, or both . Information on the condition and disposition of specimens that do not meet the laboratory’s criteria for acceptability, when appropriate TE1.0 6 Open the patient’s record to be used for Patient’s record does not include the incorporated lab 1 [AMB] incorporating the Corrected Sed Rate message tests and values/results. and show the Proctor that the lab tests and values/results are not yet incorporated.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE1.0 7 Open the EHR Context-Based Validation test tool, Test case is loaded and the message is sent to the 2-1.04 [AMB] load the test case for Corrected Sed Rate using EHR. the identified profile and send the message to the EHR directly from the tool’s “send” feature or by downloading the file and sending it directly to the system using another utility. TE1.0 8 Demonstrate that the EHR received and Using the Juror Document, the Proctor verifies that the 5-1.07 [AMB] incorporated the lab tests and values/results: lab test results are complete and accurate, are displayed 1. Can be displayed in human-readable in human-readable format associated with the correct TE3.0 patient’s record or lab order, and using the Message 1 format; Or Content tab of the test tool verifies the LOINCs are valid TE3.0 2. Are attributed/linked/associated with the and correct. 2 patient’s record or laboratory order; and IN1.01 3. LOINCs are received and incorporated. IN3.01

NOTE: The method for attributing/linking/associating can be manual or automated. TE2.0 9 From within the patient’s record or laboratory Using the Juror Document, the Proctor confirms that the 1-2.02 [AMB] order, display the received lab test and Lab Test Report is accurate and complete and includes IN2.01 values/results in a Lab Test Report. all of the following sections and information: . Patient’s name and ID number, or a unique patient ID and ID number . Name and address of the laboratory location where the test was performed . Test report date . Test performed . Specimen source, when appropriate . Test result and, if applicable, the units of measurement or interpretation, or both . Information on the condition and disposition of specimens that do not meet the laboratory’s criteria for acceptability, when appropriate TE1.0 10 Open the patient’s record to be used for Patient’s record does not include the incorporated lab 1 [AMB] incorporating the Rejected Sed Rate message tests and values/results. and show the Proctor that the lab tests and values/results are not yet incorporated.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE1.0 11 Open the EHR Context-Based Validation test tool, Test case is loaded and the message is sent to the 2-1.04 [AMB] load the test case for Rejected Sed Rate using EHR. the identified profile and send the message to the EHR directly from the tool’s “send” feature or by downloading the file and sending it directly to the system using another utility. TE1.0 12 Demonstrate that the EHR received and Using the Juror Document, the Proctor verifies that the 5-1.07 [AMB] incorporated the lab tests and values/results: lab test results are complete and accurate, are displayed 1. Can be displayed in human-readable in human-readable format associated with the correct TE3.0 patient’s record or lab order, and using the Message 1 format; Or Content tab of the test tool verifies the LOINCs are valid TE3.0 2. Are attributed/linked/associated with the and correct. 2 patient’s record or laboratory order; and IN1.01 3. LOINCs are received and incorporated. IN3.01

NOTE: The method for attributing/linking/associating can be manual or automated. TE2.0 13 From within the patient’s record or laboratory Using the Juror Document, the Proctor confirms that the 1-2.02 [AMB] order, display the received lab test and Lab Test Report is accurate and complete and includes IN2.01 values/results in a Lab Test Report. all of the following sections and information: . Patient’s name and ID number, or a unique patient ID and ID number . Name and address of the laboratory location where the test was performed [this item not sent from test tool, so may not appear in EHR] . Test report date . Test performed . Specimen source, when appropriate . Test result and, if applicable, the units of measurement or interpretation, or both . Information on the condition and disposition of specimens that do not meet the laboratory’s criteria for acceptability, when appropriate

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE1.0 14 Open the patient’s record to be used for Patient’s record does not include the incorporated lab 1 [AMB] incorporating the CBC message and show the tests and values/results. Proctor that the lab tests and values/results are not yet incorporated. TE1.0 15 Open the EHR Context-Based Validation test tool, Test case is loaded and the message is sent to the 2-1.04 [AMB] load the test case for CBC using the identified EHR. profile and send the message to the EHR directly from the tool’s “send” feature or by downloading the file and sending it directly to the system using another utility. TE1.0 16 Demonstrate that the EHR received and Using the Juror Document, the Proctor verifies that the 5-1.07 [AMB] incorporated the lab tests and values/results: lab test results are complete and accurate, are displayed 1. Can be displayed in human-readable in human-readable format associated with the correct TE3.0 patient’s record or lab order, and using the Message 1 format; Or Content tab of the test tool verifies the LOINCs are valid TE3.0 2. Are attributed/linked/associated with the and correct. 2 patient’s record or laboratory order; and IN1.01 3. LOINCs are received and incorporated. IN3.01

NOTE: The method for attributing/linking/associating can be manual or automated. TE2.0 17 From within the patient’s record or laboratory Using the Juror Document, the Proctor confirms that the 1-2.02 [AMB] order, display the received lab test and Lab Test Report is accurate and complete and includes IN2.01 values/results in a Lab Test Report. all of the following sections and information: . Patient’s name and ID number, or a unique patient ID and ID number . Name and address of the laboratory location where the test was performed . Test report date . Test performed . Specimen source, when appropriate . Test result and, if applicable, the units of measurement or interpretation, or both . Information on the condition and disposition of specimens that do not meet the laboratory’s criteria for acceptability, when appropriate

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE1.0 18 Open the patient’s record to be used for Patient’s record does not include the incorporated lab 1 [AMB] incorporating the Lipid Panel message and show tests and values/results. the Proctor that the lab tests and values/results are not yet incorporated. TE1.0 19 Open the EHR Context-Based Validation test tool, Test case is loaded and the message is sent to the 2-1.04 [AMB] load the test case for Lipid Panel using the EHR. identified profile and send the message to the EHR directly from the tool’s “send” feature or by downloading the file and sending it directly to the system using another utility. TE1.0 20 Demonstrate that the EHR received and Using the Juror Document, the Proctor verifies that the 5-1.07 [AMB] incorporated the lab tests and values/results: lab test results are complete and accurate, are displayed 1. Can be displayed in human-readable in human-readable format associated with the correct TE3.0 patient’s record or lab order, and using the Message 1 format; Or Content tab of the test tool verifies the LOINCs are valid TE3.0 2. Are attributed/linked/associated with the and correct. 2 patient’s record or laboratory order; and IN1.01 3. LOINCs are received and incorporated. IN3.01

NOTE: The method for attributing/linking/associating can be manual or automated. TE2.0 21 From within the patient’s record or laboratory Using the Juror Document, the Proctor confirms that the 1-2.02 [AMB] order, display the received lab test and Lab Test Report is accurate and complete and includes IN2.01 values/results in a Lab Test Report. all of the following sections and information: . Patient’s name and ID number, or a unique patient ID and ID number . Name and address of the laboratory location where the test was performed . Test report date . Test performed . Specimen source, when appropriate . Test result and, if applicable, the units of measurement or interpretation, or both . Information on the condition and disposition of specimens that do not meet the laboratory’s criteria for acceptability, when appropriate

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE1.0 22 Open the patient’s record to be used for Patient’s record does not include the incorporated lab 1 [AMB] incorporating the Culture and Susceptibility tests and values/results. Parent message and show the Proctor that the lab tests and values/results are not yet incorporated. TE1.0 23 Open the EHR Context-Based Validation test tool, Test case is loaded and the message is sent to the 2-1.04 [AMB] load the test case for Culture and Susceptibility EHR. Parent using the identified profile and send the message to the EHR directly from the tool’s “send” feature or by downloading the file and sending it directly to the system using another utility. TE1.0 24 Demonstrate that the EHR received and Using the Juror Document, the Proctor verifies that the 5-1.07 [AMB] incorporated the lab tests and values/results: lab test results are complete and accurate, are displayed 1. Can be displayed in human-readable in human-readable format associated with the correct TE3.0 patient’s record or lab order, and using the Message 1 format; Or Content tab of the test tool verifies the LOINCs are valid TE3.0 2. Are attributed/linked/associated with the and correct. 2 patient’s record or laboratory order; and IN1.01 3. LOINCs are received and incorporated. IN3.01

NOTE: The method for attributing/linking/associating can be manual or automated.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE2.0 25 From within the patient’s record or laboratory Using the Juror Document, the Proctor confirms that the 1-2.02 [AMB] order, display the received lab test and Lab Test Report is accurate and complete and includes IN2.01 values/results in a Lab Test Report. all of the following sections and information: . Patient’s name and ID number, or a unique patient ID and ID number . Name and address of the laboratory location where the test was performed . Test report date . Test performed . Specimen source, when appropriate . Test result and, if applicable, the units of measurement or interpretation, or both . Information on the condition and disposition of specimens that do not meet the laboratory’s criteria for acceptability, when appropriate TE1.0 26 Open the patient’s record to be used for Patient’s record does not include the incorporated lab 1 [AMB] incorporating the Culture and Susceptibility tests and values/results. Parent/Child message and show the Proctor that the lab tests and values/results are not yet incorporated. TE1.0 27 Open the EHR Context-Based Validation test tool, Test case is loaded and the message is sent to the 2-1.04 [AMB] load the test case for Culture and Susceptibility EHR. Parent/Child using the identified profile and send the message to the EHR directly from the tool’s “send” feature or by downloading the file and sending it directly to the system using another utility.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE1.0 28 Demonstrate that the EHR received and Using the Juror Document, the Proctor verifies that the 5-1.07 [AMB] incorporated the lab tests and values/results: lab test results are complete and accurate, are displayed 1. Can be displayed in human-readable in human-readable format associated with the correct TE3.0 patient’s record or lab order, and using the Message 1 format; Or Content tab of the test tool verifies the LOINCs are valid TE3.0 2. Are attributed/linked/associated with the and correct. 2 patient’s record or laboratory order; and IN1.01 3. LOINCs are received and incorporated. IN3.01

NOTE: The method for attributing/linking/associating can be manual or automated. TE2.0 29 From within the patient’s record or laboratory Using the Juror Document, the Proctor confirms that the 1-2.02 [AMB] order, display the received lab test and Lab Test Report is accurate and complete and includes IN2.01 values/results in a Lab Test Report. all of the following sections and information: . Patient’s name and ID number, or a unique patient ID and ID number . Name and address of the laboratory location where the test was performed . Test report date . Test performed . Specimen source, when appropriate . Test result and, if applicable, the units of measurement or interpretation, or both . Information on the condition and disposition of specimens that do not meet the laboratory’s criteria for acceptability, when appropriate TE1.0 30 Open the patient’s record to be used for Patient’s record does not include the incorporated lab 1 [AMB] incorporating the Reflex-Hepatitis message and tests and values/results. show the Proctor that the lab tests and values/results are not yet incorporated.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE1.0 31 Open the EHR Context-Based Validation test tool, Reflex-Hepatitis test case is loaded and the value for 2-1.03 [AMB] load the test case for Reflex-Hepatitis and OBX[4].5[1] is modified. change the observation value for OBX[4].5[1] from 0.40 to 0.50.

Click the Refresh button within the test tool before sending the message if using the test tool’s functions to perform the “send”. TE1.0 32 Send the message to the EHR directly from the Message is sent to the EHR. 4 [AMB] tool’s “send” feature or by downloading the file and sending it directly to the system using another utility. TE1.0 33 Demonstrate that the EHR received and Using the Juror Document, the Proctor verifies that the 5-1.07 [AMB] incorporated the lab tests and values/results: lab test results are complete and accurate, are displayed 1. Can be displayed in human-readable in human-readable format associated with the correct TE3.0 patient’s record or lab order, and using the Message 1 format; Or Content tab of the test tool verifies the LOINCs are valid TE3.0 2. Are attributed/linked/associated with the and correct. 2 patient’s record or laboratory order; and IN1.01 3. LOINCs are received and incorporated. Proctor confirms that the lab test result for Hepatitis B IN3.01 virus core Ab (Units/Volume) in Serum is 0.50. NOTE: The method for attributing/linking/associating can be manual or automated.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE2.0 34 From within the patient’s record or laboratory Using the Juror Document, the Proctor confirms that the 1-2.02 [AMB] order, display the received lab test and Lab Test Report is accurate and complete and includes IN2.01 values/results in a Lab Test Report. all of the following sections and information: . Patient’s name and ID number, or a unique patient ID and ID number . Name and address of the laboratory location where the test was performed . Test report date . Test performed . Specimen source, when appropriate . Test result and, if applicable, the units of measurement or interpretation, or both . Information on the condition and disposition of specimens that do not meet the laboratory’s criteria for acceptability, when appropriate ☐ Steps 35-37 only performed by Inpatient systems TE1.0 35 Notify the Proctor of the test data set to be used Proctor documents the test data set being used and the 1 [INP] for the test, and identify the structured format and structured format and messaging protocol. messaging protocol used to send lab tests and values/results messages to the EHR. TE1.0 36 Using the created file, incorporate the message Lab tests and values/results are incorporated into the 2-1.03 [INP] into the EHR and associate the lab test and EHR and associated with either the patient’s record or values/results into the correct patient’s record or laboratory order. TE3.0 lab order. 1 Or TE3.0 2 NOTE: The process for association may be

automated or manual. IN3.01

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE1.0 37 From within the patient’s record or laboratory Laboratory test results are associated with the correct 4-1.05 [INP] order, display the lab test and values/results. lab order or patient’s record, are displayed as discrete TE2.0 data elements in human-readable format, and display 1-2.02 correctly and without omission, including: IN1.01 IN2.01 . Patient’s name and ID number, or a unique patient ID and ID number . Name and address of the laboratory location where the test was performed . Test report date . Test performed . Specimen source, when appropriate . Test result, and if applicable, the units of measurement or interpretation, or both . Information on the condition and disposition of specimens that do not meet the lab’s criteria for acceptability, if applicable Select Document any other pertinent observations below: Test Result 170.314(f)(7) Transmission to Public Health Agencies – Syndromic Surveillance [Ambulatory Only – Optional] Setup ONC Test Guidance and Test Tool . Create a patient record and enter Data and . Guidance from ICSA Labs syndromic surveillance data Procedure . ONC Test Proc edur e Step # Action to Perform Expected Outcome Ref ere Notes / Deviations nce TE1.0 1 Open the patient’s record that contains syndromic The presence of syndromic surveillance data is 1 [AMB] surveillance data that was entered prior to the confirmed. test. Proctor documents the syndromic event.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE1.0 2 Generate the syndromic message for this patient, Syndromic surveillance message was generated for the 2-1.03 [AMB] then open the message, and display the appropriate patient. IN1.01 syndromic event. ☐ Steps 3-4 only performed by systems demonstrating the optional ability to electronically create syndromic surveillance data elements 3 Zip the file and then submit it to ICSA Labs. Syndromic surveillance message is submitted using [AMB] Include organization name and criterion number correct filename. [optional] in .zip filename (e.g. f7_ABCompany). TE2.0 4 File validation performed to determine whether The message contains the following required data 1 [AMB] the file contains the required data elements. elements: IN2.01 [optional] . Patient demographics This step performed outside of the demonstration. . Provider specialty . Provider address . Problem list . Vital signs . Laboratory test values/results . Procedure . Medication list . Insurance

This step scored on the Conformance Worksheet. Select Document any other pertinent observations below: Test Result

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts 170.314(a)(3) Demographics Setup Guidance . Create 3 shell patient records. NOTE: If any of the data elements . Guidance from ICSA Labs specified at Step 1 are Required fields in the system, you should NOT create these shell records in advance of the test. Instead you will create them live during the test in front of the Proctor. . Do not pre-enter any of the test data

Step # Action to Perform Expected Outcome Ref ere Notes / Deviations nce TE1.0 1 Select the first test patient and enter the provided Demographic data is entered correctly, without omission, 1-1.03 demographic test data. Demographic data must and in conformance with the standards for race, IN1.01 include: ethnicity, and preferred language. -1.02 . Preferred language: English (ISO 639-2 alpha 3 code: eng) . Sex: Female . Race: Native Hawaiian or Other Pacific Islander . Ethnicity: Not Hispanic or Latino . Date of birth: 03/30/1977 . Preliminary cause of death [INP only]: Cardiac Arrest

After entering the data, exit the screen.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE2.0 2 Access and display the demographics entered at Demographics are accessed and displayed correctly, 1-2.03 Step 1. without omission, and in conformance with the IN2.01 appropriate standards. IN2.03 IN3.01 Then change the demographic data to the -3.02 following: Demographics are changed correctly, without omission, . Preferred language: Declined to specify and in conformance with the standards for race, ethnicity, and preferred language. . Sex: Male . Race: Declined to specify . Ethnicity: Declined to specify . Date of birth: 09/17/1954 . Preliminary cause of death [INP only]: Head Trauma

After changing the data, exit the screen. TE3.0 3 Access and display the changed demographic Changed demographics are stored correctly, without 1-3.03 data. omission, and in conformance with the appropriate IN2.02 standards. IN3.01 -3.02 TE1.0 4 Select the second patient and enter the following Demographic data is entered correctly, without omission, 1-1.03 demographic data: and in conformance with the standards for race, IN1.01 -1.02 . Preferred language: Spanish (ISO 639-2 ethnicity, and preferred language. alpha 3 code: spa) . Sex: Male When the alpha-3 codes for Preferred Language (e.g. spa, eng, fra) are not displayed in the user interface, the . Race: Black or African American and mapping of the code to the description are confirmed White elsewhere (e.g. database table). . Ethnicity: Hispanic or Latino . Date of birth: 08/31/1938 At least 2 races can be recorded for the patient and are . Preliminary cause of death [INP only]: in accordance with OMB standards. “Multiracial” may not be used to indicate more than one race. Head Trauma

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE2.0 5 Access and display the demographics entered at Demographics are accessed and displayed correctly, 1-2.03 Step 4. without omission, and in conformance with the IN2.01 appropriate standards. IN2.03 IN3.01 Then change the demographic data to the -3.02 following: Demographics are changed correctly, without omission, . Preferred language: Japanese (ISO and in conformance with the standards for race, 639-2 alpha 3 code: jpn) ethnicity, and preferred language. . Sex: Female . Race: Asian . Ethnicity: Not Hispanic or Latino . Date of birth: 02/24/1974 . Preliminary cause of death [INP only]: Cardiac Arrest

After changing the data, exit the screen. TE3.0 6 Access and display the changed demographic Changed demographics are stored correctly, without 1-3.03 data. omission, and in conformance with the appropriate IN2.02 standards. IN3.01 -3.02 TE1.0 7 Select the third patient and enter the following Demographic data is entered correctly, without omission, 1-1.03 demographic data: and in conformance with the standards for race, IN1.01 -1.02 . Preferred language: Declined to specify ethnicity, and preferred language. . Sex: Female . Race: Declined to specify . Ethnicity: Declined to specify . Date of birth: 04/07/1980 . Preliminary cause of death [INP only]: Medication Overdose

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE2.0 8 Access and display the demographics entered at Demographics are accessed and displayed correctly, 1-2.03 Step 7. without omission, and in conformance with the IN2.01 appropriate standards. IN2.03 IN3.01 Then change the demographic data to the -3.02 following: Demographics are changed correctly, without omission, . Preferred language: French (ISO 639-2 and in conformance with the standards for race, alpha 3 code: fra) ethnicity, and preferred language. . Sex: Male At least 2 races can be stored for the patient and are in . Race: American Indian or Alaska Native accordance with OMB standards. “Multiracial” may not and White be used to indicate more than one race. . Ethnicity: Not Hispanic or Latino . Date of birth: 05/24/1964 . Preliminary cause of death [INP only]: Cerebrovascular Accident

After changing the data, exit the screen. TE3.0 9 Access and display the changed demographic Changed demographics are stored correctly, without 1-3.03 data. omission, and in conformance with the appropriate IN2.02 standards. IN3.01 -3.02 ☐ Steps 10-11 performed only if the EHR permits the collection of additional race/ethnicity categories 10 Prior to the test, attestation is submitted to ICSA Documentation is received by ICSA Labs and provided IN1.03 [conditional] Labs documenting the additional race/ethnicity to the Proctor. categories available within the EHR and how those additional categories are mapped to the This step performed outside of the demonstration. minimum OMB race/ethnicity categories.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts 11 Show how the additional race and ethnicity Additional race/ethnicity categories are mapped to the IN1.03 [conditional] categories are mapped to the minimum race and minimum OMB race and ethnicity categories and ethnicity categories. matches the submitted documentation: Race . American Indian or Alaska Native . Asian . Black or African American . Native Hawaiian or Other Pacific Islander . White Ethnicity . Hispanic or Latino . Not Hispanic or Latino Select Document any other pertinent observations below: Test Result

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts 170.314(a)(17) Advance Directives [Inpatient Only] Setup O Guidance . Create a patient record N . Guidance from ICSA Labs . Have available the advance directive C indicator/content T e s t D a t a

P r o c e d u r e . Cu

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts Step # Action to Perform Expected Outcome Ref ere Notes / Deviations nce TE1.0 1 Select a patient and enter the advance directive Advance directive indicator/content is entered correctly 1-1.03 [INP] indicator/content. and without omission. IN1.01 Exit the record after the advance directive indicator/content is entered. 2 Display the advance directive indicator/content The advance directive indicator/content is stored within IN1.02 [INP] within the patient’s record. the patient’s record and displays correctly and without omission. Select Document any other pertinent observations below: Test Result 170.314(a)(4) Vital Signs, Body Mass Index, and Growth Charts [Growth Charts Optional] Setup Guidance . Create 1 male and 1 female patient record . Guidance from ICSA Labs . Growth charts: enter data sets 1-2 for 1 male patient and data sets 3-4 for 1 female patient

Step # Action to Perform Expected Outcome Ref ere Notes / Deviations nce TE(i)1. 1 Select a patient and enter non-numerical vitals for Non-numerical vitals are not recorded. 01- height/length, weight, and blood pressure. 1.02

Exit the vital signs entry screen. TE(i)1. 2 Attempt to access and display the vitals entered Non-numerical vitals were not recorded. 03 at Step 1.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE(i)1. 3 Enter height/length, weight, and blood pressure Vital signs are entered correctly and without omission. 04- from the provided test data set selected by the 1.06 Proctor. IN(i)1. Units of measure for height/length and weight were 01- 1.02 displayed or selected at the time of entry. Exit the vital signs entry screen. Proctor documents test data set used and system of measurement (e.g. English, Metric). IN(i)1. 4 Access and display the vitals entered at Step 3. Vital signs display correctly and without omission. 03

Appropriate units of measure display. TE(i)2. 5 Change the vital signs for height/length, weight, Vital signs are changed correctly and without omission. 01- and blood pressure using the provided test data. 2.03 TE(ii)1 Units of measure for height/length and weight were .01- 1.03 Display the BMI. displayed or selected at the time of the change. IN(i)2. 01- 2.02 Exit the vital signs entry screen. BMI is automatically calculated correctly. IN(ii)1. 01- 1.03 TE(i)3. 6 Access and display the vital signs. Changed vital signs are stored correctly and without 01- omission. 3.02 IN(i)2. 03 IN(i)3. Appropriate units of measure display. BMI electronically 01- displays without omission or error. 3.02 ☐ Steps 7-12 only performed if the EHR is demonstrating Growth Charts TE(iii) 7 Select the male patient record and display the The 2 data points were entered correctly and without 1.01- [optional] pre-entered test data points and the gender and omission, are stored correctly in the record, and the 1.03 age to the Proctor. units of measure appropriate for the height and weight IN(iii)1 .01- display (or were confirmed as a selection option when 1.04 entering height/length and weight at Steps 3 and 5).

The gender and age display within the patient’s record. TE(iii) 8 Display the growth chart for height and age. Height and age are plotted accurately and display on the 1.04 [optional] appropriate growth chart (male). IN(III)1 .05- 1.06

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE(iii) 9 Display the growth chart for weight and age. Weight and age are plotted accurately and display on 1.04 [optional] the appropriate growth chart (male). IN(iii)1 .05 IN(iii)1 .07 TE(iii) 10 Select the female patient record and display the The 2 data points are entered correctly and without 1.01- [optional] pre-entered test data points and the gender and omission, are stored correctly in the record, and the 1.03 age to the Proctor. units of measure appropriate for the height and weight IN(iii)1 .01- display (or were confirmed as a selection option when 1.04 entering height/length and weight at Steps 3 and 5).

The gender and age display within the patient’s record. TE(iii) 11 Display the growth chart for height and age. Height and age are plotted accurately and display on the 1.04 [optional] appropriate growth chart (female). IN(iii)1 .05 IN(iii)1 .08 TE(iii) 12 Display the growth chart for weight and age. Weight and age are plotted accurately and display on 1.04 [optional] the appropriate growth chart (female). IN(iii)1 .05 IN(iii)1 .09 Select Document any other pertinent observations below: Test Result

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts Setup ONC Guidance . Create a patient record Test . Guidance from ICSA Labs Data and Proced ure . O N C

T e s t D a t a - R e f o r m a tt e d . O N C

T e s t D a t a Page 69 of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts Step # Action to Perform Expected Outcome Ref ere Notes / Deviations nce TE1.0 1 Select a patient record and enter the 3 Immunization test data is entered correctly and without 1-1.03 immunizations from the test data set selected by omission. IN1.01 the Proctor. Proctor documents the test data set. Exit the immunization screen. TE3.0 2 Access and display the immunization data Immunization data is displayed correctly and without 1-3.02 entered at Step 1. omission. IN1.02 IN3.01 TE2.0 3 Change the previously entered immunization data Immunization data is changed correctly and without 1-2.03 using the provided test data. omission. IN2.01

Exit the immunization screen. TE3.0 4 Access and display the immunization data Revised immunization data is displayed correctly and 1-3.02 changed at Step 3. without omission. IN2.02 IN3.01 Select Document any other pertinent observations below: Test Result

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts 170.314(f)(5) Cancer Case Information [Ambulatory Only--Optional] Setup ONC Test Guidance . Create a patient record Data and . Guidance from ICSA Labs Procedure . ONC Test Data - Refor matte d . ONC Test Data - Origi nal . ONC Test Proc edur e Step # Action to Perform Expected Outcome Ref ere Notes / Deviations nce TE1.0 1 Select a patient record and enter the cancer case Cancer case test data is entered correctly and without 1-1.03 [AMB] data from the test data set selected by the omission. IN1.01 Proctor. Proctor documents the test data set. Exit the screen. 2 Access and display the cancer case data entered Cancer case data is displayed correctly and without IN1.02 TE3.0 [AMB] at Step 1. omission. 1-3.02 IN3.01

TE2.0 3 Change the previously entered cancer case data Cancer case data is changed correctly and without 1-2.03 [AMB] using the provided test data. omission. IN2.01

Exit the screen.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts 4 Access and display the cancer case data Revised cancer case data is displayed correctly and IN2.02 TE3.0 [AMB] changed at Step 3. without omission. 1-3.02 IN3.01 Select Document any other pertinent observations below: Test Result 170.314(a)(11) Smoking Status Setup ONC Test Guidance . Create a patient record Data and . Guidance from ICSA Labs Procedure . ONC Test Proc edur e Step # Action to Perform Expected Outcome Ref ere Notes / Deviations nce TE2.0 1 Select a patient and enter the patient’s smoking Smoking status and associated SNOMED-CT code are 1-2.02 status as ‘Heavy tobacco smoker’, which has an recorded correctly and without omission. associated SNOMED-CT code of IN2.01 428071000124103. -2.02 When the SNOMED-CT code is not displayed in the user interface, the mapping of the code to the Exit the smoking status screen. description is confirmed elsewhere (e.g. database table). 2 Access and display the smoking status entered at Previously recorded smoking status and associated IN2.03 Step 1. SNOMED-CT code are displayed correctly prior to TE3.0 modification. 1-3.03

Change it to ‘Light tobacco smoker’, which has an IN3.01 associated SNOMED-CT code of Smoking status and associated SNOMED-CT code are 428061000124105. changed correctly and without omission.

Exit the smoking status screen.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE3.0 3 Access and display the smoking status entered at Previously recorded smoking status and associated 2-3.03 Step 2. SNOMED-CT code are displayed correctly prior to modification. IN3.01 -3.02 Change it to ‘Current every day smoker’, which has an associated SNOMED-CT code of Smoking status and associated SNOMED-CT code are 449868002. changed correctly and without omission.

Exit the smoking status screen. TE3.0 4 Access and display the smoking status entered at Previously recorded smoking status and associated 2-3.03 Step 3. SNOMED-CT code are displayed correctly prior to modification. IN3.01 -3.02 Change the smoking status to ‘Current some day smoker’, which has an associated SNOMED-CT Smoking status and associated SNOMED-CT code are code of 428041000124106. changed correctly and without omission.

Exit the smoking status screen. TE3.0 5 Access and display the smoking status entered at Previously recorded smoking status and associated 2-3.03 Step 4. SNOMED-CT code are displayed correctly prior to modification. IN3.01 -3.02 Change the smoking status to ‘Former smoker’, which has an associated SNOMED-CT code of Smoking status and associated SNOMED-CT code are 8517006. changed correctly and without omission.

Exit the smoking status screen. TE3.0 6 Access and display the smoking status entered at Previously recorded smoking status and associated 2-3.03 Step 5. SNOMED-CT code are displayed correctly prior to modification. IN3.01 -3.02 Change the smoking status to ‘Never smoker’, which has an associated SNOMED-CT code of Smoking status and associated SNOMED-CT code are 266919005. changed correctly and without omission.

Exit the smoking status screen.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE3.0 7 Access and display the smoking status entered at Previously recorded smoking status and associated 2-3.03 Step 6. SNOMED-CT code are displayed correctly prior to modification. IN3.01 -3.02 Change the smoking status to ‘Smoker, current status unknown’, which has an associated Smoking status and associated SNOMED-CT code are SNOMED-CT code of 77176002. changed correctly and without omission.

Exit the smoking status screen. TE3.0 8 Access and display the smoking status entered at Previously recorded smoking status and associated 2-3.03 Step 7. SNOMED-CT code are displayed correctly prior to modification. IN3.01 -3.02 Change it to ‘Unknown if ever smoked’, which has an associated SNOMED-CT code of 266927001. Smoking status and associated SNOMED-CT code are changed correctly and without omission. Exit the smoking status screen. TE3.0 9 Access and display the smoking status entered at Previously recorded smoking status and associated 2-3.03 Step 8. SNOMED-CT code are displayed correctly prior to modification. IN3.01 -3.02 Change it to ‘Heavy tobacco smoker’, which has an associated SNOMED-CT code of Smoking status and associated SNOMED-CT code are TE1.0 1 428071000124103. changed correctly and without omission. IN1.01

Exit the smoking status screen. TE4.0 10 Access the current smoking status of the patient. Smoking status and associated SNOMED-CT code are 1-4.02 displayed correctly and without omission. IN4.01 Select Document any other pertinent observations below: Test Result

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts 170.314(a)(13) Family Health History Setup ONC Test Guidance . Create a patient record Data and . Guidance from ICSA Labs Procedure . Cust omer must creat e their own test data . ONC Test Proc edur e Step # Action to Perform Expected Outcome Ref ere Notes / Deviations nce 1 Notify the Proctor whether SNOMED-CT or HL7 Proctor documents whether SNOMED-CT or HL7 Pedigree will be used. Pedigree is used. TE1.0 2 Select a patient and enter the patient’s family Family health history data is entered correctly as 1-1.03 health history data for first-degree family structured data, without omission, and in conformance members: with the named standard for: IN1.01 . Parents; . Parents; . Offspring; and . Offspring; and . Siblings . Siblings

The data must be structured and include the NOTE: Family health history data includes both the relationship to the patient. condition and the familial relationship and as such both must be entered as structured data. After entering the data, exit the screen. 3 Access and display the family health history data Family health history data is displayed correctly, without IN1.02 entered at Step 2. omission, and in conformance with the standard.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE2.0 4 Change the health history data for each family Family health history data is changed correctly, without 1-2.03 member. omission, and in conformance with the named standard. IN2.01 After changing the data, exit the screen. 5 Access and display the family health history data. Changed family health history data is stored correctly, IN2.02 TE3.0 displayed correctly, without omission, and in 1— conformance with the named standard. 3.02 IN3.01 Select Document any other pertinent observations below: Test Result 170.314(a)(5) Problem List Setup Guidance . AMB: Create a male patient record with at least 3 encounters by the same . Guidance from ICSA Labs provider over a multiple month timeframe and record problems using customer-supplied test data . INP: Create a female patient with an existing record over the entire duration of a hospital stay and record problems using customer-supplied test data

Step # Action to Perform Expected Outcome Ref ere Notes / Deviations nce 1 Open the patient’s record and show the Proctor Patient record includes problems within the required that the patient has problems recorded: timeframe. . AMB: for at least 3 encounters by the same provider over a multiple month timeframe; OR . INP: over the duration of a hospital stay

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE1.0 2 Record problem list data from the provided test Problem list data including code, status, and dates are 1-1.03 data set using IHTSDO SNOMED-CT and US entered correctly, without omission, and in conformance [AMB] Extension to SNOMED-CT codes. with the named standards. IN1.01 -1.02 [AMB] TE4.0 Exit the problem list screen. 1-4.03 [INP] IN4.01 -4.02 [INP] IN1.03 3 Access and display the problems entered at Step Previously entered problems are stored correctly, [AMB] 2. without omission, and in conformance with the named IN4.03 standards. [INP] TE2.0 4 Change the previously entered problem list data Problems are changed correctly and without omission. 1-2.03 using the provided test data. [AMB] IN2.01 [AMB] TE5.0 Exit the problem list screen. 1-5.03 [INP] IN5.01 [INP] IN2.02 5 Access and display the problems changed at Step Changed problems are stored correctly and in [AMB] 4. conformance with the named standards. IN5.02 [INP] TE3.0 6 Access and display the active problem list. Active problem list displays correctly, without omission, 1 and in conformance with the named standards. [AMB] TE3.0 3 [AMB] IN3.01 [AMB] TE6.0 1 [INP] TE6.0 3 [INP] IN6.01 [INP] TE3.0 7 Access and display the patient problem history. Patient problem history displays correctly, without 2 omission, in conformance with the named standards, [AMB] and includes active and historical problems. TE3.0 3 [AMB] IN3.02 [AMB] TE6.0 2 [INP] TE6.0 3 [INP] IN6.02 [INP]

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts Select Document any other pertinent observations below: Test Result 170.314(a)(6) Medication List Setup Guidance . Create a patient record with medications entered for at least 3 . Guidance from ICSA Labs encounters with the same provider over a multiple month timeframe (AMB) or over the entire duration of a hospital visit (INP)

Step # Action to Perform Expected Outcome Ref ere Notes / Deviations nce 1 Open the patient’s record and show the Proctor Patient record includes medications within the required that the patient has medications recorded: timeframe. . AMB: for at least 3 encounters by the same provider over a multiple month timeframe; OR . INP: over the duration of a hospital stay TE1.0 2 Select a patient and enter active medication data Active medication data is entered correctly and without 1-1.03 from the provided test data set for the relevant omission. [AMB] IN1.01 care setting (AMB or INP). [AMB] TE4.0 1-4.03 Exit the medication screen. [INP] IN4.01 [INP] IN1.02 3 Access and display the medications entered at Previously entered medications are stored correctly in [AMB] Step 2. the patient’s record. IN4.02 [INP]

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE2.0 4 Change the previously entered medication list Medications are changed correctly and without omission. 1-2.03 using the provided test data. [AMB] IN2.01 [AMB] TE5.0 Exit the medication screen. 1-5.03 [INP] IN5.01 [INP] IN2.02 5 Access and display the medications changed at Changed medications are stored correctly and without [AMB] Step 4. omission. IN5.02 [INP] TE3.0 6 Access and display the active medication list. Active medication list displays correctly and without 1 omission. [AMB] TE3.0 3 [AMB] IN3.01 [AMB] TE6.0 1 [INP] TE6.0 3 [INP] IN6.01 [INP] TE3.0 7 Access and display the medication history. Medication history displays correctly, without omission 2-3.03 and includes active and discontinued medications. [AMB] IN3.02 [AMB] TE6.0 2-6.03 [INP] IN6.02 [INP] Select Document any other pertinent observations below: Test Result

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts 170.314(a)(10) Drug-Formulary Checks Setup ONC Test Guidance . Create a patient record Data and . Guidance from ICSA Labs Procedure . ONC Test Data - Refor matte d . ONC Test Data - Origi nal . ONC Test Proc edur e Step # Action to Perform Expected Outcome Ref ere Notes / Deviations nce TE1.0 1 Select a patient and enter 1 drug from the Drug data is entered correctly and without omission. 1-1.03 provided test data set selected by the Proctor. IN1.01 A drug check against a drug formulary or preferred drug -1.02 Demonstrate that it is automatically and list is automatically and electronically performed, and the electronically checked against a drug formulary or results are displayed to the user. preferred drug list. Proctor documents drug(s) used. Select Document any other pertinent observations below: Test Result

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts 170.314(a)(16) eMAR [Inpatient Only] Setup Guidance . Create the patient records for and input all of the provided test data . Guidance from ICSA Labs . Generate materials needed by the assistive technology for patient ID purposes (e.g. patient ID bar codes)

Step # Action to Perform Expected Outcome Ref ere Notes / Deviations nce NTP1. 1 Network Time Protocol (NTP) test. This step observed and scored as part of the NTP test 01- [INP] procedure. 1.06 TE1.0 2 Open the first patient’s record using the data set Medication orders are entered correctly and without 1 [INP] selected by the Proctor and display the omission. medication orders that were pre-entered. Proctor documents test data set used. TE1.0 3 Open the second patient’s record using the data Medication orders are entered correctly and without 1 [INP] set selected by the Proctor at Step 2 and display omission. the medication orders that were pre-entered. 4 Demonstrate how the materials needed by the Materials needed by the assistive technology are [INP] assistive technology for identification of the generated. patients and the medications are generated. TE1.0 5 Sign on as a user with eMAR authorization and The eMAR is accessed and displayed. 2 [INP] access and display the eMAR for the first test patient.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE1.0 6 For the first patient, administer the medications EHR assistive technology correctly and accurately 3-1.05 [INP] and demonstrate how the EHR assistive verifies the right patient and the right medication, dose, IN1.01 technology is used to determine that the right route, and time for each medication administered. patient is identified and to verify the following for TE2.0 1 each medication order: Using the system clock, the Proctor documents the User . Medication is the right medication based ID, date and time that the medication administration on the medication order; information was verified and/or submitted to the patient’s . Dose matches the dose information in the record for each medication administered. medication order; . Route matches the route information in the medication order; and . Current time matches the time indicated for the medication being administered in the medication order. TE2.0 7 Display the date, time, and user ID for each The system-generated dates, times and user IDs match 2 [INP] medication administered at Step 6 that was those recorded by the Proctor in Step 6. electronically, automatically, and simultaneously recorded. TE1.0 8 Select the second test patient and using EHR Using EHR assistive technology, an automated “wrong 6 [INP] assistive technology, generate a “wrong patient” patient” message appears during the eMAR verification automated message during the eMAR verification process. IN1.02 process.

Example: Patient ID barcode does not match the patient for whom the eMAR is being displayed. TE1.0 9 Select the second test patient and demonstrate EHR assistive technology automatically provides an alert 7 [INP] how the EHR assistive technology generates an about a wrong medication, wrong dose, wrong route, IN1.03 automated alert during the electronic medication and wrong time. administration verification process for: . Wrong medication . Wrong dose . Wrong route . Wrong time 10 Select the first test patient and display the eMAR. Medication administration data that was IN2.01 [INP] verified/submitted at Step 6 is stored correctly and without omission and in the correct patient’s record.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts Select Document any other pertinent observations below: Test Result 170.314(a)(7) Medication Allergy List Setup Guidance . Create a patient record with medication allergies entered for at . Guidance from ICSA Labs least 3 encounters with the same provider over a multiple month timeframe (AMB) or over the entire duration of a hospital visit (INP)

Step # Action to Perform Expected Outcome Ref ere Notes / Deviations nce 1 Open the patient’s record and show the Proctor Patient record includes medication allergies within the that the patient has medication allergies recorded required timeframe. for: . AMB: at least 3 encounters by the same provider over a multiple month timeframe; OR . INP: over the duration of a hospital stay TE1.0 2 Select a patient and enter medication allergy list Medication allergy list data is entered correctly and 1-1.03 data from the provided test data for the relevant without omission. [AMB] IN1.01 care setting (AMB or INP). [AMB] TE4.0 1-4.03 Exit the allergy screen. [INP] IN4.01 [INP] IN1.02 3 Access and display the medication allergies Previously entered medication allergies are stored [AMB] entered at Step 2. correctly in the patient’s record. IN4.02 [INP]

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE2.0 4 Change the previously entered medication allergy Medication allergies are changed correctly and without 1-2.03 list data using the provided test data. omission. [AMB] IN2.01 [AMB] TE5.0 Exit the allergy screen. 1-5.03 [INP] IN5.01 [INP] IN2.02 5 Access and display the medication allergies Changed medication allergies are stored correctly and [AMB] changed at Step 4. without omission. IN5.02 [INP] TE3.0 6 Access and display the active medication allergy Active medication allergy list displays correctly and 1 list. without omission. [AMB] TE3.0 3 [AMB] IN3.01 [AMB] TE6.0 1 [INP] TE6.0 3 [INP] IN6.01 [INP] TE3.0 7 Access and display the medication allergy history Medication allergy history list, including both active and 2-3.03 list. inactive allergies, displays correctly and without [AMB] omission. IN3.02 [AMB] TE6.0 2 [INP] IN6.02 [INP] Select Document any other pertinent observations below: Test Result 170.314(a)(2) Drug-Drug, Drug-Allergy Interaction Checks Setup Guidance . Create a patient record . Guidance from ICSA Labs . Identify the combination of medications and medication allergies that will be used to generate the notifications . Identify 1 user with rights to adjust drug-drug interactions . Identify 1 clinical user with rights to prescribe medications . Record the allergy

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts Step # Action to Perform Expected Outcome Ref ere Notes / Deviations nce TE2.0 1 Sign on as a user with the ability to adjust the Authorized users are permitted to adjust the severity 1-2.02 severity level of drug-drug interactions. level for drug-drug interactions. IN2.01 -2.02 Adjust the severity level to allow all drug-drug The severity level is adjusted to allow all drug-drug notifications to be triggered. notifications to be triggered.

Sign off after changes have been made. TE2.0 2 Sign on as a user who does not have the ability to The unauthorized user is unable to adjust the drug-drug 3

adjust the severity level of drug-drug interactions. interactions. IN2.01 -2.02

Demonstrate how the unauthorized user is unable to adjust the drug-drug interactions. TE1.0 3 Select a patient. Display the medications and The medications and medication allergy have been 1-1.04 medication allergy data entered for the patient. entered for the patient. IN1.01 -1.02 Using CPOE, enter new medication orders. Upon entering new medication orders, one drug-drug Notifications are triggered and displayed for the interaction with a low significance, one drug-drug TE2.0 4-2.05 following: interaction with a high significance, and one drug-allergy . One drug-drug interaction with a low notification are electronically and automatically IN2.03 significance (e.g. Protonix and Argesic generated before the order is completed and acted SA) upon, based upon information in the patient’s medication and medication allergy list. . One drug-drug interaction with a high significance (e.g. Coumadin and Rufen) . One drug-allergy interaction (e.g. Sulfonamides and Bactrim) TE2.0 4 Sign on as a user with the ability to adjust the The severity level is adjusted to allow only high 6 severity level of drug-drug interactions and adjust significance drug-drug notifications to be triggered. the severity level to allow only high significance IN2.02 drug-drug notifications to be triggered. TE2.0 5 Using the same patient and combination of Notification is triggered and displayed for the high 7-2.08 medications/medication allergies used at Step 3, significance drug-drug interaction and the drug-allergy use CPOE to enter new medication orders. interaction, but is not triggered for the low significance IN2.03 drug-drug interaction.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts Select Document any other pertinent observations below: Test Result 170.314(a)(8) Clinical Decision Support Setup Guidance . Create patient record(s) that meets the criteria to trigger the CDS . Guidance from ICSA Labs interventions and diagnostic/therapeutic reference resources . Create one or more CDS interventions based on problems, medications, medication allergies, demographics, lab tests and values/results, and vital signs . Create a CCDA that includes medications, medication allergies, and problems that will trigger CDS interventions and ensure those interventions are setup . AMB: Create a lab message that will trigger CDS interventions and ensure those interventions are setup Step # Action to Perform Expected Outcome Ref ere Notes / Deviations nce TE1.0 1 Log in as a user with the ability to configure CDS Login successful. 1 interventions and diagnostic and therapeutic TE4.0 reference resources and the ability to activate 1 TE4.0 CDS interventions (e.g. system admin). 5 TE4.0 2 Configure at least one CDS intervention and one CDS interventions and diagnostic and therapeutic 2 diagnostic and therapeutic reference resource references resources can be configured based on a TE4.0 based on a user’s clinical role (e.g. triggered for a user’s clinical role. 6 physician, but not triggered for a nurse or office IN4.01 staff).

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE1.0 3 Activate/enable CDS interventions based on data CDS interventions are activated based on each of the 2 from each one of and at least one combination of required categories separately and one combination TE1.0 data from 2 or more of the following data from two or more categories. 4 categories: IN1.01 . Problem list Proctor documents the timeframe associated with the . Medication list activation of each CDS intervention. . Medication allergy list . Demographics . Laboratory tests and values/results . Vital signs 4 Demonstrate that the EHR recorded the status Proctor verifies that the status and timing of the IN1.02 and timing of the activated CDS interventions activated CDS interventions match actions taken in Step (e.g. by viewing a log or report). 3.

Logout. Logout successful. TE4.0 5 Log in as a user without the ability to configure Login successful. 9 CDS interventions and diagnostic and therapeutic reference resources or activate CDS interventions. TE4.0 6 Attempt to configure CDS interventions and CDS interventions and diagnostic and therapeutic 9 diagnostic and therapeutic reference resources references resources cannot be configured. based on a user’s clinical role. TE1.0 7 Attempt to activate/enable CDS interventions CDS interventions cannot be activated by non- 3 based on the categories and combinations authorized users. described at Step 3. Logout successful. Logout. TE2.0 8 Log in as a user whose clinical role has been Login successful. 1 configured to allow triggering of CDS TE4.0 interventions and diagnostic and therapeutic 3 TE4.0 references resources (e.g. physician). 7 TE5.0 1 TE5.0 5

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE2.0 9 Select a patient and demonstrate that the CDS CDS interventions are electronically identified and 2-2.03 interventions are identified and triggered based triggered automatically and electronically based on each IN2.01 on data from each one of the following categories of the required categories separately and one IN2.04 and at least one combination of data from two or combination from two or more categories. TE4.0 3 more of the categories: IN4.02 . Problem list TE5.0 2 . Medication list . Medication allergy list . Demographics . Laboratory tests and values/results . Vital signs TE5.0 10 Access an evidence-based CDS intervention At least 1 evidence-based CDS intervention is accessed 2-5.04 using one of the required data categories from based on the required data categories and the attributes IN5.01 Step 9 and review the following attributes: are displayed correctly and without omission. . Bibliographic citation (clinical research/guideline); . Developer (translation from clinical research/guideline); . Funding source of the technical implementation; . Release; and . Revision date, if applicable TE5.0 11 Access 1 diagnostic and therapeutic reference At least 1 linked referential CDS is accessed based on 6-5.08 resource using one of the required data the required data categories and the attributes are IN5.02 categories from Step 9 and review the following displayed correctly and without omission. attributes: . Developer, and . Bibliographic citation (clinical research/guideline), where clinically indicated

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE2.0 12 Electronically incorporate a CCDA into the One or more CDS interventions are triggered 4-2.05 patient’s record that contains: automatically and electronically based on data found IN2.02 . Medications within the newly incorporated: IN2.04 . Medication allergies . Medications, . Problems . Medication allergies, and . Problems ☐ Step 13 only performed by Ambulatory systems TE2.0 13 Electronically incorporate an HL7 v2.5.1 lab One or more CDS interventions are triggered 6-2.07 [AMB] message (must use LOINC and IG: S&I automatically and electronically based on data found IN2.03 Framework LRI) into the patient’s record as within the newly incorporated lab tests and -2.04 structured data. values/results. Steps 14-18 performed by all systems TE3.0 14 Using either the Infobutton standard or a general Using the Infobutton standard or a general capability 1-3.02 capability within the EHR, access diagnostic and within the EHR, diagnostic and therapeutic reference IN3.01 therapeutic reference information based on data information is accessed based on each of the required TE4.0 from each of the following categories: categories separately and 1 combination of data from 2 7 IN4.03 or more of the required categories. . Problem list TE5.0 6 . Medication list Proctor documents the Implementation Guide if the . Laboratory tests and values/results Infobutton standard is used.

And based on at least 1 combination of data from 2 or more of the following categories: . Problem list . Medication list . Medication allergy list . Demographics . Laboratory tests and values/results . Vital signs

If using the Infobutton standard, specify the Implementation Guide: . URL-Based Implementations . Service-Oriented Architecture

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE5.0 15 Using CPOE, enter new medication orders. Upon entering new medication orders, one drug-drug 9-5.10 Notifications are triggered and displayed for the interaction and one drug-allergy notification are following: electronically and automatically generated based on the . One drug-drug interaction (e.g. Coumadin patient’s medication list or medication allergy list and Rufen) respectively, before a medication order is completed and acted upon during CPOE. . One drug-allergy interaction (e.g. Sulfonamides and Bactrim) TE5.1 16 Review the drug-drug and drug-allergy interaction The attributes for a drug-drug and a drug-allergy 1-5.12 source attributes including: interaction are displayed correctly and without omission. IN5.03 . Developer, and . Bibliographic citation (clinical research/guideline), where clinically indicated TE4.0 17 Log in as a user whose clinical role does not Login successful. 4 allow triggering of CDS interventions or access to TE4.0 diagnostic and therapeutic reference resources 8 (e.g. office staff). TE4.0 18 Open the same patient record and attempt to CDS interventions cannot be triggered and diagnostic 4 trigger CDS interventions and access diagnostic and therapeutic reference resources cannot be TE4.0 and therapeutic references resources. accessed. 8 Select Document any other pertinent observations below: Test Result 170.314(a)(15) Patient-Specific Education Resources Setup Guidance . Create a patient record with problems, medications and . Guidance from ICSA Labs lab results populated

Step # Action to Perform Expected Outcome Ref ere Notes / Deviations nce

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts 1 Specify which Implementation Guide is used for Proctor documents the Implementation Guide used. the Infobutton standard: . URL-Based Implementations . Service-Oriented Architecture TE1.0 2 Select a patient and electronically identify Education resources are electronically identified, patient- 1-1.03 education resources based on the patient’s specific, and based on the patient’s problem list using IN1.01 problem list using: Infobutton and one other EHR function. . Infobutton standard; and . 1 other EHR function TE1.0 3 Select a patient and electronically identify Education resources are electronically identified, patient- 1-1.03 education resources based on the patient’s specific, and based on the patient’s medication list using IN1.01 medication list using: Infobutton and one other EHR function. . Infobutton standard; and . 1 other EHR function 4 Select a patient and electronically identify Education resources are electronically identified, patient- TE1.0 specific, and based on the patient’s lab tests and 1-1.03 education resources based on the patient’s lab IN1.01 tests and values/results using: values/results using Infobutton and one other EHR function. . Infobutton standard; and . 1 other EHR function Select Document any other pertinent observations below: Test Result

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts 170.314(a)(1) Computerized Provider Order Entry Setup ONC Test Guidance . Create a patient record Data and . Guidance from ICSA Labs Procedure . ONC Test Data - Refor matte d . ONC Test Data - Origi nal . ONC Test Proc edur e Step # Action to Perform Expected Outcome Ref ere Notes / Deviations nce TE1.0 1 Select a patient and enter medication, lab, and Orders are entered correctly and without omission. 1-1.03 imaging orders appropriate to the domain being [AMB] tested (AMB or INP), using the test data set IN1.01 Proctor documents test data set. [AMB] selected by Proctor. TE4.0 1-4.03 [INP] IN4.01 After entering the orders, exit the order entry [INP] screen. IN1.02 2 Access and display the orders entered at Step 1. Orders are recorded correctly and without omission. [AMB] IN4.02 [INP]

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE2.0 3 Change the medication, lab, and imaging orders Orders are changed correctly and without omission. 1-2.03 using the provided test data. [AMB] IN2.01 [AMB] TE5.0 After changing the orders, exit the order entry 1-5.03 screen. [INP] IN5.01 [INP] IN2.02 4 Access and display the revised order data. Revised order data are displayed correctly and without [AMB] omission. TE3.0 1-3.02 [AMB] IN3.01 [AMB] IN5.02 [INP] TE6.0 1-6.02 [INP] IN6.01 [INP] Select Document any other pertinent observations below: Test Result

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts 170.314(a)(18) CPOE – Medications [Optional] Setup ONC Test Guidance and Test Tool . Create a patient record Data and . Guidance from ICSA Labs Procedure . ONC Test Data - Refor matte d . ONC Test Data - Origi nal . ONC Test Proc edur e Step # Action to Perform Expected Outcome Ref ere Notes / Deviations nce TE1.0 1 Select a patient and enter medication orders Orders are entered correctly and without omission. 1-1.03 appropriate to the domain being tested (AMB or [AMB] INP), using the test data set selected by Proctor. IN1.01 Proctor documents test data set. [AMB] TE4.0 1-4.03 After entering the orders, exit the order entry [INP] IN4.01 screen. [INP] IN1.02 2 Access and display the orders entered at Step 1. Orders are recorded correctly and without omission. [AMB] IN4.02 [INP]

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE2.0 3 Change the medication orders using the provided Orders are changed correctly and without omission. 1-2.03 test data. [AMB] IN2.01 [AMB] TE5.0 After changing the orders, exit the order entry 1-5.03 screen. [INP] IN5.01 [INP] IN2.02 4 Access and display the revised order data. Revised order data are displayed correctly and without [AMB] omission. TE3.0 1-3.02 [AMB] IN3.01 [AMB] IN5.02 [INP] TE6.0 1-6.02 [INP] IN6.01 [INP] Select Document any other pertinent observations below: Test Result

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts 170.314(a)(19) CPOE – Laboratory [Optional] Setup ONC Test Guidance and Test Tool . Create a patient record Data and . Guidance from ICSA Labs Procedure . ONC Test Data - Refor matte d . ONC Test Data - Origi nal . ONC Test Proc edur e Step # Action to Perform Expected Outcome Ref ere Notes / Deviations nce TE1.0 1 Select a patient and enter lab orders appropriate Orders are entered correctly and without omission. 1-1.03 to the domain being tested (AMB or INP), using [AMB] the test data set selected by Proctor. IN1.01 Proctor documents test data set. [AMB] TE4.0 1-4.03 After entering the orders, exit the order entry [INP] IN4.01 screen. [INP] IN1.02 2 Access and display the orders entered at Step 1. Orders are recorded correctly and without omission. [AMB] IN4.02 [INP]

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE2.0 3 Change the lab orders using the provided test Orders are changed correctly and without omission. 1-2.03 data. [AMB] IN2.01 [AMB] TE5.0 After changing the orders, exit the order entry 1-5.03 screen. [INP] IN5.01 [INP] IN2.02 4 Access and display the revised order data. Revised order data are displayed correctly and without [AMB] omission. TE3.0 1-3.02 [AMB] IN3.01 [AMB] IN5.02 [INP] TE6.0 1-6.02 [INP] IN6.01 [INP] Select Document any other pertinent observations below: Test Result

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts 170.314(a)(20) CPOE – Diagnostic Imaging [Optional] Setup ONC Test Guidance and Test Tool . Create a patient record Data and . Guidance from ICSA Labs Procedure . ONC Test Data - Refor matte d . ONC Test Data - Origi nal . ONC Test Proc edur e Step # Action to Perform Expected Outcome Ref ere Notes / Deviations nce TE1.0 1 Select a patient and enter imaging orders Orders are entered correctly and without omission. 1-1.03 appropriate to the domain being tested (AMB or [AMB] INP), using the test data set selected by Proctor. IN1.01 Proctor documents test data set. [AMB] TE4.0 1-4.03 After entering the orders, exit the order entry [INP] IN4.01 screen. [INP] IN1.02 2 Access and display the orders entered at Step 1. Orders are recorded correctly and without omission. [AMB] IN4.02 [INP]

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE2.0 3 Change the imaging orders using the provided Orders are changed correctly and without omission. 1-2.03 test data. [AMB] IN2.01 [AMB] TE5.0 After changing the orders, exit the order entry 1-5.03 screen. [INP] IN5.01 [INP] IN2.02 4 Access and display the revised order data. Revised order data are displayed correctly and without [AMB] omission. TE3.0 1-3.02 [AMB] IN3.01 [AMB] IN5.02 [INP] TE6.0 1-6.02 [INP] IN6.01 [INP] Select Document any other pertinent observations below: Test Result 170.314(a)(12) Image Results Setup Guidance . Create a patient record with the imaging results for 2 or more . Guidance from ICSA Labs radiological or diagnostic tests, including one with an image and associated narrative interpretation and the other with only an image

Step # Action to Perform Expected Outcome Ref ere Notes / Deviations nce TE1.0 1 Select a patient and demonstrate how the system The system electronically indicates the availability of the 1-1.03 indicates the availability of a radiological or other image and associated narrative interpretation. IN1.01 diagnostic image and the associated narrative interpretation. TE1.0 2 Demonstrate how the system indicates the The system electronically indicates the availability of an 4-1.05 availability of an image that has no narrative image that has no narrative available. IN1.01 interpretation.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE2.0 3 Access and display the images and narrative The images and narrative interpretations are accessed 1-2.05 interpretations from Steps 1 and 2. within the EHR system OR via a context-sensitive link to IN2.01 an external application that provides access to images -2.02 and their narratives OR via a context-sensitive link to an external application that provides access to narrative interpretations stored within the EHR.

The images and narrative interpretations are accessed without requiring additional patient lookup/selection or test/study selection. Select Document any other pertinent observations below: Test Result 170.314(b)(4) Clinical Information Reconciliation Setup Guidance . Create a patient record and enter the test data for two . Guidance from ICSA Labs medication lists, two problems lists, and two medication allergy lists using the provided test data

Step # Action to Perform Expected Outcome Ref ere Notes / Deviations nce TE1.0 1 Select a patient and display the two medication Two medication lists from 2 different sources are 1-1.03 lists at the same time including: displayed correctly and in a single view on the screen. IN1.01 -1.02 . Source of the medication list . Last date each medication was Each medication list displays the required information. documented, ordered, prescribed, refilled or edited TE2.0 2 Merge the two medication lists into a single Two medication lists have been merged into a single 1 reconciled medication list. reconciled medication list. IN2.01

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE2.0 3 Consolidate the identical medication, Insulin Two or more identical medications are consolidated and 2 Glargine (Lantus), from the two lists so that it is represented only one time on the single reconciled IN2.02 represented only one time on the single medication list. reconciled medication list.

NOTE: This step may have been accomplished through the reconciliation process. TE2.0 4 Remove Metoprolol Tartrate from the single The removed medication does not appear on the single 3 reconciled medication list. reconciled medication list. IN2.03

NOTE: This step may be accomplished prior to Step 2 (e.g. excluding the medication from the reconciliation process). TE2.0 5 Display the reconciled medication list. The reconciled medication list displays correctly and 4 without omission. The two medication lists have been IN2.01 merged into a single reconciled medication list, the -2.03 TE3.0 identical medications are consolidated and represented 1 only one time, and the removed medication does not appear. TE3.0 6 Confirm and submit the reconciled medications to The reconciled medications are submitted to the 2 the patient’s active medication list. patient’s active medication list. TE3.0 7 Display the patient’s active medication list. The active medication list displays correctly and includes 3 the newly reconciled medications. IN3.01

NOTE: Last modification date is not required to display TE4.0 8 Select a patient and display the two problem lists Two problem lists from 2 different sources are displayed 1-4.03 at the same time including: correctly and in a single view on the screen. IN4.01 -4.02 . Source of the problem list . Last date each problem was documented Each problem list displays the required information. or edited TE5.0 9 Merge the two problem lists into a single Two problem lists have been merged into a single 1 reconciled problem list. reconciled problem list. IN5.01

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE5.0 10 Consolidate the identical problem, Benign Two or more identical problems are consolidated and 2 Prostatic Hyperplasia, from the two lists so that represented only one time on the single reconciled IN5.02 it is represented only one time on the single problem list. reconciled problem list.

NOTE: This step may have been accomplished through the reconciliation process. TE5.0 11 Remove Atrial Fibrillation from the single The removed problem does not appear on the single 3 reconciled problem list. reconciled problem list. IN5.03

NOTE: This step may be accomplished prior to Step 9 (e.g. excluding the problem from the reconciliation process). TE5.0 12 Display the reconciled problem list. The reconciled problem list displays correctly and 4 without omission. The two problem lists have been IN5.01 merged into a single reconciled problem list, the identical -5.03 TE6.0 problems are consolidated and represented only one 1 time, and the removed problem does not appear. TE6.0 13 Confirm and submit the reconciled problems to The reconciled problems are submitted to the patient’s 2 the patient’s active problem list. active problem list. TE6.0 14 Display the patient’s active problem list. The active problem list displays correctly and includes 3 the newly reconciled problems. IN6.01

NOTE: Last modification date is not required to display TE7.0 15 Select a patient and display the two medication Two medication allergy lists from 2 different sources are 1-7.03 allergy lists from the test data at the same time displayed correctly and in a single view on the screen. IN7.01 including: -7.02 . Source of the medication allergy list Each medication allergy list displays the required . Last date each medication allergy was information. documented, edited or updated TE8.0 16 Merge the two medication allergy lists into a Two medication allergy lists have been merged into a 1 single reconciled medication allergy list. single reconciled medication allergy list. IN8.01

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE8.0 17 Consolidate the identical medication allergy, Two or more identical medication allergies are 2 Penicillin, from the two lists so that it is consolidated and represented only one time on the IN8.02 represented only one time on the single single reconciled medication allergy list. reconciled medication allergy list.

NOTE: This step may have been accomplished through the reconciliation process. TE8.0 18 Remove Carbamazepine from the single The removed medication allergy does not appear on the 3 reconciled medication allergy list. single reconciled medication allergy list. IN8.03

NOTE: This step may be accomplished prior to Step 16 (e.g. excluding the medication allergy from the reconciliation process). TE8.0 19 Display the reconciled medication allergy list. The reconciled medication allergy list displays correctly 4 and without omission. The two medication allergy lists IN8.01 have been merged into a single reconciled medication -8.03 TE9.0 allergy list, the identical medication allergies are 1 consolidated and represented only one time, and the removed medication allergy does not appear. TE9.0 20 Confirm and submit the reconciled medication The reconciled medication allergies are submitted to the 2 allergies to the patient’s active medication allergy patient’s active medication allergy list. list. TE9.0 21 Display the patient’s active medication allergy list. The active medication allergy list displays correctly and 3 includes the newly reconciled medication allergies. IN9.01

NOTE: Last modification date is not required to display Select Document any other pertinent observations below: Test Result

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts 170.314(b)(9) Clinical Information Reconciliation and Incorporation [Optional] Setup Guidance and Test Tool . Create a patient record and enter the test data for two medication . Guidance from ICSA Labs lists, two problems lists, and two medication allergy lists using the provided test data . Create 2 Transition of Care/Referral Summary CCDA documents; one for the patient for whom the test data was entered in the above Setup step and one for a patient that does not exist in the EHR

Step # Action to Perform Expected Outcome Ref ere Notes / Deviations nce TE1.0 1 Receive a Transition of Care/Referral Summary The Transition of Care/Referral Summary is not matched 3 for a patient that does not exist in the EHR. to a patient’s record. IN1.01 TE1.0 2 Receive a Transition of Care/Referral Summary The Transition of Care/Referral Summary is received 1-1.02 for the patient for whom the test data was pre- and matched to the correct patient’s record. IN1.01 entered, and demonstrate that it is matched to the correct patient’s record. TE2.0 3 Display two medication lists in a single view. One Two medication lists from 2 different sources are 1-2.03 source must be the TOC/Referral Summary from displayed correctly and accurately, and in a single view IN2.01 Step 2. on the screen, including: -2.02 . Source of the medication list . Last date each medication was documented, ordered, prescribed, refilled or edited

One of the sources is the TOC/Referral Summary from Step 2. TE3.0 4 Merge the two medication lists into a single Two medication lists have been merged into a single 1 reconciled medication list. reconciled medication list. IN3.01

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE3.0 5 Consolidate the identical medication, Insulin Two or more identical medications are consolidated and 2 Glargine (Lantus), from the two lists so that it is represented only one time on the single reconciled IN3.02 represented only one time on the single medication list. reconciled medication list.

NOTE: This step may have been accomplished through the reconciliation process. TE3.0 6 Remove Metoprolol Tartrate from the single The removed medication does not appear on the single 3 reconciled medication list. reconciled medication list. IN3.03

NOTE: This step may be accomplished prior to Step 4 (e.g. excluding the medication from the reconciliation process). TE3.0 7 Display the reconciled medication list. The reconciled medication list displays accurately and 4 completely. The two medication lists have been merged IN3.01 into a single reconciled medication list, the identical -3.03 TE4.0 medications are consolidated and represented only one 1 time, and the removed medication does not appear. TE4.0 8 Confirm and incorporate the reconciled The reconciled medications are incorporated into the 2 medications into the patient’s active medication patient’s active medication list in structured data format. list. TE4.0 9 Display the patient’s active medication list. The active medication list displays correctly and 3 accurately, and includes the newly reconciled IN4.01 medications in structured data format and RxNorm -4.02 coded data.

NOTE: Last modification date is not required to display TE5.0 10 Display two problem lists in a single view. One Two problem lists from 2 different sources are displayed 1-5.03 source must be the TOC/Referral Summary from correctly and accurately, and in a single view on the IN5.01 Step 2. screen, including: -5.02 . Source of the problem list . Last date each problem was documented or edited

One of the sources is the TOC/Referral Summary from Step 2.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE6.0 11 Merge the two problem lists into a single Two problem lists have been merged into a single 1 reconciled problem list. reconciled problem list. IN6.01 TE6.0 12 Consolidate the identical problem, Benign Two or more identical problems are consolidated and 2 Prostatic Hyperplasia, from the two lists so that represented only one time on the single reconciled IN6.02 it is represented only one time on the single problem list. reconciled problem list.

NOTE: This step may have been accomplished through the reconciliation process. TE6.0 13 Remove Atrial Fibrillation from the single The removed problem does not appear on the single 3 reconciled problem list. reconciled problem list. IN6.03

NOTE: This step may be accomplished prior to Step 11 (e.g. excluding the problem from the reconciliation process). TE6.0 14 Display the reconciled problem list. The reconciled problem list displays accurately and 4 completely. The two problem lists have been merged IN6.01 into a single reconciled problem list, the identical -6.03 TE7.0 problems are consolidated and represented only one 1 time, and the removed problem does not appear. TE7.0 15 Confirm and incorporate the reconciled problems The reconciled problems are incorporated into the 2 into the patient’s active problem list. patient’s active problem list in structured data format. TE7.0 16 Display the patient’s active problem list. The active problem list displays correctly and accurately, 3 and includes the newly reconciled problems in structured IN7.01 data format and SNOMED-CT coded data. -7.02

NOTE: Last modification date is not required to display TE8.0 17 Display two medication allergy lists in a single Two medication allergy lists from 2 different sources are 1-8.03 view. One source must be the TOC/Referral displayed correctly and accurately, and in a single view IN8.01 Summary from Step 2. on the screen, including: -8.02 . Source of the medication allergy list . Last date each medication allergy was documented, edited, or updated

One of the sources is the TOC/Referral Summary from Step 2.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE9.0 18 Merge the two medication allergy lists into a Two medication allergy lists have been merged into a 1 single reconciled medication allergy list. single reconciled medication allergy list. IN9.01 TE9.0 19 Consolidate the identical medication allergy, Two or more identical medication allergies are 2 Penicillin, from the two lists so that it is consolidated and represented only one time on the IN9.02 represented only one time on the single single reconciled medication allergy list. reconciled medication allergy list.

NOTE: This step may have been accomplished through the reconciliation process. TE9.0 20 Remove Carbamazepine from the single The removed medication allergy does not appear on the 3 reconciled medication allergy list. single reconciled medication allergy list. IN9.03

NOTE: This step may be accomplished prior to Step 18 (e.g. excluding the medication allergy from the reconciliation process). TE9.0 21 Display the reconciled medication allergy list. The reconciled medication allergy list displays accurately 4 and completely. The two medication allergy lists have IN9.01 been merged into a single reconciled medication allergy -9.03 TE10. list, the identical medication allergies are consolidated 01 and represented only one time, and the removed medication allergy does not appear. TE10. 22 Confirm and incorporated the reconciled The reconciled medication allergies are incorporated into 02 medication allergies into the patient’s active the patient’s active medication allergy list in structured medication allergy list. data format. TE10. 23 Display the patient’s active medication allergy list. The active medication allergy list displays correctly and 03 accurately, and includes the newly reconciled IN10.0 medication allergies in structured data format and 1- 10.02 RxNorm coded data.

NOTE: Last modification date is not required to display Select Document any other pertinent observations below: Test Result

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts 170.314(a)(9) Electronic Notes Setup ONC Test Guidance . Create a patient record Data and . Guidance from ICSA Labs Procedure . ONC Test Data - Refor matte d . ONC Test Data - Origi nal . ONC Test Proc edur e Step # Action to Perform Expected Outcome Ref ere Notes / Deviations nce TE1.0 1 Select a patient and enter the following notes: Electronic notes are captured correctly and without 1-1.03 Note 1 omission. IN1.01 Patient denies nausea and has not vomited, but is experiencing anorexia. Bowel movements are normal in color and consistency. The patient has had no fever or chills and has had no weight loss. Note 2 Patient has had a cholecystectomy and an appendectomy. Patient has a history of recurring urinary bladder infections.

Exit the electronic notes screen.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts 2 Access and display the electronic notes entered Electronic notes are stored in the patient’s record IN1.02 at Step 1. correctly and without omission. TE2.0 3 Change the electronic notes: Electronic notes are changed correctly and without 1-2.03 Note 1 omission. IN2.01 . Replace “denies” with “is complaining of” . Remove “not” . Replace “but is” with “and is also” Note 2 . Add “, but has had no bladder infections in the past 12 months” after “infections”

After changing the electronic notes, exit the screen.

4 Access and display the revised electronic notes. Revised electronic notes are displayed correctly and IN2.02 TE3.0 without omission: 1-3.02 Note 1 IN3.01 Patient is complaining of nausea and has vomited, and is also experiencing anorexia. Bowel movements are normal in color and consistency. The patient has had no fever or chills and has had no weight loss. Note 2 Patient has had a cholecystectomy and an appendectomy. Patient has a history of recurring urinary bladder infections, but has had no bladder infections in the past 12 months. TE4.0 5 Using the single word provided by the Proctor The word is found in the electronic note. 1-4.03 that exists within the electronic note, search for TE4.0 the specific data within Note 1. 5 If the EHR technology searches across multiple notes, IN4.01 the result must identify individual note(s) in the result set that meet the search criteria. TE4.0 6 Using the group of words provided by the The words are found in the electronic note. 1-4.03 Proctor that exist within the electronic note, TE4.0 search for the specific data within Note 1. 5 If the EHR technology searches across multiple notes, IN4.01 the result must identify individual note(s) in the result set that meet the search criteria.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE4.0 7 Using the single word provided by the Proctor The word is not found in the electronic note. 4-4.05 that does not exist within the electronic note, IN4.02 search for the specific data within Note 1. If the EHR technology searches across multiple notes, the result must identify individual note(s) in the result set that meet the search criteria.

8 Using the group of words provided by the The words are not found in the electronic note. TE4.0 4-4.05 Proctor that do not exist within the electronic note, IN4.02 search for the specific data within Note 1. If the EHR technology searches across multiple notes, the result must identify individual note(s) in the result set that meet the search criteria. TE4.0 9 Using the single word provided by the Proctor The word is not found in the electronic note. 6-4.08 that does not exist within the electronic note, IN4.02 search for the specific data within Note 2. If the EHR technology searches across multiple notes, the result must identify individual note(s) in the result set that meet the search criteria. TE4.0 10 Using the group of words provided by the The words are not found in the electronic note. 6-4.08 Proctor that do not exist within the electronic note, IN4.02 search for the specific data within Note 2. If the EHR technology searches across multiple notes, the result must identify individual note(s) in the result set that meet the search criteria. Select Document any other pertinent observations below: Test Result 170.314(a)(14) Patient List Creation Setup Guidance . Create patient record data to populate the patient lists, . Guidance from ICSA Labs ensuring that at least two patients populate each list

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE1.0 1 Create a list of patients by timeframe and based The selected list for the Problem List category is 1 on data elements included in the Problem List. accessed by timeframe, is based on the named data [AMB] elements, is accurate and complete, and is selected TE1.0 3 electronically and dynamically. [AMB] IN1.01 [AMB] TE3.0 1-3.02 [AMB] IN3.01 [AMB] TE4.0 1 [INP] TE4.0 3 [INP] IN4.01 [INP] TE6.0 1-6.02 [INP] IN6.01 [INP] TE2.0 2 Sort the list based on data elements included in List is sorted by timeframe and data elements contained 1-2.03 the Problem List and by timeframe. in the Problem List. [AMB] IN2.01 [AMB] TE5.0 1-5.03 [INP] IN5.01 [INP] TE1.0 3 Create a list of patients by timeframe and based The selected list for the Medication List category is 1 on data elements included in the Medication accessed by timeframe, is based on the named data [AMB] List. elements, is accurate and complete, and is selected TE1.0 3 electronically and dynamically. [AMB] IN1.01 [AMB] TE3.0 1-3.02 [AMB] IN3.01 [AMB] TE4.0 1 [INP] TE4.0 3 [INP] IN4.01 [INP] TE6.0 1-6.02 [INP] IN6.01 [INP]

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE2.0 4 Sort the list based on data elements included in List is sorted by timeframe and data elements contained 1-2.03 the Medication List and by timeframe. in the Medication List. [AMB] IN2.01 [AMB] TE5.0 1-5.03 [INP] IN5.01 [INP] TE1.0 5 Create a list of patients by timeframe and based The selected list for the Medication Allergy List category 1 on data elements included in the Medication is accessed by timeframe, is based on the named data [AMB] Allergy List. elements, is accurate and complete, and is selected TE1.0 3 electronically and dynamically. [AMB] IN1.01 [AMB] TE3.0 1-3.02 [AMB] IN3.01 [AMB] TE4.0 1 [INP] TE4.0 3 [INP] IN4.01 [INP] TE6.0 1-6.02 [INP] IN6.01 [INP] TE2.0 6 Sort the list based on data elements included in List is sorted by timeframe and data elements contained 1-2.03 the Medication Allergy List and by timeframe. in the Medication Allergy List. [AMB] IN2.01 [AMB] TE5.0 1-5.03 [INP] IN5.01 [INP]

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE1.0 7 Create a list of patients by timeframe and based The selected list for the Demographics category is 1 on data elements included in Demographics. accessed by timeframe, is based on the named data [AMB] elements, is accurate and complete, and is selected TE1.0 3 electronically and dynamically. [AMB] IN1.01 [AMB] TE3.0 1-3.02 [AMB] IN3.01 [AMB] TE4.0 1 [INP] TE4.0 3 [INP] IN4.01 [INP] TE6.0 1-6.02 [INP] IN6.01 [INP] TE2.0 8 Sort the list based on data elements included in List is sorted by timeframe and data elements contained 1-2.03 the Demographics and by timeframe. in the Demographics. [AMB] IN2.01 [AMB] TE5.0 1-5.03 [INP] IN5.01 [INP] TE1.0 9 Create a list of patients by timeframe and based The selected list for the Lab Tests and Values/Results 1 on data elements included in Lab Tests and category is accessed by timeframe, is based on the [AMB] Values/Results. named data elements, is accurate and complete, and is TE1.0 3 selected electronically and dynamically. [AMB] IN1.01 [AMB] TE3.0 1-3.02 [AMB] IN3.01 [AMB] TE4.0 1 [INP] TE4.0 3 [INP] IN4.01 [INP] TE6.0 1-6.02 [INP] IN6.01 [INP]

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE2.0 10 Sort the list based on data elements included in List is sorted by timeframe and data elements contained 1-2.03 Lab Tests and Values/Results and by timeframe. in Lab Tests and Values/Results. [AMB] IN2.01 [AMB] TE5.0 1-5.03 [INP] IN5.01 [INP] ☐ Steps 11-12 only performed by Ambulatory systems TE1.0 11 Create a list of patients by timeframe and based The selected list for the Patient Communication 1 [AMB] on data elements included in Patient Preferences category is accessed by timeframe, is TE1.0 Communication Preferences. based on the named data elements, is accurate and 3 complete, and is selected electronically and dynamically. IN1.01 TE3.0 1-3.02 IN3.01 TE2.0 12 Sort the list based on data elements included in List is sorted by timeframe and data elements contained 1-2.03 [AMB] Patient Communication Preferences and by in Patient Communication Preferences. IN2.01 timeframe. Steps 13-14 performed by all systems TE1.0 13 Create a list of patients by timeframe and based The selected list is accessed by timeframe, is based on 2-1.03 on a combination of at least two categories. a combination of the two categories, is accurate and IN1.01 Options include: complete, and is selected electronically and dynamically. TE3.0 1-3.02 . Problem list IN3.01 TE4.0 . Medication list 2-4.03 [INP] . Medication allergy list IN4.01 [INP] . Demographics TE6.0 1-6.02 . Lab tests and values/results [INP] IN6.01 . Patient communication preferences [INP] [AMB] TE2.0 14 Sort the list based on the data elements included List is sorted by timeframe and data elements contained 1-2.03 in the two categories selected and by timeframe. in the two categories selected. IN2.01 TE5.0 1-5.03 [INP] IN5.01 [INP] Select Document any other pertinent observations below: Test Result

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts Test Script – Security Focus NTP Test [170.314(a)(16) eMAR; 170.314(d)(2) Auditable Events and Tamper-Resistance; and 170.314(e)(1) View, Download, and Transmit to 3rd Party] Setup Guidance . Verify NTP network traffic (UDP port 123) to and from the EHR is . Guidance from ICSA Labs permitted . Ensure time is set manually . Configure system time to be out of sync by approximately 1-2 minutes from the desired time server . Verify initial clock skew does not exceed the sanity limit Step # Action to Perform Expected Outcome Ref ere Notes / Deviations nce 1 Identify the EHR technology server or servers The EHR technology servers that apply the required responsible for applying the timestamps for the timestamps are identified. following applicable scenarios. NTP conformance must be demonstrated independently on all servers used to apply the required timestamps: . 170.314(a)(16) eMAR [Inpatient Only] – When a medication is administered . 170.314(d)(2) Auditable Events and Tamper-Resistance – When a log event is written to the audit log . 170.314(e)(1) View, Download, and Transmit to 3rd Party – When a log event is written to the patient accessible audit log NTP1. 2 Identify the protocol used for synchronizing the Proctor documents the protocol used. 01 NTP version: EHR system clock.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts NTP1. 3 Choose a time server and add it to the NTP Time server is added to the NTP software configuration 02- software configuration (if not already configured), and NTP service is started. 1.03 then start the NTP service. The Proctor may elect to continue to other test Wait until time synchronization occurs. If procedures while waiting for synchronization to occur, synchronization does not occur within 15 minutes, and then return to complete NTP testing after an check the settings and try again. appropriate amount of time has passed. NTP1. 4 Using the NTP logs, demonstrate that the system System time and NIST time server are synchronized to 04 time is within five second accuracy of the NIST within five seconds using http://time.gov/ to verify NIST NTP1. time server chosen. time. 06 NTP1. 5 Display the current time from the system clock. System clock is synchronized to within five seconds of 05- NIST time server. 1.06 NTP1. 6 Display the current time from the EHR interface. The EHR interface is synchronized to within five 05- seconds of NIST time server. 1.06 Select Document any other pertinent observations below: Test Result

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts 170.314(e)(1) View, Download, and Transmit to 3rd Party Setup Guidance and Test Tool . Attestation identifying the encryption algorithm and corresponding key . Guidance from ICSA Labs length, hashing algorithm, and authentication method, and WCAG must . Direct Certificate Discovery Tool (DCDT) be submitted prior to scheduling test date . DCDT Google Groups Support Site or Email . Create a patient record and enter all test data for the appropriate care setting . Edge Testing Tool (ETT) . [INP] Prepare a minimum of 2 documents for download and . ETT Google Groups Support Site or Email transmission – Patient Summary and Transition of Care/Referral . Certificate Thumbprints for Test Tools Summary . [AMB] Prepare a minimum of 1 document for download and transmission – Patient Summary . Create and install certificates to be used for Direct testing . From the Discovery page of the DCDT, download and import the DCDT’s Trust Anchor into the EHR’s trust store . From the Direct Testing page of the ETT, download and import the ETT's Public Key Certificate and Trust Anchor into the EHR’s trust store . If demonstrating edge protocols, register a login on the ETT using the instructions provided in the Edge Testing Tool User Guide . If demonstrating edge protocols using SMTP Test Cases, create and save all necessary profiles, enable SMTP Authentication Required on the EHR, and enable logging of the authentication method used to verify PLAIN SASL usage Step # Action to Perform Expected Outcome Ref ere Notes / Deviations nce NTP1. 1 Network Time Protocol (NTP) test. This step observed and scored as part of the NTP test 01- procedure. 1.06

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts 2 Verbally confirm the encryption algorithm and Proctor documents the encryption algorithm and Encryption: corresponding key length, hashing algorithm, and corresponding key length, hashing algorithm, and Hash: the authentication method to be used as specified authentication method and verifies they are compliant Auth method: in your 2014 Edition Attestation. with FIPS 140-2 Annex A and match the values provided via attestation.

Note: All functionality required for this criterion must be accessed using the encryption, hashing, and authentication methods identified here. 3 Proctor selects one web page from those The results in conformance testing of the web page IN5.04 Webpage: previously identified via the submitted WCAG selected are comparable to the documentation and Tool: attestation materials. conformance testing results provided at attestation.

Scan the web page selected using the applicable Proctor documents the web page and conformance tool test tool(s) also identified in the WCAG selected. attestation. Note: All functionality required for this criterion must be accessed using the web pages previously identified via the submitted WCAG attestation materials. 4 Identify a patient authorized to access their Proctor documents the authorized patient's name and Pt name: records online and their User ID for login. User ID for login. User ID: 5 Identify a patient representative authorized to Proctor documents the authorized patient Pt rep name: access the online records of the patient identified representative's name and User ID for login. User ID: in Step 4 and their User ID for login. 6 Identify a user who is not authorized to access the Proctor documents the unauthorized user's name and Unauth name: online records of the patient identified in Step 4 User ID for login. User ID: and their User ID for login. Identify the non-Direct (Contact) email address to Proctor documents the non-Direct (Contact) email be used to receive the results emails sent from address to be used for the Direct tests. the DCDT and ETT. Note: All results emails must be sent to an email account that is accessible on the presenter’s screen during testing. 8 Identify the Direct (From) address and registered Proctor documents the Direct (From) address and domain that will be used by the EHR to send registered domain to be used for the Direct tests. Direct messages to the DCDT and ETT.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE3.0 9 Register the Direct (To) addresses (specified on The Direct (To) addresses are stored within the EHR, 6 the ETT home page) in the EHR (to be available displayed as visible Direct addresses, and are available IN3.02 as a recipient for sending of Direct messages as a recipient for sending of Direct messages within the within the Patient Portal). EHR. TE3.0 10 Identify the DCDT's Trust Anchor in the EHR’s The DCDT's Trust Anchor is stored in the EHR's trust 1 trust store. store.

Proctor validates the thumbprints when possible. 11 Identify the ETT's Public Key Certificate and Trust The ETT's Public Key Certificate and Trust Anchor are Anchor in the EHR’s trust store. stored in the EHR's trust store.

Proctor validates the thumbprints when possible. 12 Identify the EHR's signing certificate to be used to EHR's signing certificate is identified. sign message content with its Private Key and to provide the Public Key in messages sent to the ETT. TE1.0 13 Log on as the patient identified in Step 4 and The patient summary is created in human readable 1-1.03 AMB Summary display each appropriate patient summary format and is complete and accurate. TE1.0 Time: (Ambulatory and/or Inpatient) in human readable 6-1.07 format, including the Common MU Data Set and IN1.01 Proctor documents the time each patient summary is -1.02 the following data elements: INP Summary displayed. . [AMB] Summary: provider’s name and Time: office contact information . [INP] Summary: admission and discharge dates and locations, discharge instructions, and reason(s) for hospitalization TE2.0 14 While still logged on as the patient identified in Each applicable patient summary is downloaded in 1-2.02 AMB Summary Step 4, download each applicable patient human readable format and is complete and accurate. TE2.0 Time: summary in human readable format, including 5 the Common MU Data Set and the following data IN2.01 Proctor documents the time each patient summary is -2.02 elements: INP Summary downloaded. . [AMB] Summary: provider’s name and Time: office contact information . [INP] Summary: admission and discharge dates and locations, discharge instructions, and reason(s) for hospitalization Page 120 of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE2.0 15 For EHR technology testing in the Inpatient The applicable Referral Summary/Transition of Care is 3 INP Referral Summary [Conditional] domain, download the same information downloaded according to the CCDA standard and the TE2.0 Time: downloaded at Step 14 in CCDA XML format for named vocabulary standards and is complete and 6 the following: accurate. IN2.04 . [INP] Referral Summary/Transition of Care: Common MU Data Set and Proctor documents the time each patient summary is encounter diagnoses, immunizations, downloaded. cognitive status, functional status, and discharge instructions TE1.0 16 Log on as the authorized patient representative The patient summary is created in human readable 4 AMB Summary identified in Step 5 and display the summary format and is complete and accurate. TE1.0 Time: information viewed at Step 13. 6-1.07 IN1.01 -1.03 Proctor documents the time each patient summary is INP Summary displayed. Time: TE1.0 17 Log on as the unauthorized patient representative The unauthorized patient representative is prevented 5 identified in Step 6 and attempt to display the from accessing the patient record. IN1.03 same patient record viewed at Step 13. 18 Access the Direct Certificate Discovery Tool The DCDT is opened to the Discover DCDT's DCDT v (DCDT) and navigate to the Discover DCDT's Certificates section. Certificates section. Proctor documents the DCDT version. TE3.0 19 In Step 3 of the Discover DCDT's Certificates The non-Direct (Contact) email address and Direct 2-3.03 section, map the Direct (From) address specified (From) address are mapped on the DCDT. in Step 8 of this test script as the Direct Address and the non-Direct (Contact) email address identified in Step 7 of this test script as the Email Address. TE3.0 20 In Step 5 of the Discover DCDT's Certificates Sending of message was attempted (results email to be 4-3.05 section, choose the test case "D1 - Valid address- examined in Step 36). bound certificate discovery in DNS". Attempt to send a message from the EHR to the Direct (To) address provided by the DCDT for that test case. TE3.0 21 In Step 5 of the Discover DCDT's Certificates Sending of message was attempted (results email to be 4-3.05 section, choose the test case "D2 - Valid domain- examined in Step 36). bound certificate discovery in DNS". Attempt to send a message from the EHR to the Direct (To) address provided by the DCDT for that test case.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE3.0 22 In Step 5 of the Discover DCDT's Certificates Sending of message was attempted (results email to be 4-3.05 section, choose the test case "D3 - Valid address- examined in Step 36). bound certificate discovery in LDAP". Attempt to send a message from the EHR to the Direct (To) address provided by the DCDT for that test case. TE3.0 23 In Step 5 of the Discover DCDT's Certificates Sending of message was attempted (results email to be 4-3.05 section, choose the test case "D4 - Valid domain- examined in Step 36). bound certificate discovery in LDAP". Attempt to send a message from the EHR to the Direct (To) address provided by the DCDT for that test case. TE3.0 24 In Step 5 of the Discover DCDT's Certificates Sending of message was attempted (results email to be 4-3.05 section, choose the test case "D5 - Invalid examined in Step 36). address-bound certificate discovery in DNS". Attempt to send a message from the EHR to the Direct (To) address provided by the DCDT for that test case. TE3.0 25 In Step 5 of the Discover DCDT's Certificates Sending of message was attempted (results email to be 4-3.05 section, choose the test case "D6 - Invalid examined in Step 36). domain-bound certificate discovery in DNS". Attempt to send a message from the EHR to the Direct (To) address provided by the DCDT for that test case. TE3.0 26 In Step 5 of the Discover DCDT's Certificates Sending of message was attempted (results email to be 4-3.05 section, choose the test case "D7 - Invalid examined in Step 36). address-bound certificate discovery in LDAP". Attempt to send a message from the EHR to the Direct (To) address provided by the DCDT for that test case. TE3.0 27 In Step 5 of the Discover DCDT's Certificates Sending of message was attempted (results email to be 4-3.05 section, choose the test case "D8 - Invalid examined in Step 36). domain-bound certificate discovery in LDAP". Attempt to send a message from the EHR to the Direct (To) address provided by the DCDT for that test case. TE3.0 28 In Step 5 of the Discover DCDT's Certificates Sending of message was attempted (results email to be 4-3.05 section, choose the test case "D9 - Select valid examined in Step 36). address-bound certificate over invalid certificate in DNS". Attempt to send a message from the EHR to the Direct (To) address provided by the DCDT for that test case.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE3.0 29 In Step 5 of the Discover DCDT's Certificates Sending of message was attempted (results email to be 4-3.05 section, choose the test case "D10 - Certificate examined in Step 36). discovery in LDAP with one unavailable LDAP server". Attempt to send a message from the EHR to the Direct (To) address provided by the DCDT for that test case. TE3.0 30 In Step 5 of the Discover DCDT's Certificates Sending of message was attempted (results email to be 4-3.05 section, choose the test case "D11 - No examined in Step 36). certificates discovered in DNS CERT records and no SRV records". Attempt to send a message from the EHR to the Direct (To) address provided by the DCDT for that test case. TE3.0 31 In Step 5 of the Discover DCDT's Certificates Sending of message was attempted (results email to be 4-3.05 section, choose the test case "D12 - No examined in Step 36). certificates found in DNS CERT records and no available LDAP servers". Attempt to send a message from the EHR to the Direct (To) address provided by the DCDT for that test case. TE3.0 32 In Step 5 of the Discover DCDT's Certificates Sending of message was attempted (results email to be 4-3.05 section, choose the test case "D13 - No examined in Step 36). certificates discovered in DNS CERT records or LDAP servers". Attempt to send a message from the EHR to the Direct (To) address provided by the DCDT for that test case. TE3.0 33 In Step 5 of the Discover DCDT's Certificates Sending of message was attempted (results email to be 4-3.05 section, choose the test case "D14 - Discovery of examined in Step 36). certificate larger than 512 bytes in DNS". Attempt to send a message from the EHR to the Direct (To) address provided by the DCDT for that test case. TE3.0 34 In Step 5 of the Discover DCDT's Certificates Sending of message was attempted (results email to be 4-3.05 section, choose the test case "D15 - Certificate examined in Step 36). discovery in LDAP based on SRV priority value". Attempt to send a message from the EHR to the Direct (To) address provided by the DCDT for that test case.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE3.0 35 In Step 5 of the Discover DCDT's Certificates Sending of message was attempted (results email to be 4-3.05 section, choose the test case "D16 - Certificate examined in Step 36). discovery in LDAP based on SRV weight value". Attempt to send a message from the EHR to the Direct (To) address provided by the DCDT for that test case. 36 Access the non-Direct (Contact) email address Results emails from the DCDT are received and report IN3.01 identified in Step 7 and display the results emails the test case as “Passed” for the following messages. If from the DCDT. no email is received for these test cases, the test has failed. . D1 . D2 . D3 . D4 . D9 . D10 . D14 . D15 . D16

No results emails were received for the following messages. If an email is received, the test has failed. . D5 . D6 . D7 . D8 . D11 . D12 . D13 37 Access the Edge Testing Tool (ETT). The ETT is opened to the home page. ETT v

Proctor documents the ETT version.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts 38 From the home page of the ETT - Direct, select The Register Direct tab opens on the ETT. Register Direct. 39 Enter the Direct (From) address identified in Step The Direct email address is loaded into the ETT. 8 into the Direct Email Address field and select the Add button. 40 Enter the (Contact) email address identified in The Contact address is loaded into the ETT. Step 7 into the Contact Email Address field and select the Load/Create Contact button TE3.0 41 Transmit each applicable human readable Using the ETT, verify each applicable human readable 7 AMB Summary document to the Direct (To) addresses specified document was transmitted and received successfully IN3.03 Time: on the ETT – DIRECT home page using the ONC according to the ONC Applicability Statement for Secure Applicability Statement for Secure Health Health Transport (Direct) standard, including successful Transport (Direct) standard. The Direct message decryption validation. INP Summary should be encrypted using the recipient’s (ETT) Time: Public Key identified at Step 11 and signed using Proctor documents the time each patient summary is the sender’s (EHR) Private Key. transmitted. 42 Transmit each applicable CCDA XML document Using the ETT, verify each applicable CCDA document TE3.0 AMB Summary to the Direct (To) addresses specified on the ETT 8 was transmitted and received successfully according to IN3.03 Time: – DIRECT home page using the ONC the ONC Applicability Statement for Secure Health Applicability Statement for Secure Health Transport (Direct) standard, including successful Transport (Direct) standard. The Direct message decryption validation. INP Summary should be encrypted using the recipient’s (ETT) Time: Public Key identified at Step 11 and signed using the sender’s (EHR) Private Key. Proctor documents the time each patient summary is transmitted. INP Referral Summary Time: 43 Access the non-Direct (Contact) email address Validation Results display no errors. identified in Step 7, display the Direct Message Validation Report emails, and open the validation reports.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE3.0 44 Identify and download each applicable human Each applicable human readable patient summary is 9 readable patient summary from the Validation identified in the transmitted message and downloaded. IN3.04 Results page and demonstrate that it is in Each summary is confirmed to be in human readable -3.05 human readable format and includes the format and is complete and accurate. Common MU Data Set (in the English representation if applicable) and the following data elements: . [AMB] Summary: provider’s name and office contact information . [INP] Summary: admission and discharge dates and locations, discharge instructions, and reason(s) for hospitalization 45 Identify and download each applicable CCDA Each applicable CCDA XML document is identified in IN3.06 XML document from the Validation Results the transmitted message and downloaded. page.

Alternatively, this may involve reviewing EHR logs to access the transmitted documents, parsing files and inspecting the header to identify the CCDA conformant document XML (vs. style sheet, human readable document, etc.).

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE2.0 46 Per the instructions at Submitting Files on Test Zip file containing CCDA XML document(s) is uploaded 4 Day, access the CCDA XML file(s) and e1 .txt file using the correct filename, and results emails from the and zip them together. Upload the zip file to ICSA DCDT and TTT are submitted using the correct subject Labs using the URL provided by the Proctor. line. Uploaded zip files must include the organization name and criterion number in the filename (e.g. e1_ABCompany).

Submit the original results emails from the DCDT and TTT (either individually or together as attachments to a single email) to ehr- [email protected] and include the organization name and criterion number in the subject line of the email (e.g. e1_ABCompany).

Resubmissions during the same test session MUST modify the .zip filename and email subject line to include the word ‘Retest’, as in e1_ABCompany_Retest1, e1_ABCompany_Retest2, etc. TE2.0 47 File validation performed to determine compliance File is in conformance with the CCDA standard and 6 with the required specifications. named vocabulary standards and is complete and TE3.1 accurate. 0 IN2.05 This step performed outside of the demonstration. -2.06 IN3.07 This step scored on the Conformance Worksheet. -3.08 ☐ Steps 48-135 only performed by systems demonstrating the optional edge protocols to send health information 48 Identify the edge protocol to be used to send Edge protocol is identified. [Conditional] health information from the EHR to the HISP: . IHE XDR profile for Limited Metadata Proctor documents the edge protocol. Document Sources edge protocol . SMTP-focused edge protocol 49 Login to the Edge Testing Tool (ETT) and ETT is opened to the Help page. ETT v [Conditional] navigate to the Help page. Proctor documents the ETT version. ☐ Steps 50-117 only performed by systems demonstrating the IHE XDR profile for Limited Metadata Document Sources as the edge protocol to send health information

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts 50 Navigate to the XDR Test Cases section and The Sender test page is opened. [Conditional] select the Your System as: Sender button. 51 Identify the Direct (From) address and registered Proctor documents the Direct (From) address and [Conditional] domain that will be used by the EHR to send XDR registered domain to be used for the XDR send tests. messages to the ETT. 52 Identify the IP address that will be used by the Proctor documents the IP address to be used for the [Conditional] EHR to send XDR messages to the ETT. XDR send tests. TE4.0 53 In the section for XDR Test 6 enter the Direct The XDR Test 6 TLS endpoint is generated. 1 [Conditional] (From) address specified in Step 51 and select Run. TE4.0 54 Configure the EHR to create and send an XDR EHR is configured to send an XDR message to the XDR 1 [Conditional] message using the XDR Test 6 TLS endpoint as Test 6 TLS endpoint and a session connection is the XDR message recipient. Session connection established. must occur before any data is transmitted. TE4.0 55 Attempt to send an XDR message to the XDR Confirm receipt of the XDR message by changing the 1 [Conditional] Test 6 TLS endpoint and then select Pending Pending Refresh button to Waiting Validation. Refresh to check the status. 56 Upon refresh completion select the Waiting The log screen for the test case is displayed. IN4.01 [Conditional] Validation button. 57 Manually review the Request and Response Confirm a mutual TLS session is established between IN4.01 [Conditional] tabs to confirm the message content and the EHR and the ETT prior to transmitting any data. metadata conform to the testing objectives. 58 If confirmed by the Tester, select the Accept XDR Acceptance or rejection of the XDR message content IN4.05 [Conditional] button. If not confirmed by the Tester, select the results in overall Test Case testing success or failure Reject XDR button. and is recorded in the Validation Report. TE4.0 59 In the section for XDR Test 7 enter the EHR’s IP The XDR Test 7 TLS endpoint is generated. 2 [Conditional] address specified in Step 52 and select Run. TE4.0 60 Configure the EHR to create and send an XDR EHR is configured to send an XDR message to the XDR 2 [Conditional] message using the XDR Test 7 TLS endpoint as Test 7 TLS endpoint. the XDR message recipient. TE4.0 61 Attempt to send an XDR message to the XDR Confirm receipt of the XDR message by changing the 2 [Conditional] Test 7 TLS endpoint and then select Pending Pending Refresh button to Waiting Validation. Refresh to check the status. 62 Upon refresh completion select the Waiting The log screen for the test case is displayed. IN4.02 [Conditional] Validation button.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts 63 Manually review the Request and Response Confirm the EHR disconnects from the ETT when the IN4.02 [Conditional] tabs to confirm the message content and ETT provides an invalid certificate and incorrect mutual metadata conform to the testing objectives. TLS configuration. 64 If confirmed by the Tester, select the Accept XDR Acceptance or rejection of the XDR message content IN4.05 [Conditional] button. If not confirmed by the Tester, select the results in overall Test Case testing success or failure Reject XDR button. and is recorded in the Validation Report. TE4.0 65 In the section for XDR Test 1 enter the Direct The XDR Test 1 TLS endpoint is generated. 3 [Conditional] (From) address specified in Step 51 and select Run. TE4.0 66 Configure the EHR to create and send an XDR EHR is configured to send an XDR message to the XDR 3 [Conditional] message using the XDR Test 1 TLS endpoint as Test 1 TLS endpoint. the XDR message recipient. TE4.0 67 Attempt to send each applicable CCDA document Confirm receipt of the XDR message by changing the 3 [Conditional] to the XDR Test 1 TLS endpoint in an XDR Pending Refresh button to Waiting Validation. message with limited metadata and a Direct Address block using the Implementation Guide for Direct Edge Protocols version 1.1 (XDR-1) and then select Pending Refresh to check the status. 68 Upon refresh completion select the Waiting The log screen for the test case is displayed. IN4.03 [Conditional] Validation button. TE4.0 69 Manually review the Request and Response Confirm each applicable CCDA XML document was 6-4.07 [Conditional] tabs to confirm the message content and sent with limited metadata and received successfully IN4.03 metadata conform to the testing objectives. according to the Implementation Guide for Direct Edge Protocols v1.1. Retrieve the CCDA XML document for conformance validation to be performed later. CCDA XML document is saved for the conformance validation step to be performed later. 70 If confirmed by the Tester, select the Accept XDR Acceptance or rejection of the XDR message content IN4.03 [Conditional] button. If not confirmed by the Tester, select the results in overall Test Case testing success or failure Reject XDR button. and is recorded in the Validation Report. TE4.0 71 Attempt to send each applicable human readable Confirm receipt of the XDR message by changing the 4 [Conditional] document to the XDR Test 1 TLS endpoint in an Pending Refresh button to Waiting Validation. XDR message with limited metadata and a Direct Address block using the Implementation Guide for Direct Edge Protocols version 1.1 (XDR-1) and then select Pending Refresh to check the status. 72 Upon refresh completion select the Waiting The log screen for the test case is displayed. IN4.03 [Conditional] Validation button.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE4.0 73 Manually review the Request and Response Confirm each applicable Human Readable CCDA 4 [Conditional] tabs to confirm the message content and document was sent with limited metadata and received TE4.0 metadata conform to the testing objectives. successfully according to the Implementation Guide for 7 Direct Edge Protocols v1.1. IN4.03 74 If confirmed by the Tester, select the Accept XDR Acceptance or rejection of the XDR message content IN4.03 [Conditional] button. If not confirmed by the Tester, select the results in overall Test Case testing success or failure Reject XDR button. and is recorded in the Validation Report. TE4.0 75 In the section for XDR Test 2 enter the Direct The XDR Test 2 TLS endpoint is generated. 5 [Conditional] (From) address specified in Step 51 and select Run. TE4.0 76 Configure the EHR to create and send an XDR EHR is configured to send an XDR message to the XDR 5 [Conditional] message using the XDR Test 2 TLS endpoint as Test 2 TLS endpoint. the XDR message recipient. TE4.0 77 Attempt to send each applicable CCDA document Confirm receipt of the XDR message by changing the 5 [Conditional] to the XDR Test 2 TLS endpoint in an XDR Pending Refresh button to Waiting Validation. message with full metadata using the standard edge protocol and then select Pending Refresh to check the status. 78 Upon refresh completion select the Waiting The log screen for the test case is displayed. IN4.04 [Conditional] Validation button. TE4.0 79 Manually review the Request and Response Confirm each applicable CCDA XML document was 5-4.07 [Conditional] tabs to confirm the message content and sent with full metadata and received successfully IN4.04 metadata conform to the testing objectives. according to the Implementation Guide for Direct Edge Protocols v1.1. Retrieve the CCDA XML document for conformance validation to be performed later. CCDA XML document is saved for the conformance validation step to be performed later. 80 If confirmed by the Tester, select the Accept XDR Acceptance or rejection of the XDR message content IN4.04 [Conditional] button. If not confirmed by the Tester, select the results in overall Test Case testing success or failure Reject XDR button. and is recorded in the Validation Report. TE4.0 81 In the section for XDR MU2 Test 19 enter the The XDR MU2 Test 19 TLS endpoint is generated. 7 [Conditional] Direct (From) address specified in Step 51 and select Run. TE4.0 82 Configure the EHR to create and send multiple EHR is configured to send multiple XDR messages to 7 [Conditional] XDR messages using the XDR MU2 Test 19 TLS the XDR MU2 Test 19 TLS endpoint. endpoint as the XDR message recipient.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE4.0 83 Attempt to send three separate XDR messages to Confirm receipt of each XDR message by changing the 7 [Conditional] the XDR MU2 Test 19 TLS endpoint, each with Pending Refresh button to Waiting Validation. unique message IDs, and then select Pending Refresh to check the status. 84 Upon refresh completion of each message select The log screen for the test case is displayed for each IN4.09 [Conditional] the Waiting Validation button. message. 85 Manually review the Request and Response Confirm the EHR is able to create multiple messages IN4.09 [Conditional] tabs to confirm the message content and with unique message IDs specific to each message. metadata conform to the testing objectives. Each unique message ID shall be included in the MessageID field of the WS-Addressing Header element. 86 If confirmed by the Tester, select the Accept XDR Acceptance or rejection of the XDR message content IN4.09 [Conditional] button. If not confirmed by the Tester, select the results in overall Test Case testing success or failure Reject XDR button. and is recorded in the Validation Report. TE4.0 87 In the section for XDR MU2 Test 20a enter the The XDR MU2 Test 20a TLS endpoint is generated. 8 [Conditional] Direct (From) address specified in Step 51 and select Run. TE4.0 88 Configure the EHR to create and send an XDR EHR is configured to send an XDR message to the XDR 8 [Conditional] message using the XDR MU2 Test 20a TLS MU2 Test 20a TLS endpoint. endpoint as the XDR message recipient. TE4.0 89 Attempt to send an applicable CCDA document to Confirm receipt of the XDR message by changing the 8 [Conditional] the ETT in an XDR message using the XDR MU2 Pending Refresh button to Waiting Validation. Test 20a TLS endpoint as the XDR message recipient and then select Pending Refresh to check the status. 90 Upon refresh completion select the Waiting The log screen for the test case is displayed. IN4.10 [Conditional] Validation button. 91 Manually review the Request and Response Confirm the Processed MDN is sent. IN4.10 [Conditional] tabs to confirm the message content and metadata conform to the testing objectives. The EHR must be able to accept failure messages for invalid recipients from the ETT. Failure messages to invalid recipients have to be processed/tracked appropriately. 92 If confirmed by the Tester, select the Accept XDR Acceptance or rejection of the XDR message content IN4.10 [Conditional] button. If not confirmed by the Tester, select the results in overall Test Case testing success or failure Reject XDR button. and is recorded in the Validation Report. TE4.0 93 In the section for XDR MU2 Test 20b enter the The XDR MU2 Test 20b TLS endpoint is generated. 8 [Conditional] Direct (From) address specified in Step 51 and select Run. Page 131 of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE4.0 94 Configure the EHR to create and send an XDR EHR is configured to send an XDR message to the XDR 8 [Conditional] message using the XDR MU2 Test 20b TLS MU2 Test 20b TLS endpoint. endpoint as the XDR message recipient. TE4.0 95 Attempt to send an applicable CCDA document to Confirm receipt of the XDR message by changing the 8 [Conditional] the ETT in an XDR message using the XDR MU2 Pending Refresh button to Waiting Validation. Test 20b TLS endpoint as the XDR message recipient and then select Pending Refresh to check the status. 96 Upon refresh completion select the Waiting The log screen for the test case is displayed. IN4.10 [Conditional] Validation button. 97 Manually review the Request and Response Confirm the Failure MDN is sent. IN4.10 [Conditional] tabs to confirm the message content and metadata conform to the testing objectives. The EHR must be able to accept failure messages for invalid recipients from the ETT. Failure messages to invalid recipients have to be processed/tracked appropriately. 98 If confirmed by the Tester, select the Accept XDR Acceptance or rejection of the XDR message content IN4.10 [Conditional] button. If not confirmed by the Tester, select the results in overall Test Case testing success or failure Reject XDR button. and is recorded in the Validation Report. TE4.0 99 In the section for XDR MU2 Test 48 enter the The XDR MU2 Test 48 TLS endpoint is generated. 9 [Conditional] Direct (From) address specified in Step 51 and select Run. TE4.0 100 Configure the EHR to create and send multiple EHR is configured to send multiple XDR messages to 9 [Conditional] XDR messages using the XDR MU2 Test 48 TLS the XDR MU2 Test 48 TLS endpoint. endpoint as the XDR message recipient. TE4.0 101 Attempt to send multiple XDR messages (the Confirm receipt of each XDR message by changing the 9 [Conditional] exact number to be determined by the proctor Pending Refresh button to Waiting Validation. based on the amount of rigor the testing requires), each with unique message IDs, using the XDR MU2 Test 48 TLS endpoint as the XDR message recipient and then select Pending Refresh to check the status. 102 Upon refresh completion of each message select The log screen for the test case is displayed for each IN4.11 [Conditional] the Waiting Validation button. message. 103 Manually review the Request and Response Confirm the EHR is able to create multiple messages IN4.11 [Conditional] tabs to confirm the message content and with unique message IDs specific to each message. metadata conform to the testing objectives. Each unique message ID shall be included in the MessageID field of the WS-Addressing Header element.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts 104 If confirmed by the Tester, select the Accept XDR Acceptance or rejection of the XDR message content IN4.11 [Conditional] button. If not confirmed by the Tester, select the results in overall Test Case testing success or failure Reject XDR button. and is recorded in the Validation Report. TE4.1 105 In the section for XDR MU2 Test 49 enter the The XDR MU2 Test 49 TLS endpoint is generated. 0 [Conditional] Direct (From) address specified in Step 51 and select Run. TE4.1 106 Configure the EHR to create and send an XDR EHR is configured to send an XDR message to the XDR 0 [Conditional] message with a valid Direct Address Block and MU2 Test 49 TLS endpoint. Delivery Notifications header using the XDR MU2 Test 49 TLS endpoint as the XDR message recipient. TE4.1 107 Attempt to send an XDR message using the XDR Confirm receipt of the XDR message by changing the 0 [Conditional] MU2 Test 49 TLS endpoint as the XDR message Pending Refresh button to Waiting Validation. recipient and then select Pending Refresh to check the status. 108 Upon refresh completion select the Waiting The log screen for the test case is displayed. IN4.12 [Conditional] Validation button. 109 Manually review the Request and Response Confirm the EHR is able to generate the Direct Address IN4.12 [Conditional] tabs to confirm the message content and Block header including the Disposition Notifications metadata conform to the testing objectives. header. 110 If confirmed by the Tester, select the Accept XDR Acceptance or rejection of the XDR message content IN4.12 [Conditional] button. If not confirmed by the Tester, select the results in overall Test Case testing success or failure Reject XDR button. and is recorded in the Validation Report. TE4.1 111 In the section for XDR MU2 Test 20a enter the The XDR MU2 Test 20a TLS endpoint is generated. 1 [Conditional] Direct (From) address specified in Step 51 and select Run. TE4.1 112 Configure the EHR to create and send an XDR EHR is configured to send an XDR message to both the 1 [Conditional] message using both the XDR MU2 Test 50a and XDR MU2 Test 50a and XDR MU2 Test 50b TLS XDR MU2 Test 50b TLS endpoints as the XDR endpoints at the same time. message recipient at the same time. TE4.1 113 Attempt to an XDR message using both the XDR Confirm receipt of both XDR messages by changing 1 [Conditional] MU2 Test 50a and XDR MU2 Test 50b TLS both Pending Refresh buttons to Waiting Validation. endpoints as XDR message recipients at the same time and then select both Pending Refresh buttons to check the status. 114 Upon refresh completion select both Waiting The log screen for each test case is displayed. IN4.13 [Conditional] Validation buttons.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts 115 Manually review the Request and Response Confirm the Processed MDN and Failure MDN are sent. IN4.13 [Conditional] tabs to confirm the message content and metadata conform to the testing objectives. The EHR must be able to accept failure messages from invalid recipients. 116 If confirmed by the Tester, select the Accept XDR Acceptance or rejection of the XDR message content IN4.13 [Conditional] button. If not confirmed by the Tester, select the results in overall Test Case testing success or failure Reject XDR button. and is recorded in the Validation Report. 117 Select the Validation Reports page and view the Verify that all tests have been completed with a status of IN4.14 [Conditional] results. pass or fail. ☐ Steps 118-133 only performed by systems demonstrating SMTP as the edge protocol to send health information 118 Navigate to the SMTP Test Cases section and The Sender test page is opened. [Conditional] select the Sender button. 119 Identify the server hostname or IP address that The identified server should directly host the EHR email [Conditional] will be used by the EHR to send SMTP messages address listed in Step 120. to the ETT. Proctor documents the server hostname or IP address to be used for the SMTP send tests. 120 Identify the email address that will be used by the The email address should be the same email address [Conditional] EHR when sending SMTP messages to the ETT. used to create the user account on the ETT.

Proctor documents the email address to be used for the SMTP send tests. 121 Identify the username and password on the The username and password should correspond to the Username: [Conditional] EHR’s SMTP server to be used for PLAIN SASL email address listed in Step 120. Password: Authorization. Proctor documents the username and password to be used for the SMTP send tests using PLAIN SASL Authorization. TE5.0 122 Compose an email from the EHR’s email address Email is created and each applicable CCDA is sent to 1 [Conditional] and send each applicable CCDA document to the ETT. TE5.0 [email protected] to initiate a TLS 3 TE5.0 session and authenticate using PLAIN SASL 5-5.06 authentication to the ETT SMTP server using the username and password identified in Step 121.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE5.0 123 Select the applicable SMTP profile and then Verify a secure session was established, a STARTTTLS 1 [Conditional] select Run in the section for SMTP Test 1-8, 14, command was received, and successful authentication TE5.0 18. with PLAIN SASL was performed. 3 TE5.0 5 A green check represents a pass and a red X represents IN5.01 IN5.03 a fail. The ETT validation report should also indicate a IN5.05 successful sequence of commands for SMTP protocols -5.07 (SMTP-1 through SMTP-8).

TE5.0 124 Manually review the Request and Response Confirm each applicable CCDA XML document was 6 [Conditional] tabs to confirm the message content and sent according to the Implementation Guide for Direct IN5.05 metadata conform to the testing objectives. Edge Protocols (SMTP) standard v1.1. The ETT -5.07 validation report should indicate: Retrieve the CCDA XML document for . The CCDA Implementation Guide conformance conformance validation to be performed later. requirements tested are met by the electronically generated (Ambulatory/Inpatient) Transition of Care/Referral Summary . The standards for the named vocabularies for the Common MU Data Set, Encounter diagnoses, and Immunizations are met by the electronically generated Transition of Care/Referral Summary

CCDA XML document is saved for the conformance validation step to be performed later. TE5.0 125 Compose three or more emails from the EHR’s Emails are created sent to the ETT using unique IDs for 8 [Conditional] email address (the exact number to be each message. determined by the proctor based on the amount of rigor the testing requires) and send them to [email protected] with unique message IDs specific to each message. 126 Select the applicable SMTP profile and then Verify the EHR is able to create multiple messages with IN5.10 [Conditional] select Run in the section for SMTP MU2 Test 17. unique message IDs specific to each message. A green check represents a pass and a red X represents a fail. TE5.1 127 Compose three or more emails from the EHR’s Emails are created and sent to the ETT using unique IDs 0 [Conditional] email address (the exact number to be for each message. determined by the proctor based on the amount of rigor the testing requires) and send them to [email protected] with unique message IDs specific to each message. Page 135 of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts 128 Select the applicable SMTP profile and then Verify the EHR is able to create multiple messages with IN5.12 [Conditional] select Run in the section for SMTP MU2 Test 45. unique message IDs specific to each message. A green check represents a pass and a red X represents a fail. TE5.1 129 Compose an email from the EHR’s email address Email is created and sent to the ETT using the proper 1 [Conditional] and send it to [email protected] header. with a valid Disposition-Notifications-Options Header that provides an extensible mechanism for required information and additional control over how and what MDNs are generated per section 1.3 of the Implementation Guide for Delivery Notifications. 130 Select the applicable SMTP profile and then Verify that the ETT will process the Disposition- IN5.13 [Conditional] select Run in the section for SMTP MU2 Test 46. Notifications-Options header appropriately and include the header in the message to the receiver. A green check represents a pass and a red X represents a fail. TE5.1 131 Compose an email from the EHR’s email address Email is created and sent to the ETT using both 2 [Conditional] and send a single message to both addresses. [email protected] and [email protected]. 132 Select the applicable SMTP profile and then Verify that the system has received, processed, and IN5.14 [Conditional] select Run in the section for SMTP MU2 Test 47. tracked a successful MDN for processedonly5@hit- testing2.nist.gov and failure Message (MDN) for [email protected]. A green check represents a pass and a red X represents a fail. 133 Select the Validation Reports page and view the Verify that all tests have been completed with a status of IN5.15 [Conditional] results. pass or fail. Steps 134-135 are required to be performed by all systems demonstrating the optional edge protocols to send health information

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE4.0 134 Access the applicable CCDA XML file(s) retrieved Zip file containing all applicable CCDA XML 5-4.06 [Conditional] in Steps 69, 79, and/or 124 then access the e1 document(s) is uploaded using the correct filename. TE5.0 .txt file and zip them together per the instructions 6-5.07 IN4.05 at Submitting Files on Test Day. Upload the zip -4.08 file to ICSA Labs using the URL provided by the IN5.08 Proctor. Uploaded zip files must include the -5.09 organization name and criterion number in the filename (e.g. e1_ABCompany).

Resubmissions during the same test session MUST modify the .zip filename and email subject line to include the word ‘Retest’, as in e1_ABCompany_Retest1, e1_ABCompany_Retest2, etc. IN4.05 135 File validation performed to determine compliance File is in conformance with the CCDA standard and -4.08 [Conditional] with the required specifications. named vocabulary standards and is complete and IN5.08 accurate. -5.09 This step performed outside of the demonstration. This step scored on the Conformance Worksheet. ☐ Step 136 not required by systems also certifying to 170.314(d)(2) Auditable Events and Tamper-Resistance if the system is able to provide patients with access to this information (log of the time, date, and users who view, download and transmit patient health information).

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE6.0 136 Log on as the patient identified in Step 4 and For the action taken at each step, the correct user, date, 1-6.07 [conditional] display the activity history log for the actions time, and description of the actions performed are stored IN6.01 performed at the following steps: accurately and without omission in the correct patient’s -6.03 . Steps 13, 16 (viewed) record. . Steps 14, 15 (downloaded) Note 1: The “view” action performed in Step 16 must be . Steps 41, 42 (transmitted) attributed to the patient representative identified in Step . Conditionally Steps 67, 71, 122 5. All other actions must be attributed to the patient (transmitted) identified in Step 4.

Note 2: Step 15 is only required for EHRs testing in the Inpatient domain.

Note 3: Steps 41 and 42 may be represented in a single log entry if either the CCDA XML document is transmitted with an associated stylesheet to comply with the requirements for transmitting a human readable document or if the XML and human readable versions of the CCDA are sent in a single transmission.

Note 4: Steps 67, 71, and 122 are conditional upon if the optional Edge protocols are demonstrated, and if XDR or SMTP is chosen. Select Document any other pertinent observations below: Test Result

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts 170.314(b)(2) Transitions of Care – Create and Transmit Setup Guidance and Test Tool . Create a patient record as specified in the required . Guidance from ICSA Labs test data and enter all test data for the appropriate . Direct Certificate Discovery Tool (DCDT) care setting . DCDT Google Groups Support Site or Email . Create and install certificates to be used for Direct testing . Edge Testing Tool (ETT) . From the Discovery page of the DCDT, download and . ETT Google Groups Support Site or Email Certificate Thumbprints for Test Tools import the DCDT’s Trust Anchor into the EHR’s trust store . From the Direct Testing page of the ETT, download and import the ETT's Public Key Certificate and Trust Anchor into the EHR’s trust store Step # Action to Perform Expected Outcome Ref ere Notes / Deviations nce 1 Identify the non-Direct (Contact) email address to Proctor documents the non-Direct (Contact) email be used to receive the results emails sent from address to be used for the Direct tests. the DCDT and ETT. Note: All results emails must be sent to an email account that is accessible on the presenter’s screen during testing. 2 Identify the Direct (From) address and registered Proctor documents the Direct (From) address and domain that will be used by the EHR to send registered domain to be used for the Direct tests. Direct messages to the DCDT and ETT. TE2.0 3 Register the Direct (To) addresses (specified on The Direct (To) addresses are stored within the EHR, 6 the ETT – DIRECT home page) in the EHR (to be displayed as visible Direct addresses, and are available IN2.02 available as a recipient for sending of Direct as a recipient for sending of Direct messages within the within the EHR). EHR. TE2.0 4 Identify the DCDT's Trust Anchor in the EHR’s The DCDT's Trust Anchor is stored in the EHR's trust 1 trust store. store.

Proctor validates the thumbprints when possible.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts 5 Identify the ETT's Public Key Certificate and Trust The ETT's Public Key Certificate and Trust Anchor are Anchor in the EHR’s trust store. stored in the EHR's trust store.

Proctor validates the thumbprints when possible. 6 Identify the EHR's signing certificate to be used to EHR's signing certificate is identified. sign message content with its Private Key and to provide the Public Key in messages sent to the ETT. TE1.0 7 Log in to the EHR as a provider, open the patient Test data has been entered correctly and without 1-1.02 record for the appropriate data set [Ambulatory or omission. Inpatient], and display the Common MU Data Set and the following data elements: . Encounter diagnoses . Immunizations . Cognitive and functional status . Reason for referral [AMB only] . Referring provider’s name and contact information [AMB only] . Discharge instructions [INP only] TE1.0 8 Generate a transition of care/referral summary Each applicable CCDA document is generated and is 2-1.03 CCDA document for each applicable data set correct and without omission. IN1.01 (Ambulatory and/or Inpatient). 9 Access the Direct Certificate Discovery Tool The DCDT is opened to the Discover DCDT's DCDT v (DCDT) and navigate to the Discover DCDT's Certificates section. Certificates section. Proctor documents the DCDT version. TE2.0 10 In Step 3 of the Discover DCDT's Certificates The non-Direct (Contact) email address and Direct 2-2.03 section, map the Direct (From) address specified (From) address are mapped on the DCDT. in Step 5 of this test script as the Direct Address and the non-Direct (Contact) email address specified in Step 1 of this test script as the Email Address. TE2.0 11 In Step 5 of the Discover DCDT's Certificates Sending of message was attempted (results email to be 4-2.05 section, choose the test case "D1 - Valid address- examined in Step 27). bound certificate discovery in DNS". Attempt to send a message from the EHR to the Direct (To) address provided by the DCDT for that test case. Page 140 of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE2.0 12 In Step 5 of the Discover DCDT's Certificates Sending of message was attempted (results email to be 4-2.05 section, choose the test case "D2 - Valid domain- examined in Step 27). bound certificate discovery in DNS". Attempt to send a message from the EHR to the Direct (To) address provided by the DCDT for that test case. TE2.0 13 In Step 5 of the Discover DCDT's Certificates Sending of message was attempted (results email to be 4-2.05 section, choose the test case "D3 - Valid address- examined in Step 27). bound certificate discovery in LDAP". Attempt to send a message from the EHR to the Direct (To) address provided by the DCDT for that test case. TE2.0 14 In Step 5 of the Discover DCDT's Certificates Sending of message was attempted (results email to be 4-2.05 section, choose the test case "D4 - Valid domain- examined in Step 27). bound certificate discovery in LDAP". Attempt to send a message from the EHR to the Direct (To) address provided by the DCDT for that test case. TE2.0 15 In Step 5 of the Discover DCDT's Certificates Sending of message was attempted (results email to be 4-2.05 section, choose the test case "D5 - Invalid examined in Step 27). address-bound certificate discovery in DNS". Attempt to send a message from the EHR to the Direct (To) address provided by the DCDT for that test case. TE2.0 16 In Step 5 of the Discover DCDT's Certificates Sending of message was attempted (results email to be 4-2.05 section, choose the test case "D6 - Invalid examined in Step 27). domain-bound certificate discovery in DNS". Attempt to send a message from the EHR to the Direct (To) address provided by the DCDT for that test case. TE2.0 17 In Step 5 of the Discover DCDT's Certificates Sending of message was attempted (results email to be 4-2.05 section, choose the test case "D7 - Invalid examined in Step 27). address-bound certificate discovery in LDAP". Attempt to send a message from the EHR to the Direct (To) address provided by the DCDT for that test case. TE2.0 18 In Step 5 of the Discover DCDT's Certificates Sending of message was attempted (results email to be 4-2.05 section, choose the test case "D8 - Invalid examined in Step 27). domain-bound certificate discovery in LDAP". Attempt to send a message from the EHR to the Direct (To) address provided by the DCDT for that test case.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE2.0 19 In Step 5 of the Discover DCDT's Certificates Sending of message was attempted (results email to be 4-2.05 section, choose the test case "D9 - Select valid examined in Step 27). address-bound certificate over invalid certificate in DNS". Attempt to send a message from the EHR to the Direct (To) address provided by the DCDT for that test case. TE2.0 20 In Step 5 of the Discover DCDT's Certificates Sending of message was attempted (results email to be 4-2.05 section, choose the test case "D10 - Certificate examined in Step 27). discovery in LDAP with one unavailable LDAP server". Attempt to send a message from the EHR to the Direct (To) address provided by the DCDT for that test case. TE2.0 21 In Step 5 of the Discover DCDT's Certificates Sending of message was attempted (results email to be 4-2.05 section, choose the test case "D11 - No examined in Step 27). certificates discovered in DNS CERT records and no SRV records". Attempt to send a message from the EHR to the Direct (To) address provided by the DCDT for that test case. TE2.0 22 In Step 5 of the Discover DCDT's Certificates Sending of message was attempted (results email to be 4-2.05 section, choose the test case "D12 - No examined in Step 27). certificates found in DNS CERT records and no available LDAP servers". Attempt to send a message from the EHR to the Direct (To) address provided by the DCDT for that test case. TE2.0 23 In Step 5 of the Discover DCDT's Certificates Sending of message was attempted (results email to be 4-2.05 section, choose the test case "D13 - No examined in Step 27). certificates discovered in DNS CERT records or LDAP servers". Attempt to send a message from the EHR to the Direct (To) address provided by the DCDT for that test case. TE2.0 24 In Step 5 of the Discover DCDT's Certificates Sending of message was attempted (results email to be 4-2.05 section, choose the test case "D14 - Discovery of examined in Step 27). certificate larger than 512 bytes in DNS". Attempt to send a message from the EHR to the Direct (To) address provided by the DCDT for that test case.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE2.0 25 In Step 5 of the Discover DCDT's Certificates Sending of message was attempted (results email to be 4-2.05 section, choose the test case "D15 - Certificate examined in Step 27). discovery in LDAP based on SRV priority value". Attempt to send a message from the EHR to the Direct (To) address provided by the DCDT for that test case. TE2.0 26 In Step 5 of the Discover DCDT's Certificates Sending of message was attempted (results email to be 4-2.05 section, choose the test case "D16 - Certificate examined in Step 27). discovery in LDAP based on SRV weight value". Attempt to send a message from the EHR to the Direct (To) address provided by the DCDT for that test case.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts 27 Access the non-Direct (Contact) email address Results emails from the DCDT are received and report IN2.01 identified in Step 1 and display the results emails the test case as “Passed” for the following messages. If from the DCDT. no email is received for these test cases, the test has failed. . D1 . D2 . D3 . D4 . D9 . D10 . D14 . D15 . D16

Proctor documents the ETT version. 29 From the home page of the ETT - Direct, select The Register Direct tab opens on the ETT. Register Direct. 30 Enter the Direct (From) address identified in Step The Direct email address is loaded into the ETT. 2 into the Direct Email Address field and select the Add button.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts 31 Enter the (Contact) email address identified in Step 1 into the Contact Email Address field and The Contact address is loaded into the ETT. select the Load/Create Contact button. TE2.0 32 Transmit each applicable CCDA document Using the ETT, verify each applicable CCDA document 7 generated in Step 8 to the Direct (To) addresses was transmitted and received successfully according to IN2.03 specified in the ETT using the ONC Applicability the ONC Applicability Statement for Secure Health Statement for Secure Health Transport (Direct) Transport (Direct) standard, including successful standard. The Direct message should be decryption validation. encrypted using the recipient’s (ETT) Public Key identified at Step 5 and signed using the sender’s (EHR) Private Key. 33 Access the non-Direct (Contact) email address Validation Results display no errors. identified in Step 1, display the Direct Message Validation Report email(s), and open the validation report(s). 34 Identify and download each applicable CCDA Each applicable CCDA XML document is identified in IN2.05 XML document from the Validation Results the transmitted message and downloaded. page.

Alternatively, this may involve reviewing EHR logs to access the transmitted documents, parsing files and inspecting the header to identify the CCDA conformant document XML (vs. style sheet, human readable document, etc.).

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts 35 Access the CCDA XML file(s) and b2 .txt file and Zip file containing CCDA XML document(s) is uploaded zip them together per the instructions at using the correct filename, and results emails from the Submitting Files on Test Day. Upload the zip file DCDT and TTT are submitted using the correct subject to ICSA Labs using the URL provided by the line. Proctor. Uploaded zip files must include the organization name and criterion number in the filename (e.g. b2_ABCompany).

Submit the original results emails from the DCDT and TTT (either individually or together as attachments to a single email) to ehr- [email protected] and include the organization name and criterion number in the subject line of the email (e.g. b2_ABCompany).

Resubmissions during the same test session MUST modify the .zip filename and email subject line to include the word ‘Retest’, as in b2_ABCompany_Retest1, b2_ABCompany_Retest2, etc. TE2.0 36 File validation performed to determine compliance File is in conformance with the CCDA standard and 8 with the required specifications. named vocabulary standards and is complete and TE3.0 accurate. 3 TE4.0 This step performed outside of the demonstration. 2 This step scored on the Conformance Worksheet. IN2.04 IN2.06 -2.07 IN3.05 -3.06 IN4.02 -4.03 ☐ Steps 37-39 only performed by systems demonstrating the optional XDM Validation 37 If different than the Direct address specified in Proctor documents the Direct (From) address. [optional] Step 2, identify the Direct (From) address for registering within the ETT for XDM validation. TE3.0 38 Repeat Steps 28-34 except using ONC Steps are completed successfully using ONC 1-3.03 [optional] Applicability Statement for Secure Health Applicability Statement for Secure Health Transport IN3.01 Transport (Direct) standard with XDM Validation. (Direct) standard with XDM Validation. -3.04

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts 39 Generate a hash value of the CCDA XML file(s) If the hash values of the CCDA XML file(s) downloaded [optional] downloaded in Step 34 sent via Direct. Record in Step 34 match exactly then only one file needs to be the results in a text file. Then generate a hash submitted for conformance validation. Otherwise, value of the CCDA XML file(s) downloaded in complete Steps 35-36 with the CCDA XML file(s) sent Step 34 sent via XDM. Record the results in the via XDM. same text file. Compare the hash values. ☐ Steps 40-42 only performed by systems demonstrating the optional SOAP Protocols 40 Generate a SOAP endpoint for XDR for each A SOAP endpoint for XDR is generated for each CCDA [optional] CCDA conformant document that will be sent to conformant document that will be sent to the TTT and a the TTT and provide a name for each TTT name is provided for each TTT connection. connection. TE4.0 41 Transmit the CCDA documents created in Step 8 Using the ETT, verify the transmitted CCDA documents 1 [optional] to the SOAP endpoint available in the TTT using have been transmitted and received successfully IN4.01 SOAP Protocols with XDR Validation. according to SOAP Protocols with XDR Validation. 42 Generate a hash value of the CCDA XML file(s) If the hash values of the CCDA XML file(s) downloaded [optional] downloaded in Step 34 sent via Direct. Record in Step 34 and Step 41 match exactly then only one file the results in a text file. Then generate a hash needs to be submitted for conformance validation. value of the CCDA XML file(s) downloaded in Otherwise, complete Steps 35-36 with the CCDA XML Step 41 sent via SOAP. Record the results in the file(s) sent via SOAP. same text file. Compare the hash values. Select Document any other pertinent observations below: Test Result

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts 170.314(h)(1) Applicability Statement for Secure Health Transport [Optional] Setup ONC Test Guidance and Test Tool . Create patient records for and input all Data and . Guidance from ICSA Labs data for each of the provided test data Procedure . Direct Certificate Discovery Tool (DCDT) sets . Test . DCDT Google Groups Support Site or Email data is . Edge Testing Tool (ETT) avail . ETT Google Groups Support Site or Email Certificate Thumbprints for Test Tools able from ETT . ONC Test Proc edur e Step # Action to Perform Expected Outcome Ref ere Notes / Deviations nce 1 Identify the non-Direct (Contact) email address to Proctor documents the non-Direct (Contact) email be used to receive the results emails sent from address to be used for receiving the results from the the Direct Certificate Discovery Tool (DCDT) and DCDT and ETT. the Transport Testing Tool (ETT). Note: All results emails must be sent to an email account that is accessible on the presenter’s screen during testing. 2 Identify the Direct address that will be used by the Proctor documents the Direct address to be used by the EHR to send and receive Direct messages to and EHR for sending and receiving Direct messages to and from the DCDT and ETT. from the DCDT and ETT. 3 Identify the Direct (From) address that will be Proctor documents the Direct (From) address to be used Email: @ttpedge.sitenv.org used by the ETT to send valid Direct messages to for the valid Direct tests. the EHR. TE1.0 4 Identify the DCDT's Trust Anchor in the EHR’s The DCDT's Trust Anchor is stored in the EHR's trust 1 trust store. store.

Proctor validates the thumbprints when possible.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts 5 Identify the ETT's Public Key Certificate and Trust The ETT's Public Key Certificate and Trust Anchor are Anchor in the EHR’s trust store. stored in the EHR's trust store.

Proctor validates the thumbprints when possible. 6 Identify the certificates on the EHR to be used for EHR's certificates are identified. encrypting, decrypting, and signing the Direct message(s) to be sent by the ETT to the EHR's Direct address(es). 7 Identify the CCDA document available for CCDA document is identified. transmission.

Note: CCDA documents are available from the TTT home page via the “Human readable CDA/CCR data” link. 8 Access the DCDT and navigate to the Discover The DCDT is opened to the Discover DCDT's DCDT v DCDT's Certificates section. Certificates section.

Proctor documents the DCDT version. TE1.0 9 In Step 3 of the Discover DCDT's Certificates The EHR’s Direct address and the non-Direct (Contact) 2-1.03 section, map the Direct address for the EHR email address are mapped on the DCDT. specified in Step 2 of this test script as the Direct Address and map the non-Direct (Contact) email address specified in Step 1 of this test script as the Email Address. TE1.0 10 In Step 5 of the Discover DCDT's Certificates Sending of message was attempted (results email to be 2 section, choose the test case "D1 - Valid address- examined at Step 26). TE1.0 bound certificate discovery in DNS." Attempt to 4 send a message from the EHR to the Direct (To) address provided by the DCDT for that test case. TE1.0 11 In Step 5 of the Discover DCDT's Certificates Sending of message was attempted (results email to be 2 section, choose the test case "D2 - Valid domain- examined at Step 26). TE1.0 bound certificate discovery in DNS." Attempt to 4 send a message from the EHR to the Direct (To) address provided by the DCDT for that test case.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE1.0 12 In Step 5 of the Discover DCDT's Certificates Sending of message was attempted (results email to be 2 section, choose the test case "D3 - Valid address- examined at Step 26). TE1.0 bound certificate discovery in LDAP." Attempt to 4 send a message from the EHR to the Direct (To) address provided by the DCDT for that test case. TE1.0 13 In Step 5 of the Discover DCDT's Certificates Sending of message was attempted (results email to be 2 section, choose the test case "D4 - Valid domain- examined at Step 26). TE1.0 bound certificate discovery in LDAP." Attempt to 4 send a message from the EHR to the Direct (To) address provided by the DCDT for that test case. TE1.0 14 In Step 5 of the Discover DCDT's Certificates Sending of message was attempted (results email to be 2 section, choose the test case "D5 - Invalid examined at Step 26). TE1.0 address-bound certificate discovery in DNS." 4 Attempt to send a message from the EHR to the Direct (To) address provided by the DCDT for that test case. TE1.0 15 In Step 5 of the Discover DCDT's Certificates Sending of message was attempted (results email to be 2 section, choose the test case "D6 - Invalid examined at Step 26). TE1.0 domain-bound certificate discovery in DNS." 4 Attempt to send a message from the EHR to the Direct (To) address provided by the DCDT for that test case. TE1.0 16 In Step 5 of the Discover DCDT's Certificates Sending of message was attempted (results email to be 2 section, choose the test case "D7 - Invalid examined at Step 26). TE1.0 address-bound certificate discovery in LDAP." 4 Attempt to send a message from the EHR to the Direct (To) address provided by the DCDT for that test case. TE1.0 17 In Step 5 of the Discover DCDT's Certificates Sending of message was attempted (results email to be 2 section, choose the test case "D8 - Invalid examined at Step 26). TE1.0 domain-bound certificate discovery in LDAP." 4 Attempt to send a message from the EHR to the Direct (To) address provided by the DCDT for that test case. TE1.0 18 In Step 5 of the Discover DCDT's Certificates Sending of message was attempted (results email to be 2 section, choose the test case "D9 - Select valid examined at Step 26). TE1.0 address-bound certificate over invalid certificate in 4 DNS." Attempt to send a message from the EHR to the Direct (To) address provided by the DCDT for that test case.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE1.0 19 In Step 5 of the Discover DCDT's Certificates Sending of message was attempted (results email to be 2 section, choose the test case "D10 - Certificate examined at Step 26). TE1.0 discovery in LDAP with one unavailable LDAP 4 server." Attempt to send a message from the EHR to the Direct (To) address provided by the DCDT for that test case. TE1.0 20 In Step 5 of the Discover DCDT's Certificates Sending of message was attempted (results email to be 2 section, choose the test case "D11 - No examined at Step 26). TE1.0 certificates discovered in DNS CERT records and 4 no SRV records." Attempt to send a message from the EHR to the Direct (To) address provided by the DCDT for that test case. TE1.0 21 In Step 5 of the Discover DCDT's Certificates Sending of message was attempted (results email to be 2 section, choose the test case "D12 - No examined at Step 26). TE1.0 certificates found in DNS CERT records and no 4 available LDAP servers." Attempt to send a message from the EHR to the Direct (To) address provided by the DCDT for that test case. TE1.0 22 In Step 5 of the Discover DCDT's Certificates Sending of message was attempted (results email to be 2 section, choose the test case "D13 - No examined at Step 26). TE1.0 certificates discovered in DNS CERT records or 4 LDAP servers." Attempt to send a message from the EHR to the Direct (To) address provided by the DCDT for that test case. TE1.0 23 In Step 5 of the Discover DCDT's Certificates Sending of message was attempted (results email to be 2 section, choose the test case "D14 - Discovery of examined at Step 26). TE1.0 certificate larger than 512 bytes in DNS." Attempt 4 to send a message from the EHR to the Direct (To) address provided by the DCDT for that test case. TE1.0 24 In Step 5 of the Discover DCDT's Certificates Sending of message was attempted (results email to be 2 section, choose the test case "D15 - Certificate examined at Step 26). TE1.0 discovery in LDAP based on SRV priority value." 4 Attempt to send a message from the EHR to the Direct (To) address provided by the DCDT for that test case.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE1.0 25 In Step 5 of the Discover DCDT's Certificates Sending of message was attempted (results email to be 2 section, choose the test case "D16 - Certificate examined at Step 26). TE1.0 discovery in LDAP based on SRV weight value." 4 Attempt to send a message from the EHR to the Direct (To) address provided by the DCDT for that test case. TE1.0 26 Access the non-Direct (Contact) email address Results emails from the DCDT are received and 3 identified in Step 1 and display the results emails displayed, demonstrating that the following messages TE1.0 from the DCDT. were sent successfully. If no email is received, the test 5 has failed. IN1.01 . D1 . D2 . D3 . D4 . D9 . D10 . D14 . D15 . D16

No results emails were received for the following messages. If an email is received, the test has failed. . D5 . D6 . D7 . D8 . D11 . D12 . D13 27 Access the ETT – Direct Testing home page and The ETT is opened to the Register Direct tab. ETT v Register Direct tab. Proctor documents the ETT version.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts 28 Enter the Direct (From) address identified in Step The Direct email address is loaded into the ETT. 2 into the Direct Email Address field and select the Add button. 29 Enter the (Contact) email address identified in Step 1 into the Contact Email Address field and The Contact address is loaded into the ETT. select the Load/Create Contact button. TE1.0 30 Transmit the CCDA document to the Direct (To) Using the ETT, verify that the CCDA document was 7-1.08 addresses specified in the ETT using the Direct transmitted and received successfully according to the IN1.03 standard. The Direct message should be Direct standard, including successful decryption encrypted using the recipient’s (ETT) Public Key validation. identified at Step 5 and signed using the sender’s (EHR) Private Key. 31 Access the DCDT and open the Hosting section. The DCDT is opened to the Hosting section. 32 Identify whether the EHR stores certificates as Proctor documents the type of certificate used by the address-bound or domain-bound certificates. EHR. 33 Identify whether the EHR hosts certificates in Proctor documents the hosting method used by the DNS or LDAP servers. EHR. TE2.0 34 Select the Test Case that maps to the selections The appropriate test case is selected. 1 in Steps 34 and 35. TE2.0 35 Enter the Direct Address identified at Step 2 into The DCDT reports a successful result when run. 1-2.02 the Direct Address field of the DCDT and select IN2.01 "Submit." 36 Access the ETT – Direct Testing home page. The ETT is opened to the Direct Testing home page. 37 Select the Send Direct Message tab from the The Send Direct Message tab opens on the ETT. TTT home page. 38 Enter the Direct (From) Address identified at Step The Direct (From) address is added. 3 into the Direct From Address field of the ETT. 39 Enter the Direct address identified at Step 2 into The Direct address is added. the Direct To Address field of the ETT. 40 Select Unwrapped from the Message Format The Unwrapped message format type is selected in the section of the ETT. ETT. 41 Select GOOD_CERT from the Signing The GOOD_CERT signing certificate is selected in the Certificate section of the ETT. ETT. 42 Identify the Signing Algorithm to be used. Either SHA-1 or SHA-256 is selected.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts 43 If necessary, upload the EHR's Public Key Public key is uploaded to the ETT if necessary. Certificate via the Encryption Certificate section of the ETT. TE2.0 44 From the Choose document to be sent as the The CCDA document was received by the EHR. 4 message content field of the ETT, select one of IN2.02 the CCDA documents (without an XDM label) and then select Submit to transmit the document as a Direct message. 45 Identify whether the EHR offers the capability to The Proctor documents whether the EHR accepts only accept only unwrapped messages or both unwrapped messages or both unwrapped and RFC- unwrapped and RFC-5751 wrapped messages. 5751 wrapped messages. TE2.0 46 If the EHR accepts both unwrapped and RFC- The Wrapped option is selected and the required test is 5-2.06 5751 wrapped messages, repeat Step 47, except repeated. IN2.02 choose the Wrapped option from the Message Format section of the ETT. TE2.0 47 Access the non-Direct (Contact) email address Validation Results confirm that MDNs were received by 4 identified at Step 1, display the Direct Message the ETT. TE2.0 Validation Report emails, and open the 6 validation reports. IN2.03

48 Reset the Message format to Unwrapped. The Unwrapped message format type is selected in the ETT. TE2.0 49 Remove the ETT's valid Trust Anchor from the The ETT's valid Trust Anchor is no longer stored in the 7 EHR's trust store. Then, from the Direct Testing EHR's trust store and the ETT's Invalid Trust Anchor is home page of the ETT, download and import the stored in the EHR's trust store. Invalid Trust Anchor into the EHR’s trust store. Proctor validates the thumbprints when possible. TE2.0 50 From the Send Direct Message tab of the ETT, A custom email address for sending an unwrapped 8 Email: @ttpedge.sitenv.org enter a custom Direct (From) address (i.e., CCDA document using an invalid trust anchor has been [email protected]) entered.

Proctor documents the Direct (From) address TE2.0 51 Select Send to transmit the document using the The CCDA document is rejected by the EHR. 9-2.10 Time: Direct transport standard. Proctor documents the time the message was sent.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE2.1 52 Remove the ETT's Invalid Trust Anchor from the The ETT's invalid Trust Anchor is no longer stored in the 1 EHR's trust store. Then reimport the ETT's valid EHR's trust store and the ETT's valid Trust Anchor is Trust Anchor into the EHR’s trust store. stored in the EHR's trust store.

Proctor validates the thumbprints when possible. TE2.1 53 Enter a custom Direct (From) address (i.e., A custom email address for sending an unwrapped 2 Email: @ttpedge.sitenv.org invalidcert@ @ttpedge.sitenv.org. CCDA document using an invalid certificate has been entered.

Proctor documents the Direct (From) address. TE2.1 54 Select INVALID_CERT from the Signing The INVALID_CERT signing certificate is selected in the 3 Time: Certificate section of the ETT, then select Send ETT. to transmit the document using the Direct transport standard. The CCDA document is rejected by the EHR.

Proctor documents the time the message was sent. TE2.1 55 Enter a custom Direct (From) address (i.e., A test session name for sending an unwrapped CCDA 5 Email: @ttpedge.sitenv.org expiredcert@ @ttpedge.sitenv.org. document using an expired certificate has been entered.

Proctor documents the Direct (From) address. TE2.1 56 Select EXPIRED_CERT from the Signing The EXPIRED_CERT signing certificate is selected in 6 Time: Certificate section of the ETT, then select Send the ETT. to transmit the document using the Direct The CCDA document is rejected by the EHR. transport standard.

Proctor documents the time the message was sent. TE2.1 57 From the Send a Direct Message tab of the ETT, A test session name for sending an unwrapped CCDA 8 Email: @ttpedge.sitenv.org enter a custom Direct (From) address (i.e., document using a certificate from a different trust anchor difftrust@ @ttpedge.sitenv.org has been entered.

Proctor documents the Direct (From) address . TE2.1 58 Select DIFFERENT_TRUST_ANCHOR from the The DIFFERENT_TRUST_ANCHOR signing certificate 9 Time: Signing Certificate section of the ETT, then is selected in the ETT. select Send to transmit the document using the The CCDA document is rejected by the EHR. Direct transport standard.

Proctor documents the time the message was sent.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE2.1 59 Inspect the system logs to verify that the System logs confirm that the messages were rejected 0 TE2.1 transmitted messages identified in Steps 54, 57, and not received by the EHR. Examine the timestamps 4 59, and 61 were rejected and not received by the and Direct (From) addresses to validate each of the TE2.1 7 EHR. rejected messages. TE2.2 0 TE2.2 1 Verify that no Direct Message Validation Report IN2.04 emails were received via email. -2.05 60 Submit the original results emails from the DCDT Results emails from the DCDT and ETT are submitted and ETT (either individually or together as using the correct subject line. attachments to a single email) to ehr- [email protected] and include the organization name and criterion number in the subject line of the email (e.g. h1_ABCompany).

Resubmissions during the same test session MUST modify the email subject line to include the word ‘Retest’, as in h1_ABCompany_Retest1, h1_ABCompany_Retest2, etc. Select Document any other pertinent observations below: Test Result 170.314(h)(2) Applicability Statement for Secure Health Transport and XDR/XDM for Direct Messaging [Optional] Setup ONC Test Guidance and Test Tool . Create patient records for and input all Data and . Guidance from ICSA Labs data for each of the provided test data Procedure . Direct Certificate Discovery Tool (DCDT) sets . Test . DCDT Google Groups Support Site or Email data is . Edge Testing Tool (ETT) avail . ETT Google Groups Support Site or Email Certificate Thumbprints for Test Tools able from ETT . ONC Test Proc edur e

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts Step # Action to Perform Expected Outcome Ref ere Notes / Deviations nce 1 Identify the non-Direct (Contact) email address to Proctor documents the non-Direct (Contact) email be used to receive the results emails sent from address to be used for receiving the results from the the Direct Certificate Discovery Tool (DCDT) and DCDT and ETT. the Transport Testing Tool (ETT). Note: All results emails must be sent to an email account that is accessible on the presenter’s screen during testing. 2 Identify the Direct address and registered domain Proctor documents the Direct address and registered that will be used by the EHR to send and receive domain to be used by the EHR for sending and receiving Direct messages with XDM Validation to and from Direct messages with XDM Validation to and from the the DCDT and ETT. DCDT and ETT. 3 Identify the Direct (From) address that will be Proctor documents the Direct (From) address to be used Email: @ttpedge.sitenv.org used by the ETT to send valid Direct messages to for the valid Direct tests. the EHR. TE1.0 4 Identify the DCDT's Trust Anchor in the EHR’s The DCDT's Trust Anchor is stored in the EHR's trust 1 trust store. store.

Proctor validates the thumbprints when possible. 5 Identify the ETT's Public Key Certificate and Trust The ETT's Public Key Certificate and Trust Anchor are Anchor in the EHR’s trust store. stored in the EHR's trust store.

Proctor validates the thumbprints when possible. 6 Identify the certificates on the EHR to be used for EHR's certificates are identified. encrypting, decrypting, and signing the Direct message(s) to be sent by the ETT to the EHR's Direct address(es). 7 Identify the CCDA document available for CCDA document is identified. transmission.

Note: CCDA documents are available from the ETT home page via the “Documents” link.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts 8 Access the Direct Certificate Discovery Tool The DCDT is opened to the Discover DCDT's DCDT v (DCDT) and navigate to the Discover DCDT's Certificates section. Certificates section. Proctor documents the DCDT version. TE1.0 9 In Step 3 of the Discover DCDT's Certificates The EHR’s Direct address and the non-Direct (Contact) 2-1.03 section, map the Direct address for the EHR email address are mapped on the DCDT. specified in Step 2 of this test script as the Direct Address and map the non-Direct (Contact) email address specified in Step 1 of this test script as the Email Address. TE1.0 10 In Step 5 of the Discover DCDT's Certificates Sending of message was attempted (results email to be 2 section, choose the test case "D1 - Valid address- examined at Step 26). TE1.0 bound certificate discovery in DNS." Attempt to 4 send a message from the EHR to the Direct (To) address provided by the DCDT for that test case. TE1.0 11 In Step 5 of the Discover DCDT's Certificates Sending of message was attempted (results email to be 2 section, choose the test case "D2 - Valid domain- examined at Step 26). TE1.0 bound certificate discovery in DNS." Attempt to 4 send a message from the EHR to the Direct (To) address provided by the DCDT for that test case. TE1.0 12 In Step 5 of the Discover DCDT's Certificates Sending of message was attempted (results email to be 2 section, choose the test case "D3 - Valid address- examined at Step 26). TE1.0 bound certificate discovery in LDAP." Attempt to 4 send a message from the EHR to the Direct (To) address provided by the DCDT for that test case. TE1.0 13 In Step 5 of the Discover DCDT's Certificates Sending of message was attempted (results email to be 2 section, choose the test case "D4 - Valid domain- examined at Step 26). TE1.0 bound certificate discovery in LDAP." Attempt to 4 send a message from the EHR to the Direct (To) address provided by the DCDT for that test case. TE1.0 14 In Step 5 of the Discover DCDT's Certificates Sending of message was attempted (results email to be 2 section, choose the test case "D5 - Invalid examined at Step 26). TE1.0 address-bound certificate discovery in DNS." 4 Attempt to send a message from the EHR to the Direct (To) address provided by the DCDT for that test case.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE1.0 15 In Step 5 of the Discover DCDT's Certificates Sending of message was attempted (results email to be 2 section, choose the test case "D6 - Invalid examined at Step 26). TE1.0 domain-bound certificate discovery in DNS." 4 Attempt to send a message from the EHR to the Direct (To) address provided by the DCDT for that test case. TE1.0 16 In Step 5 of the Discover DCDT's Certificates Sending of message was attempted (results email to be 2 section, choose the test case "D7 - Invalid examined at Step 26). TE1.0 address-bound certificate discovery in LDAP." 4 Attempt to send a message from the EHR to the Direct (To) address provided by the DCDT for that test case. TE1.0 17 In Step 5 of the Discover DCDT's Certificates Sending of message was attempted (results email to be 2 section, choose the test case "D8 - Invalid examined at Step 26). TE1.0 domain-bound certificate discovery in LDAP." 4 Attempt to send a message from the EHR to the Direct (To) address provided by the DCDT for that test case. TE1.0 18 In Step 5 of the Discover DCDT's Certificates Sending of message was attempted (results email to be 2 section, choose the test case "D9 - Select valid examined at Step 26). TE1.0 address-bound certificate over invalid certificate in 4 DNS." Attempt to send a message from the EHR to the Direct (To) address provided by the DCDT for that test case. TE1.0 19 In Step 5 of the Discover DCDT's Certificates Sending of message was attempted (results email to be 2 section, choose the test case "D10 - Certificate examined at Step 26). TE1.0 discovery in LDAP with one unavailable LDAP 4 server." Attempt to send a message from the EHR to the Direct (To) address provided by the DCDT for that test case. TE1.0 20 In Step 5 of the Discover DCDT's Certificates Sending of message was attempted (results email to be 2 section, choose the test case "D11 - No examined at Step 26). TE1.0 certificates discovered in DNS CERT records and 4 no SRV records." Attempt to send a message from the EHR to the Direct (To) address provided by the DCDT for that test case.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE1.0 21 In Step 5 of the Discover DCDT's Certificates Sending of message was attempted (results email to be 2 section, choose the test case "D12 - No examined at Step 26). TE1.0 certificates found in DNS CERT records and no 4 available LDAP servers." Attempt to send a message from the EHR to the Direct (To) address provided by the DCDT for that test case. TE1.0 22 In Step 5 of the Discover DCDT's Certificates Sending of message was attempted (results email to be 2 section, choose the test case "D13 - No examined at Step 26). TE1.0 certificates discovered in DNS CERT records or 4 LDAP servers." Attempt to send a message from the EHR to the Direct (To) address provided by the DCDT for that test case. TE1.0 23 In Step 5 of the Discover DCDT's Certificates Sending of message was attempted (results email to be 2 section, choose the test case "D14 - Discovery of examined at Step 26). TE1.0 certificate larger than 512 bytes in DNS." Attempt 4 to send a message from the EHR to the Direct (To) address provided by the DCDT for that test case. TE1.0 24 In Step 5 of the Discover DCDT's Certificates Sending of message was attempted (results email to be 2 section, choose the test case "D15 - Certificate examined at Step 26). TE1.0 discovery in LDAP based on SRV priority value." 4 Attempt to send a message from the EHR to the Direct (To) address provided by the DCDT for that test case. TE1.0 25 In Step 5 of the Discover DCDT's Certificates Sending of message was attempted (results email to be 2 section, choose the test case "D16 - Certificate examined at Step 26). TE1.0 discovery in LDAP based on SRV weight value." 4 Attempt to send a message from the EHR to the Direct (To) address provided by the DCDT for that test case.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE1.0 26 Access the non-Direct (Contact) email address Results emails from the DCDT are received and 3 identified in Step 1 and display the results emails displayed, demonstrating that the following messages TE1.0 from the DCDT. were sent successfully. If no email is received, the test 5 has failed. IN1.01 . D1 . D2 . D3 . D4 . D9 . D10 . D14 . D15 . D16

Proctor documents the ETT version. 28 From the home page of the ETT - Direct, select The Register Direct tab opens on the ETT Register Direct. 29 Enter the Direct (From) address identified in Step The Direct email address is loaded into the ETT. 3 into the Direct Email Address field and select the Add button.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts 30 Enter the (Contact) email address identified in The Contact address is loaded into the ETT. Step 1 into the Contact Email Address field and select the Load/Create Contact button. 31 Register the Direct (To) addresses (specified on The Direct (To) addresses are stored within the EHR, TE1.0 6 the ETT – DIRECT home page) in the EHR. (to displayed as visible Direct addresses, and are available IN1.02 be available as a recipient for sending of Direct as a recipient for sending of Direct messages within the messages with XDM Validation within the EHR). EHR. TE1.0 32 Transmit the CCDA document to the Direct (To) Using the ETT, verify that the CCDA document was 7-1.08 addresses specified in the ETT using the Direct transmitted and received successfully according to the IN1.03 standard with XDM Validation. The Direct Direct standard with XDM Validation, including message should be encrypted using the successful decryption validation. recipient’s (ETT) Public Key identified at Step 5 and signed using the sender’s (EHR) Private Key. 33 Access the Direct Certificate Discovery Tool The DCDT is opened to the Hosting section. (DCDT) and open the Hosting section. 34 Identify whether the EHR stores certificates as Proctor documents the type of certificate used by the address-bound or domain-bound certificates. EHR. 35 Identify whether the EHR hosts certificates in Proctor documents the hosting method used by the DNS or LDAP servers. EHR. TE2.0 36 Select the Test Case that maps to the selections The appropriate test case is selected. 1 in Steps 34 and 35. TE2.0 37 Enter the Direct address identified at Step 2 into The DCDT reports a successful result when run. 1-2.02 the Direct Address field of the DCDT and select IN2.01 "Submit". 38 Access the Edge Testing Tool (ETT). The ETT is opened to the home page.

39 Access the ETT – Direct Testing home page. The Send Direct Message tab opens on the ETT. Select the Send Direct Message tab from the TTT home page. 40 Enter the Direct (From) Address identified at Step The Direct (From) address is added. 3 into the Direct From Address field of the ETT. 41 Enter the Direct address identified at Step 2 into The Direct address is added. the Direct To Address field of the ETT. 42 Select Unwrapped from the Message Format The Unwrapped message format type is selected in the section of the ETT. ETT. 43 Select GOOD_CERT from the Signing The GOOD_CERT signing certificate is selected in the Certificate section of the ETT. ETT.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts 44 Identify the Signing Algorithm to be used. Either SHA-1 or SHA-256 is selected.

45 If necessary, upload the EHR's Public Key Public key is uploaded to the ETT if necessary. Certificate via the Encryption Certificate section of the ETT. TE2.0 46 From the Choose document to be sent as the The CCDA document was received by the EHR. 4 message content field of the ETT, select one of IN2.02 the CCDA documents (without an XDM label) and then select Send to transmit the document as a Direct message. 47 Identify whether the EHR offers the capability to The Proctor documents whether the EHR accepts only accept only unwrapped messages or both unwrapped messages or both unwrapped and RFC- unwrapped and RFC-5751 wrapped messages. 5751 wrapped messages. TE2.0 48 If the EHR accepts both unwrapped and RFC- The Wrapped option is selected and all required tests 5-2.06 5751 wrapped messages, repeat Step46, except are repeated. IN2.02 choose the Wrapped option from the Message Format section of the TTT. TE2.0 49 Access the non-Direct (Contact) email address Validation Results confirm that MDNs were received by 4 identified at Step 1, display the Direct Message the TTT. TE2.0 Validation Report emails, and open the 6 validation reports. IN2.03

TE2.0 50 Remove the ETT's valid Trust Anchor from the The ETT's valid Trust Anchor is no longer stored in the 7 EHR's trust store. Then, from the Direct Testing EHR's trust store and the ETT's Invalid Trust Anchor is home page of the ETT, download and import the stored in the EHR's trust store. Invalid Trust Anchor into the EHR’s trust store. Proctor validates the thumbprints when possible. TE2.0 51 From the Send Direct Message tab of the ETT, A custom email address for sending an unwrapped 8 Email: @ttpedge.sitenv.org enter a custom Direct (From) address (i.e., CCDA document using an invalid trust anchor has been [email protected]. entered.

Proctor documents the Direct (From) address. TE2.0 52 Select Send to transmit the document using the The CCDA document is rejected by the EHR. 9-2.10 Time: Direct transport standard with XDM Validation. Proctor documents the time the message was sent.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE2.1 53 Remove the ETT's Invalid Trust Anchor from the The ETT's invalid Trust Anchor is no longer stored in the 1 EHR's trust store, then reimport the ETT's valid EHR's trust store and the ETT's valid Trust Anchor is Trust Anchor into the EHR’s trust store. stored in the EHR's trust store.

Proctor validates the thumbprints when possible. TE2.1 54 Enter a custom Direct (From) address (i.e., A custom email address for sending an unwrapped 2 invalidcert@ @ttpedge.sitenv.org. CCDA document using an invalid certificate has been Email: @ttpedge.sitenv.org entered.

Proctor documents the Direct (From) address. TE2.1 55 Select INVALID_CERT from the Signing The INVALID_CERT signing certificate is selected in the 3 Time: Certificate section of the ETT, then select Send ETT. The CCDA document is rejected by the EHR. to transmit the document using the Direct transport standard. Proctor documents the time the message was sent. TE2.1 56 Enter a custom Direct (From) address (i.e., A test session name for sending an unwrapped CCDA 3-2.14 Email: @ttpedge.sitenv.org expiredcert@ @ttpedge.sitenv.org. document using an expired certificate has been entered.

Proctor documents the Direct (From) address. TE2.1 59 Select DIFFERENT_TRUST_ANCHOR from the DIFFERENT_TRUST_ANCHOR signing certificate is 6-2.17 Time: Signing Certificate section of the ETT, then selected in the ETT. The CCDA document is rejected by select Send to transmit the document using the the EHR. Direct transport standard. Proctor documents the time the message was sent.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE2.1 60 Inspect the system logs to verify that the System logs confirm that the messages were rejected 0 TE2.1 transmitted messages identified in Steps 52, 55, and not received by the EHR. Examine the timestamps 4 57, and 59 were rejected and not received by the and Direct (From) addresses to validate each of the TE2.1 7 EHR. rejected messages. TE2.2 0 TE2.2 1 Verify that no Direct Message Validation Report IN2.04 emails were received via email. -2.05 61 Submit the original results emails from the DCDT Results emails from the DCDT and ETT are submitted and ETT (either individually or together as using the correct subject line. attachments to a single email) to ehr- [email protected] and include the organization name and criterion number in the subject line of the email (e.g. h2_ABCompany).

Resubmissions during the same test session MUST modify the email subject line to include the word ‘Retest’, as in h2_ABCompany_Retest1, h2_ABCompany_Retest2, etc. Select Document any other pertinent observations below: Test Result 170.314(h)(3) SOAP Transport and Security Specification and XDR/XDM for Direct Messaging [Optional] Setup ONC Test Guidance and Test Tool . Create patient records for and input all Data and . Guidance from ICSA Labs data for each of the provided test data Procedure . Edge Testing Tool (ETT) sets . Test . ETT Google Groups Support Site or Email Certificate Thumbprints for Test Tools data is avail able from ETT . ONC Test Proc edur e

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts Step # Action to Perform Expected Outcome Ref ere Notes / Deviations nce 1 Access the Edge Testing Tool (ETT). The ETT is opened to the home page. ETT v

Proctor documents the ETT version. 2 From the home page of the TTT, select The Sim Control tab opens on the TTT. Simulator Control. 3 From the Select actor type field, select SOAP endpoint is generated. Document Recipient and then select the Create Actor Simulator button. 4 Copy and save the PnR TLS endpoint to be TLS endpoint is copied and saved to be used in the used as the recipient endpoint that must be used. EHR.

Note: The PnR endpoint is non-TLS and must not be used. 5 Select the correct CCDA type from the Expected The Expected CCDA Type for XDR content is CCDA Type for XDR content. selected. 6 Provide a Name to identify the connection in A Name is entered for the connection. Name: subsequent menus. Proctor documents the Name to identify the connection in subsequent menus. 7 Select the Save button to create the simulator Simulator is created. under the Name entered. TE1.0 8 Using the EHR, transmit the CCDA document for CCDA is transmitted. 1 Referral Summary/Transition of Care using SOAP Protocols with XDR Validation to the SOAP endpoint generated at Step 3 in the TTT.

Note: CCDA documents are available from the TTT home page via the “Human readable CDA/CCR data” link. 9 From the home page of the TTT, select The Sim Msgs tab opens on the TTT. Simulator Message View.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE1.0 10 From the Simulator field, select the Name A display will be presented that depicts the messages 2 created at Step 6. exchanged with that Simulator. Verify that the Transition IN1.01 of Care/Referral Summary was transmitted using SOAP Protocols with XDR Validation and no errors are displayed. 11 From the home page of the TTT, select The ActorConfig tab opens on the TTT. Site/Actor Configuration. 12 Select the + button to add a new Actor. The form to add a new Actor is displayed. 13 Provide a Site Name to identify the endpoint used A Site Name is entered to identify the endpoint used by Site Name: by the EHR to receive each XDR message in the EHR. subsequent menus. Proctor documents the Name to identify the connection in subsequent menus. 14 Define and identify an Actor Simulator in the TTT Actor Simulator is defined and identified. terminology (as described in the TTT User Guide), and select the Save Changes button to create the endpoint under the Site Name entered.

Note: Do not use the non-TLS Endpoints column as that feature is not supported. 15 From the home page of the TTT, select XDR The XDR Send tab opens on the TTT. Send. 16 From the Environment field, select the The SOAP_TEST option is selected. SOAP_TEST option. 17 Enter a valid Patient ID that corresponds to the A valid Patient ID is entered. Patient ID: patient record that exists within the EHR that will receive the CCDA. Proctor documents the Patient ID. 18 Select the applicable document from the Select The appropriate Select Test Data Set is selected. Test Data Set field. 19 Select NHIN SAML from the SAML menu. NHIN SAML is selected. 20 Select the TLS? check box. TLS? check box is selected. 21 Select the Actor defined in Step 14 within the The applicable Actor is selected. Document Recipient section. TE2.0 22 Select the Run button to transmit a CCDA CCDA is transmitted. 1 document using SOAP Protocols with XDR Validation using both NHIN SAML and TLS to the EHR’s SOAP endpoint. Page 167 of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE2.0 23 Select the Inspect Results button to view the Verify that the transmitted documents were received 2 results. successfully by the EHR according to SOAP Protocols IN2.01 with XDR Validation with no errors. Select Document any other pertinent observations below: Test Result 170.314(b)(8) Transitions of Care – Send and Receive via Edge Protocol [Optional] Setup Guidance and Test Tool . Create patient records for and input all data for each of the provided . Guidance from ICSA Labs test data sets . Edge Testing Tool (ETT) . Register a login on the ETT using the instructions provided in the . ETT Google Groups Support Site or Email Edge Testing Tool User Guide . For SMTP Test Cases create and save all necessary profiles, enable SMTP Authentication Required on the EHR, and enable logging of the authentication method used to verify PLAIN SASL usage

Step # Action to Perform Expected Outcome Ref ere Notes / Deviations nce TE1.0 1 Log in to the EHR as a provider, create the Test data has been entered correctly and without 1-1.02 patient encounter and summary care record using omission. IN- the appropriate data set [Ambulatory or Inpatient], 1.01 and display the Common MU Data Set and the following data elements: . Encounter diagnoses . Immunizations . Cognitive and functional status . Reason for referral [AMB only] . Referring provider’s name and contact information [AMB only] . Discharge instructions [INP only] TE1.0 2 Generate a transition of care/referral summary Each applicable CCDA document is generated and is 2-1.03 CCDA document for each applicable data set correct and without omission. IN- (Ambulatory and/or Inpatient). 1.01

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts 3 Identify the edge protocol to be used to send Edge protocol is identified. health information from the EHR to the HISP: . IHE XDR profile for Limited Metadata Proctor documents the edge protocol. Document Sources edge protocol . SMTP-focused edge protocol 4 Login to the Edge Testing Tool (ETT) and ETT is opened to the Help page. ETT v navigate to the Help page. Proctor documents the ETT version. ☐ Steps 5-68 only performed by systems demonstrating the IHE XDR profile for Limited Metadata Document Sources as the edge protocol to send health information 5 Navigate to the XDR Test Cases section and The Sender test page is opened. [Conditional] select the Your System as: Sender button. 6 Identify the Direct (From) address and registered Proctor documents the Direct (From) address and [Conditional] domain that will be used by the EHR to send XDR registered domain to be used for the XDR send tests. messages to the ETT. 7 Identify the IP address that will be used by the Proctor documents the IP address to be used for the [Conditional] EHR to send XDR messages to the ETT. XDR send tests. TE2.0 8 In the section for XDR Test 6 enter the Direct The XDR Test 6 TLS endpoint is generated. 1 [Conditional] (From) address specified in Step 6 and select Run. TE2.0 9 Configure the EHR to create and send an XDR EHR is configured to send an XDR message to the XDR 1 [Conditional] message using the XDR Test 6 TLS endpoint as Test 6 TLS endpoint and a session connection is the XDR message recipient. Session connection established. must occur before any data is transmitted. TE2.0 10 Attempt to send an XDR message to the XDR Confirm receipt of the XDR message by changing the 1 [Conditional] Test 6 TLS endpoint and then select Pending Pending Refresh button to Waiting Validation. Refresh to check the status. 11 Upon refresh completion select the Waiting The log screen for the test case is displayed. IN2.01 [Conditional] Validation button. 12 Manually review the Request and Response Confirm a mutual TLS session is established between IN2.01 [Conditional] tabs to confirm the message content and the EHR and the ETT prior to transmitting any data. metadata conform to the testing objectives. 13 If confirmed by the Tester, select the Accept XDR Acceptance or rejection of the XDR message content IN2.05 [Conditional] button. If not confirmed by the Tester, select the results in overall Test Case testing success or failure Reject XDR button. and is recorded in the Validation Report.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE2.0 14 In the section for XDR Test 7 enter the EHR’s IP The XDR Test 7 TLS endpoint is generated. 2 [Conditional] address specified in Step 7 and select Run. TE2.0 15 Configure the EHR to create and send an XDR EHR is configured to send an XDR message to the XDR 2 [Conditional] message using the XDR Test 7 TLS endpoint as Test 7 TLS endpoint. the XDR message recipient. TE2.0 16 Attempt to send an XDR message to the XDR Confirm receipt of the XDR message by changing the 2 [Conditional] Test 7 TLS endpoint and then select Pending Pending Refresh button to Waiting Validation. Refresh to check the status. 17 Upon refresh completion select the Waiting The log screen for the test case is displayed. IN2.02 [Conditional] Validation button. 18 Manually review the Request and Response Confirm the EHR disconnects from the ETT when the IN2.02 [Conditional] tabs to confirm the message content and ETT provides an invalid certificate and incorrect mutual metadata conform to the testing objectives. TLS configuration. 19 If confirmed by the Tester, select the Accept XDR Acceptance or rejection of the XDR message content IN2.05 [Conditional] button. If not confirmed by the Tester, select the results in overall Test Case testing success or failure Reject XDR button. and is recorded in the Validation Report. TE2.0 20 In the section for XDR Test 1 enter the Direct The XDR Test 1 TLS endpoint is generated. 3 [Conditional] (From) address specified in Step 6 and select Run. TE2.0 21 Configure the EHR to create and send an XDR EHR is configured to send an XDR message to the XDR 3 [Conditional] message using the XDR Test 1 TLS endpoint as Test 1 TLS endpoint. the XDR message recipient. TE2.0 22 Attempt to send each applicable CCDA document Confirm receipt of the XDR message by changing the 3 [Conditional] generated in Step 2 to the XDR Test 1 TLS Pending Refresh button to Waiting Validation. endpoint in an XDR message with limited metadata and a Direct Address block using the Implementation Guide for Direct Edge Protocols version 1.1 (XDR-1) and then select Pending Refresh to check the status. 23 Upon refresh completion select the Waiting The log screen for the test case is displayed. IN2.03 [Conditional] Validation button. TE2.0 24 Manually review the Request and Response Confirm each applicable CCDA XML document was 5-2.06 [Conditional] tabs to confirm the message content and sent with limited metadata and received successfully IN2.03 metadata conform to the testing objectives. according to the Implementation Guide for Direct Edge Protocols v1.1. Retrieve the CCDA XML document for conformance validation to be performed later. CCDA XML document is saved for the conformance validation step to be performed later. Page 170 of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts 25 If confirmed by the Tester, select the Accept XDR Acceptance or rejection of the XDR message content IN2.03 [Conditional] button. If not confirmed by the Tester, select the results in overall Test Case testing success or failure Reject XDR button. and is recorded in the Validation Report. TE2.0 26 In the section for XDR Test 2 enter the Direct The XDR Test 2 TLS endpoint is generated. 4 [Conditional] (From) address specified in Step 6 and select Run. TE2.0 27 Configure the EHR to create and send an XDR EHR is configured to send an XDR message to the XDR 4 [Conditional] message using the XDR Test 2 TLS endpoint as Test 2 TLS endpoint. the XDR message recipient. TE2.0 28 Attempt to send each applicable CCDA document Confirm receipt of the XDR message by changing the 4 [Conditional] generated in Step 1 to the XDR Test 2 TLS Pending Refresh button to Waiting Validation. endpoint in an XDR message with full metadata using the standard edge protocol and then select Pending Refresh to check the status. 29 Upon refresh completion select the Waiting The log screen for the test case is displayed. IN2.04 [Conditional] Validation button. TE2.0 30 Manually review the Request and Response Confirm each applicable CCDA XML document was 5-2.06 [Conditional] tabs to confirm the message content and sent with full metadata and received successfully IN2.04 metadata conform to the testing objectives. according to the Implementation Guide for Direct Edge Protocols v1.1. Retrieve the CCDA XML document for conformance validation to be performed later. CCDA XML document is saved for the conformance validation step to be performed later. 31 If confirmed by the Tester, select the Accept XDR Acceptance or rejection of the XDR message content IN2.04 [Conditional] button. If not confirmed by the Tester, select the results in overall Test Case testing success or failure Reject XDR button. and is recorded in the Validation Report. TE2.0 32 In the section for XDR MU2 Test 19 enter the The XDR MU2 Test 19 TLS endpoint is generated. 7 [Conditional] Direct (From) address specified in Step 6 and select Run. TE2.0 33 Configure the EHR to create and send multiple EHR is configured to send multiple XDR messages to 7 [Conditional] XDR messages using the XDR MU2 Test 19 TLS the XDR MU2 Test 19 TLS endpoint. endpoint as the XDR message recipient. TE2.0 34 Attempt to send three separate XDR messages to Confirm receipt of each XDR message by changing the 7 [Conditional] the XDR MU2 Test 19 TLS endpoint, each with Pending Refresh button to Waiting Validation. unique message IDs, and then select Pending Refresh to check the status. 35 Upon refresh completion of each message select The log screen for the test case is displayed for each IN2.09 [Conditional] the Waiting Validation button. message.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts 36 Manually review the Request and Response Confirm the EHR is able to create multiple messages IN2.09 [Conditional] tabs to confirm the message content and with unique message IDs specific to each message. metadata conform to the testing objectives. Each unique message ID shall be included in the MessageID field of the WS-Addressing Header element. 37 If confirmed by the Tester, select the Accept XDR Acceptance or rejection of the XDR message content IN2.09 [Conditional] button. If not confirmed by the Tester, select the results in overall Test Case testing success or failure Reject XDR button. and is recorded in the Validation Report. TE2.0 38 In the section for XDR MU2 Test 20a enter the The XDR MU2 Test 20a TLS endpoint is generated. 8 [Conditional] Direct (From) address specified in Step 6 and select Run. TE2.0 39 Configure the EHR to create and send an XDR EHR is configured to send an XDR message to the XDR 8 [Conditional] message using the XDR MU2 Test 20a TLS MU2 Test 20a TLS endpoint. endpoint as the XDR message recipient. TE2.0 40 Attempt to send an applicable CCDA document Confirm receipt of the XDR message by changing the 8 [Conditional] generated in Step 1 to the ETT in an XDR Pending Refresh button to Waiting Validation. message using the XDR MU2 Test 20a TLS endpoint as the XDR message recipient and then select Pending Refresh to check the status. 41 Upon refresh completion select the Waiting The log screen for the test case is displayed. IN2.10 [Conditional] Validation button. 42 Manually review the Request and Response Confirm the Processed MDN is sent. IN2.10 [Conditional] tabs to confirm the message content and metadata conform to the testing objectives. The EHR must be able to accept failure messages for invalid recipients from the ETT. Failure messages to invalid recipients have to be processed/tracked appropriately. 43 If confirmed by the Tester, select the Accept XDR Acceptance or rejection of the XDR message content IN2.10 [Conditional] button. If not confirmed by the Tester, select the results in overall Test Case testing success or failure Reject XDR button. and is recorded in the Validation Report. TE2.0 44 In the section for XDR MU2 Test 20b enter the The XDR MU2 Test 20b TLS endpoint is generated. 8 [Conditional] Direct (From) address specified in Step 6 and select Run. TE2.0 45 Configure the EHR to create and send an XDR EHR is configured to send an XDR message to the XDR 8 [Conditional] message using the XDR MU2 Test 20b TLS MU2 Test 20b TLS endpoint. endpoint as the XDR message recipient.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE2.0 46 Attempt to send an applicable CCDA document Confirm receipt of the XDR message by changing the 8 [Conditional] generated in Step 1 to the ETT in an XDR Pending Refresh button to Waiting Validation. message using the XDR MU2 Test 20b TLS endpoint as the XDR message recipient and then select Pending Refresh to check the status. 47 Upon refresh completion select the Waiting The log screen for the test case is displayed. IN2.10 [Conditional] Validation button. 48 Manually review the Request and Response Confirm the Failure MDN is sent. IN2.10 [Conditional] tabs to confirm the message content and metadata conform to the testing objectives. The EHR must be able to accept failure messages for invalid recipients from the ETT. Failure messages to invalid recipients have to be processed/tracked appropriately. 49 If confirmed by the Tester, select the Accept XDR Acceptance or rejection of the XDR message content IN2.10 [Conditional] button. If not confirmed by the Tester, select the results in overall Test Case testing success or failure Reject XDR button. and is recorded in the Validation Report. TE2.0 50 In the section for XDR MU2 Test 48 enter the The XDR MU2 Test 48 TLS endpoint is generated. 9 [Conditional] Direct (From) address specified in Step 6 and select Run. TE2.0 51 Configure the EHR to create and send multiple EHR is configured to send multiple XDR messages to 9 [Conditional] XDR messages using the XDR MU2 Test 48 TLS the XDR MU2 Test 48 TLS endpoint. endpoint as the XDR message recipient. TE2.0 52 Attempt to send multiple XDR messages (the Confirm receipt of each XDR message by changing the 9 [Conditional] exact number to be determined by the proctor Pending Refresh button to Waiting Validation. based on the amount of rigor the testing requires), each with unique message IDs, using the XDR MU2 Test 48 TLS endpoint as the XDR message recipient and then select Pending Refresh to check the status. 53 Upon refresh completion of each message select The log screen for the test case is displayed for each IN2.11 [Conditional] the Waiting Validation button. message. 54 Manually review the Request and Response Confirm the EHR is able to create multiple messages IN2.11 [Conditional] tabs to confirm the message content and with unique message IDs specific to each message. metadata conform to the testing objectives. Each unique message ID shall be included in the MessageID field of the WS-Addressing Header element. 55 If confirmed by the Tester, select the Accept XDR Acceptance or rejection of the XDR message content IN2.11 [Conditional] button. If not confirmed by the Tester, select the results in overall Test Case testing success or failure Reject XDR button. and is recorded in the Validation Report.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE2.1 56 In the section for XDR MU2 Test 49 enter the The XDR MU2 Test 49 TLS endpoint is generated. 0 [Conditional] Direct (From) address specified in Step 6 and select Run. TE2.1 57 Configure the EHR to create and send an XDR EHR is configured to send an XDR message to the XDR 0 [Conditional] message with a valid Direct Address Block and MU2 Test 49 TLS endpoint. Delivery Notifications header using the XDR MU2 Test 49 TLS endpoint as the XDR message recipient. TE2.1 58 Attempt to send an XDR message using the XDR Confirm receipt of the XDR message by changing the 0 [Conditional] MU2 Test 49 TLS endpoint as the XDR message Pending Refresh button to Waiting Validation. recipient and then select Pending Refresh to check the status. 59 Upon refresh completion select the Waiting The log screen for the test case is displayed. IN2.12 [Conditional] Validation button. 60 Manually review the Request and Response Confirm the EHR is able to generate the Direct Address IN2.12 [Conditional] tabs to confirm the message content and Block header including the Disposition Notifications metadata conform to the testing objectives. header. 61 If confirmed by the Tester, select the Accept XDR Acceptance or rejection of the XDR message content IN2.12 [Conditional] button. If not confirmed by the Tester, select the results in overall Test Case testing success or failure Reject XDR button. and is recorded in the Validation Report. TE2.1 62 In the section for XDR MU2 Test 20a enter the The XDR MU2 Test 20a TLS endpoint is generated. 1 [Conditional] Direct (From) address specified in Step 6 and select Run. TE2.1 63 Configure the EHR to create and send an XDR EHR is configured to send an XDR message to both the 1 [Conditional] message using both the XDR MU2 Test 50a and XDR MU2 Test 50a and XDR MU2 Test 50b TLS XDR MU2 Test 50b TLS endpoints as the XDR endpoints at the same time. message recipient at the same time. TE2.1 64 Attempt to an XDR message using both the XDR Confirm receipt of both XDR messages by changing 1 [Conditional] MU2 Test 50a and XDR MU2 Test 50b TLS both Pending Refresh buttons to Waiting Validation. endpoints as XDR message recipients at the same time and then select both Pending Refresh buttons to check the status. 65 Upon refresh completion select both Waiting The log screen for each test case is displayed. IN2.13 [Conditional] Validation buttons. 66 Manually review the Request and Response Confirm the Processed MDN and Failure MDN are sent. IN2.13 [Conditional] tabs to confirm the message content and metadata conform to the testing objectives. The EHR must be able to accept failure messages from invalid recipients. Page 174 of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts 67 If confirmed by the Tester, select the Accept XDR Acceptance or rejection of the XDR message content IN2.13 [Conditional] button. If not confirmed by the Tester, select the results in overall Test Case testing success or failure Reject XDR button. and is recorded in the Validation Report. 68 Select the Validation Reports page and view the Verify that all tests have been completed with a status of IN2.14 [Conditional] results. pass or fail. ☐ Steps 69-84 only performed by systems demonstrating SMTP as the edge protocol to send health information 69 Navigate to the SMTP Test Cases section and The Sender test page is opened. [Conditional] select the Sender button. 70 Identify the server hostname or IP address that The identified server should directly host the EHR email [Conditional] will be used by the EHR to send SMTP messages address listed in step 71. to the ETT. Proctor documents the server hostname or IP address to be used for the SMTP send tests. 71 Identify the email address that will be used by the The email address should be the same email address [Conditional] EHR when sending SMTP messages to the ETT. used to create the user account on the ETT.

Proctor documents the email address to be used for the SMTP send tests. 72 Identify the username and password on the The username and password should correspond to the Username: [Conditional] EHR’s SMTP server to be used for PLAIN SASL email address listed in step 71. Password: Authorization. Proctor documents the username and password to be used for the SMTP send tests using PLAIN SASL Authorization. TE3.0 73 Compose an email from the EHR’s email address Email is created and each applicable CCDA is sent to 1 [Conditional] and send each applicable CCDA document the ETT. TE3.0 generated in Step 2 to 3 TE3.0 [email protected] to initiate a TLS 5-3.06 session and authenticate using PLAIN SASL authentication to the ETT SMTP server using the username and password identified in Step 72.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE3.0 74 Select the applicable SMTP profile and then Verify a secure session was established, a STARTTTLS 1 [Conditional] select Run in the section for SMTP Test 1-8, 14, command was received, and successful authentication TE3.0 18. with PLAIN SASL was performed. 3 TE3.0 5 A green check represents a pass and a red X represents IN3.01 IN3.03 a fail. The ETT validation report should also indicate a IN3.05 successful sequence of commands for SMTP protocols -3.07 (SMTP-1 through SMTP-8).

TE3.0 75 Manually review the Request and Response Confirm each applicable CCDA XML document was 6 [Conditional] tabs to confirm the message content and sent according to the Implementation Guide for Direct IN3.05 metadata conform to the testing objectives. Edge Protocols (SMTP) standard v1.1. The ETT -3.07 validation report should indicate: Retrieve the CCDA XML document for . The CCDA Implementation Guide conformance conformance validation to be performed later. requirements tested are met by the electronically generated (Ambulatory/Inpatient) Transition of Care/Referral Summary . The standards for the named vocabularies for the Common MU Data Set, Encounter diagnoses, and Immunizations are met by the electronically generated Transition of Care/Referral Summary

CCDA XML document is saved for the conformance validation step to be performed later. TE3.0 76 Compose three or more emails from the EHR’s Emails are created sent to the ETT using unique IDs for 8 [Conditional] email address (the exact number to be each message. determined by the proctor based on the amount of rigor the testing requires) and send them to [email protected] with unique message IDs specific to each message. 77 Select the applicable SMTP profile and then Verify the EHR is able to create multiple messages with IN3.10 [Conditional] select Run in the section for SMTP MU2 Test 17. unique message IDs specific to each message. A green check represents a pass and a red X represents a fail. TE3.1 78 Compose three or more emails from the EHR’s Emails are created and sent to the ETT using unique IDs 0 [Conditional] email address (the exact number to be for each message. determined by the proctor based on the amount of rigor the testing requires) and send them to [email protected] with unique message IDs specific to each message. Page 176 of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts 79 Select the applicable SMTP profile and then Verify the EHR is able to create multiple messages with IN3.12 [Conditional] select Run in the section for SMTP MU2 Test 45. unique message IDs specific to each message. A green check represents a pass and a red X represents a fail. TE3.1 80 Compose an email from the EHR’s email address Email is created and sent to the ETT using the proper 1 [Conditional] and send it to [email protected] header. with a valid Disposition-Notifications-Options Header that provides an extensible mechanism for required information and additional control over how and what MDNs are generated per section 1.3 of the Implementation Guide for Delivery Notifications. 81 Select the applicable SMTP profile and then Verify that the ETT will process the Disposition- IN3.13 [Conditional] select Run in the section for SMTP MU2 Test 46. Notifications-Options header appropriately and include the header in the message to the receiver. A green check represents a pass and a red X represents a fail. TE3.1 82 Compose an email from the EHR’s email address Email is created and sent to the ETT using both 2 [Conditional] and send a single message to both addresses. [email protected] and [email protected]. 83 Select the applicable SMTP profile and then Verify that the system has received, processed, and IN3.14 [Conditional] select Run in the section for SMTP MU2 Test 47. tracked a successful MDN for processedonly5@hit- testing2.nist.gov and failure Message (MDN) for [email protected]. A green check represents a pass and a red X represents a fail. 84 Select the Validation Reports page and view the Verify that all tests have been completed with a status of IN3.15 [Conditional] results. pass or fail. ☐ Steps 85-124 only performed by systems demonstrating the IHE XDR profile for Limited Metadata Document Sources as the edge protocol to receive health information 85 Navigate to the XDR Test Cases section and The Receiver test page is opened. [Conditional] select the Your System as: Receiver button. 86 Identify the TLS endpoint that will be used by the Proctor documents the TLS endpoint to be used for the [Conditional] EHR to receive XDR messages from the ETT. XDR receive tests. 87 Identify the IP address and port number that will Proctor documents the IP address and port number to [Conditional] be used by the EHR to receive XDR messages be used for the XDR receive tests. from the ETT.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE4.0 88 In the section for XDR Test 8 enter the IP The EHR’s IP address and port number is configured for 1 [Conditional] address and port number specified in Step 86 and XDR Test 8 and the XDR message is sent. Confirm select Run to authenticate the ETT with the EHR receipt of the response from the EHR by changing the (EHR) using Mutual TLS. Run button to Waiting Validation. 89 Upon receipt of response from the EHR select the The log screen for the test case is displayed. IN4.01 [Conditional] Waiting Validation button. 90 Manually review the Request and Response Confirm the EHR is capable of accepting and validating IN4.01 [Conditional] tabs to confirm the message content and a mutual TLS session when authenticating to the ETT. metadata conform to the testing objectives. 91 If confirmed by the Tester, select the Accept XDR Acceptance or rejection of the XDR message content IN4.01 [Conditional] button. If not confirmed by the Tester, select the results in overall Test Case testing success or failure Reject XDR button. and is recorded in the Validation Report. TE4.0 92 In the section for XDR Test 9 enter the IP The EHR’s IP address and port number is configured for 2 [Conditional] address and port number specified in Step 86 and XDR Test 9 and the XDR message is sent. Confirm select Run to authenticate the ETT with the EHR receipt of the response from the EHR by changing the using bad certificates (incorrect Mutual TLS Run button to Waiting Validation. configuration). 93 Upon receipt of response from the EHR select the The log screen for the test case is displayed. IN4.02 [Conditional] Waiting Validation button. 94 Manually review the Request and Response Confirm the EHR does not accept the connection due to IN4.02 [Conditional] tabs to confirm the message content and the incorrect Mutual TLS configuration and invalid metadata conform to the testing objectives. certificate published by the ETT. 95 If confirmed by the Tester, select the Accept XDR Acceptance or rejection of the XDR message content IN4.02 [Conditional] button. If not confirmed by the Tester, select the results in overall Test Case testing success or failure Reject XDR button. and is recorded in the Validation Report. TE4.0 96 In the section for XDR Test 3 enter the TLS The EHR’s TLS endpoint is configured for XDR Test 3 3 [Conditional] endpoint specified in Step 85 and select Run to and the XDR message is sent. Confirm receipt of the receive a properly formatted XDR message with response from the EHR by changing the Run button to limited metadata from the ETT. Waiting Validation. 97 Upon receipt of response from the EHR select the The log screen for the test case is displayed. IN4.03 [Conditional] Waiting Validation button. 98 Manually review the Request and Response Confirm the EHR is capable of receiving and processing IN4.03 [Conditional] tabs to confirm the message content and a valid XDR message with Limited Metadata from the metadata conform to the testing objectives. ETT. 99 If confirmed by the Tester, select the Accept XDR Acceptance or rejection of the XDR message content IN4.03 [Conditional] button. If not confirmed by the Tester, select the results in overall Test Case testing success or failure Reject XDR button. and is recorded in the Validation Report.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE4.0 100 In the section for XDR Test 5 enter the TLS The EHR’s TLS endpoint is configured for XDR Test 5 4 [Conditional] endpoint specified in Step 85 and select Run to and the XDR message is sent. Confirm receipt of the receive a properly formatted XDR message with response from the EHR by changing the Run button to full metadata from the ETT. Waiting Validation. 101 Upon receipt of response from the EHR select the The log screen for the test case is displayed. IN4.04 [Conditional] Waiting Validation button. 102 Manually review the Request and Response Confirm the EHR is capable of receiving and processing IN4.04 [Conditional] tabs to confirm the message content and a valid XDR message with Full Metadata from the ETT. metadata conform to the testing objectives. 103 If confirmed by the Tester, select the Accept XDR Acceptance or rejection of the XDR message content IN4.04 [Conditional] button. If not confirmed by the Tester, select the results in overall Test Case testing success or failure Reject XDR button. and is recorded in the Validation Report. TE4.0 104 In the section for XDR Test 4a enter the TLS The EHR’s TLS endpoint is configured for XDR Test 4a 5 [Conditional] endpoint specified in Step 85 and select Run to and the XDR message is sent. Confirm receipt of the return an error when an invalid XDR message response from the EHR by changing the Run button to containing bad SOAP envelope details is received Waiting Validation. from the ETT. 105 Upon receipt of response from the EHR select the The log screen for the test case is displayed. IN4.05 [Conditional] Waiting Validation button. 106 Manually review the Request and Response Confirm the EHR does not accept invalid messages IN4.05 [Conditional] tabs to confirm the message content and containing bad SOAP envelope details sent from the metadata conform to the testing objectives. ETT in one message. 107 If confirmed by the Tester, select the Accept XDR Acceptance or rejection of the XDR message content IN4.05 [Conditional] button. If not confirmed by the Tester, select the results in overall Test Case testing success or failure Reject XDR button. and is recorded in the Validation Report. TE4.0 108 In the section for XDR Test 4b enter the TLS The EHR’s TLS endpoint is configured for XDR Test 4b 6 [Conditional] endpoint specified in Step 85 and select Run to and the XDR message is sent. Confirm receipt of the return an error when an invalid XDR message response from the EHR by changing the Run button to containing bad SOAP body details is received Waiting Validation. from the ETT. 109 Upon receipt of response from the EHR select the The log screen for the test case is displayed. IN4.05 [Conditional] Waiting Validation button. 110 Manually review the Request and Response Confirm the EHR does not accept invalid messages IN4.05 [Conditional] tabs to confirm the message content and containing bad SOAP body details sent from the ETT in metadata conform to the testing objectives. one message. 111 If confirmed by the Tester, select the Accept XDR Acceptance or rejection of the XDR message content IN4.05 [Conditional] button. If not confirmed by the Tester, select the results in overall Test Case testing success or failure Reject XDR button. and is recorded in the Validation Report.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE4.0 112 In the section for XDR Test 4c enter the TLS The EHR’s TLS endpoint is configured for XDR Test 4c 7 [Conditional] endpoint specified in Step 85 and select Run to and the XDR message is sent. Confirm receipt of the return an error when an invalid XDR message response from the EHR by changing the Run button to missing metadata elements is received from the Waiting Validation. ETT. 113 Upon receipt of response from the EHR select the The log screen for the test case is displayed. IN4.05 [Conditional] Waiting Validation button. 114 Manually review the Request and Response Confirm the EHR does not accept invalid messages IN4.05 [Conditional] tabs to confirm the message content and missing metadata elements sent from the ETT. metadata conform to the testing objectives. 115 If confirmed by the Tester, select the Accept XDR Acceptance or rejection of the XDR message content IN4.05 [Conditional] button. If not confirmed by the Tester, select the results in overall Test Case testing success or failure Reject XDR button. and is recorded in the Validation Report. TE4.0 116 In the section for XDR Test 4d enter the TLS The EHR’s TLS endpoint is configured for XDR Test 4d 8 [Conditional] endpoint specified in Step 85 and select Run to and the XDR message is sent. Confirm receipt of the return an error when an invalid XDR message response from the EHR by changing the Run button to missing associations between ebRIM constructs Waiting Validation. is received from the ETT. 117 Upon receipt of response from the EHR select the The log screen for the test case is displayed. IN4.05 [Conditional] Waiting Validation button. 118 Manually review the Request and Response Confirm the EHR does not accept invalid messages IN4.05 [Conditional] tabs to confirm the message content and missing associations between ebRIM constructs sent metadata conform to the testing objectives. from the ETT. 119 If confirmed by the Tester, select the Accept XDR Acceptance or rejection of the XDR message content IN4.05 [Conditional] button. If not confirmed by the Tester, select the results in overall Test Case testing success or failure Reject XDR button. and is recorded in the Validation Report. TE4.0 120 In the section for XDR Test 4e enter the TLS The EHR’s TLS endpoint is configured for XDR Test 4e 9 [Conditional] endpoint specified in Step 85 and select Run to and the XDR message is sent. Confirm receipt of the return an error when an invalid XDR message response from the EHR by changing the Run button to missing the Direct Address block is received from Waiting Validation. the ETT. 121 Upon receipt of response from the EHR select the The log screen for the test case is displayed. IN4.05 [Conditional] Waiting Validation button. 122 Manually review the Request and Response Confirm the EHR does not accept invalid messages IN4.05 [Conditional] tabs to confirm the message content and missing the Direct Address block sent from the ETT. metadata conform to the testing objectives.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts 123 If confirmed by the Tester, select the Accept XDR Acceptance or rejection of the XDR message content IN4.05 [Conditional] button. If not confirmed by the Tester, select the results in overall Test Case testing success or failure Reject XDR button. and is recorded in the Validation Report. 124 Select the Validation Reports page and view the Verify that all tests have been completed with a status of IN4.06 [Conditional] results. pass or fail. ☐ Steps 125-138 only performed by systems demonstrating SMTP as the edge protocol to receive health information 125 Navigate to the SMTP Test Cases section and The Receiver test page is opened. [Conditional] select the Receiver button. 126 Identify the server hostname or IP address that The identified server should directly host the EHR email [Conditional] will be used by the EHR to send SMTP messages address listed in step 126. to the ETT. Proctor documents the server hostname or IP address to be used for the SMTP send tests. 127 Identify the email address that will be used by the The email address should be the same email address [Conditional] EHR when sending SMTP messages to the ETT. used to create the user account on the ETT.

Proctor documents the email address to be used for the SMTP send tests. 128 Identify the username and password on the The username and password should correspond to the Username: [Conditional] EHR’s SMTP server to be used for PLAIN SASL email address listed in Step 126. Password: Authorization. Proctor documents the username and password to be used for the SMTP send tests using PLAIN SASL Authorization.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE5.0 129 Select the applicable SMTP profile and then Verify that a secure session was established from the 1 [Conditional] select the CCDA button followed by Run in the ETT to the EHR based on TLS initiation using correct TE5.0 section for SMTP Test 9, 16, 20 to initiate a TLS syntax and successful authentication was achieved with 3 session with the correct syntax, authenticate PLAIN SASL with the username and password identified IN5.01 IN5.03 using a valid PLAIN SASL username and in Step 127. A green check represents a pass and a red password, and send a CCDA document from the X represents a fail. ETT to the EHR. Navigate to the email client used for the email address identified in Step 126 to verify an email was received with the subject “STARTTLS & PLAIN SASL AUTHENTICATION” and an attachment from the ETT email address of [email protected]. The attachment contains additional information concerning the test. TE5.0 130 Select the applicable SMTP profile and then Verify the EHR does not accept the TLS session based 2 [Conditional] select Run in the section for SMTP Test 17 to on the incorrect syntax used. A green check represents IN5.02 initiate a TLS session using invalid TLS a pass and a red X represents a fail. commands from the ETT when the CCDA is sent from the ETT to the EHR. TE5.0 131 Select the applicable SMTP profile and then Verify that the EHR does not accept the authentication 5 [Conditional] select Run in the section for SMTP Test 22 to request from the ETT due to an invalid PLAIN SASL IN5.05 attempt to authenticate using an invalid PLAIN username and password. A green check represents a SASL username and password from the ETT to pass and a red X represents a fail. the EHR. TE5.0 132 Select the applicable SMTP profile and then Verify that the transmitted CCDA conformant document 7 [Conditional] select the CCDA button followed by Run in the has been received successfully according to the IN5.07 section for SMTP Test 9, 16, 20. Implementation Guide for Direct Edge Protocols (SMTP) standard and the ETT validation report indicates the successful sequence of commands for SMTP protocols. A green check represents a pass and a red X represents a fail. TE5.0 133 Select the applicable SMTP profile and then Verify that the transmitted HITSP/C32 conformant 8 [Conditional] select the C32 button followed by Run in the document has been received successfully according to IN5.08 section for SMTP Test 9, 16, 20. the Implementation Guide for Direct Edge Protocols (SMTP) standard and the ETT validation report indicates the successful sequence of commands for SMTP protocols. A green check represents a pass and a red X represents a fail.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE5.0 134 Select the applicable SMTP profile and then Verify that the transmitted ASTM CCR conformant 9 [Conditional] select the CCR button followed by Run in the document has been received successfully according to IN5.09 section for SMTP Test 9, 16, 20. the Implementation Guide for Direct Edge Protocols (SMTP) standard and the ETT validation report indicates the successful sequence of commands for SMTP protocols. A green check represents a pass and a red X represents a fail. TE5.1 135 Select the applicable SMTP profile and then Verify that a secure session cannot be established 0 [Conditional] select Run in the section for SMTP Test 10 to based on the Invalid Data command and does not IN5.10 receive the CCDA which sends invalid data as accept the data by using the Invalid Data command. A part of the DATA command. green check represents a pass and a red X represents a fail. TE5.1 136 Select the applicable SMTP profile and then Verify that a secure session cannot be established 1 [Conditional] select Run in the section for SMTP Test 11 to based on the Invalid SMTP commands and does not IN5.10 receive the CCDA which sends invalid SMTP accept the data by using Invalid SMTP commands. A commands data as part of the DATA command. green check represents a pass and a red X represents a fail. TE5.1 137 Select the applicable SMTP profile and then Verify that the ETT has kept the transaction open for 3 [Conditional] select Run in the section for SMTP Test 13 to beyond the specified time limits and therefore cannot IN5.11 receive the CCDA beyond the allowable time accept the incoming message. A green check period. represents a pass and a red X represents a fail. 138 Select the Validation Reports page and view the Verify that all tests have been completed with a status of IN5.12 [Conditional] results. pass or fail. Steps 139-145 are required to be performed by all systems

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE6.0 139 Log in to the EHR as a provider, open the patient The information displayed for the Ambulatory Summary 1-6.03 record for the Ambulatory test patient, and display of Care record is complete and accurate and all sections IN6.01 an Ambulatory Summary Care Record received are displayed individually. IN6.03 from the ETT. Verify that the content of the received CCDA conformant Ambulatory Summary of Care Record displays completely and accurately, including section headings and at a minimum, the following data elements (in their English representation if they associate with a vocabulary/code set): . Encounter diagnoses . Immunizations . Cognitive status . Functional status . Reason for referral . Referring or transitioning provider’s name . Provider name . Provider office contact information . Common MU Data Set (in their English representation if applicable)

If the EHR technology requires additional users that are not the provider to receive the message, view message header information, and match the summary care record to the patient prior to being available for the provider, this is permitted.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE6.0 140 Open the patient record for the Inpatient test The information displayed for the Inpatient Summary of 1 patient, and display an Inpatient Summary Care Care record is complete and accurate and all sections TE6.0 Record received from a third party. Verify that the are displayed individually. 4-6.05 IN6.02 content of the received CCDA conformant -6.03 Inpatient Summary of Care Record displays completely and accurately, including section headings and at a minimum, the following data elements (in their English representation if they associate with a vocabulary/code set): . Encounter diagnoses . Immunizations . Cognitive status . Functional status . Discharge instructions . Common MU Data Set (in their English representation if applicable)

If the EHR technology requires additional users that are not the provider to receive the message, view message header information, and match the summary care record to the patient prior to being available for the provider, this is permitted. TE6.0 141 Using either the Ambulatory or Inpatient Summary Header and individual section information is accurate 6 Care Record CCDA, demonstrate that the EHR and can be viewed without having to view or navigate IN6.04 can display individual sections (not all) of the the entire document. CCDA. TE6.0 142 If demonstrating SMTP as the edge protocol to The content of the received HITSP/C32 document 7-6.08 [Conditional] receive health information, display the HITSP/C32 displays completely and accurately and coded IN6.05 document received in Step 133. information displays in its English representation if associated with a vocabulary/code set. TE6.0 143 If demonstrating SMTP as the edge protocol to The content of the received ASTM CCR document 9-6.10 [Conditional] receive health information, display the ASTM displays completely and accurately and coded IN6.06 CCR document received in Step 134. information displays in its English representation if associated with a vocabulary/code set

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE2.0 144 Access the applicable CCDA XML file(s) retrieved Zip file containing all applicable CCDA XML 5-2.06 in Steps 24, 30, and/or 75 then access the b8 .txt document(s) is uploaded using the correct filename. TE3.0 file and zip them together per the instructions at 6-3.07 IN2.05 Submitting Files on Test Day. Upload the zip file -2.08 to ICSA Labs using the URL provided by the IN3.08 Proctor. Uploaded zip files must include the -3.09 organization name and criterion number in the filename (e.g. b8_ABCompany).

Resubmissions during the same test session MUST modify the .zip filename and email subject line to include the word ‘Retest’, as in b8_ABCompany_Retest1, b8_ABCompany_Retest2, etc. IN2.05 145 File validation performed to determine compliance File is in conformance with the CCDA standard and -2.08 with the required specifications. named vocabulary standards and is complete and IN3.08 accurate. -3.09 This step performed outside of the demonstration. This step scored on the Conformance Worksheet. Select Document any other pertinent observations below: Test Result 170.314(b)(1) Transitions of Care – Receive, Display and Incorporate Setup ONC Test Guidance and Test Tool . Create patient records for and input all Data and . Guidance from ICSA Labs ONC Test Data for both the Procedure . Direct Certificate Discovery Tool (DCDT) Ambulatory and Inpatient test patients . ONC . DCDT Google Groups Support Site or Email . Create and install certificates to be Test used for Direct testing Data . Edge Testing Tool (ETT) . From the home page of the ETT, . ONC . ETT Google Groups Support Site or Email Certificate Thumbprints for Test Tools download and import the TTT's Public Test Key Certificate and Trust Anchor into Proc the EHR’s trust store edur e Step # Action to Perform Expected Outcome Ref ere Notes / Deviations nce

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts 1 Identify the non-Direct (Contact) email address to Proctor documents the non-Direct (Contact) email be used to receive the results emails sent from address to be used for the Direct tests. the ETT. Note: All results emails must be sent to an email account that is accessible on the presenter’s screen during testing. 2 Identify the Direct (From) address that will be Proctor documents the Direct (From) address and Email: @ttpedge.sitenv.org used by the ETT to send valid Direct messages to registered domain to be used for the valid Direct tests. the EHR. 3 Identify the Direct (To) address and registered Proctor documents the Direct (To) address and domain that will be used by the EHR to receive registered domain to be used for the Direct tests. Direct messages sent from the ETT. 4 Identify the ETT's Public Key Certificate and Trust The ETT's Public Key Certificate and Trust Anchor are Anchor in the EHR’s trust store. stored in the EHR's trust store.

Proctor validates the thumbprints when possible. 5 Identify the certificates on the EHR to be used for Certificates are identified on the EHR. decrypting the Direct message(s) to be sent by the ETT to the EHR's Direct receive address(es). 6 Identify the EHR’s Public Key for encryption of the Public key is identified. Direct messages to be sent by the ETT to the EHR. 7 Log in to the EHR as a provider, open the patient Test data for both the Ambulatory and Inpatient test records for both the Ambulatory and Inpatient test patients has been entered correctly and without patients, and verify all test data has been entered omission. correctly. 8 Access the Direct Certificate Discovery Tool The DCDT is opened to the Hosting section. DCDT v (DCDT) and open the Hosting section. Proctor documents the DCDT version. 9 Identify whether the EHR stores certificates as Proctor documents the type of certificate used by the address-bound or domain-bound certificates. EHR. 10 Identify whether the EHR hosts certificates in Proctor documents the hosting method used by the DNS or LDAP servers. EHR. TE1.0 11 Select the Test Case which maps to the The appropriate test case is selected. 2 selections in Steps 9 and 10.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE1.0 12 Enter the Direct (To) Address identified in Step 3 The DCDT reports a successful result when run. 2-1.03 into the Direct Address field of the DCDT and select "Submit". 13 Access the ETT – Direct Testing home page. The ETT is opened to the Direct Testing home page. ETT v

Proctor documents the ETT version. 14 Select the Send Direct Message tab from the The Send Direct Message tab opens on the ETT. TTT home page. 15 Enter the Direct (From) Address identified at Step The Direct (From) address is added. 2 into the Direct From Address field of the ETT. 16 Enter the Direct address identified at Step 3 into The Direct address is added. the Direct To Address field of the ETT. 17 Select Unwrapped from the Message Format The Unwrapped message format type is selected in the section of the ETT. ETT. 18 Select GOOD_CERT from the Signing The GOOD_CERT signing certificate is selected in the Certificate section of the ETT. ETT. 19 Identify the Signing Algorithm to be used. Either SHA-1 or SHA-256 is selected.

TE1.0 20 From the Send Direct Message tab of the ETT, A test session name for sending of an unwrapped 4 Email: @ttpedge.sitenv.org enter a custom Direct (From) address (i.e., Ambulatory Summary of Care Record in CCDA format [email protected] for sending of an has been entered. unwrapped Ambulatory Summary of Care Record in CCDA format. Proctor documents the custom email address to identify the corresponding Summary of Care later in the test. TE1.0 21 From the Choose document to be sent as the The Ambulatory Summary of Care Record in CCDA 5 message content field of the TTT select the format was received by the EHR using the ONC IN1.02 Ambulatory Summary of Care Record in CCDA Applicability Statement for Secure Health Transport format and then select Send to transmit the (Direct) standard. document using the ONC Applicability Statement for Secure Health Transport (Direct) standard. TE1.0 22 From the Send Direct Message tab of the ETT, A custom email address for sending of an unwrapped 6 Email: @ttpedge.sitenv.org enter a custom Direct (From) address (i.e., Inpatient Summary of Care Record in CCDA format has [email protected] for sending of an been entered. unwrapped Inpatient Summary of Care Record in CCDA format. Proctor documents the custom email address to identify the corresponding Summary of Care later in the test.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE1.0 23 From the Choose document to be sent as the The Inpatient Summary of Care Record in CCDA format 7 message content field of the TTT select the was received by the EHR using the ONC Applicability IN1.02 Inpatient Summary of Care Record in CCDA Statement for Secure Health Transport (Direct) format and then select Send to transmit the standard. document using the ONC Applicability Statement for Secure Health Transport (Direct) standard. TE1.0 24 From the Send Direct Message tab of the ETT, A custom email address for sending of an unwrapped 8 Email: @ttpedge.sitenv.org enter a custom Direct (From) address (i.e., HITSP/C32 document has been entered. [email protected] for sending of an unwrapped HITSP/C32 document. Proctor documents the custom email address to identify the corresponding Summary of Care later in the test. TE1.0 25 From the Choose document to be sent as the The HITSP/C32 document was received by the EHR 9 message content field of the TTT select the using the ONC Applicability Statement for Secure Health IN1.02 HITSP/C32 document and then select Send to Transport (Direct) standard. transmit the document using the ONC Applicability Statement for Secure Health Transport (Direct) standard. TE1.1 26 From the Send Direct Message tab of the ETT, A custom email address for sending of an unwrapped 0 Email: @ttpedge.sitenv.org enter a custom Direct (From) address (i.e., ASTM CCR document has been entered. [email protected] for sending of an unwrapped ASTM CCR document. Proctor documents the custom email address to identify the corresponding Summary of Care later in the test. TE1.1 27 From the Choose document to be sent as the The ASTM CCR document was received by the EHR 1 message content field of the TTT select the using the ONC Applicability Statement for Secure Health IN1.02 ASTM CCR document and then select Send to Transport (Direct) standard. transmit the document using the ONC Applicability Statement for Secure Health Transport (Direct) standard. 28 Identify whether the EHR offers the capability to The Proctor identifies whether the EHR accepts only accept only unwrapped messages or both unwrapped messages or both unwrapped and RFC- unwrapped and RFC-5751 wrapped messages. 5751 wrapped messages. TE1.1 29 If the EHR accepts both unwrapped and RFC- The Wrapped option is selected and all required tests 2-1.19 [Conditional] 5751 wrapped messages, re-run Steps 20-27, are re-run. IN1.02 except choose the Wrapped option from the -1.03 Message Format section of the TTT.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE1.0 30 Access the non-Direct (Contact) email address Validation Results confirm that MDNs were received by 5 identified in Step 1, display the Direct Message the TTT. TE1.0 Validation Report emails, and open the 7 TE1.0 validation reports. 9 TE1.1 1 IN1.03 31 Reset the Message format to Unwrapped. The Unwrapped message format type is selected in the ETT. TE1.2 32 Remove the ETT's valid Trust Anchor from the The ETT's valid Trust Anchor is no longer stored in the 0 EHR's trust store. Then, from the Direct Testing EHR's trust store and the ETT's Invalid Trust Anchor is home page of the ETT, download and import the stored in the EHR's trust store. Invalid Trust Anchor into the EHR’s trust store. Proctor validates the thumbprints when possible. TE2.0 33 From the Send Direct Message tab of the ETT, A custom email address for sending an unwrapped 8 Email: @ttpedge.sitenv.org enter a custom Direct (From) address (i.e., Summary of Care Record in CCDA format using an [email protected]) invalid trust anchor has been entered.

Proctor documents the Direct (From) address TE1.2 34 Select Send to transmit the document using the The Summary of Care Record in CCDA format is 2-1.23 Time: Direct transport standard. rejected by the EHR.

Proctor documents the time the message was sent. TE1.2 35 Remove the ETT's Invalid Trust Anchor from the The ETT's invalid Trust Anchor is no longer stored in the 4 EHR's trust store,tThen reimport the ETT's valid EHR's trust store and the ETT's valid Trust Anchor is Trust Anchor into the EHR’s trust store. stored in the EHR's trust store.

Proctor validates the thumbprints when possible. TE1.2 36 Enter a custom Direct (From) address (i.e., A custom email address for sending an unwrapped 5 Email: @ttpedge.sitenv.org invalidcert@ @ttpedge.sitenv.org. Summary of Care Record in CCDA format using an invalid certificate has been entered.

Proctor documents the Direct (From) address.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE1.2 37 Select INVALID_CERT from the Signing The INVALID_CERT signing certificate is selected in the 6 Time: Summary of Care Certificate section of the ETT, then select Send ETT. Record in CCDA format to transmit the document using the Direct The Summary of Care Record in CCDA format is transport standard. rejected by the EHR.

Proctor documents the time the message was sent. TE1.2 38 Enter a custom Direct (From) address (i.e., A test session name for sending an unwrapped 6-1.27 Email: @ttpedge.sitenv.org expiredcert@ @ttpedge.sitenv.org. Summary of Care Record in CCDA format using an expired certificate has been entered.

Proctor documents the Direct (From) address . TE1.2 41 Select DIFFERENT_TRUST_ANCHOR from the The DIFFERENT_TRUST_ANCHOR signing certificate 9-1.30 Time: Signing Certificate section of the ETT, then is selected in the ETT. select Send to transmit the document using the The Summary of Care Record in CCDA format is Direct transport standard. rejected by the EHR.

Proctor documents the time the message was sent. TE1.2 42 Inspect the system logs to verify that the System logs confirm that the messages were rejected 3 transmitted messages identified in Steps 33, 36, and not received by the EHR. Examine the timestamps TE1.2 38, and 40 were rejected and not received by the and Direct (From) addresses to validate each of the 7 TE1.3 EHR. rejected messages. 0 TE1.3 3-1.34 IN1.04 -05 ☐ Steps 43-55 only performed by systems demonstrating the optional XDM Validation

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts 43 From the DirectSender tab of the ETT select The Unwrapped message format type is selected in the [optional] Unwrapped from the Message Format section of ETT. the TTT. 44 Select GOOD_CERT from the Signing The GOOD_CERT signing certificate is selected in the [optional] Certificate section of the ETT. ETT. TE2.0 45 Enter a custom Direct (From) Address (i.e. A custom email address name for sending of an 2 Email: @ttpedge.sitenv.org [optional] ambxdm@ ttpedge.sitenv.org for sending of an unwrapped Ambulatory Summary of Care Record in unwrapped Ambulatory Summary of Care Record CCDA format using Direct with XDM validation has been in CCDA format using Direct with XDM validation. entered.

Proctor documents the Direct (From) address TE2.0 46 From the Choose document to be sent as the The Ambulatory Summary of Care Record in CCDA 3 [optional] message content field of the TTT select the format was received by the EHR using the ONC ”CCDA_Ambulatory_in_XDM.zip” file and then Applicability Statement for Secure Health Transport select Send to transmit the document using the (Direct) standard with XDM Validation. ONC Applicability Statement for Secure Health Transport (Direct) standard with XDM Validation. TE2.0 47 Enter a custom Direct (From) Address (i.e. A custom email address name for sending of an 2 Email: @ttpedge.sitenv.org [optional] inpxdm@ ttpedge.sitenv.org for sending of an unwrapped Inpatient Summary of Care Record in CCDA unwrapped Inpatient Summary of Care Record in format using Direct with XDM validation has been CCDA format using Direct with XDM validation. entered.

Proctor documents the Direct (From) address TE2.0 48 From the Choose document to be sent as the The Inpatient Summary of Care Record in CCDA format 5 [optional] message content field of the TTT select the was received by the EHR using the ONC Applicability ”CCDA_Inpatient_in_XDM.zip” file and then Statement for Secure Health Transport (Direct) standard select Send to transmit the document using the with XDM Validation. ONC Applicability Statement for Secure Health Transport (Direct) standard with XDM Validation. TE2.0 49 Enter a custom Direct (From) Address (i.e. A custom email address name for sending of an 2 Email: @ttpedge.sitenv.org [optional] c32xdm@ ttpedge.sitenv.org for sending of an unwrapped HITSP/C32 document using Direct with XDM unwrapped HITSP/C32 document using Direct validation has been entered. with XDM validation. Proctor documents the Direct (From) address

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE2.0 50 From the Choose document to be sent as the The HITSP/C32 document was received by the EHR 7 [optional] message content field of the TTT select the using the ONC Applicability Statement for Secure Health ”C32_Sample_1_in_XDM.zip” file and then Transport (Direct) standard with XDM Validation. select Send to transmit the document using the ONC Applicability Statement for Secure Health Transport (Direct) standard with XDM Validation. TE2.0 51 Enter a custom Direct (From) Address (i.e. A custom email address name for sending of an 2 Email: @ttpedge.sitenv.org [optional] ccrxdm@ ttpedge.sitenv.org for sending of an unwrapped CCR document using Direct with XDM unwrapped ASTM CCR document using Direct validation has been entered. with XDM validation. Proctor documents the Direct (From) address TE2.0 52 From the Choose document to be sent as the The ASTM CCR document was received by the EHR 9 [optional] message content field of the TTT select the using the ONC Applicability Statement for Secure Health ”CCR_Sample1_in_XDM.zip” file and then Transport (Direct) standard with XDM Validation. select Send to transmit the document using the ONC Applicability Statement for Secure Health Transport (Direct) standard with XDM Validation. 53 Access the non-Direct (Contact) email address Validation Results confirm that MDNs were received by IN2.01 [optional] identified in Step 1, display the Direct Message the ETT. Validation Report emails, and open the validation reports.

54 Identify whether the EHR offers the capability to The Proctor identifies whether the EHR accepts only [optional] accept only unwrapped messages or both unwrapped messages or both unwrapped and RFC- unwrapped and RFC-5751 wrapped messages. 5751 wrapped messages. TE2.1 55 If the EHR accepts both unwrapped and RFC- The Wrapped option is selected and all required tests 0-2.17 [optional] 5751 wrapped messages, re-run Steps 46-55, are re-run. IN2.02 except choose the Wrapped option from the Message Format section of the TTT. ☐ Steps 56-61 only performed by systems demonstrating the optional SOAP Protocols 56 Identify a Site Name, a separate endpoint used by The Proctor documents the Site Name, the endpoint [optional] the EHR to receive each XDR message, and a used to receive each XDR message, and the patient ID. valid patient ID for the test patient data entered for this test. 57 Define and identify an Actor Simulator in the The Proctor documents the Actor Simulator. [optional] Transport Testing Tool terminology (as described in the Transport Testing Tool User Guide).

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE3.0 58 Transmit one Ambulatory Summary of Care The Ambulatory Summary of Care Record in CCDA 1 [optional] Record in CCDA format using SOAP Protocols format transmitted using SOAP Protocols with XDR TE3.0 with XDR Validation with both NHIN SAML and Validation with both NHIN SAML and TLS was received 5 TLS selected from the TTT to the EHR’s SOAP by the EHR. IN3.01 endpoint provided in Step 58. TE3.0 59 Transmit one Inpatient Summary of Care Record The Inpatient Summary of Care Record in CCDA format 2 [optional] in CCDA format using SOAP Protocols with XDR transmitted using SOAP Protocols with XDR Validation TE3.0 Validation with both NHIN SAML and TLS with both NHIN SAML and TLS was received by the 5 selected from the TTT to the EHR’s SOAP EHR. IN3.01 endpoint provided in Step 58.

60 Transmit one HITSP/C32 document using SOAP The HITSP/C32 document transmitted using SOAP TE3.0 3 [optional] Protocols with XDR Validation with NHIN SAML Protocols with XDR Validation with both NHIN SAML TE3.0 and TLS selected from the TTT to the EHR’s and TLS was received by the EHR. 5 SOAP endpoint provided in Step 58. IN3.01 TE3.0 61 Transmit one ASTM CCR document using SOAP The ASTM CCR document transmitted using SOAP 4 [optional] Protocols with XDR Validation with NHIN SAML Protocols with XDR Validation with NHIM SAML and TE3.0 and TLS selected from the TTT to the EHR’s TLS was received by the EHR. 5 SOAP endpoint provided in Step 58. IN3.01 Steps 62-76 are required to be performed by all systems TE1.0 62 Log on as a provider with authorized access to The provider successfully logs in. 1 the test patients' records. TE2.0 1 TE4.0 1 TE5.0 1 TE5.0 63 Describe and demonstrate the EHR function(s) to The EHR was able to match the Ambulatory CCDA 2 match patient identifying information from the document to the correct patient record without requiring Ambulatory Summary Care Record received at a user to visually inspect the Summary Care Record in Step 21 to the correct patient record. XML format. 64 Describe and demonstrate the EHR function(s) to The EHR was able to store the Ambulatory CCDA IN5.01 save and store the Ambulatory Summary Care document in the correct patient record. Record received at Step 21 to the correct patient record. TE5.0 65 Describe and demonstrate the EHR function(s) to The EHR was able to display the Ambulatory CCDA 2-5.03 display the Ambulatory Summary Care Record document from the correct patient record. received at Step 21 as a CCDA conformant document.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE4.0 66 Describe and demonstrate the EHR function(s) to The EHR was able to display the Ambulatory CCDA 2-4.03 display the Ambulatory Summary Care Record document in the correct patient record. The information IN4.01 received at Step 21 as a CCDA-conformant displayed is complete and accurate and all sections are document in human readable format. Show that displayed individually and in human readable format. the document includes individual section headings and the following data elements: . Encounter diagnoses . Immunizations . Cognitive status . Functional status . Reason for referral . Referring or transitioning provider’s name . Provider name . Provider office contact information . Common MU Data Set (in their English representation if applicable) TE5.0 67 Describe and demonstrate the EHR function(s) to The problem list, medication list, and allergy list data 4 display the problem list, medication list, and stored as structured data and displayed for clinical IN5.02 medication allergy information contained within information reconciliation are complete and accurate. -5.03 the Ambulatory Summary Care Record CCDA received at Step 23 as structured data in the correct patient record so that it is available for clinical information reconciliation. TE5.0 68 Describe and demonstrate the EHR function(s) to The EHR was able to match the Inpatient CCDA 5 match patient identifying information from the document to the correct patient record without requiring Inpatient Summary Care Record received at Step a user to visually inspect the Summary Care Record in 23 to the correct patient record. XML format. 69 Describe and demonstrate the EHR function(s) to The EHR was able to store the Inpatient CCDA IN5.01 save and store the Inpatient Summary Care document in the correct patient record. Record received at Step 23 to the correct patient record. TE5.0 70 Describe and demonstrate the EHR function(s) to The EHR was able to display the Inpatient CCDA 5-5.06 display the Inpatient Summary Care Record document from the correct patient record. received at Step 23 as a CCDA conformant document.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE4.0 71 Describe and demonstrate the EHR function(s) to The EHR was able to display the Inpatient CCDA 4-4.05 display the Inpatient Summary Care Record document in the correct patient record. The information IN4.02 received at Step 23 as a CCDA-conformant displayed is complete and accurate and all sections are document in human readable format. Show that displayed individually and in human readable format. the document includes individual section headings and the following data elements: . Encounter diagnoses . Immunizations . Cognitive status . Functional status . Discharge instructions . Common MU Data Set (in their English representation if applicable) TE5.0 72 Describe and demonstrate the EHR function(s) to The problem list, medication list, and allergy list data 7 display the problem list, medication list, and stored as structured data and displayed for clinical IN5.02 medication allergy information contained within information reconciliation are complete and accurate. -5.03 the Inpatient Summary Care Record CCDA received at Step 23 as structured data in the correct patient record so that it is available for clinical information reconciliation. TE4.0 73 Using either the Ambulatory or Inpatient Summary Header and individual section information is accurate 6 Care Record CCDA, demonstrate that the EHR and can be viewed without having to view or navigate IN4.03 can display the header information along with the entire document. -4.04 individual section information without having to view or navigate the entire document. TE4.0 74 Access the appropriate patient's record and The content displayed is complete and accurate and 7-4.08 display the contents of the HITSP/C32 document coded information displays in its English representation IN4.05 received at Step 25 in human readable format. if associated with a vocabulary/code set. TE4.0 75 Access the appropriate patient's record and The content displayed is complete and accurate and 9-4.10 display contents of the ASTM CCR document coded information displays in its English representation IN4.06 received at Step 27 in human readable format. if associated with a vocabulary/code set.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts 76 Submit the original results emails from the DCDT Results emails from the DCDT and ETT are submitted and ETT (either individually or together as using the correct subject line. attachments to a single email) to ehr- [email protected] and include the organization name and criterion number in the subject line of the email (e.g. b1_ABCompany).

Resubmissions during the same test session MUST modify the email subject line to include the word ‘Retest’, as in b1_ABCompany_Retest1, b1_ABCompany_Retest2, etc. Select Document any other pertinent observations below: Test Result 170.314(e)(3) Secure Messaging [Ambulatory Only] Setup Guidance . Attestation identifying the encryption algorithm and . Guidance from ICSA Labs corresponding key length, hashing algorithm, and authentication method must be submitted prior to scheduling test date

Step # Action to Perform Expected Outcome Ref ere Notes / Deviations nce 1 Verbally confirm the encryption algorithm and Proctor documents the encryption algorithm and Encryption: [AMB] corresponding key length, hashing algorithm, and corresponding key length, hashing algorithm, and Hash: the authentication method to be used as specified authentication method and verifies they are compliant Auth method: in your 2014 Edition Attestation. with FIPS 140-2 Annex A and match the values provided via attestation. 2 Identify the provider to use for this test and their Proctor documents the provider's name and User ID for Provider name: [AMB] User ID for login. login. User ID: 3 Identify the patient to use for this test and their Proctor documents the patient's name and User ID for Pt name: [AMB] User ID for login. login. User ID: 4 Identify the authorized patient representative to Proctor documents the authorized patient Pt rep name: [AMB] use for this test and their User ID for login. representative's name and User ID for login. User ID:

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE1.0 5 Log on to the EHR as the provider and send a The message is sent in compliance with the named 1-1.02 [AMB] message from the provider to the patient. protocols and standards. IN1.01 TE1.0 6 Send a message from the provider to the The message is sent in compliance with the named 3-1.04 [AMB] authorized patient representative. protocols and standards. IN1.01

Log out. TE1.0 7 Log on to the EHR as the patient and display the The message is received according to the named 2 [AMB] message sent from the provider in Step 5. protocols and standards, and the text in the message is IN1.01 complete and accurate. TE2.0 8 Send a message from the patient to the provider. The message is sent in compliance with the named 1-2.02 [AMB] protocols and standards. IN2.01 Log out. TE1.0 9 Log on to the EHR as the authorized patient The message is received according to the named 4 [AMB] representative and display the message sent from protocols and standards, and the text in the message is IN1.01 the provider in Step 6. complete and accurate. TE2.0 10 Send a message from the authorized patient The message is sent in compliance with the named 3-2.04 [AMB] representative to the provider. protocols and standards. IN2.01

Log out. TE2.0 11 Log on to the EHR as the provider and display the The message is received according to the named 2 [AMB] message sent from the patient in Step 8. protocols and standards, and the text in the message is IN2.01 complete and accurate. TE2.0 12 Display the message sent from the authorized The message is received according to the named 4 [AMB] patient representative in Step 10. protocols and standards, and the text in the message is IN2.01 complete and accurate. Select Document any other pertinent observations below: Test Result

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts 170.314(d)(9) Accounting of Disclosures [Optional] Setup ONC Test Guidance . Create a patient record Data and . Guidance from ICSA Labs Procedure . Cust omer must creat e their own test data . ONC Test Proc edur e Step # Action to Perform Expected Outcome Ref ere Notes / Deviations nce TE1.0 1 Record a disclosure related to treatment, Description of disclosure is recorded correctly and the 1-1.02 including a description of the disclosure. system automatically records: IN1.01 -1.02 . Date . Time . Patient identification . User identification TE1.0 2 Record a disclosure related to payment, including Description of disclosure is recorded correctly and the 1-1.02 a description of the disclosure. system automatically records: IN1.01 -1.02 . Date . Time . Patient identification . User identification

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE1.0 3 Record a disclosure related to healthcare Description of disclosure is recorded correctly and the 1-1.02 operations, including a description of the system automatically records: IN1.01 -1.02 disclosure. . Date . Time Exit the disclosure screen. . Patient identification . User identification TE1.0 4 Enter the disclosure screen and display the The three disclosures are displayed correctly and 3 disclosures entered at Steps 1 - 3. without omission and include the required data IN1.01 elements. -1.02 . Date . Time . Patient identification . User identification . Description of the disclosure Select Document any other pertinent observations below: Test Result

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts 170.314(d)(4) Amendments Setup O Guidance . Create 2 patient records including patient name, N . Guidance from ICSA Labs medical record number, and date of birth C T e s t D a t a a n d P r o c e d u r e . C

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE1.0 1 Select a patient and display the patient name, The data included in the patient’s record is correct and 1 medical record number, and date of birth. without omission and the amendment is associated with IN1.01 the patient’s record. TE1.0 2 Append the accepted amendment to the patient’s The accepted amendment is appended to the patient’s 2 Amendment Requested record OR enter information that provides a link to record OR a link is provided to enable a user to obtain IN1.01 Date: the location of the amendment. the information associated with the amendment’s -1.02 Time: acceptance.

Amendment Accepted Proctor documents the date and time the amendment is appended or linked to the patient's record. If performed Date: separately, the Proctor must also document the time the Time: amendment was requested and/or accepted. Amendment Appended/Linked Date: Time: TE1.0 3 Record the source of the amended information The accepted amendment indicates the source of the 3 (e.g., patient, provider/organization). amended information. IN1.03

Exit the patient record. TE1.0 4 Select the patient used at Step 1 and display the The appended amendment displays correctly and 4 appended amendment. without omission and where applicable includes the date IN1.04 and time of: -1.05 . Patient’s amendment request; . Acceptance of the amendment request; and . Appending/linking of amendment information

These actions may be recorded in the audit log. TE2.0 5 Select a different patient and display the patient The data included in the patient’s record is correct and 1 name, medical record number, and date of birth. without omission and the amendment is associated with IN2.01 the patient’s record.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE2.0 6 Append the denied amendment to the patient’s The denied amendment is appended to the patient’s 2 Amendment Requested record OR enter information that provides a link to record OR a link is provided to enable a user to obtain IN2.01 Date: the location of the amendment. the information associated with the amendment’s denial. -2.02 Time:

Proctor documents the date and time the amendment is Amendment Denied appended or linked to the patient's record. If performed separately, the Proctor must also document the time the Date: amendment was requested and/or denied. Time:

Amendment Appended/Linked Date: Time: TE2.0 7 Record the source of the denied amended The denied amendment indicates the source of the 3 information (e.g., patient, provider/organization). amended information. IN2.03

Exit the patient record. TE2.0 8 Select the patient used at Step 6 and display the The appended amendment displays correctly and 4 appended amendment. without omission and where applicable includes the date IN2.04 and time of: -2.05 . Patient’s amendment request; . Denial of the amendment request; and . Appending/linking of amendment information

These actions may be recorded in the audit log. Select Document any other pertinent observations below: Test Result

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts 170.314(d)(2) Auditable Events and Tamper-Resistance Setup ONC Test Guidance . Create a patient record Data and . Guidance from ICSA Labs Procedure . Cust omer must creat e their own test data . ONC Test Proc edur e Step # Action to Perform Expected Outcome Ref ere Notes / Deviations nce NTP1. 1 Network Time Protocol (NTP) test. This step observed and scored as part of the NTP test 01- procedure. 1.06 TE1.0 2 Demonstrate that the EHR is recording actions The audit log records actions related to electronic health 1-1.03 related to electronic health information in the audit information without any additional configuration. If the IN1.01 log by default. setting is configurable, verify the default setting for audit -1.03 logs is enabled. ☐ Steps 3-5 only performed by systems that allow audit logs to be disabled TE2.0 3 Log on as a user who does not have the Audit logs are not disabled. 1-2.02 [conditional] authorization to disable audit logs and attempt to IN2.01 disable audit logs. -2.02 IN2.04 TE2.0 4 Log on as a user with the authorization to disable Audit logs are disabled. 3-2.04 Time: [conditional] audit logs and disable audit logs. IN2.01 User ID: -2.03 Proctor documents the date, time, and user IN2.05 identification.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE2.0 5 Re-enable the audit logs. Audit logs are enabled. 5 Time: [conditional] User ID: Proctor documents the date, time, and user identification. ☐ Steps 6-9 only performed by systems that allow the audit log status to be disabled TE2.1 6 Determine the EHR's default audit log setting to The default setting for recording audit log status is 2 [conditional] record the audit log status (enabled or disabled). enabled. TE2.0 7 Log on as a user who does not have the Audit log status is not disabled. 7-2.08 [conditional] authorization to disable the audit log status and IN2.01 attempt to disable the recording of the audit log -2.02 status. IN2.04 TE2.0 8 Log on as a user with the authorization to disable Audit log status is disabled. 9-2.10 Time: [conditional] the audit log status and disable audit log status. IN2.01 User ID: -2.03 Proctor documents the date, time, and user IN2.05 identification. TE2.1 9 Re-enable the audit log status. Audit log status is enabled. 1 Time: [conditional] User ID: Proctor documents the date, time, and user identification. ☐ Steps 10-13 only performed by systems that are testing against 170.314(d)(7) End-User Device Encryption AND allow the encryption status to be disabled TE2.1 10 Determine the EHR's default setting for recording The default setting for recording the encryption status of 8 [conditional] the encryption status (enabled or disabled) of electronic health information stored on end-user devices electronic health information stored on end-user by the EHR is enabled. devices by the EHR. TE2.1 11 Log on as a user who does not have the Encryption status is not disabled. 3-2.14 [conditional] authorization to disable the encryption status and IN2.01 attempt to disable the encryption status. -2.02 IN2.04 TE2.1 12 Log on as a user with the authorization to disable Encryption status is disabled. 5-2.16 Time: [conditional] the encryption status and disable encryption IN2.01 User ID: status. -2.03 Proctor documents the date, time, and user IN2.05 identification. TE2.1 13 Re-enable the encryption status. Encryption status is enabled. 7 Time: [conditional] User ID: Proctor documents the date, time, and user identification.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts Steps 14-19 are required to be performed by all systems except for steps previously exempted via attestation prior to the day of the test TE3.0 14 If the EHR permits electronic health information to Electronic health information is entered into the patient 1 Time: [conditional] be added, select a patient and add electronic record. User ID: health information to the patient record. Patient ID: Otherwise, skip to the next step. Proctor documents the date, time, user identification, Data Accessed: patient identification, and identifies the patient data After test data is entered, exit the record. accessed. TE3.0 15 If the EHR permits electronic health information to Electronic health information is changed in the patient 3 Time: [conditional] be changed, select the patient used at Step 14 record. User ID: and change electronic health information from the Patient ID: patient record. Otherwise, skip to the next step. Proctor documents the date, time, user identification, Data Accessed: patient identification, and identifies the patient data After test data is changed, exit the record. accessed. TE3.0 16 If the EHR permits electronic health information to Electronic health information is queried from the patient 4 Time: [conditional] be queried, select the patient used at Step 14 and record. User ID: query electronic health information from the Patient ID: patient record. Otherwise, skip to the next step. Proctor documents the date, time, user identification, Data Accessed: patient identification, and identifies the patient data After test data is queried, exit the record. accessed. TE3.0 17 If the EHR permits electronic health information to Electronic health information is printed from the patient 5 Time: [conditional] be printed, select the patient used at Step 14 and record. User ID: print electronic health information from the Patient ID: patient record. Otherwise, skip to the next step. Proctor documents the date, time, user identification, Data Accessed: patient identification, and identifies the patient data accessed. TE3.0 18 If the EHR permits electronic health information to Electronic health information is copied from the patient 6 Time: [conditional] be copied, select the patient used at Step 14 and record. User ID: copy electronic health information from the Patient ID: patient record. Otherwise, skip to the next step. Proctor documents the date, time, user identification, Data Accessed: patient identification, and identifies the patient data accessed. TE3.0 19 If the EHR permits electronic health information to Electronic health information is deleted from the patient 2 Time: [conditional] be deleted, select the patient used at Step 14 and record. IN3.04 User ID: delete electronic health information from the Patient ID: patient record. Otherwise, skip to the next step. Proctor documents the date, time, user identification, Data Accessed: patient identification, and identifies the patient data After test data is deleted, exit the record. accessed.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts Step 20 is required to be performed by all systems IN2.06 20 Generate an audit log that includes the entries for Audit log is generated correctly and without omission -2.08 the actions demonstrated at Steps 5, 8-9, 12-13, and matches the data recorded by the Proctor for these IN3.01 and 14-19. actions. This includes ensuring the timestamps were -3.03 applied using a clock synchronized to NTP per the applicable NTP criteria.

For Steps 4-5, 8-9, and 12-13, the audit log contains an entry for each action taken, and each entry includes the correct: . Date . Time . User identification

For Steps 14-19, the audit log contains an entry for each action taken, and each entry includes the correct: . Date . Time . Patient identification . User identification . Actions taken (additions, deletions, changes, queries, prints, copies); Change and Delete actions must include a pointer to the original data that was modified or deleted . Identification of the patient data accessed ☐ Step 21 only required for systems also certifying to 170.314(e)(1) View, Download, and Transmit to 3rd Party and have attested to providing a patient accessible log per the requirements in 170.314(d)(2) Auditable Events and Tamper-Resistance.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE4.0 21 Produce an audit log report that can be presented For the action taken at each step, the correct user, date, 1-4.07 [conditional] to the patient identified in Step 4 of 170.314(e)(1) time, and description of the actions performed are stored IN4.01 View, Download, and Transmit to 3rd Party for the accurately and without omission in the correct patient’s -4.03 [from actions performed at the following steps from record. test 170.314(e)(1) View, Download, and Transmit to proced ure for 3rd Party: 170.31 Note 1: The “view” action performed in Step 15 must be 4(e)(1) . Steps 13, 16 (viewed) View, attributed to the patient representative identified in Step Downl 4. All other actions must be attributed to the patient oad, . Steps 14, 15 (downloaded) and identified in Step 3. Trans . Steps 41, 42 (transmitted) mit to 3rd Party] . Conditionally Steps 67, 71, 122 Note 2: Step 14 is only required for EHRs testing in the (transmitted) Inpatient domain.

Note 3: Steps 40 and 41 may be represented in a single log entry if either the CCDA XML document is transmitted with an associated stylesheet to comply with the requirements for transmitting a human readable document or if the XML and human readable versions of the CCDA are sent in a single transmission.

Note 4: Steps 67, 71, and 122 are conditional upon if the optional Edge protocols are demonstrated, and if XDR or SMTP is chosen. Select Document any other pertinent observations below: Test Result 170.314(d)(3) Audit Reports Setup Guidance . Create the necessary data to ensure that the audit log has 2 or more . Guidance from ICSA Labs entries . Verify that there are unique values within all required fields in order to properly demonstrate the ability to sort on each of the fields

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE1.0 1 Generate an audit log for a specified time period Audit log is generated correctly and without omission, 1 that includes at least one each of the following contains at least 2 entries, encompasses the specified IN1.01 actions: time period, and each entry of the audit log contains: -1.02 . Addition . Date and time of event . Deletion . Patient identification . Change . User identification . Query . Actions taken (additions, deletions, changes, . Print queries, prints, copies); Change and Delete actions must include a pointer to the original . Copy data that was modified or deleted The audit report should also contain enough . Identification of the patient data accessed variable data for each of the following fields to permit the demonstration of sorting capabilities: . Date and time of event . Patient identification . User identification . Actions taken . Identification of the patient data accessed TE2.0 2 Sort the audit log generated at Step 1 by each of Audit log is correctly sorted by each of the elements. 1-2.05 the following elements: IN2.01 -2.02 . Date and time of event . Patient identification . User identification . Actions taken (additions, deletions, changes, queries, prints, copies) . Identification of the patient data accessed Select Document any other pertinent observations below: Test Result

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts 170.314(d)(8) Integrity Setup OGuidance . Attestation identifying the secure hash algorithm used . . Guidance from ICSA Labs to provide the hash value Cu . O

Step # Action to Perform Expected Outcome Ref ere Notes / Deviations nce TE1.0 1 Notify the Proctor of the secure hashing algorithm Proctor documents the secure hashing algorithm used to 1 being used to provide the hash value. provide the hash value and verifies it is equal to or IN1.01 greater in strength than SHA-1 as specified in FIPS PUB 180-4 and matches the algorithm provided via attestation. TE1.0 2 Using the data identified during attestation, The 2 hash values are identical. 2 generate 2 separate hash values. Output these IN1.02 hash values and store them for comparison (e.g. TE2.0 copy/paste to Notepad). 1 IN2.01 TE1.0 3 Modify the original data used in Step 2 and then This hash value is different from the 2 hash values 3-1.04 generate 1 additional hash value. Output this generated at Step 2. IN1.02 hash value and store it for comparison (e.g. TE2.0 copy/paste to Notepad). 2 IN2.02 4 Identify the transport technology and receiving A transport technology and receiving system is specified system used to exchange the test data and hash that can be used to exchange the test data and hash value from the EHR. value with the tester. TE3.0 5 Exchange the test data and hash value with the Test data and hash value are received by the receiving 1-3.02 receiving system. system.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE3.0 6 Access the final hash value and corresponding Zip file containing the hash value and test data is 1-3.02 test data received at Step 5 and d8 .txt file and zip uploaded using the correct filename. them together per the instructions at Submitting Files on Test Day. Upload the zip file to ICSA Labs using the URL provided by the Proctor. Uploaded zip files must include the organization name and criterion number in filename (e.g. d8_ABCompany).

Resubmissions during the same test session MUST modify the .zip filename to include the word ‘Retest’, as in d8_ABCompany_Retest1, d8_ABCompany_Retest2, etc. TE3.0 7 Using the test data submitted electronically to the The electronically exchanged hash value and the hash 3-3.04 receiving system, the Proctor will generate a new value generated on the receiving system are the same. IN3.01 hash value.

This step performed outside of the demonstration. Select Document any other pertinent observations below: Test Result 170.314(d)(7) End-User Device Encryption Setup ONC Guidance . Attestation identifying the encryption algorithm Test . Guidance from ICSA Labs and corresponding key length must be Data submitted prior to scheduling test date. and Proc edur e . C

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts Step # Action to Perform Expected Outcome Ref ere Notes / Deviations nce ☐ Steps 1-9 performed only if the system stores electronic health information on an end-user device TE1.0 1 Notify the Proctor of the encryption algorithm and Proctor documents the encryption algorithm and 1-1.02 [conditional] corresponding key length to be used to encrypt corresponding key length and verifies they are compliant IN1.01 electronic health information on end-user devices. with FIPS 140-2 Annex A and matches the algorithm -1.02 provided via attestation. TE3.0 2 From an end-user device, initiate an EHR session A session is initiated to store electronic health 1 [conditional] that is designed to store electronic health information on the end-user device. information on the end-user device. TE3.0 3 Stop the EHR session using the end-user device The session is stopped using the end-user device. 2 [conditional] identified in Step 2. TE3.0 4 Demonstrate that the electronic health information The electronic health information stored locally on the 3 [conditional] stored locally on the end-user device after the end-user device after the session stops is encrypted and IN3.01 session stops is encrypted. unreadable. ☐ Steps 5-9 performed only if the system allows the encryption of electronic health information stored on an end-user device to be disabled TE2.0 5 Determine the EHR's default setting to encrypt The default setting to encrypt electronic health 1-2.02 [conditional] electronic health information stored on end-user information stored on end-user devices is enabled. IN2.01 devices (enabled or disabled). TE2.0 6 Demonstrate that the configuration setting can The configuration setting can only be disabled by a 3 [conditional] only be disabled by a limited set of users. limited set of users. IN2.02 TE2.0 7 Log on as a user who does not have the Encryption is not disabled. 3 [conditional] authorization to disable the encryption and IN2.02 attempt to disable the encryption. TE2.0 8 Log on as a user with the authorization to disable Encryption is disabled. 3 [conditional] the encryption and disable the encryption. IN2.02 9 Re-enable the encryption. Encryption is enabled. [conditional] ☐ Steps 10-12 performed only if the system does NOT permit electronic health information to be stored on an end-user device TE4.0 10 From an end-user device, initiate an EHR session A session is initiated to access electronic health 1 [conditional] that accesses electronic health information. information from the end-user device. TE4.0 11 Stop the EHR session using the end-user device The session is stopped using the end-user device. 2 [conditional] identified in Step 10. TE4.0 12 Demonstrate that no electronic health information No electronic health information from the session is 3-4.04 [conditional] is locally stored on the end-user device. locally stored on the end-user device. IN4.01 -4.02 Page 212 of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts Select Document any other pertinent observations below: Test Result 170.314(d)(1) Authentication, Access Control and Authorization Setup Guidance . Identify user information to be created for this step . Guidance from ICSA Labs . Be prepared to enter passwords in a manner that is visible to the Proctor via an onscreen keyboard or copying/pasting text out of a separate document (e.g. Notepad) using your mouse (utilizing keyboard shortcut keys are prohibited)

Step # Action to Perform Expected Outcome Ref ere Notes / Deviations nce TE1.0 1 Create a new user account with a unique identifier User account with a unique user identifier is created, 1 and configure identification and authentication identification and authentication information are TE2.0 information (typically a username and password configured, and appropriate permissions are assigned. 2-2.03 combination). IN1.01 IN2.02 Passwords and other authentication information were Assign appropriate permissions to allow access to entered correctly and in a way that was visible to the some functions available through the EHR Proctor (e.g. onscreen keyboard or copying/pasting). technology and prevent access to other functions. TE1.0 2 Login as the user created at Step 1 and attempt The user is able to login and the authorized action was 2 to perform an action authorized by the assigned performed successfully. TE2.0 permissions. 4-2.05 IN1.02 Password was entered in a way that was visible to the IN2.03 Proctor (e.g. onscreen keyboard or copying/pasting). TE1.0 3 Attempt to perform an action unauthorized by the The system does not allow the unauthorized action to be 3 assigned permissions. performed. TE2.0 6-2.07 IN1.02 Log out. Logout successful. IN2.04 TE2.0 4 Attempt to login as the user created at Step 1 Login attempt fails. 1 while using an invalid password. IN2.01 Password was entered in a way that was visible to the Proctor (e.g. onscreen keyboard or copying/pasting).

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE1.0 5 Attempt to create a duplicate of the user identified Duplicate user identifier is not created. 4 at Step 1. IN1.03 TE2.0 6 Change the permissions for the user created at Permissions are changed correctly. 8 Step 1 to allow access to all functions, including IN2.05 those previously prohibited. TE2.0 7 Login as the user created at Step 1 and attempt The now authorized action was performed successfully. 9-2.10 to perform the same action that was performed at IN2.06 Step 3. Password was entered in a way that was visible to the Proctor (e.g. onscreen keyboard or copying/pasting). TE1.0 8 Log out of the system. Log out successful. 3 TE2.0 7 IN1.02 TE1.0 9 Delete, deactivate, or disable the account created Account is successfully deleted, deactivated, or 5 at Step 1. disabled. IN1.04 TE1.0 10 Attempt to login to the system using the deleted, Login attempt fails. 6 deactivated, or disabled account. IN1.05 Password was entered in a way that was visible to the Proctor (e.g. onscreen keyboard or copying/pasting). Select Document any other pertinent observations below: Test Result

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts Setup O Guidance . Identify an existing user account N . Guidance from ICSA Labs . Create emergency and non-emergency access C scenarios T e s t

D a t a

P r o c e d u r e .

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts Step # Action to Perform Expected Outcome Ref ere Notes / Deviations nce TE1.0 1 Select an existing user account and assign Emergency access authorizations are successfully 1 emergency access abillity. assigned. IN1.01 TE1.0 2 In a non-emergency access scenario, attempt to Action is not permitted. 2-1.03 perform an action involving EHI that requires IN1.03 emergency access authorizations. TE1.0 3 In an emergency access scenario, have the user Action is permitted. 4-1.05 initiate emergency access. Perform an action IN1.02 involving EHI authorized by the emergency access authorizations. Select Document any other pertinent observations below: Test Result 170.314(d)(5) Automatic Log-Off Setup Guidance . Identify an existing user account . Guidance from ICSA Labs . If possible, set the pre-determined time of inactivity to 1 minute Step # Action to Perform Expected Outcome Ref ere Notes / Deviations nce 1 Configure and display the pre-determined period Pre-determined time of inactivity is configured and of inactivity to automatically terminate a user's displayed. session (1 minute is suggested). TE1.0 2 Using an existing user account, log in to the Login is successful and patient record is accessed. 1 system and access a patient’s record. TE1.0 3 Allow the pre-determined time of inactivity to Further access to the user's session is not permitted. 2 expire and attempt to gain further access to the IN1.01 record. TE1.0 4 Login using the same credentials that were used Access to the user's session is permitted only after re- 2 to initiate the session and attempt to access the authentication. IN1.01 patient’s record identified in Step 2.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts Select Document any other pertinent observations below: Test Result

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts Test Script – Automated Measure 170.314(g)(1) Automated Numerator Recording [EHR Modules Only] Setup Guidance . Create all patient records and input data for the setup patients . Guidance from ICSA Labs (Scenario 1 – first table in the Test Data) for each measure . Matrix of Core/Menu Set Objectives being tested using the provided test data

Step # Action to Perform Expected Outcome Ref ere Notes / Deviations nce TE1.0 1 Demonstrate the capability to create a report for The EHR is able to accurately adjust the reporting 2 the following reporting periods: periods and the numerator information is accurate and IN1.01 [AMB] (Eligible Professional) complete for each reporting period. . Any 90 consecutive days within a calendar year, including 90 day periods that span across more than 3 months (e.g. beginning May 12th); . Calendar year quarters (1st, 2nd, 3rd, 4th); and . Calendar year. [INP] (Eligible Hospital/Critical Access Hospital) . Any 90 consecutive days within a federal fiscal year; . Federal fiscal year quarters (1st, 2nd, 3rd, 4th); and . Federal fiscal year. TE1.0 2 Demonstrate the capability to create select The numerator information is accurate and complete for 3 reports for Stage 1 meaningful use. meaningful use Stage 1. IN1.01 TE1.0 3 Demonstrate the capability to create select The numerator information is accurate and complete for 3 reports for Stage 2 meaningful use. meaningful use Stage 2. IN1.01 Page 219 of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts ☐ Steps 4-9 optional for systems testing criterion a5 which maps to the Problem List measure [Stage 1] TE4.0 4 For Problem List, create a baseline report that Report is created correctly and without omission and 1 [Problems] includes the numerator values and sufficient detail includes the required information. TE4.0 to match the patients/actions to the denominator 7 IN4.01 limitations using the data that was previously -4.02 entered from 1: Test Data Set-Up for New Patient. TE4.0 5 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 2 [Problems] Proctor from 2: Modify Test Data Set-Up for New Patient. TE4.0 6 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 3 [Problems] Proctor from 3: Add New Patient or Modify Existing Patient. TE4.0 7 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 4 [Problems] Proctor from 4: Add New Patient or Modify Existing Patient. TE4.0 8 Enter the test data for 1 patient selected by the Test data is entered correctly and without omission. 5 [Problems] Proctor from 5: Add New or Modify Existing Patient. TE4.0 9 Generate the delta report. Report includes sufficient detail to match the 6-4.07 [Problems] patients/actions to the denominator limitations and the IN4.01 numerator increments as expected. -4.03

☐ Steps 10-15 optional for systems testing criterion a6 which maps to the Medication List measure [Stage 1] TE5.0 10 For Medication List, create a baseline report that Report is created correctly and without omission and 1 [Medications] includes the numerator values and sufficient detail includes the required information. TE5.0 to match the patients/actions to the denominator 7 IN5.01 limitations using the data that was previously -5.02 entered from 1: Test Data Set-Up for New Patient. TE5.0 11 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 2 [Medications] Proctor from 2: Modify Test Data Set-Up for New Patient. TE5.0 12 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 3 [Medications] Proctor from 3: Add New Patient or Modify Existing Patient. TE5.0 13 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 4 [Medications] Proctor from 4: Add New Patient or Modify Existing Patient.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE5.0 14 Enter the test data for 1 patient selected by the Test data is entered correctly and without omission. 5 [Medications] Proctor from 5: Add New or Modify Existing Patient. TE5.0 15 Generate the delta report. Report includes sufficient detail to match the 6-5.07 [Medications] patients/actions to the denominator limitations and the IN5.01 numerator increments as expected. -5.03 ☐ Steps 16-21 optional for systems testing criterion a7 which maps to the Medication Allergy List measure [Stage 1] TE6.0 16 For Medication Allergy List, create a baseline Report is created correctly and without omission and 1 [Med Allergy] report that includes the numerator values and includes the required information. TE6.0 sufficient detail to match the patients/actions to 7 IN6.01 the denominator limitations using the data that -6.02 was previously entered from 1: Test Data Set-Up for New Patient. TE6.0 17 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 2 [Med Allergy] Proctor from 2: Modify Test Data Set-Up for New Patient. TE6.0 18 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 3 [Med Allergy] Proctor from 3: Add New Patient or Modify Existing Patient. TE6.0 19 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 4 [Med Allergy] Proctor from 4: Add New Patient or Modify Existing Patient. TE6.0 20 Enter the test data for 1 patient selected by the Test data is entered correctly and without omission. 5 [Med Allergy] Proctor from 5: Add New or Modify Existing Patient. TE6.0 21 Generate the delta report. Report includes sufficient detail to match the 6-6.07 [Med Allergy] patients/actions to the denominator limitations and the IN6.01 numerator increments as expected. -6.03 ☐ Steps 22-43 required for systems testing criteria a1 or a18-20 which map to the Computerized Provider Order Entry (CPOE) measure [Stage 1, Alternate Stage 1, Stage 2] Criterion a1 performs all steps. Criterion a18 only performs Steps 22-33. Criterion a19 only performs Steps 34-38. Criterion a20 only performs Steps 39-43. TE7.0 22 For CPOE, create a Stage 1 baseline report that Report is created correctly and without omission and 1 [CPOE] includes the numerator values and sufficient detail includes the required information. TE7.0 to match the patients/actions to the denominator 7 IN7.01 limitations using the data that was previously -7.02 entered from 1: Test Data Set-Up for New Patient (medication orders).

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE7.0 23 Enter Stage 1 test data for 1 patient selected by Test data is entered correctly and without omission. 2 [CPOE] the Proctor from 2: Modify Test Data Set-Up for New Patient (medication orders). TE7.0 24 Enter Stage 1 test data for 1 patient selected by Test data is entered correctly and without omission. 3 [CPOE] the Proctor from 3: Add New Patient or Modify Existing Patient (medication orders). TE7.0 25 Enter Stage 1 test data for 1 patient selected by Test data is entered correctly and without omission. 4 [CPOE] the Proctor from 4: Add New Patient or Modify Existing Patient (medication orders). TE7.0 26 Enter Stage 1 test data for 1 patient selected by Test data is entered correctly and without omission. 5 [CPOE] the Proctor from 5: Add New or Modify Existing Patient (medication orders). TE7.0 27 Generate the delta report. Report includes sufficient detail to match the 6-7.07 [CPOE] patients/actions to the denominator limitations and the IN7.01 numerator increments as expected. -7.03 TE7.0 28 Create a Stage 1 Alternative and Stage 2 Reports created correctly and without omission and 1 [CPOE] baseline reports that include the numerator values include the required information. TE7.0 and sufficient detail to match the patients/actions 7-7.08 IN7.01 to the denominator limitations using the data that -7.02 was previously entered from 1: Test Data Set-Up for New Patient (medication orders). TE7.0 29 Enter Stage 1 Alternative/Stage 2 test data for 1 Test data is entered correctly and without omission. 2 [CPOE] patient selected by the Proctor from 2: Modify Test Data Set-Up for New Patient (medication orders). TE7.0 30 Enter Stage 1 Alternative/Stage 2 test data for 1 Test data is entered correctly and without omission. 3 [CPOE] patient selected by the Proctor from 3: Add New Patient or Modify Existing Patient (medication orders). TE7.0 31 Enter Stage 1 Alternative/Stage 2 test data for 1 Test data is entered correctly and without omission. 4 [CPOE] patient selected by the Proctor from 4: Add New Patient or Modify Existing Patient (medication orders). TE7.0 32 Enter Stage 1 Alternative/Stage 2 test data for 1 Test data is entered correctly and without omission. 5 [CPOE] patient selected by the Proctor from 5: Add New or Modify Existing Patient (medication orders). TE7.0 33 Generate the Stage 1 Alternative and Stage 2 Report includes sufficient detail to match the 6-7.08 [CPOE] delta reports. patients/actions to the denominator limitations and the IN7.01 numerator increments as expected. -7.03

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE7.0 34 Create a Stage 2 baseline report that includes the Report created correctly and without omission and 1 [CPOE] numerator values and sufficient detail to match includes the required information. TE7.0 the patients/actions to the denominator limitations 7-7.08 IN7.01 using the data that was previously entered from 1: -7.02 Test Data Set-Up for New Patient (lab orders). TE7.0 35 Enter Stage 2 test data for 1 patient selected by Test data is entered correctly and without omission. 3 [CPOE] the Proctor from 3: Add New Patient or Modify Existing Patient (lab orders). TE7.0 36 Enter Stage 2 test data for 1 patient selected by Test data is entered correctly and without omission. 4 [CPOE] the Proctor from 4: Add New Patient or Modify Existing Patient (lab orders). TE7.0 37 Enter Stage 2 test data for 1 patient selected by Test data is entered correctly and without omission. 5 [CPOE] the Proctor from 5: Add New or Modify Existing Patient (lab orders). TE7.0 38 Generate the Stage 2 delta reports. Report includes sufficient detail to match the 6-7.08 [CPOE] patients/actions to the denominator limitations and the IN7.01 numerator increments as expected. -7.03 TE7.0 39 Create a Stage 2 baseline report that includes the Report created correctly and without omission and 1 [CPOE] numerator values and sufficient detail to match includes the required information. TE7.0 the patients/actions to the denominator limitations 7-7.08 IN7.01 using the data that was previously entered from 1: -7.02 Test Data Set-Up for New Patient (radiology orders). TE7.0 40 Enter Stage 2 test data for 1 patient selected by Test data is entered correctly and without omission. 3 [CPOE] the Proctor from 3: Add New Patient or Modify Existing Patient (radiology orders). TE7.0 41 Enter Stage 2 test data for 1 patient selected by Test data is entered correctly and without omission. 4 [CPOE] the Proctor from 4: Add New Patient or Modify Existing Patient (radiology orders). TE7.0 42 Enter Stage 2 test data for 1 patient selected by Test data is entered correctly and without omission. 5 [CPOE] the Proctor from 5: Add New or Modify Existing Patient (radiology orders). TE7.0 43 Generate the Stage 2 delta report. Report includes sufficient detail to match the 6-7.08 [CPOE] patients/actions to the denominator limitations and the IN7.01 numerator increments as expected. -7.03 ☐ Steps 44-58 required for systems testing criterion b3 which maps to the ePrescribing (eRx) measure [Stage 1, Stage 2 controlled substances, Stage 2 uncontrolled substances]

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE8.0 44 For eRx, create a Stage 1 baseline report that Report is created correctly and without omission and 1 [AMB] includes the numerator values and sufficient detail includes the required information. TE8.0 to match the patients/actions to the denominator 6 [eRx] IN8.01 limitations using the data that was previously -8.02 entered from 1: Test Data Set-Up for New Patient. TE8.0 45 Enter Stage 1 test data for 1 patient selected by Test data is entered correctly and without omission. 2 [AMB] the Proctor from 3: Add New Patient or Modify [eRx] Existing Patient. TE8.0 46 Enter Stage 1 test data for 1 patient selected by Test data is entered correctly and without omission. 3 [AMB] the Proctor from 4: Add New Patient or Modify [eRx] Existing Patient. TE8.0 47 Enter Stage 1 test data for 1 patient selected by Test data is entered correctly and without omission. 4 [AMB] the Proctor from 5: Add New or Modify Existing [eRx] Patient. TE8.0 48 Generate the delta report. Report includes sufficient detail to match the 5-8.06 [AMB] patients/actions to the denominator limitations and the IN8.01 -8.03 [eRx] numerator increments as expected. TE8.0 49 Create a Stage 2 report that includes the Report is created correctly and without omission and 1 [AMB] numerator values and sufficient detail to match includes the required information. TE8.0 the patients/actions to the denominator limitations 6 [eRx] IN8.01 using the data that was previously entered from 1: -8.02 Test Data Set-Up for New Patient (includes controlled substances). TE8.0 50 Enter Stage 2 test data for 1 patient selected by Test data is entered correctly and without omission. 2 [AMB] the Proctor from 3: Add New Patient or Modify [eRx] Existing Patient (includes controlled substances). TE8.0 51 Enter Stage 2 test data for 1 patient selected by Test data is entered correctly and without omission. 3 [AMB] the Proctor from 4: Add New Patient or Modify [eRx] Existing Patient (includes controlled substances). TE8.0 52 Enter Stage 2 test data for 1 patient selected by Test data is entered correctly and without omission. 4 [AMB] the Proctor from 5: Add New or Modify Existing [eRx] Patient (includes controlled substances). TE8.0 53 Generate the delta report. Report includes sufficient detail to match the 5-8.06 [AMB] patients/actions to the denominator limitations and the IN8.01 -8.03 [eRx] numerator increments as expected.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE8.0 54 Create a Stage 2 report that includes the Report is created correctly and without omission and 1 [eRx] numerator values and sufficient detail to match includes the required information. TE8.0 the patients/actions to the denominator limitations 6 IN8.01 using the data that was previously entered from 1: -8.02 Test Data Set-Up for New Patient (excludes controlled substances). TE8.0 55 Enter Stage 2 test data for 1 patient selected by Test data is entered correctly and without omission. 2 [eRx] the Proctor from 3: Add New Patient or Modify Existing Patient (excludes controlled substances). TE8.0 56 Enter Stage 2 test data for 1 patient selected by Test data is entered correctly and without omission. 3 [eRx] the Proctor from 4: Add New Patient or Modify Existing Patient (excludes controlled substances). TE8.0 57 Enter Stage 2 test data for 1 patient selected by Test data is entered correctly and without omission. 4 [eRx] the Proctor from 5: Add New or Modify Existing Patient (excludes controlled substances). TE8.0 58 Generate the delta report. Report includes sufficient detail to match the 5-8.06 [eRx] patients/actions to the denominator limitations and the IN8.01 numerator increments as expected. -8.03 ☐ Steps 59-64 optional for systems testing criterion a3 which maps to the Demographics measure [Stage 1 & Stage 2] TE9.0 59 For Demographics, create the Stage 1 and Reports created correctly and without omission and 1 [Demographi Stage 2 baseline reports that include the include the required information. TE9.0 c] numerator values and sufficient detail to match 7 IN9.01 the patients/actions to the denominator limitations -9.02 using the data that was previously entered from 1: Test Data Set-Up for New Patient. TE9.0 60 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 2 [Demographi Proctor from 2: Modify Test Data Set-Up for New c] Patient. TE9.0 61 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 3 [Demographi Proctor from 3: Add New Patient or Modify c] Existing Patient. TE9.0 62 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 4 [Demographi Proctor from 4: Add New Patient or Modify c] Existing Patient. TE9.0 63 Enter the test data for 1 patient selected by the Test data is entered correctly and without omission. 5 [Demographi Proctor from 5: Add New or Modify Existing c] Patient. Page 225 of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE9.0 64 Generate the Stage 1 and Stage 2 delta reports. Reports include sufficient detail to match the 6-9.07 [Demographi patients/actions to the denominator limitations and the IN9.01 c] numerators increment as expected. -9.03 ☐ Steps 65-70 optional for systems testing criterion a4 which maps to the Vital Signs measure [Stage 1, Alternate Stage 1, Stage 2] TE10. 65 For Vital Signs, create the Stage 1 and Reports created correctly and without omission and 01 [Vitals] Alternate Stage 1/Stages 1 & 2 baseline reports include the required information. TE10. for that include the numerator values and 07 IN10.0 sufficient detail to match the patients/actions to 1- the denominator limitations using the data that 10.02 was previously entered from 1: Test Data Set-Up for New Patient. . Alternate Stage 1/Stage 1 & Stage 2 reports should specify All Within Scope (EP/EH), BP Out of Scope (EP only), and Height/Weight Out of Scope (EP only); separate reports for each designation are permitted, though not required TE10. 66 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 02 [Vitals] Proctor from 2: Modify Test Data Set-Up for New Patient. TE10. 67 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 03 [Vitals] Proctor from 3: Add New Patient or Modify Existing Patient. TE10. 68 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 04 [Vitals] Proctor from 4: Add New Patient or Modify Existing Patient. TE10. 69 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 05 [Vitals] Proctor from 5: Add New or Modify Existing Patient. TE10. 70 Generate the delta reports for Stage 1 and Reports include sufficient detail to match the 06- [Vitals] Alternate Stage 1/Stages 1 & 2. patients/actions to the denominator limitations and the 10.07 numerators increment as expected. IN10.0 . Alternate Stage 1/Stage 1 & Stage 2 1- reports should specify All Within Scope 10.03 (EP/EH), BP Out of Scope (EP only), and Height/Weight Out of Scope (EP only); separate reports for each designation are permitted, though not required ☐ Steps 71-76 optional for systems testing a11 which maps to the Smoking Status measure [Stage 1 & Stage 2]

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE11. 71 For Smoking Status, create the Stage 1 and Reports created correctly and without omission and 01 [Smoking] Stage 2 baseline reports that include the include the required information. TE11. numerator values and sufficient detail to match 07 IN11.0 the patients/actions to the denominator limitations 1- using the data that was previously entered from 1: 11.02 Test Data Set-Up for New Patient. TE11. 72 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 02 [Smoking] Proctor from 2: Modify Test Data Set-Up for New Patient. TE11. 73 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 03 [Smoking] Proctor from 3: Add New Patient or Modify Existing Patient. TE11. 74 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 04 [Smoking] Proctor from 4: Add New Patient or Modify Existing Patient. TE11. 75 Enter the test data for 1 patient selected by the Test data is entered correctly and without omission. 05 [Smoking] Proctor from 5: Add New or Modify Existing Patient. TE11. 76 Generate the Stage 1 and Stage 2 delta reports. Reports include sufficient detail to match the 06- [Smoking] patients/actions to the denominator limitations and the 11.07 numerators increment as expected. IN11.0 1- 11.03 ☐ Steps 77-81 optional for systems testing b5 which maps to the Incorporated Lab Results measure [Stage 1 & 2] TE12. 77 For Incorporated Lab Results, create the Stage Reports created correctly and without omission and 01 [Incorp Labs] 1 and Stage 2 baseline reports that include the include the required information. TE12. numerator values and sufficient detail to match 06 IN12.0 the patients/actions to the denominator limitations 1- using the data that was previously entered from 1: 12.02 Test Data Set-Up for New Patient. TE12. 78 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 02 [Incorp Labs] Proctor from 3: Add New Patient or Modify Existing Patient. TE12. 79 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 03 [Incorp Labs] Proctor from 4: Add New Patient or Modify Existing Patient. TE12. 80 Enter the test data for 1 patient selected by the Test data is entered correctly and without omission. 04 [Incorp Labs] Proctor from 5: Add New or Modify Existing Patient.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE12. 81 Generate the Stage 1 and Stage 2 delta report. Reports include sufficient detail to match the 05- [Incorp Labs] patients/actions to the denominator limitations and the 12.06 numerator increments as expected. IN12.0 1- 12.03 ☐ Steps 82-94 optional for Ambulatory systems testing criterion a14 which supports the Patient Reminders measure [Stage 1 & Stage 2] TE13. 82 Demonstrate and describe how appointment Demonstration/description sufficiently indicates that 08 [AMB] reminders are excluded from the numerator appointment reminders are excluded from the numerator [Reminders] calculations. calculations. TE13. 83 For Patient Reminders, create a Stage 1 Report is created correctly and without omission and 01 [AMB] baseline report that includes the numerator values includes the required information. TE13. and sufficient detail to match the patients/actions 07 [Reminders] IN13.0 to the denominator limitations using the data that 1- was previously entered from 1: Test Data Set-Up 13.02 for New Patient. TE13. 84 Enter Stage 1 test data for 1 patient selected by Test data is entered correctly and without omission. 02 [AMB] the Proctor from 2: Modify Test Data Set-Up for [Reminders] New Patient. TE13. 85 Enter Stage 1 test data for 1 patient selected by Test data is entered correctly and without omission. 03 [AMB] the Proctor from 3: Add New Patient or Modify [Reminders] Existing Patient. TE13. 86 Enter Stage 1 test data for 1 patient selected by Test data is entered correctly and without omission. 04 [AMB] the Proctor from 4: Add New Patient or Modify [Reminders] Existing Patient. TE13. 87 Enter Stage 1 test data for 1 patient selected by Test data is entered correctly and without omission. 05 [AMB] the Proctor from 5: Add New or Modify Existing [Reminders] Patient. TE13. 88 Generate the delta report. Report includes sufficient detail to match the 06- [AMB] patients/actions to the denominator limitations and the 13.07 numerator increments as expected. IN13.0 [Reminders] 1- 13.03 TE13. 89 Create a Stage 2 baseline report that includes the Report is created correctly and without omission and 01 [AMB] numerator values and sufficient detail to match includes the required information. TE13. the patients/actions to the denominator limitations 07 [Reminders] IN13.0 using the data that was previously entered from 1: 1- Test Data Set-Up for New Patient. 13.02

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE13. 90 Enter Stage 2 test data for 1 patient selected by Test data is entered correctly and without omission. 02 [AMB] the Proctor from 2: Modify Test Data Set-Up for [Reminders] New Patient. TE13. 91 Enter Stage 2 test data for 1 patient selected by Test data is entered correctly and without omission. 03 [AMB] the Proctor from 3: Add New Patient or Modify [Reminders] Existing Patient. TE13. 92 Enter Stage 2 test data for 1 patient selected by Test data is entered correctly and without omission. 04 [AMB] the Proctor from 4: Add New Patient or Modify [Reminders] Existing Patient. TE13. 93 Enter Stage 2 test data for 1 patient selected by Test data is entered correctly and without omission. 05 [AMB] the Proctor from 5: Add New or Modify Existing [Reminders] Patient TE13. 94 Generate the delta report. Report includes sufficient detail to match the 06- [AMB] patients/actions to the denominator limitations and the 13.07 numerator increments as expected. IN13.0 [Reminders] 1- 13.03 ☐ Steps 95-103 required for systems testing criterion e1 which maps to the View, Download and Transmit (VDT) measure [Stage 1 & 2] TE14. 95 For View, Download and Transmit Stage 1 and Demonstration sufficiently indicates that health 01 [VDT] Stage 2 Measure A, use customer-supplied test information is made available online only after all IN14.0 data to demonstrate the method by which the required information (or indication of none) is made 1 IN14.0 numerator is populated. Numerator population available online to the patient. 3 may include methods by which all available data is automatically sent for online access or methods Proctor documents whether all data is sent automatically which all data is available after a provider completes specific actions. At least one test for online access or whether all data is available only patient should have all CMS required information after being reviewed and authorized by the provider. (or an indication of none) made available online to the patient and another test patient should not have all required information (or an indication of none) available online.

Specify whether all data is sent automatically for online access or whether all data is available only after being reviewed and authorized by the provider.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE14. 96 For View, Download and Transmit, create the Reports include numerator increments as expected 02 [VDT] Stage 1 and Stage 2 Measure A reports which using customer-supplied test data. TE14. includes the numerator values based on 04 IN14.0 customer-supplied test data. 3- 14.04

TE14. 97 Where the capability exists to release all available Reports include numerator value increments as 03- [VDT] patient information online only after action(s) expected and reflect the scenarios listed. 14.04 taken by the provider for View, Download and IN14.0 [Conditional] 1- Transmit, create the Stage 1 and Stage 2 14.04 Measure A reports, which are reflective of the following scenarios: . AMB: Patient information is available online within 4 business days of being seen, after 4 business days of being seen, and when the provider takes no action . INP: Patient information is available online within 36 hours of discharge, after 36 hours of discharge, and when the provider takes no action TE14. 98 For View, Download and Transmit, create the Reports created correctly and without omission and 05 [VDT] Stage 2 Measure B baseline reports that include include the required information. TE14. the numerator values and sufficient detail to 11 IN14.0 match the patients/actions to the denominator 5- limitations using the data that was previously 14.06 entered from 1: Test Data Set-Up for New Patient. TE14. 99 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 06 [VDT] Proctor from 2: Modify Test Data Set-Up for New Patient. TE14. 100 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 07 [VDT] Proctor from 3: Add New Patient or Modify Existing Patient. TE14. 101 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 08 [VDT] Proctor from 4: Add New Patient or Modify Existing Patient. TE14. 102 Enter the test data for 1 patient selected by the Test data is entered correctly and without omission. 09 [VDT] Proctor from 5: Add New or Modify Existing Patient.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE14. 103 Generate the Stage 2 Measure B delta report. Reports include sufficient detail to match the 10- [VDT] patients/actions to the denominator limitations and the 14.11 numerator increments as expected. IN14.0 5- 14.07 ☐ Steps 104-109 optional for Ambulatory systems testing criterion e2 which maps to the Clinical Summary measure [Stage 1 & Stage 2] TE15. 104 Describe and demonstrate the method(s) by The method(s) described allow numerator population 08 [AMB] which all CMS required information is made only upon provision of a clinical summary containing all IN15.0 4 [Summaries] available in the clinical summary in order to required information (or indication of none) within 3 populate the numerator. Required data elements business days of an office visit for Stage 1 and within 1 include the Common MU Data Set and the business day of an office visit for Stage 2. following data elements, (or an indication of none): . Provider’s name and office contact info . Date and location of visit . Reason for visit . Immunizations and/or medications administered during the visit . Diagnostic tests pending . Clinical instructions . Future appointments . Referrals to other providers . Future scheduled tests . Recommended patient decision aids TE15. 105 For Clinical Summaries, create the Stage 1 and Reports created correctly and without omission and 01 [AMB] Stage 2 baseline reports that include the include the required information. TE15. numerator values and sufficient detail to match 07 [Summaries] IN15.0 the patients/actions to the denominator limitations 1- using the data that was previously entered from 1: 15.02 Test Data Set-Up for New Patient. TE15. 106 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 02 [AMB] Proctor from 3: Add New Patient or Modify [Summaries] Existing Patient. TE15. 107 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 03 [AMB] Proctor from 4: Add New Patient or Modify [Summaries] Existing Patient.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE15. 108 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 04 [AMB] Proctor from 5: Add New or Modify Existing [Summaries] Patient. TE15. 109 Generate the Stage 1 and Stage 2 delta reports. Reports include sufficient detail to match the 06- [AMB] patients/actions to the denominator limitations and the 15.07 numerator increments as expected. IN15.0 [Summaries] 1- 15.03 ☐ Steps 110-115 required for systems testing criterion a15 which maps to the Patient Education measure [Stage 1 & Stage 2] TE16. 110 For Patient Education, create the Stage 1 and Reports created correctly and without omission and 01 [Education] Stage 2 baseline reports that include the include the required information. TE16. numerator values and sufficient detail to match 07 IN16.0 the patients/actions to the denominator limitations 1- using the data that was previously entered from 1: 16.02 Test Data Set-Up for New Patient. TE16. 111 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 02 [Education] Proctor from 2: Modify Test Data Set-Up for New Patient. TE16. 112 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 03 [Education] Proctor from 3: Add New Patient or Modify Existing Patient. TE16. 113 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 04 [Education] Proctor from 4: Add New Patient or Modify Existing Patient. TE16. 114 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 05 [Education] Proctor from 5: Add New or Modify Existing Patient. TE16. 115 Generate the Stage 1 and Stage 2 delta reports. Reports include sufficient detail to match the 06- [Education] patients/actions to the denominator limitations and the 16.07 numerator increments as expected. IN16.0 1- 16.03 ☐ Steps 116-125 required for systems testing criterion b4 and/or b9 which maps to the Medication Reconciliation measure [Stage 1 & Stage 2] TE17. 116 For Medication Reconciliation, create a Stage 1 Report is created correctly and without omission and 01 [AMB] baseline report that includes the numerator values includes the required information. TE17. and sufficient detail to match the patients/actions 06 [Med Rec] IN17.0 to the denominator limitations using the data that 1- was previously entered from 1: Test Data Set-Up 17.02 for New Patient.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE17. 117 Enter Stage 1 test data for 1 patient selected by Test data is entered correctly and without omission. 02 [AMB] the Proctor from 3: Add New Patient or Modify Existing Patient. [Med Rec] Transition of care is triggered through receipt of a CCDA Referral Summary/Summary of Care document. Transition of care must be triggered through receipt of a CCDA Referral Summary/Summary of Care document. TE17. 118 Enter Stage 1 test data for 1 patient selected by Test data is entered correctly and without omission. 03 [AMB] the Proctor from 4: Add New Patient or Modify Existing Patient. [Med Rec] TE17. 119 Enter Stage 1 test data for 1 patient selected by Test data is entered correctly and without omission. 04 [AMB] the Proctor from 5: Add New or Modify Existing Patient. [Med Rec] TE17. 120 Generate the delta report. Report includes sufficient detail to match the 05- [AMB] patients/actions to the denominator limitations and the 17.06 numerator increments as expected. IN17.0 [Med Rec] 1- 17.03 TE17. 121 Create a Stage 2 baseline report that includes the Report is created correctly and without omission and 01 [INP] numerator values and sufficient detail to match includes the required information. TE17. the patients/actions to the denominator limitations 06 [Med Rec] IN17.0 using the data that was previously entered from 1: 1- Test Data Set-Up for New Patient. 17.02 TE17. 122 Enter Stage 2 test data for 1 patient selected by Test data is entered correctly and without omission. 02 [INP] the Proctor from 3: Add New Patient or Modify Existing Patient. [Med Rec] Reconciliation is triggered through receipt of a CCDA document. Reconciliation must be triggered through receipt of a CCDA document. TE17. 123 Enter Stage 2 test data for 1 patient selected by Test data is entered correctly and without omission. 03 [INP] the Proctor from 4: Add New Patient or Modify Existing Patient. [Med Rec] TE17. 124 Enter Stage 2 test data for 1 patient selected by Test data is entered correctly and without omission. 04 [INP] the Proctor from 5: Add New or Modify Existing Patient. [Med Rec]

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE17. 125 Generate the delta report. Report includes sufficient detail to match the 05- [INP] patients/actions to the denominator limitations and the 17.06 numerator increments as expected. IN17.0 [Med Rec] 1- 17.03 ☐ Steps 126-132 required for systems testing criterion b2 and/or b8 which maps to the Summary of Care measure [Stage 1 & Stage 2 Measures A-B] TE18. 126 For Summary of Care, create the Stage 1, Stage Reports created correctly and without omission and 01 [Summary of 2 Measure A, and Stage 2 Measure B baseline include the required information. TE18. Care] reports that include the numerator values and 07 IN18.0 sufficient detail to match the patients/actions to 1- the denominator limitations using the data that 18.02 was previously entered from 1: Test Data Set-Up for New Patient. TE18. 127 Enter test data for 1 patient selected by the Test data is entered correctly and without omission 02- [Summary of Proctor from 3: Add New Patient or Modify through transmission of a CCDA document using the 18.03 Care] Existing Patient by transmitting a CCDA ONC Applicability Statement for Secure Health TE18. 11- document using the ONC Applicability Statement Transport (Direct) standard. 18.12 for Secure Health Transport (Direct) standard via IN18.0 4- the Transport Testing Tool using the Non-Specific 18.05 At a minimum, the following fields in the summary of CCDA email address (ccda@transport- care record contain information (or an indication of none) testing.nist.gov). prior to numerator population (Ambulatory & Inpatient settings): Describe and demonstrate the method(s) by . Current problem list which the following CMS required fields in the summary of care record, at a minimum, are . Current medication list populated (or contain an indication of none) for . Current medication allergy list the Ambulatory & Inpatient settings:

. Current problem list The Tester shall verify that the transmitted C-CDA . Current medication list document(s) have been transmitted and received successfully according to the ONC Applicability . Current medication allergy list Statement for Secure Health Transport (Direct) standard. TE18. 128 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 04 [Summary of Proctor from 4: Add New Patient or Modify Care] Existing Patient. TE18. 129 Enter test data for 1 patient selected by the Test data is entered correctly and without omission 05 [Summary of Proctor from 5: Add New or Modify Existing Care] Patient.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE18. 130 Generate the Stage 1, Stage 2 Measure A and Reports include sufficient detail to match the 06- [Summary of Stage 2 Measure B delta reports. patients/actions to the denominator limitations and the 18.07 Care] numerator increments as expected. IN18.0 1- 18.03

TE18. 131 Create an additional encounter with a Additional encounter with referral/transition of care is 08 [Summary of referral/transition of care for the patient selected created. Care] at Step 127. TE18. 132 Generate another set of Stage 1, Stage 2 Reports include sufficient detail to match the 09- [Summary of Measure A and Stage 2 Measure B delta patients/actions to the denominator limitations and the 18.10 Care] reports. numerator increments as expected. IN18.0 1- 18.03 ☐ Steps 133-138 required for Ambulatory systems testing criterion e3 which maps to the Secure Messaging measure [Stage 2] TE19. 133 For Secure Messaging, create a baseline report Report is created correctly and without omission and 01 [AMB] that includes the numerator values and sufficient includes the required information. TE19. detail to match the patients/actions to the 07 [Messaging] IN19.0 denominator limitations using the data that was 1- previously entered from 1: Test Data Set-Up for 19.02 New Patient. TE19. 134 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 02 [AMB] Proctor from 2: Modify Test Data Set-Up for New [Messaging] Patient. TE19. 135 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 03 [AMB] Proctor from 3: Add New Patient or Modify [Messaging] Existing Patient. TE19. 136 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 04 [AMB] Proctor from 4: Add New Patient or Modify [Messaging] Existing Patient. TE19. 137 Enter the test data for 1 patient selected by the Test data is entered correctly and without omission. 05 [AMB] Proctor from 5: Add New or Modify Existing [Messaging] Patient. TE19. 138 Generate the delta report. Report includes sufficient detail to match the 06- [AMB] patients/actions to the denominator limitations and the 19.07 numerator increments as expected. IN19.0 [Messaging] 1- 19.03 ☐ Steps 139-143 optional for systems testing criterion a12 which maps to the Imaging measure [Stage 2]

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE20. 139 For Imaging, create a baseline report that Report is created correctly and without omission and 01 [Imaging] includes the numerator values and sufficient detail includes the required information. TE20. to match the patients/actions to the denominator 06 IN20.0 limitations using the data that was previously 1- entered from 1: Test Data Set-Up for New Patient. 20.02 TE20. 140 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 02 [Imaging] Proctor from 3: Add New Patient or Modify Existing Patient. TE20. 141 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 03 [Imaging] Proctor from 4: Add New Patient or Modify Existing Patient. TE20. 142 Enter the test data for 1 patient selected by the Test data is entered correctly and without omission. 04 [Imaging] Proctor from 5: Add New or Modify Existing Patient. TE20. 143 Generate the delta report. Report includes sufficient detail to match the 05- [Imaging] patients/actions to the denominator limitations and the 20.06 numerator increments as expected. IN20.0 1- 20.03 ☐ Steps 144-149 optional for systems testing criterion a13 which maps to the Family Health History measure [Stage 2] TE21. 144 For Family Health History, create a baseline Report is created correctly and without omission and 01 [Family Hx] report that includes the numerator values and includes the required information. TE21. sufficient detail to match the patients/actions to 07 IN21.0 the denominator limitations using the data that 1- was previously entered from 1: Test Data Set-Up 21.02 for New Patient. TE21. 145 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 02 [Family Hx] Proctor from 2: Modify Test Data Set-Up for New Patient. TE21. 146 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 03 [Family Hx] Proctor from 3: Add New Patient or Modify Existing Patient. TE21. 147 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 04 [Family Hx] Proctor from 4: Add New Patient or Modify Existing Patient. TE21. 148 Enter the test data for 1 patient selected by the Test data is entered correctly and without omission. 05 [Family Hx] Proctor from 5: Add New or Modify Existing Patient.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE21. 149 Generate the delta report. Report includes sufficient detail to match the 06- [Family Hx] patients/actions to the denominator limitations and the 21.07 numerator increments as expected. IN21.0 1- 21.03 ☐ Steps 150-156 optional for systems testing criterion a9 which maps to the Electronic Notes (eNotes) measure [Stage 2] TE22. 150 For eNotes, create a baseline report that includes Report is created correctly and without omission and 01 [eNotes] the numerator values and sufficient detail to includes the required information. TE22. match the patients/actions to the denominator 08 IN22.0 limitations using the data that was previously 1- entered from 1: Test Data Set-Up for New Patient. 22.02 TE22. 151 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 02 [eNotes] Proctor from 2: Modify Test Data Set-Up for New Patient. TE22. 152 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 03 [eNotes] Proctor from 3: Add New Patient or Modify Existing Patient. TE22. 153 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 04 [eNotes] Proctor from 4: Add New Patient or Modify Existing Patient. TE22. 154 Enter the test data for 2 patients selected by the Test data is entered correctly and without omission. 05 [eNotes] Proctor from 5: Add New or Modify Existing Patient. . Patient #1 – Note is created . Patient #2 – Note is edited and/or signed TE22. 155 Enter an electronic note by an individual who is Test data is entered correctly and without omission and 06 [eNotes] not the authorized provider. does not populate the numerator. TE22. 156 Generate the delta report. Report includes sufficient detail to match the 07- [eNotes] patients/actions to the denominator limitations and the 22.08 numerator increments as expected. IN22.0 1- 22.03 ☐ Steps 157-162 optional for Inpatient systems testing criterion a17 which maps to the Advance Directives measure [Stage 1 & 2] TE23. 157 For Advance Directives, create the Stage 1 and Reports created correctly and without omission and 01 [INP] Stage 2 baseline reports that include the include the required information. TE23. numerator values and sufficient detail to match 07 [Adv IN23.0 Directive] the patients/actions to the denominator limitations 1- using the data that was previously entered from 1: 23.02 Test Data Set-Up for New Patient.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE23. 158 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 02 [INP] Proctor from 2: Modify Test Data Set-Up for New [Adv Patient. Directive] TE23. 159 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 03 [INP] Proctor from 3: Add New Patient or Modify [Adv Existing Patient. Directive] TE23. 160 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 04 [INP] Proctor from 4: Add New Patient or Modify [Adv Existing Patient. Directive] TE23. 161 Enter the test data for 1 patient selected by the Test data is entered correctly and without omission. 05 [INP] Proctor from 5: Add New or Modify Existing [Adv Patient. Directive] TE23. 162 Generate the Stage 1 and Stage 2 delta reports. Reports include sufficient detail to match the 06- [INP] patients/actions to the denominator limitations and the 23.07 numerator increments as expected. IN23.0 [Adv 1- Directive] 23.03 ☐ Steps 163-167 optional for Inpatient systems testing criterion b6 which maps to the Structured Lab EH to EP measure [Stage 2] TE24. 163 For Structured Lab EH to EP, create a report Report is created correctly and without omission and 01 [INP] that includes the numerator values and sufficient includes the required information. TE24. detail to match the patients/actions to the 06 [Labs to EP] IN24.0 denominator limitations using the data that was 1- previously entered from 1: Test Data Set-Up for 24.02 New Patient. TE24. 164 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 02 [INP] Proctor from 3: Add New Patient or Modify [Labs to EP] Existing Patient. TE24. 165 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 03 [INP] Proctor from 4: Add New Patient or Modify [Labs to EP] Existing Patient. TE24. 166 Enter the test data for 1 patient selected by the Test data is entered correctly and without omission. 04 [INP] Proctor from 5: Add New or Modify Existing [Labs to EP] Patient.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE24. 167 Generate the delta report. Report includes sufficient detail to match the 05- [INP] patients/actions to the denominator limitations and the 24.06 numerator increments as expected. IN24.0 [Labs to EP] 1- 24.03 ☐ Steps 168-172 optional for Inpatient systems testing criterion a16 which maps to the Electronic Medication Administration Record (eMAR) measure [Stage 2] TE25. 168 For eMAR, create a report that includes the Report is created correctly and without omission and 01 [INP] numerator values and sufficient detail to match includes the required information. TE25. the patients/actions to the denominator limitations 06 [eMAR] IN25.0 using the data that was previously entered from 1: 1- Test Data Set-Up for New Patient. 25.02 TE25. 169 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 02 [INP] Proctor from 3: Add New Patient or Modify [eMAR] Existing Patient. TE25. 170 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 03 [INP] Proctor from 4: Add New Patient or Modify [eMAR] Existing Patient. TE25. 171 Enter the test data for 1 patient selected by the Test data is entered correctly and without omission. 04 [INP] Proctor from 5: Add New or Modify Existing [eMAR] Patient. TE25. 172 Generate the delta report. Report includes sufficient detail to match the 05- [INP] patients/actions to the denominator limitations and the 25.06 numerator increments as expected. IN25.0 [eMAR] 1- 25.03 Select Document any other pertinent observations below: Test Result

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts Setup O Guidance . Create all patient records and input data for the N . Guidance from ICSA Labs setup patients (Scenario 1 – first table in the Test C . Matrix of Core/Menu Set Objectives Data) for each measure being tested using the provided test data T e s t

D a t a

P r o c e d u r e .

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts Step # Action to Perform Expected Outcome Ref ere Notes / Deviations nce TE1.0 1 Demonstrate the capability to create a report for The EHR is able to accurately adjust the reporting 2 the following reporting periods: periods and the numerator and denominator information IN1.01 [AMB] (Eligible Professional) is accurate and complete for each reporting period. . Any 90 consecutive days within a calendar year, including 90 day periods that span across more than 3 months (e.g. beginning May 12th); . Calendar year quarters (1st, 2nd, 3rd, 4th); and . Calendar year. [INP] (Eligible Hospital/Critical Access Hospital) . Any 90 consecutive days within a federal fiscal year; . Federal fiscal year quarters (1st, 2nd, 3rd, 4th); and . Federal fiscal year. TE1.0 2 Demonstrate the capability to create select The numerator and denominator information is accurate 3 reports for Stage 1 meaningful use. and complete for meaningful use Stage 1. IN1.01 TE1.0 3 Demonstrate the capability to create select The numerator and denominator information is accurate 3 reports for Stage 2 meaningful use. and complete for meaningful use Stage 2. IN1.01 ☐ Steps 4-6 required for Ambulatory systems testing measures related to: CPOE, eRx, Incorporated Labs, VDT, Clinical Summary, Patient Education, Medication Reconciliation, Summary of Care, Imaging, or Electronic Notes TE2.0 4 For two providers, create a report that includes Report is created and includes the numerator, 1 [AMB] the test data for at least 1 measure. denominator, and resulting percentage.

NOTE: One report may be shown that identifies each provider’s metrics, or two separate reports (one for each provider) may be created. TE2.0 5 Increase the numerator of patients entered for Numerator is increased for one of the providers. 2 [AMB] one of the providers.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE2.0 6 Generate and display the same report(s) again. Report is created and includes the numerator, 3-2.04 [AMB] denominator, and resulting percentage correctly and IN2.01 without omission.

The numerator increments correctly for the appropriate provider. ☐ Steps 7-9 required for Inpatient systems testing measures related to: Problems, Meds, Med Allergies, Demographics, Vital Signs, Smoking Status, Patient Education, Family Health History, Electronic Notes, or Advance Directives TE3.0 7 Demonstrate that the Setup patient data Patients and encounter information from the Setup test 1 [INP] (Scenario 1) was entered according to the data (Scenario 1) are included. IN3.01 provided test data and includes all patients and encounter information: . (A) Direct admission to INP department (POS 21) . (B) Admitted to ED and then admitted to the INP department (POS 21) . (C) Admitted to ED and discharged from ED (POS 23) . (D) Admitted to ED and received observation services and then admitted to the INP department (POS 21) . (E) Admitted to INP department upon receiving observation services in the outpatient department (POS 22)

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE3.0 8 Generate and display the Observation Services Calculation of the Observation Services Method is 2-3.03 [INP] Method report and show that it includes test accurate and includes the appropriate test patients. IN3.02 patients with: . (A) Direct admission to INP department (POS 21) . (B) Admitted to the ED and then admitted to the INP department (POS 21) . (D) Admitted to ED and received observation services and then admitted to the INP department (POS 21) . (E) Admitted to INP department upon receiving observation services in the outpatient department (POS 22) TE3.0 9 Generate and display the All ED Visits Method Calculation of the All ED Visits Method is accurate and 2-3.03 [INP] report and show that it includes test patients with: includes the appropriate test patients. IN3.03 . (A) Direct admission to inpatient department (POS 21) . (B) Admitted to the ED and then admitted to the inpatient department (POS 21) . (C) Admitted to the ED and discharged from the ED (POS 23) . (D) Admitted to the ED and received observation services and then admitted to the inpatient department (POS 21) . (E) Admitted to INP department upon receiving observation services in the outpatient department (POS 22)

NOTE: Steps 7-9 must be repeated for every applicable measure being tested ☐ Steps 10-15 optional for systems testing criterion a5 which maps to the Problem List measure [Stage 1] TE4.0 10 For Problem List, create a baseline report that Report is created correctly and without omission and 1 [Problems] includes the numerator and denominator values includes the required information. TE4.0 and resulting percentage using the data that was 7 previously entered from 1: Test Data Set-Up for IN4.01 IN4.03 New Patient.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE4.0 11 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 2 [Problems] Proctor from 2: Modify Test Data Set-Up for New IN4.02 Patient. TE4.0 12 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 3 [Problems] Proctor from 3: Add New Patient or Modify IN4.02 Existing Patient. TE4.0 13 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 4 [Problems] Proctor from 4: Add New Patient or Modify IN4.02 Existing Patient. TE4.0 14 Enter the test data for 1 patient selected by the Test data is entered correctly and without omission. 5 [Problems] Proctor from 5: Add New or Modify Existing IN4.02 Patient. TE4.0 15 Generate the delta report. Report includes numerator and denominator value 6-4.07 [Problems] increments as expected and percentage calculation is IN4.03 accurate. -4.04 ☐ Steps 16-21 optional for systems testing criterion a6 which maps to the Medication List measure [Stage 1] TE5.0 16 For Medication List, create a baseline report that Report is created correctly and without omission and 1 [Medications] includes the numerator and denominator values includes the required information. TE5.0 and resulting percentage using the data that was 7 previously entered from 1: Test Data Set-Up for IN5.01 IN5.03 New Patient. TE5.0 17 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 2 [Medications] Proctor from 2: Modify Test Data Set-Up for New IN5.02 Patient. TE5.0 18 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 3 [Medications] Proctor from 3: Add New Patient or Modify IN5.02 Existing Patient. TE5.0 19 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 4 [Medications] Proctor from 4: Add New Patient or Modify IN5.02 Existing Patient. TE5.0 20 Enter the test data for 1 patient selected by the Test data is entered correctly and without omission. 5 [Medications] Proctor from 5: Add New or Modify Existing IN5.02 Patient. TE5.0 21 Generate the delta report. Report includes numerator and denominator value 6-5.07 [Medications] increments as expected and percentage calculation is IN5.03 accurate. -5.04 ☐ Steps 22-27 optional for systems testing criterion a7 which maps to the Medication Allergy List measure [Stage 1]

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE6.0 22 For Medication Allergy List, create a baseline Report is created correctly and without omission and 1 [Med Allergy] report that includes the numerator and includes the required information. TE6.0 denominator values and resulting percentage 7 using the data that was previously entered from 1: IN6.01 IN6.03 Test Data Set-Up for New Patient. TE6.0 23 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 2 [Med Allergy] Proctor from 2: Modify Test Data Set-Up for New IN6.02 Patient. TE6.0 24 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 3 [Med Allergy] Proctor from 3: Add New Patient or Modify IN6.02 Existing Patient. TE6.0 25 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 4 [Med Allergy] Proctor from 4: Add New Patient or Modify IN6.02 Existing Patient. TE6.0 26 Enter the test data for 1 patient selected by the Test data is entered correctly and without omission. 5 [Med Allergy] Proctor from 5: Add New or Modify Existing IN6.02 Patient. TE6.0 27 Generate the delta report. Report includes numerator and denominator value 6-6.07 [Med Allergy] increments as expected and percentage calculation is IN6.03 accurate. -6.04 ☐ Steps 28-49 required for systems testing criteria a1 or a18-20 which map to the Computerized Provider Order Entry (CPOE) measure [Stage 1, Alternate Stage 1, Stage 2] Criterion a1 performs all steps. Criterion a18 only performs Steps 28-39. Criterion a19 only performs Steps 40-44. Criterion a20 only performs Steps 45-49. TE7.0 28 For CPOE, create a Stage 1 baseline report that Report is created correctly and without omission and 1 [CPOE] includes the numerator and denominator values includes the required information. TE7.0 and resulting percentage using the data that was 7 previously entered from 1: Test Data Set-Up for IN7.01 IN7.03 New Patient (medication orders). TE7.0 29 Enter Stage 1 test data for 1 patient selected by Test data is entered correctly and without omission. 2 [CPOE] the Proctor from 2: Modify Test Data Set-Up for IN7.02 New Patient (medication orders). TE7.0 30 Enter Stage 1 test data for 1 patient selected by Test data is entered correctly and without omission. 3 [CPOE] the Proctor from 3: Add New Patient or Modify IN7.02 Existing Patient (medication orders). TE7.0 31 Enter Stage 1 test data for 1 patient selected by Test data is entered correctly and without omission. 4 [CPOE] the Proctor from 4: Add New Patient or Modify IN7.02 Existing Patient (medication orders).

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE7.0 32 Enter Stage 1 test data for 1 patient selected by Test data is entered correctly and without omission. 5 [CPOE] the Proctor from 5: Add New or Modify Existing IN7.02 Patient (medication orders). TE7.0 33 Generate the delta report. Report includes numerator and denominator value 6-7.07 [CPOE] increments as expected and percentage calculation is IN7.03 accurate. -7.04 TE7.0 34 Create a Stage 1 Alternative and Stage 2 Reports created correctly and without omission and 1 [CPOE] baseline reports that include the numerator and include the required information. TE7.0 denominator values and resulting percentage 7-7.08 using the data that was previously entered from 1: IN7.01 IN7.03 Test Data Set-Up for New Patient (medication orders). TE7.0 35 Enter Stage 1 Alternative/Stage 2 test data for 1 Test data is entered correctly and without omission. 2 [CPOE] patient selected by the Proctor from 2: Modify IN7.02 Test Data Set-Up for New Patient (medication orders). TE7.0 36 Enter Stage 1 Alternative/Stage 2 test data for 1 Test data is entered correctly and without omission. 3 [CPOE] patient selected by the Proctor from 3: Add New IN7.02 Patient or Modify Existing Patient (medication orders). TE7.0 37 Enter Stage 1 Alternative/Stage 2 test data for 1 Test data is entered correctly and without omission. 4 [CPOE] patient selected by the Proctor from 4: Add New IN7.02 Patient or Modify Existing Patient (medication orders). TE7.0 38 Enter Stage 1 Alternative/Stage 2 test data for 1 Test data is entered correctly and without omission. 5 [CPOE] patient selected by the Proctor from 5: Add New IN7.02 or Modify Existing Patient (medication orders). TE7.0 39 Generate the Stage 1 Alternative and Stage 2 Reports include numerator and denominator value 6-7.08 [CPOE] delta reports. increments as expected and percentage calculation is IN7.03 accurate. -7.05 TE7.0 40 Create a Stage 2 baseline report that include the Report created correctly and without omission and 1 [CPOE] numerator and denominator values and resulting includes the required information. TE7.0 percentage using the data that was previously 7-7.08 entered from 1: Test Data Set-Up for New Patient IN7.01 IN7.03 (lab orders). TE7.0 41 Enter Stage 2 test data for 1 patient selected by Test data is entered correctly and without omission. 3 [CPOE] the Proctor from 3: Add New Patient or Modify IN7.02 Existing Patient (lab orders).

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE7.0 42 Enter Stage 2 test data for 1 patient selected by Test data is entered correctly and without omission. 4 [CPOE] the Proctor from 4: Add New Patient or Modify IN7.02 Existing Patient (lab orders). TE7.0 43 Enter Stage 2 test data for 1 patient selected by Test data is entered correctly and without omission. 5 [CPOE] the Proctor from 5: Add New or Modify Existing IN7.02 Patient (lab orders). TE7.0 44 Generate the Stage 2 delta reports. Report includes numerator and denominator value 6-7.08 [CPOE] increments as expected and percentage calculation is IN7.03 accurate. -7.05 TE7.0 45 Create a Stage 2 baseline report that includes the Report created correctly and without omission and 1 [CPOE] numerator and denominator values and resulting includes the required information. TE7.0 percentage using the data that was previously 7-7.08 entered from 1: Test Data Set-Up for New Patient IN7.01 IN7.03 (radiology orders). TE7.0 46 Enter Stage 2 test data for 1 patient selected by Test data is entered correctly and without omission. 3 [CPOE] the Proctor from 3: Add New Patient or Modify IN7.02 Existing Patient (radiology orders). TE7.0 47 Enter Stage 2 test data for 1 patient selected by Test data is entered correctly and without omission. 4 [CPOE] the Proctor from 4: Add New Patient or Modify IN7.02 Existing Patient (radiology orders). TE7.0 48 Enter Stage 2 test data for 1 patient selected by Test data is entered correctly and without omission. 5 [CPOE] the Proctor from 5: Add New or Modify Existing IN7.02 Patient (radiology orders). TE7.0 49 Generate the Stage 2 delta report. Report includes numerator and denominator value 6-7.08 [CPOE] increments as expected and percentage calculation is IN7.03 accurate. -7.05 ☐ Steps 50-64 required for systems testing criterion b3 which maps to the ePrescribing (eRx) measure [Stage 1, Stage 2 controlled substances, Stage 2 uncontrolled substances] TE8.0 50 For eRx, create a Stage 1 baseline report that Report is created correctly and without omission and 1 [AMB] includes the numerator and denominator values includes the required information. TE8.0 6 [eRx] and resulting percentage using the data that was previously entered from 1: Test Data Set-Up for IN8.01 IN8.03 New Patient. TE8.0 51 Enter Stage 1 test data for 1 patient selected by Test data is entered correctly and without omission. 2 [AMB] the Proctor from 3: Add New Patient or Modify IN8.02 [eRx] Existing Patient.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE8.0 52 Enter Stage 1 test data for 1 patient selected by Test data is entered correctly and without omission. 3 [AMB] the Proctor from 4: Add New Patient or Modify IN8.02 [eRx] Existing Patient. TE8.0 53 Enter Stage 1 test data for 1 patient selected by Test data is entered correctly and without omission. 4 [AMB] the Proctor from 5: Add New or Modify Existing IN8.02 [eRx] Patient. TE8.0 54 Generate the delta report. Report includes numerator and denominator value 5-8.06 [AMB] increments as expected and percentage calculation is IN8.03 -8.04 [eRx] accurate. TE8.0 55 Create a Stage 2 report that includes the Report is created correctly and without omission and 1 [AMB] numerator and denominator values and resulting includes the required information. TE8.0 6 [eRx] percentage using the data that was previously entered from 1: Test Data Set-Up for New Patient. IN8.01 IN8.03 (includes controlled substances). TE8.0 56 Enter Stage 2 test data for 1 patient selected by Test data is entered correctly and without omission. 2 [AMB] the Proctor from 3: Add New Patient or Modify IN8.02 [eRx] Existing Patient (includes controlled substances). TE8.0 57 Enter Stage 2 test data for 1 patient selected by Test data is entered correctly and without omission. 3 [AMB] the Proctor from 4: Add New Patient or Modify IN8.02 [eRx] Existing Patient (includes controlled substances).

58 Enter Stage 2 test data for 1 patient selected by Test data is entered correctly and without omission. TE8.0 4 [AMB] the Proctor from 5: Add New or Modify Existing IN8.02 [eRx] Patient (includes controlled substances). TE8.0 59 Generate the delta report. Report includes numerator and denominator value 5-8.06 [AMB] increments as expected and percentage calculation is IN8.03 -8.05 [eRx] accurate. TE8.0 60 Create a Stage 2 report that includes the Report is created correctly and without omission and 1 [eRx] numerator and denominator values and resulting includes the required information. TE8.0 percentage using the data that was previously 6 entered from 1: Test Data Set-Up for New Patient. IN8.01 IN8.03 (excludes controlled substances). TE8.0 61 Enter Stage 2 test data for 1 patient selected by Test data is entered correctly and without omission. 2 [eRx] the Proctor from 3: Add New Patient or Modify IN8.02 Existing Patient (excludes controlled substances).

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE8.0 62 Enter Stage 2 test data for 1 patient selected by Test data is entered correctly and without omission. 3 [eRx] the Proctor from 4: Add New Patient or Modify IN8.02 Existing Patient (excludes controlled substances). TE8.0 63 Enter Stage 2 test data for 1 patient selected by Test data is entered correctly and without omission. 4 [eRx] the Proctor from 5: Add New or Modify Existing IN8.02 Patient (excludes controlled substances). TE8.0 64 Generate the delta report. Report includes numerator and denominator value 5-8.06 [eRx] increments as expected and percentage calculation is IN8.03 accurate. -8.05 ☐ Steps 65-70 optional for systems testing criterion a3 which maps to the Demographics measure [Stage 1 & 2] TE9.0 65 For Demographics, create the Stage 1 and Reports created correctly and without omission and 1 [Demographi Stage 2 baseline reports that include the include the required information. TE9.0 c] numerator and denominator values and resulting 7 percentage using the data that was previously IN9.01 IN9.03 entered from 1: Test Data Set-Up for New Patient. TE9.0 66 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 2 [Demographi Proctor from 2: Modify Test Data Set-Up for New IN9.02 c] Patient. TE9.0 67 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 3 [Demographi Proctor from 3: Add New Patient or Modify IN9.02 c] Existing Patient. TE9.0 68 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 4 [Demographi Proctor from 4: Add New Patient or Modify IN9.02 c] Existing Patient. TE9.0 69 Enter the test data for 1 patient selected by the Test data is entered correctly and without omission. 5 [Demographi Proctor from 5: Add New or Modify Existing IN9.02 c] Patient. TE9.0 70 Generate the Stage 1 and Stage 2 delta reports. Reports include numerator and denominator value 6-9.07 [Demographi increments as expected and percentage calculation is IN9.03 c] accurate. -9.04 ☐ Steps 71-76 optional for systems testing a4 which maps to the Vital Signs measure [Stage 1, Alternate Stage 1, Stage 2]

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE10. 71 For Vital Signs, create the Stage 1 and Reports created correctly and without omission and 01 [Vitals] Alternate Stage 1/Stages 1 & 2 baseline reports include the required information. TE10. that include the numerator and denominator 07 IN10.0 values and resulting percentage using the data 1 that was previously entered from 1: Test Data IN10.0 Set-Up for New Patient. 3 . Alternate Stage 1/Stage 1 & Stage 2 reports should specify All Within Scope (EP/EH), BP Out of Scope (EP only), and Height/Weight Out of Scope (EP only); separate reports for each designation are permitted, though not required TE10. 72 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 02 [Vitals] Proctor from 2: Modify Test Data Set-Up for New IN10.0 Patient. 2 TE10. 73 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 03 [Vitals] Proctor from 3: Add New Patient or Modify IN10.0 Existing Patient. 2 TE10. 74 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 04 [Vitals] Proctor from 4: Add New Patient or Modify IN10.0 Existing Patient. 2 TE10. 75 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 05 [Vitals] Proctor from 5: Add New or Modify Existing IN10.0 Patient. 2 TE10. 76 Generate the delta reports for Stage 1 and Reports include numerator and denominator value 06- [Vitals] Alternate Stage 1/Stages 1 & 2. increments as expected and percentage calculations are 10.07 accurate. IN10.0 . Alternate Stage 1/Stage 1 & Stage 2 3- reports should specify All Within Scope 10.04 (EP/EH), BP Out of Scope (EP only), and Height/Weight Out of Scope (EP only); separate reports for each designation are permitted, though not required ☐ Steps 77-82 optional for systems testing criterion a11 which maps to the Smoking Status measure [Stage 1 & Stage 2] TE11. 77 For Smoking Status, create the Stage 1 and Reports created correctly and without omission and 01 [Smoking] Stage 2 baseline reports that include the include the required information. TE11. numerator and denominator values and resulting 07 IN11.0 percentages using the data that was previously 1 entered from 1: Test Data Set-Up for New Patient. IN11.0 3

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE11. 78 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 02 [Smoking] Proctor from 2: Modify Test Data Set-Up for New IN11.0 Patient. 2 TE11. 79 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 03 [Smoking] Proctor from 3: Add New Patient or Modify IN11.0 Existing Patient. 2 TE11. 80 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 04 [Smoking] Proctor from 4: Add New Patient or Modify IN11.0 Existing Patient. 2 TE11. 81 Enter the test data for 1 patient selected by the Test data is entered correctly and without omission. 05 [Smoking] Proctor from 5: Add New or Modify Existing IN11.0 Patient. 2 TE11. 82 Generate the Stage 1 and Stage 2 delta reports. Reports include numerator and denominator value 06- [Smoking] increments as expected and percentage calculations are 11.07 accurate. IN11.0 3- 11.04 ☐ Steps 83-87 optional for systems testing criterion b5 which maps to the Incorporated Lab Results measure [Stage 1 & Stage 2] TE12. 83 For Incorporated Lab Results, create the Stage Reports created correctly and without omission and 01 [Incorp Labs] 1 and Stage 2 baseline reports that include the include the required information. TE12. numerator and denominator values and resulting 06 IN12.0 percentages using the data that was previously 1 entered from 1: Test Data Set-Up for New Patient. IN12.0 3 TE12. 84 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 02 [Incorp Labs] Proctor from 3: Add New Patient or Modify IN12.0 Existing Patient. 2 TE12. 85 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 03 [Incorp Labs] Proctor from 4: Add New Patient or Modify IN12.0 Existing Patient. 2 TE12. 86 Enter the test data for 1 patient selected by the Test data is entered correctly and without omission. 04 [Incorp Labs] Proctor from 5: Add New or Modify Existing IN12.0 Patient. 2 TE12. 87 Generate the Stage 1 and Stage 2 delta reports. Reports include numerator and denominator value 05- [Incorp Labs] increments as expected and percentage calculations are 12.06 accurate. IN12.0 3- 12.04 ☐ Steps 88-100 optional for systems testing criterion a14 which supports the Patient Reminders measure [Stage 1 & Stage 2]

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE13. 88 Demonstrate and describe how appointment Demonstration/description sufficiently indicates that 08 [AMB] reminders are excluded from the numerator appointment reminders are excluded from the numerator IN13.0 5 [Reminders] calculations. calculations. TE13. 89 For Patient Reminders, create a Stage 1 Report is created correctly and without omission and 01 [AMB] baseline report that includes the numerator and includes the required information. TE13. denominator values and resulting percentage 07 [Reminders] IN13.0 using the data that was previously entered from 1: 1 Test Data Set-Up for New Patient. IN13.0 3 TE13. 90 Enter Stage 1 test data for 1 patient selected by Test data is entered correctly and without omission. 02 [AMB] the Proctor from 2: Modify Test Data Set-Up for IN13.0 2 [Reminders] New Patient. TE13. 91 Enter Stage 1 test data for 1 patient selected by Test data is entered correctly and without omission. 03 [AMB] the Proctor from 3: Add New Patient or Modify IN13.0 2 [Reminders] Existing Patient. TE13. 92 Enter Stage 1 test data for 1 patient selected by Test data is entered correctly and without omission. 04 [AMB] the Proctor from 4: Add New Patient or Modify IN13.0 2 [Reminders] Existing Patient. TE13. 93 Enter Stage 1 test data for 1 patient selected by Test data is entered correctly and without omission. 05 [AMB] the Proctor from 5: Add New or Modify Existing IN13.0 2 [Reminders] Patient. TE13. 94 Generate the delta report. Report includes numerator and denominator value 06- [AMB] increments as expected and percentage calculation is 13.07 accurate. IN13.0 [Reminders] 3- 13.04 TE13. 95 Create a Stage 2 baseline report that includes the Report is created correctly and without omission and 01 [AMB] numerator and denominator values and resulting includes the required information. TE13. percentage using the data that was previously 07 [Reminders] IN13.0 entered from 1: Test Data Set-Up for New Patient. 1 IN13.0 3 TE13. 96 Enter Stage 2 test data for 1 patient selected by Test data is entered correctly and without omission. 02 [AMB] the Proctor from 2: Modify Test Data Set-Up for IN13.0 2 [Reminders] New Patient. TE13. 97 Enter Stage 2 test data for 1 patient selected by Test data is entered correctly and without omission. 03 [AMB] the Proctor from 3: Add New Patient or Modify IN13.0 2 [Reminders] Existing Patient.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE13. 98 Enter Stage 2 test data for 1 patient selected by Test data is entered correctly and without omission. 04 [AMB] the Proctor from 4: Add New Patient or Modify IN13.0 2 [Reminders] Existing Patient. TE13. 99 Enter Stage 2 test data for 1 patient selected by Test data is entered correctly and without omission. 05 [AMB] the Proctor from 5: Add New or Modify Existing IN13.0 2 [Reminders] Patient TE13. 100 Generate the delta report. Report includes numerator and denominator value 06- [AMB] increments as expected and percentage calculation is 13.07 accurate. IN13.0 [Reminders] 3- 13.04 ☐ Steps 101-109 required for systems testing criterion e1 which maps to the View, Download and Transmit (VDT) measure [Stage 1 & Stage 2] TE14. 101 For View, Download and Transmit Stage 1 and Demonstration sufficiently indicates that health 01 [VDT] Stage 2 Measure A, use customer-supplied test information is made available online only after all IN14.0 data to demonstrate the method by which the required information (or indication of none) is made 1 IN14.0 numerator and denominator are populated. available online to the patient. 3 Numerator population may include methods by which all available data is automatically sent for Proctor documents whether all data is sent automatically online access or methods which all data is for online access or whether all data is available only available after a provider completes specific after being reviewed and authorized by the provider. actions. At least one test patient should have all CMS required information (or an indication of none) made available online to the patient and another test patient should not have all required information (or an indication of none) available online.

Specify whether all data is sent automatically for online access or whether all data is available only after being reviewed and authorized by the provider. TE14. 102 For View, Download and Transmit, create the Reports include numerator and denominator value 02 [VDT] Stage 1 and Stage 2 Measure A reports which increments as expected and percentage calculations are TE14. includes the numerator and denominator values accurate using customer-supplied test data. 04 IN14.0 and resulting percentages using customer- 4 supplied test data.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE14. 103 Where the capability exists to release all available Reports include numerator and denominator value 03- [VDT] patient information online only after action(s) increments as expected and percentage calculations are 14.04 taken by the provider for View, Download and accurate and reflect the scenarios listed. IN14.0 [Conditional] 2- Transmit, create the Stage 1 and Stage 2 14.04 Measure A reports, which are reflective of the following scenarios: . AMB: Patient information is available online within 4 business days of being seen, after 4 business days of being seen, and when the provider takes no action . INP: Patient information is available online within 36 hours of discharge, after 36 hours of discharge, and when the provider takes no action TE14. 104 For View, Download and Transmit, create the Reports created correctly and without omission and 05 [VDT] Stage 2 Measure B baseline reports that include include the required information. TE14. the numerator and denominator values and 11 IN14.0 resulting percentage using the data that was 5- previously entered from 1: Test Data Set-Up for 14.07 New Patient. TE14. 105 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 06 [VDT] Proctor from 2: Modify Test Data Set-Up for New IN14.0 Patient. 5 TE14. 106 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 07 [VDT] Proctor from 3: Add New Patient or Modify IN14.0 Existing Patient. 5 TE14. 107 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 08 [VDT] Proctor from 4: Add New Patient or Modify IN14.0 Existing Patient. 5 TE14. 108 Enter the test data for 1 patient selected by the Test data is entered correctly and without omission. 09 [VDT] Proctor from 5: Add New or Modify Existing IN14.0 Patient. 5 TE14. 109 Generate the Stage 2 Measure B delta reports. Reports include numerator and denominator value 10- [VDT] increments as expected and percentage calculations are 14.11 accurate. IN14.0 6- 14.07 ☐ Steps 110-115 optional for Ambulatory systems testing criterion e2 which maps to the Clinical Summary measure [Stage 1 & Stage 2]

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE15. 110 Describe and demonstrate the method(s) by The method(s) described allow numerator population 05 [AMB] which all CMS required information is made only upon provision of a clinical summary containing all TE15. available in the clinical summary in order to required information (or indication of none) within 3 08 [Summaries] IN15.0 populate the numerator. Required data elements business days of an office visit for Stage 1 and within 1 5 include the Common MU Data Set and the business day of an office visit for Stage 2. following data elements, (or an indication of none): . Provider’s name and office contact info . Date and location of visit . Reason for visit . Immunizations and/or medications administered during the visit . Diagnostic tests pending . Clinical instructions . Future appointments . Referrals to other providers . Future scheduled tests . Recommended patient decision aids TE15. 111 For Clinical Summaries, create the Stage 1 and Reports created correctly and without omission and 01 [AMB] Stage 2 baseline reports that include the include the required information. TE15. numerator and denominator values and resulting 07 [Summaries] IN15.0 percentages using the data that was previously 1 entered from 1: Test Data Set-Up for New Patient. IN15.0 3 TE15. 112 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 02 [AMB] Proctor from 3: Add New Patient or Modify IN15.0 2 [Summaries] Existing Patient. TE15. 113 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 03 [AMB] Proctor from 4: Add New Patient or Modify IN15.0 2 [Summaries] Existing Patient. TE15. 114 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 04 [AMB] Proctor from 5: Add New or Modify Existing IN15.0 2 [Summaries] Patient.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE15. 115 Generate the Stage 1 and Stage 2 delta reports. Reports include numerator and denominator value 06- [AMB] increments as expected and percentage calculations are 15.07 accurate. IN15.0 [Summaries] 3- 15.04 ☐ Steps 116-121 required for systems testing criterion a15 which maps to the Patient Education measure [Stage 1 & Stage 2] TE16. 116 For Patient Education, create the Stage 1 and Reports created correctly and without omission and 01 [Education] Stage 2 baseline reports that include the include the required information. TE16. numerator and denominator values and resulting 07 IN16.0 percentages using the data that was previously 1 entered from 1: Test Data Set-Up for New Patient. IN16.0 3 TE16. 117 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 02 [Education] Proctor from 2: Modify Test Data Set-Up for New IN16.0 Patient. 2 TE16. 118 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 03 [Education] Proctor from 3: Add New Patient or Modify IN16.0 Existing Patient. 2 TE16. 119 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 04 [Education] Proctor from 4: Add New Patient or Modify IN16.0 Existing Patient. 2 TE16. 120 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 05 [Education] Proctor from 5: Add New or Modify Existing IN16.0 Patient. 2 TE16. 121 Generate the Stage 1 and Stage 2 delta reports. Reports include numerator and denominator value 06- [Education] increments as expected and percentage calculations are 16.07 accurate. IN16.0 3- 16.04 ☐ Steps 122-131 required for systems testing criterion b4 and/or b9 which map to the Medication Reconciliation measure [Stage 1 & Stage 2] TE17. 122 For Medication Reconciliation, create the Stage Report is created correctly and without omission and 01 [AMB] 1 and Stage 2 baseline reports that includes the includes the required information. TE17. numerator and denominator values and resulting 06 [Med Rec] IN17.0 percentage using the data that was previously 1 entered from 1: Test Data Set-Up for New Patient. IN17.0 3

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE17. 123 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 02 [AMB] Proctor from 3: Add New Patient or Modify IN17.0 Existing Patient. 2 [Med Rec] Transition of care is triggered through receipt of a CCDA Referral Summary/Summary of Care document. Transition of care must be triggered through receipt of a CCDA Referral Summary/Summary of Care document. TE17. 124 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 03 [AMB] Proctor from 4: Add New Patient or Modify IN17.0 2 [Med Rec] Existing Patient. TE17. 125 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 04 [AMB] Proctor from 5: Add New or Modify Existing IN17.0 2 [Med Rec] Patient. TE17. 126 Generate the Stage 1 and Stage 2 delta reports. Report includes numerator and denominator value 05- [AMB] increments as expected and percentage calculation is 17.06 accurate. IN17.0 [Med Rec] 3- 17.04 TE17. 127 Create the Stage 2 baseline report that includes Report is created correctly and without omission and 01 [INP] the numerator and denominator values and includes the required information. TE17. resulting percentage using the data that was 06 [Med Rec] IN17.0 previously entered from 1: Test Data Set-Up for 1 New Patient. IN17.0 3 TE17. 128 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 02 [INP] Proctor from 3: Add New Patient or Modify IN17.0 Existing Patient. 2 [Med Rec] Reconciliation is triggered through receipt of a CCDA document. Reconciliation must be triggered through receipt of a CCDA document. TE17. 129 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 03 [INP] Proctor from 4: Add New Patient or Modify IN17.0 2 [Med Rec] Existing Patient. TE17. 130 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 04 [INP] Proctor from 5: Add New or Modify Existing IN17.0 2 [Med Rec] Patient.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE17. 131 Generate the Stage 2 delta report. Report includes numerator and denominator value 05- [INP] increments as expected and percentage calculation is 17.06 accurate. IN17.0 [Med Rec] 3- 17.04 ☐ Steps 132-138 required for systems testing b2 and/or b8 which map to the Summary of Care measure [Stage 1 & Stage 2 Measures A-B] TE18. 132 For Summary of Care, create the Stage 1, Stage Reports created correctly and without omission and 01 [Summary of 2 Measure A, and Stage 2 Measure B baseline include the required information. TE18. Care] reports that include the numerator and 07 IN18.0 denominator values and resulting percentages 1 using the data that was previously entered from 1: IN18.0 Test Data Set-Up for New Patient. 3 TE18. 133 Enter test data for 1 patient selected by the Test data is entered correctly and without omission 02- [Summary of Proctor from 3: Add New Patient or Modify through transmission of a CCDA document using the 18.03 Care] Existing Patient by transmitting a CCDA ONC Applicability Statement for Secure Health TE18. 11- document using the ONC Applicability Statement Transport (Direct) standard. 18.12 for Secure Health Transport (Direct) standard via IN18.0 2 the Transport Testing Tool using the Non-Specific At a minimum, the following fields in the summary of IN18.0 CCDA email address (ccda@transport- 6- care record contain information (or an indication of none) 18.07 testing.nist.gov). prior to numerator population (Ambulatory & Inpatient settings): Describe and demonstrate the method(s) by . Current problem list which the following CMS required fields in the summary of care record, at a minimum, are . Current medication list populated (or contain an indication of none) for . Current medication allergy list the Ambulatory & Inpatient settings:

. Current problem list The Tester shall verify that the transmitted C-CDA . Current medication list document(s) have been transmitted and received successfully according to the ONC Applicability . Current medication allergy list Statement for Secure Health Transport (Direct) standard. TE18. 134 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 04 [Summary of Proctor from 4: Add New Patient or Modify IN18.0 Care] Existing Patient. 2 TE18. 135 Enter test data for 1 patient selected by the Test data is entered correctly and without omission 05 [Summary of Proctor from 5: Add New or Modify Existing IN18.0 Care] Patient. 2

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE18. 136 Generate the Stage 1, Stage 2 Measure A and Report includes numerator and denominator value 06- [Summary of Stage 2 Measure B delta reports. increments as expected and percentage calculations are 18.07 Care] accurate. IN18.0 3- 18.04 TE18. 137 Create an additional encounter with a Additional encounter with referral/transition of care is 08 [Summary of referral/transition of care for the patient selected created. IN18.0 Care] at Step 133. 2 TE18. 138 Generate another set of Stage 1, Stage 2 Reports include numerator and denominator value 09- [Summary of Measure A and Stage 2 Measure B delta increments as expected and percentage calculations are 18.10 Care] reports. accurate (denominator and numerator increment for IN18.0 5 every transition of care/referral that is created). ☐ Steps 139-144 required for Ambulatory systems testing criterion e3 which maps to the Secure Messaging measure [Stage 2] TE19. 139 For Secure Messaging, create a baseline report Report is created correctly and without omission and 01 [AMB] that includes the numerator and denominator includes the required information. TE19. values and resulting percentage using the data 07 [Messaging] IN19.0 that was previously entered from 1: Test Data 1 Set-Up for New Patient. IN19.0 3 TE19. 140 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 02 [AMB] Proctor from 2: Modify Test Data Set-Up for New IN19.0 2 [Messaging] Patient. TE19. 141 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 03 [AMB] Proctor from 3: Add New Patient or Modify IN19.0 2 [Messaging] Existing Patient. TE19. 142 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 04 [AMB] Proctor from 4: Add New Patient or Modify IN19.0 2 [Messaging] Existing Patient. TE19. 143 Enter the test data for 1 patient selected by the Test data is entered correctly and without omission. 05 [AMB] Proctor from 5: Add New or Modify Existing IN19.0 2 [Messaging] Patient. TE19. 144 Generate the delta report. Report includes numerator and denominator value 06- [AMB] increments as expected and percentage calculation is 19.07 accurate. IN19.0 [Messaging] 3- 19.04 ☐ Steps 145-149 optional for systems testing criterion a12 which maps to the Imaging measure [Stage 2]

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE20. 145 For Imaging, create a baseline report that Report is created correctly and without omission and 01 [Imaging] includes the numerator and denominator values includes the required information. TE20. and resulting percentage using the data that was 06 IN20.0 previously entered from 1: Test Data Set-Up for 1 New Patient. IN20.0 3 TE20. 146 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 02 [Imaging] Proctor from 3: Add New Patient or Modify IN20.0 Existing Patient. 2 TE20. 147 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 03 [Imaging] Proctor from 4: Add New Patient or Modify IN20.0 Existing Patient. 2 TE20. 148 Enter the test data for 1 patient selected by the Test data is entered correctly and without omission. 04 [Imaging] Proctor from 5: Add New or Modify Existing IN20.0 Patient. 2 TE20. 149 Generate the delta report. Report includes numerator and denominator value 05- [Imaging] increments as expected and percentage calculation is 20.06 accurate. IN20.0 3- 20.04 ☐ Steps 150-155 optional for systems testing criterion a13 which maps to the Family Health History measure [Stage 2] TE21. 150 For Family Health History, create a baseline Report is created correctly and without omission and 01 [Family Hx] report that includes the numerator and includes the required information. TE21. denominator values and resulting percentage 07 IN21.0 using the data that was previously entered from 1: 1 Test Data Set-Up for New Patient. IN21.0 3 TE21. 151 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 02 [Family Hx] Proctor from 2: Modify Test Data Set-Up for New IN21.0 Patient. 2 TE21. 152 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 03 [Family Hx] Proctor from 3: Add New Patient or Modify IN21.0 Existing Patient. 2 TE21. 153 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 04 [Family Hx] Proctor from 4: Add New Patient or Modify IN21.0 Existing Patient. 2 TE21. 154 Enter the test data for 1 patient selected by the Test data is entered correctly and without omission. 05 [Family Hx] Proctor from 5: Add New or Modify Existing IN21.0 Patient. 2

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE21. 155 Generate the delta report. Report includes numerator and denominator value 06- [Family Hx] increments as expected and percentage calculation is 21.07 accurate. IN21.0 3- 21.04 ☐ Steps 156-162 optional for systems testing criterion a9 which maps to the Electronic Notes (eNotes) measure [Stage 2] TE22. 156 For eNotes, create a baseline report that includes Report is created correctly and without omission and 01 [eNotes] the numerator and denominator values and includes the required information. TE22. resulting percentage using the data that was 08 IN22.0 previously entered from 1: Test Data Set-Up for 1 New Patient. IN22.0 3 TE22. 157 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 02 [eNotes] Proctor from 2: Modify Test Data Set-Up for New IN22.0 Patient. 2 TE22. 158 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 03 [eNotes] Proctor from 3: Add New Patient or Modify IN22.0 Existing Patient. 2 TE22. 159 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 04 [eNotes] Proctor from 4: Add New Patient or Modify IN22.0 Existing Patient. 2 TE22. 160 Enter the test data for 2 patients selected by the Test data is entered correctly and without omission. 05 [eNotes] Proctor from 5: Add New or Modify Existing IN22.0 Patient. 2 . Patient #1 – Note is created . Patient #2 – Note is edited and/or signed TE22. 161 Enter an electronic note by an individual who is Test data is entered correctly and without omission and 06 [eNotes] not the authorized provider. does not populate the numerator or denominator. IN22.0 2 TE22. 162 Generate the delta report. Report includes numerator and denominator value 07- [eNotes] increments as expected and percentage calculation is 22.08 accurate. IN22.0 3- 22.04 ☐ Steps 163-168 optional for Inpatient systems testing a17 which maps to the Advance Directives measure [Stage 1 & Stage 2] TE23. 163 For Advance Directives, create the Stage 1 and Reports created correctly and without omission and 01 [INP] Stage 2 baseline reports that include the include the required information. TE23. numerator and denominator values and resulting 07 [Adv IN23.0 Directive] percentage using the data that was previously 1 entered from 1: Test Data Set-Up for New Patient. IN23.0 3

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE23. 164 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 02 [INP] Proctor from 2: Modify Test Data Set-Up for New IN23.0 2 [Adv Patient. Directive] TE23. 165 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 03 [INP] Proctor from 3: Add New Patient or Modify IN23.0 2 [Adv Existing Patient. Directive] TE23. 166 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 04 [INP] Proctor from 4: Add New Patient or Modify IN23.0 2 [Adv Existing Patient. Directive] TE23. 167 Enter the test data for 1 patient selected by the Test data is entered correctly and without omission. 05 [INP] Proctor from 5: Add New or Modify Existing IN23.0 2 [Adv Patient. Directive] TE23. 168 Generate the Stage 1 and Stage 2 delta reports. Reports include numerator and denominator value 06- [INP] increments as expected and percentage calculations are 23.07 accurate. IN23.0 [Adv 3- Directive] 23.04 ☐ Steps 169-173 optional for Inpatient systems testing criterion b6 which maps to the Structured Lab EH to EP measure [Stage 2] TE24. 169 For Structured Lab EH to EP, create a report Report is created correctly and without omission and 01 [INP] that includes the numerator and denominator includes the required information. TE24. values and resulting percentage using the data 06 [Labs to EP] IN24.0 that was previously entered from 1: Test Data 1 Set-Up for New Patient. IN24.0 3 TE24. 170 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 02 [INP] Proctor from 3: Add New Patient or Modify IN24.0 2 [Labs to EP] Existing Patient. TE24. 171 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 03 [INP] Proctor from 4: Add New Patient or Modify IN24.0 2 [Labs to EP] Existing Patient. TE24. 172 Enter the test data for 1 patient selected by the Test data is entered correctly and without omission. 04 [INP] Proctor from 5: Add New or Modify Existing IN24.0 2 [Labs to EP] Patient.

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts TE24. 173 Generate the delta report. Report includes numerator and denominator value 05- [INP] increments as expected and percentage calculation is 24.06 accurate. IN24.0 [Labs to EP] 3- 24.04 ☐ Steps 174-178 optional for Inpatient systems testing criterion a16 which maps to the Electronic Medication Administration Record (eMAR) measure [Stage 2] TE25. 174 For eMAR, create a report that includes the Report is created correctly and without omission and 01 [INP] numerator and denominator values and resulting includes the required information. TE25. percentage using the data that was previously 06 [eMAR] IN25.0 entered from 1: Test Data Set-Up for New Patient. 1 IN25.0 3 TE25. 175 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 02 [INP] Proctor from 3: Add New Patient or Modify IN25.0 2 [eMAR] Existing Patient. TE25. 176 Enter test data for 1 patient selected by the Test data is entered correctly and without omission. 03 [INP] Proctor from 4: Add New Patient or Modify IN25.0 2 [eMAR] Existing Patient. TE25. 177 Enter the test data for 1 patient selected by the Test data is entered correctly and without omission. 04 [INP] Proctor from 5: Add New or Modify Existing IN25.0 2 [eMAR] Patient. TE25. 178 Generate the delta report. Report includes numerator and denominator value 05- [INP] increments as expected and percentage calculation is 25.06 accurate. IN25.0 [eMAR] 3- 25.04 Select Document any other pertinent observations below: Test Result

of 232 Document Version 2.5 ©2013-2016 ICSA Labs. All rights reserved. Effective Date: October 27, 2016 ICSA Labs 2014 Edition Test Scripts Common MU Data Set The Common MU Data Set is applicable to 5 criteria: 1. 170.314(b)(1) Transitions of care – receive, display and incorporate 2. 170.314(b)(2) Transitions of care – create and transmit 3. 170.314(b)(7) Data portability 4. 170.314(e)(1) View, download and transmit to 3rd party 5. 170.314(e)(2) Clinical summary Data Element Required Standard Data Element Required Standard Patient name - Sex -

Date of birth - Race OMB

Ethnicity OMB Preferred language ISO 639-2 alpha-3 codes constrained by ISO 639-1 alpha- 2 codes Smoking status SNOMED-CT Problems SNOMED-CT

Medications RxNorm Medication allergies RxNorm

Lab tests LOINC v2.4 Lab values/results -

Vital signs (height, weight, - Care plan fields, - BP, BMI) including goals and instructions Procedures SNOMED-CT or Care team members - CPT/HCPCS ICD-10-PCS and CDT optional

NOTE: CDT may be the primary standard used in the limited circumstance where EHR technology is primarily developed to record dental procedures