ATTACHMENT M – ACCREDITATION REQUIREMENTS

The Federal Information Security Modernization Act (FISMA) of 2014 requires all Federal agencies to comply with the standards and guidelines developed by the National Institute for Standards and Technology (NIST). VA Directive 6500: VA Cybersecurity Program establishes a VA cybersecurity program to protect and defend VA information and information technology. VA Office Information and Technology (OIT) describes these operational requirements in VA Handbook 6500: Risk Management Framework for VA Information Systems and subsequent chapters.

Additionally, HIPAA covered entities are bound by the provisions found in the HIPAA Privacy and Security rules (45 CFR Parts 160 & 45 CFR 164); the Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009 and the Patient Protection and Affordable Care Act (PPACA) of 2010. These mandates specifically reference the NIST SP 800-53, NIST SP 800-66 standards and include penalties for failure to comply and/or data breaches.

Electronic Healthcare Network Association Commission Healthcare Network Accreditation Program Electronic Health Network (EHNAC HNAP-EHN) certification is the primary EHNAC accreditation program indicating that a company/organization who operates an electronic health network performing claims clearinghouse or EDI gateway functions exceeds industry-established standards and comply with HIPAA regulations. HNAP assesses security infrastructure and data integrity measures including disaster recovery; business continuity; contingency plans; and intrusion detection and response. The program also evaluates transaction processing efficiency; ability to comply with generally-accepted, industry-standard data formats; and audit trail capabilities. (https://www.ehnac.org/healthcare-network/) In addition, the State of Maryland and the State of New Jersey both require electronic healthcare transactions originating in those states to be processed by an EHNAC HNAP-EHN accredited clearinghouse.

The Deputy Assistant Secretary for Information Security has concurred with acceptance of the EHNAC HNAP-EHN certification of a HIPAA covered entity as meeting VA OIT A&A requirements without further review (memo dated September 2, 2016).

All HIPAA covered entities are required by Federal law to adopt the Phase I and II CAQH-CORE Eligibility & Claim Status Operating rules by January 1, 2013 as per Section 1104 of Public Law 111-148: Patient Protection and Affordable Care Act (PPACA). The Council for Affordable Quality Healthcare (CAQH) Committee on Operating Rules for Information Exchange (CAQH-CORE) provides independent verification that an organization operates in agreement with the operating rules and the underlying standards. CORE certification means an entity has demonstrated that its IT system or product, is operating in conformance with the applicable requirements. (https://www.caqh.org/core/core-certification) To reasonably assure that a clearinghouse organization can receive and send a properly formatted HIPAA compliant electronic transaction from VA and back to VA in a production environment; VA would need to conduct a lengthy and extensive testing phase with the awardee prior to activation of live services to ensure transaction interoperability and non-compliance issues were resolved. By requiring our clearinghouse entity to have CAQH CORE certification, the awardee is already attesting to being industry and HIPAA complaint by passing the rigorous CAQH CORE testing protocols and gaining certification. VA is also a CAQH CORE certified provider organization. For the purposes of the CAQH CORE certification, a CAQH CORE Endorsement pledge does not constitute a CAQH CORE certification.

The Offeror shall be evaluated to determine the following accreditation requirements have been met or tangible evidence is provided to document the requirements will be met no later than November 1, 2026. For the purposes of accreditation, all organizations participating in the contract are required to obtain and maintain both certifications, no exceptions will be granted. A prime contractor who teams with a sub-contractor, where only the sub-contractor carries the accreditation(s) will receive a Red/Unacceptable rating. A prime contractor who carries one certificate who teams with a sub-contractor who carries the opposite certificate will receive a Red/Unacceptable rating.