S-44300-00017151- MES Attachment Ib_TRA Standards.xlsx
XLSX spreadsheet 117 KB Posted
- Solicitation number
- S-44300-00017151
- Issued by
- Oregon
About this file
This file is a Technical Reference Architecture (TRA) Standards document for the Medicaid Enterprise System (MES) System Integration Services project, jointly issued by the Oregon Health Authority (OHA) and Oregon Department of Human Services (ODHS). The document serves as a comprehensive standards and compliance framework for the MES modernization initiative, specifically Task Order 2 - Deliverable 4, with a submission date of March 19, 2025. Rather than detailing a specific procurement timeline, the TRA Standards document establishes the technical, architectural, and operational standards that vendors and system integrators must follow throughout the MES implementation. The framework encompasses governance structures, technology platforms, data management practices, and security protocols that align with both state and federal requirements. Key standards referenced include adherence to the Oregon Cloud Forward Strategy, Federal Enterprise Architecture Framework (FEAF), CMS Medicaid Information Technology Architecture (MITA), and various federal and state security and interoperability mandates.
The TRA Standards document establishes mandatory compliance requirements across multiple domains including data governance, security controls, accessibility standards, and healthcare interoperability protocols. All system solutions must demonstrate compliance with federal standards such as HIPAA, HL7 FHIR, ASC X12, and CMS-mandated interoperability rules, alongside state-specific requirements including Oregon's Cloud Forward Strategy and ODHSOHA IT governance policies. The document mandates that vendors implement Advanced Encryption Standard (AES-256), maintain SOC 2 Type 2 audit compliance, and adhere to NIST Special Publications 800-53, 800-37, and 800-207 for security and zero trust architecture. Additionally, solutions must support Oregon's commitment to data equity through compliance with REALD & SOGI standards, maintain disaster recovery and business continuity capabilities, and integrate with the state's centralized identity management system and Laserfiche document management platform, with no alternative document management systems permitted without formal exception approval.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| RFP S-44300-00017151.pdf | ||
| S-44300-00017151- MES Attachment F COBID Certification - Outreach Plan.docx | DOCX document | |
| S-44300-00017151- MES Attachment D Reference Check Form.docx | DOCX document | |
| S-44300-00017151- MES Attachment_K_MMIS Interface List.xlsx | XLSX spreadsheet | |
| S-44300-00017151- MES Attachment Ia_TRA Framework.docx | DOCX document | |
| S-44300-00017151- MES Attachment A_System Integration Platform.docx | DOCX document | |
| S-44300-00017151- MES Attachment_J_Statewide_Information_and_Cyber_Security_Standards.xlsx | XLSX spreadsheet | |
| S-44300-00017151- MES Attachment H_Initial System Integration Requirements.xlsx | XLSX spreadsheet | |
| S-44300-00017151- MES Attachment E_Price Proposal Form.xlsx | XLSX spreadsheet | |
| S-44300-00017151- MES Attachment C Proposer Information and Certification Sheet.docx | DOCX document | |
| S-44300-00017151- MES Attachment G Responsibility Inquiry.docx | DOCX document | |
| S-44300-00017151- MES Attachment B Disclosure Exemption Affidavit.docx | DOCX document |
Show all 12
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
TRA Standards Links
| S-44300-00017151- Medicaid Enterprise System (MES) System Integration Services | AttIb | ||||||||
| MES Modernization Planning Project | |||||||||
| Deliverable Name: Task Order 2 - Deliverable 4 - TRA Standards | |||||||||
| Version: V 1.0 | |||||||||
| Submission Date: 3/19/2025 | |||||||||
| Standards and Policies | Standard Type | Standard | |||||||
| Owner | Compliance Level | URL Link | URL Visibility | Description | Business Value | TRA Framework Section | |||
| Cloud Forward | Strategy | State of Oregon | Guidance | https://www.oregon.gov/eis/siteassets/eis-cloud-forward-20230116.pdf | Oregon Public Link | The Oregon Cloud Forward strategy provides the guiding principles for modernization. It directs the alignment of new and updated systems to coincide with the network and security expectations of the Agency. | A cloud forward strategy maximizes the cost efficiency, operations, and security for application services used by the State of Oregon | 1.4: Audience and Use | |
| ODHSOHA Strategic Technology Plan – Comprehensive Overview | Strategy | ODHSOHA | Guidance | https://dhsoha.sharepoint.com/teams/Hub-ODHSOHA-OIS/Shared%20Documents/Forms/AllItems.aspx?id=%2Fteams%2FHub%2DODHSOHA%2DOIS%2FShared%20Documents%2FStrategic%20Technology%20Plan%202024%2D27%20Executive%20overview%2Epdf&parent=%2Fteams%2FHub%2DODHSOHA%2DOIS%2FShared%20Documents | Oregon Internal Link | Oregon Department of Human Services (ODHS) and Oregon Health Authority (OHA) Strategic Technology Plan 2024-2027 | Strengthen the Office of Information Services' ability to deliver IT functions with greater perspective and effectiveness by providing a series of goals and strategies to be tracked on a quarterly basis. | 2: TRA Overview | |
| FEAF | Architecture | US Office of Management and Budget | Guidance | https://obamawhitehouse.archives.gov/sites/default/files/omb/assets/egov_docs/fea_v2.pdf | Internet Link | The Federal Enterprise Architecture Framework (FEAF) is the U.S. reference enterprise architecture of a federal government. Established in 1999, it provides a common approach to describe strategic, business and technology management. |
More information on FEAF can be found at this URL:
| https://en.wikipedia.org/wiki/Federal_enterprise_architecture | A common approach for IT acquisition in the United States federal government is intended to ease sharing of information and resources across federal agencies, reduce cost of services, and improve citizen services. | 2.2: Alignment with other Technical Architectures | |||||||
| ODHSOHA IT Governance Page | Governance | ODHSOHA | Mandatory | https://dhsoha.sharepoint.com/teams/Hub-ODHSOHA-OISHub-BES/SitePages/IT-Governance.aspx | Oregon Internal Link | Landing page for OHA/ODHS IT Governance policies and processes | IT governance decides what technology investments will optimize business value while managing resources and risk. Close collaboration between IT, agencies, and vendors supports informed decisions through reliable measures of feasibility, cost, risk and benefit. | 3: Governance Structure | |
| Office of Information Services Home Page | Governance | OIS | Guidance | https://www.oregon.gov/oha/fod/ois/pages/about.aspx | Oregon Public Link | Provides an overview of the Office of Information Services (OIS), detailing its role in delivering technology solutions and services to support the Oregon Department of Human Services (ODHS) and the Oregon Health Authority (OHA) | Highlights the organizational structure, key functions, and the importance of maintaining health and human services IT systems for the State. | 3.1: Office of Information Services (OIS) | |
| Technology Standards Board | Strategy | ODHSOHA | Expected | https://dhsoha.sharepoint.com/teams/Hub-ODHSOHA-OISHub-BES/SitePages/EnterpriseArchitecture.aspx | Oregon Internal Link | Technology Standards Board (TSB) is intended to be a formal committee responsible for reviewing, evaluating, and guiding the alignment of system designs and changes in IT architecture. | Ensures that the organization's IT architecture remains consistent, aligned with business objectives, and adheres to established standards and best practices, maximizing the efficiency of systems that support OHA/ODHS. | 3.2.1: Technology Standards Board (TSB) | |
| Information Technology Change Management Policy | Policy | ODHSOHA | Mandatory | https://sharedsystems.dhsoha.state.or.us/DHSForms/Served/me070-015.pdf | Oregon Public Link | Describes the mandate to use the Change Advisory Board, which oversees the processes outlined in the Information Technology Change Management Policy. | Change management is intended to ease sharing of information and resources across the agency, reduce the cost of services, and improve citizen services. | 3.2.3: Change Approval Board (CAB) | |
| ODHSOHA Change Management Process | Governance | ODHSOHA | Mandatory | https://dhsoha.sharepoint.com/:w:/r/teams/Hub-ODHSOHA-OIS-CSS-ESM/_layouts/15/Doc.aspx?sourcedoc=%7B607AAB9C-A79B-4341-8278-9336E58CD621%7D&file=OIS%20Change%20Management%20Process.docx | Oregon Internal Link | Describes the Enterprise Change Management Process, which supports the governance of the technology environment, approves the deployment of software to production, improves the maturity level of operations, and increases the quality of the services provided to OHA/ODHS. | Provides the steps, flow and approval process for OIS system change management. It includes checklists, request forms, workflows and considerations to be reviewed when requesting system changes to a production environment. | 3.2.3: Change Approval Board (CAB) | |
| ODHS Data Strategy | Strategy | ODHSOHA | Guidance | https://dhsoha.sharepoint.com/teams/Hub-ODHS-CO/Shared%20Documents/Forms/AllItems.aspx?id=%2Fteams%2FHub%2DODHS%2DCO%2FShared%20Documents%2Fodhs%2Ddata%2Dstrategy%2Epdf&parent=%2Fteams%2FHub%2DODHS%2DCO%2FShared%20Documents | Oregon Internal Link | The ODHS Data Strategy documents the vision, strategy, and intended actions to improve data maturity at ODHS. | The ODHS Data Strategy provides the goals, scope, roles and responsibilities for managing data assets. It includes the vision, principles strategy and action plan for managing the data for the Agency. OHA/ODHS has an obligation to hold and use data securely, responsibly, ethically and in a manner consistent with principles of equity, justice and anti-racism. | 3.2.4: Data Governance | |
| State Data Strategy | Strategy | State of Oregon | Guidance | https://www.oregon.gov/eis/data-governance-and-transparency/pages/data-strategy.aspx | Oregon Public Link | The Oregon EIS Data Strategy documents the vision, strategy and intended actions to improve data maturity at ODHS. |
Discrete file available at:
| https://www.oregon.gov/eis/siteassets/eis-data-strategy-2021-20230116.pdf | Data is integral to all aspects of State government including the administration and evaluation of programs, as well as funding and policy decisions. Oregon’s State Data Strategy is a tool designed to help State agencies within the Executive Branch better utilize, manage, govern, analyze and share the data assets they create and maintain on behalf of Oregonians. | 3.2.4: Data Governance | |||||||
| ODHSOHA Data Office | Governance | ODHSOHA | Guidance | https://dhsoha.sharepoint.com/teams/Hub-ODHSOHA-DataGovernance | Oregon Internal Link | Portal for the OHA/ODHS Data Office and Data Governance Council (DGC). | |||
| Additional link to ODHS Data Office Only: https://dhsoha.sharepoint.com/teams/Hub-ODHS-CO/SitePages/Data-Office.aspx | The Data Governance Council has established the communication infrastructure to eliminate data silos: to better know what data OHA/DHS possesses, where repositories are located, and who inside the agency knows about them. | 3.2.4: Data Governance | |||||||
| Advanced Encryption Standard AES-256 | Security | NIST | Mandatory (when relevant) | https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.197-upd1.pdf | Internet Link | Describes the Advanced Encryption Standard AES-256 algorithm, a data encryption standard that meets or exceeds encryption standards recommended by the National Institute of Standards and Technology (NIST). | Advanced data encryption is essential to the privacy, security, and integrity of personal and financial information. | 3.3: Solution Vendors | |
| ODHS Strategic Plan | Strategy | ODHSOHA | Guidance | https://www.oregon.gov/odhs/about/Documents/strategic-plan.pdf | Oregon Public Link | The ODHS Strategic Plan for 2024-2027 | By focusing on improving core internal functions such as hiring processes, technology systems, contract management, and access to data, the agency is better able to support people and families and improve customer service | 4.1: Strategic Plans | |
| OHA Strategic Plan | Strategy | ODHSOHA | Guidance | https://www.oregon.gov/oha/pages/strategic-plan.aspx | Oregon Public Link | The website for the OHA Strategic Plan for 2024-2027. Discrete link to the OHA Strategic Plan available at: | |||
| https://sharedsystems.dhsoha.state.or.us/DHSForms/Served/le-609702.pdf | The OHA Strategic Plan responds to the most important health challenges facing Oregon communities, aligns with priorities to reduce homelessness and strengthen Oregon’s behavioral health system, and advances OHA’s goal to eliminate health inequities by 2030. | 4.1: Strategic Plans | |||||||
| Final Rule: Advancing Interoperability and Improving Prior Authorization Processes CMS-0057-F | Technology | CMS | Mandatory (when relevant) | https://www.federalregister.gov/documents/2024/02/08/2024-00895/medicare-and-medicaid-programs-patient-protection-and-affordable-care-act-advancing-interoperability | Internet Link | Reference to the CMS Interoperability and Patient Access final rule CMS-0057-F. The rule requires Medicaid-associated plans to add prior authorization data to Patient Access APIs, update their Provider Access APIs, add Payer-to-Payer interoperability APIs, and to implement and maintain a Prior Authorization API. |
Federal Register discrete link available at: https://www.govinfo.gov/content/pkg/FR-2024-02-08/pdf/2024-00895.pdf
| The CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F) builds on CMS' previous rule by outlining requirements for additional information that certain payers must provide via the Patient Access API and new requirements for certain payers to implement three additional APIs: Provider Access API, Payer-to-Payer API, and Prior Authorization API. The APIs finalized in CMS-9115-F and CMS-0057-F must meet certain technical standards to drive interoperability and increase provider and patient access to health information. | 4.4: Consent Management | |||||||
| Section 508 of the Rehabilitation Act of 1973 | Policy | US DOJ | Mandatory | https://www.section508.gov/manage/laws-and-policies/ | Internet Link | Section 508 of the Rehabilitation Act of 1973 is the policy underpinning accessibility standards and conformance to federal accessibility regulations | Inaccessible technology interferes with an individual’s ability to obtain and use information quickly and easily. The most effective and least costly approach to technology accessibility is for the Agency to incorporate accessibility into its IT governance, development, and procurement processes. | 4.5: Accessibility and Section 508 Compliance |
| Final Rule to Strengthen Web and Mobile App Access for People with Disabilities | Accessibility | US DOJ | Mandatory | https://www.federalregister.gov/documents/2024/04/24/2024-07758/nondiscrimination-on-the-basis-of-disability-accessibility-of-web-information-and-services-of-state | Internet Link | Department of Justice's final rule enhances the accessibility standards. Systems must now support the Web Content Accessibility Guidelines (WCAG) Version 2.1, Level A and Level AA as the technical standard for state and local governments’ web content and mobile apps. PDF Version: https://www.govinfo.gov/content/pkg/FR-2024-04-24/pdf/2024-07758.pdf | ||
| Inaccessible technology interferes with an individual’s ability to obtain and use information quickly and easily. The most effective approach to technology accessibility is for the Agency to incorporate accessibility into its IT governance, development, and procurement processes. | 4.5: Accessibility and Section 508 Compliance | |||||||
| ODHSOHA Digital Accessibility in Content Creation and Sharing | Accessibility | ODHSOHA | Mandatory | https://sharedsystems.dhsoha.state.or.us/DHSForms/Served/me010-029.pdf | Oregon Internal Link | ODHSOHA 010-029 -This policy ensures any form of digital content created by the agency and provided either internally or externally is accessible because the digital content adheres to Web Content Accessibility Guidelines (WCAG) 2.2 Levels A and AA. | Using agency approved tools, ODHS and OHA staff shall ensure any form of digital content created by the agency and provided either internally or externally is accessible because the digital content adheres to Web Content Accessibility Guidelines (WCAG) 2.2 Levels A and AA. |
a. This includes but is not limited to websites, reports, surveys, dashboards, and documents.
b. If it is determined that an exception from the standard is required based on undue burden or fundamental alteration as defined by the Americans with Disabilities Act, the exception shall be approved by a high-level official not lower than a division director.
| c. Record documentation shall be maintained by OIS in a risk register created for that purpose. | 4.5: Accessibility and Section 508 Compliance | ||||||
| ODHSOHA Digital Accessibility in Hardware, Software and Systems | Accessibility | ODHSOHA | Mandatory | https://sharedsystems.dhsoha.state.or.us/DHSForms/Served/me010-030.pdf | Oregon Internal Link | ODHSOHA 010-030 This policy describes the requirements for procuring or building ICT solutions in alignment with Web | |
| Content Accessibility Guidelines 2.2 (WCAG), level A and AA Guidelines. | ODHS and OHA shall plan for accessibility in ICT solutions made available to staff or the public whether those ICT solutions are acquired, developed, customized, enhanced, modified, or procured, including but not limited to: |
a. Commercial off-the-shelf (COTS).
b. Software as a service (SaaS).
c. Software available without cost.
| d. On premise, cloud, or hosted services | 4.5: Accessibility and Section 508 Compliance | ||||||||
| PDF/UA (Portable Document Format/Universal Accessibility) standard | Accessibility | ISO | Mandatory | https://pdfa.org/resource/iso-14289-pdfua/ | Internet Link | The PDF/UA (Portable Document Format/Universal Accessibility) standard, defined in the ISO 14289-1 standard describes technical requirements for universally accessible PDF documents. | OHA/ODHS requires all new or changed publicly facing documents to meet PDF/UA standards. Successful access to content within PDFs depends both on compliant documents and compliant PDF programs and assistive technology. | 4.5: Accessibility and Section 508 Compliance | |
| Statewide data policies | Governance | State of Oregon DAS | Mandatory | https://www.oregon.gov/das/Policies/107-004-160.pdf | Oregon Public Link | DAS directive mandating that agencies develop and implement internal procedures and documented processes for data governance within their organization that | |||
| meet the requirements set forth in this policy. | A statewide approach to data governance and establishes a baseline framework and accountability structure for agencies to use in establishing internal data governance programs. | 5.1: Statewide Data Policies | |||||||
| Statewide Information Technology and Security Policies | Security | State of Oregon | Mandatory | https://www.oregon.gov/das/Pages/policies.aspx#IT | Oregon Public Link | Oregon publishes several publicly available Information Technology policies across multiple topics from data governance to asset classification and investment oversight. |
The Statewide Information Security Plan can be found at the following link: https://www.oregon.gov/eis/cyber-security-services/Documents/StatewideInformationSecurityPlan.pdf
| The Oregon IT policies work together to provide guidance in IT usage, management and procurement activities. Related policies support data governance and data quality management. | 5.1: Statewide Data Policies | |||||||
| Geographic Bounds of Data Access Policy | Security | ODHSOHA | Mandatory | https://sharedsystems.dhsoha.state.or.us/DHSForms/Served/me090-018.pdf | Oregon Public Link | This policy prohibits access to agency data from outside of the United States (U.S.) including U.S. territories unless approved. | All agency employees have a responsibility to comply with state and agency policies, administrative rule, and state and federal law. Employees and partners who fail to comply with state or agency policy, administrative rule, or state and federal law may face progressive discipline, up to and including dismissal from state service. | 5.1: Statewide Data Policies |
| Oregon Open Data Program ORS 276A.350-374 | Policy | State of Oregon | Mandatory | https://oregon.public.law/statutes/ors_276a.350 | Oregon Public Link | Oregon's Open Data Program is codified within ORS 276A.350-374. This statute requires that state agencies identify data used within agency information systems, contribute this information to an enterprise data inventory maintained by the Chief Data Officer, and that agencies publish data defined as “publishable” under the Statute to a centralized open data portal. | Open data provides transparency and accountability for state agencies and creates an opportunity for communication and relationship building with our constituents and engaged public. | 5.1: Statewide Data Policies |
| Oregon Open Data Portal | Policy | State of Oregon DAS | Mandatory (when relevant) | https://data.oregon.gov/ | Oregon Public Link | Vendors are required to support the preparation and delivery of the Agency data to the Oregon Open Data Program when requested. | The Open Data Policy supports agencies in inventorying, prioritizing, and publishing data assets as open data. Oregon's Open Data Program requires that state agencies identify data used within agency information systems, contribute this information to an enterprise data inventory maintained by the Chief Data Officer, and that agencies publish data defined as “publishable” under the Statute to a centralized open data portal. | 5.1: Statewide Data Policies |
| Oregon ArcGIS Online | Policy | State of Oregon DAS | Expected | https://geo.maps.arcgis.com/home/index.html | Internet Link | ArcGIS Online provides the State’s data portal for geospatial data assets such as map layers. Vendors are required to support the preparation and delivery of the Agency data to the Oregon Open Data Program when requested. | The Oregon Open Data Program helps turn data into information through mapping visualizations through ArcGIS. This provides for visual presentation of emergency preparedness and situational The Oregon Open Data Program helps turn data into information through mapping visualizations through ArcGIS. This provides for visual presentation of emergency preparedness and situational awareness. The mapping capability supports comparisons between counties for key data. | 5.1: Statewide Data Policies |
| Health Insurance Portability and Accountability Act of 1996 | Policy | US HHS | Mandatory (when relevant) | https://aspe.hhs.gov/reports/health-insurance-portability-accountability-act-1996 | Internet Link | The Health Insurance Portability and Accountability Act (HIPAA) is a U.S. law designed to protect patient health information and ensure privacy and security in healthcare. |
| This link is available in two places in the TRA Framework. | HIPAA ensures compliance in protecting healthcare patient data, which can be extraordinarily sensitive. This protection fosters trust and enhances the reputation and operational efficiency of healthcare businesses and administration. | 5.2: Data Standards | |||||||
| Office of the National Coordinator (ONC) / Health Information Technology (HIT) Interoperability Standards Advisory | Technology | CMS | Expected | https://www.healthit.gov/isp/isa-document-table-contents | Internet Link | The Interoperability Standards Advisory (ISA) provides a comprehensive catalog of standards and implementation specifications to support healthcare interoperability in the U.S. It covers clinical, public health, and research interoperability domains. | The standards support the goal of seamless data integration between healthcare provider and payer entities, enhancing operational efficiency, compliance, data access and innovation in the healthcare ecosystem. | 5.2: Data Standards | |
| Accredited Standards Committee X12 | Technology | X12 | Mandatory (when relevant) | https://x12.org/ | Internet Link | Accredited Standards Committee (ASC) X12 is a non-profit, ANSI-accredited, cross-industry standards development organization whose work is used by an overwhelming percentage of business-to-business transactions upholding America’s electronic information exchange. | ASC X12 defines the data content standards for the mandatory HIPAA Electronic Data Interchange transactions. | 5.2: Data Standards | |
| National Council for Prescription Drug Programs | Technology | NCPDP | Mandatory (when relevant) | https://standards.ncpdp.org/ | Internet Link | National Council for Prescription Drug Programs (NCPDP) sets standards for pharmacy formulary and benefit information, pharmaceutical billing units, pharmacy-related real time and batch communications, and Medicaid subrogation. | These standards streamline pharmacy operations, enhance patient safety, and support pharmacy regulatory compliance. | 5.2: Data Standards | |
| Transformed Medicaid System Information Systems (T-MSIS) Data Guide | Data Standards | CMS | Mandatory (when relevant) | https://www.medicaid.gov/medicaid/data-systems/macbis/transformed-medicaid-statistical-information-system-t-msis/t-msis-data-guide/index.html | Internet Link | Transformed Medicaid System Information Systems (T-MSIS) Data Dictionary. T-MSIS collects Medicaid and Children's Health Insurance Program (CHIP) data from U.S. states, territories, and the District of Columbia into the largest standardized national resource of patient information. | T-MSIS data is the foundation for research and policy on Medicaid and CHIP, helping the Centers for Medicare & Medicaid Services (CMS) conduct program oversight, administration, and integrity. | 5.2: Data Standards | |
| Affordable Care Act (ACA) 1104 Core Operating Rules | Technology | CMS | Mandatory (when relevant) | https://www.caqh.org/core/operating-rules | Internet Link | Affordable Care Act (ACA) 1104 Core Operating Rules establish service level KPIs and associated test suites for sending, receiving, and confirming healthcare claim messages. The rules also cover interface system availability expectations. | Faster and more reliable claims message processing make the healthcare ecosystem more efficient by lowering time spent with manual troubleshooting and follow up. | 5.2: Data Standards | |
| National Institute of Standards and Technology | Technology | NIST | Mandatory (when relevant) | https://www.nist.gov/standards | Internet Link | The National Institute of Standards and Technology (NIST) oversees and manages a wide range of physical and electronic technical standards for the United States--from fire hose connection standards to post-quantum cryptography. | NIST standards cover an extraordinary breadth of American and international infrastructure and industry. The standards coordinate time, security operations, and risk management. | 5.2: Data Standards | |
| International Organization for Standardization | Technology | ISO | Guidance | https://www.iso.org/home.html | Internet Link | The International Organization for Standardization (ISO) oversees over 25,000 standards covering technology, management, and manufacturing. | Established in 1946, ISO is one of the oldest non-governmental international organizations. ISO standards have enabled global trade and cooperation between people and companies since 1946. | 5.2: Data Standards | |
| American National Standards Institute | Technology | ANSI | Guidance | https://www.ansi.org/ | Internet Link | American National Standards Institute (ANSI) oversees and publishes more than 9,000 standards. Standards and programs cover: management systems certification bodies, calibration and testing labs, product certification bodies, personnel certifications and personnel credentialing bodies, forensic test and calibration service providers, inspection bodies, greenhouse gas validation and verification bodies, reference material producers, proficiency test providers, and programming languages. | ANSI and its subsidiary, the ANSI National Accreditation Board (ANAB), promote consistency, safety, interoperability, and confidence in the marketplace through accreditation programs for a wide array of conformity assessment bodies. | 5.2: Data Standards | |
| Health Level Seven International (HL7) Fast Healthcare Interoperability Resources | Technology | HL7 | Mandatory (when relevant) | https://www.hl7.org/fhir/overview.html | Internet Link | The Health Level Seven International (HL7) Fast Healthcare Interoperability Resources (FHIR) Specification. FHIR is a standard for exchanging healthcare information electronically. This page provides an overview of the standard, which continues to expand to cover clinical, financial, demographic, and administrative elements of the healthcare ecosystem. | FHIR helps standardize healthcare interoperability data. This standard leverages modern data formats and codifies numerous reference standards for data fields, and covers data lineage and history. A comprehensive data standard for healthcare, FHIR is intended to improve the speed, accuracy, and efficiency of the healthcare ecosystem | 5.2: Data Standards | |
| United States Core Data for Interoperability | Data Standards | CMS | Mandatory (when relevant) | https://www.healthit.gov/isp/united-states-core-data-interoperability-uscdi#uscdi-v5 | Internet Link | United States Core Data for Interoperability (USCDI) is a standardized set of health data classes and constituent data elements for nationwide, interoperable health information exchange for patient clinical encounters and health status information. | USCDI is the first mandated use case for FHIR in CMS' interoperability planning. The standard is intended to provide patients with comprehensive access to their health data through standard FHIR API-based data services. The USCDI data standard is evolving. New versions are balloted and expected to be utilized over time. | 5.2: Data Standards | |
| Centers for Medicare and Medicaid Services (CMS) Interoperability Guidance | Policy | CMS | Mandatory (when relevant) | https://www.cms.gov/priorities/key-initiatives/burden-reduction/interoperability | Internet Link | Centers for Medicare and Medicaid Services (CMS) Interoperability Guidance | The site is a starting location for information about CMS Interoperability policies, standards, and frequently asked questions. | 5.2: Data Standards | |
| CMS final rule on Patient Access and Interoperability | Technology | CMS | Mandatory (when relevant) | https://www.federalregister.gov/documents/2020/05/01/2020-05050/medicare-and-medicaid-programs-patient-protection-and-affordable-care-act-interoperability-and | Internet Link | The CMS Final Rule 9115-F establishes the mandate that payers must make patient healthcare data, provider directory, and prescription formulary data available through standard FHIR APIs and associated implementation guides. PDF Version | |||
| https://www.cms.gov/files/document/cms-9115-f.pdf | CMS is committed to the appropriate sharing of healthcare data between patients, providers and other payers. CMS believes that members have the right to access their health data and have input into how their data is shared and used. The Interoperability and Patient Access API mandate is intended to improve patient experience and access to care. | 5.3: Data Retention | |||||||
| OAR 410-120-1360 Requirements for Financial, Clinical and Other Records | Oregon Administrative Rule | State of Oregon | Mandatory | https://oregon.public.law/rules/oar_410-120-1360 | Oregon Public Link | OAR 410-120-1360 Requirements for Financial, Clinical and Other Records mandate that providers and other healthcare entities must retain clinical records for seven years and financial and other records for at least five years from the date(s) of service. | Provides a consistent standard for healthcare-related record retention in the state of Oregon. | 5.3: Data Retention | |
| Oregon Records Retention and Management Policy | Policy | ODHSOHA | Mandatory | https://sharedsystems.dhsoha.state.or.us/DHSForms/Served/me010-018.pdf | Oregon Public Link | The ODHSOHA EIS Department's Records Retention and Management Policy details how OHA/DHS must comply with state and federal record retention laws. | The Records Retention and Management Policy provides a consistent framework to ensure the agency’s compliance with various state and federal laws that mandate the retention of records by ODHS and OHA. | 5.3: Data Retention | |
| Oregon Records Retention Schedule | Oregon Administrative Rule | State of Oregon | Mandatory | https://secure.sos.state.or.us/oard/displayDivisionRules.action?selectedDivision=591 | Oregon Public Link | The Oregon Secretary of State Records Retention Schedule provides guidance on record retention across a variety of business purposes. | The Oregon Records Retention and Management Policy provides a consistent framework to ensure the agency’s compliance with various state and federal laws that mandate the retention of records by ODHS and OHA. | 5.3: Data Retention | |
| ODHSOHA De-identification of Individual Information and Use of Limited Data Sets | Policy | ODHSOHA | Mandatory | https://sharedsystems.dhsoha.state.or.us/DHSForms/Served/me100-011.pdf | Oregon Public Link | The ODHSOHA EIS Department's policy setting de-identification of Individual Information and Use of Limited Data Sets | De-identifying data is a critical step in protecting the privacy of citizens while allowing appropriate levels of data analysis to be performed on behalf of citizens or patient populations. | 5.4: Minimum Necessary Data | |
| ODHSOHA Minimum Necessary Standard for Releasing Confidential, Sensitive and Protected Information | Policy | ODHSOHA | Mandatory | https://sharedsystems.dhsoha.state.or.us/DHSForms/Served/de100-004.pdf | Oregon Public Link | The ODHSOHA EIS Department's Minimum Necessary Standard for Releasing Confidential, Sensitive and Protected Information | Releasing the minimum necessary amount of information for requests helps safeguard the privacy of confidential, sensitive, and protected information from inappropriate collection, use, and disclosure. It is critical to protect the privacy of citizens while allowing appropriate levels of data analysis to be performed on behalf of citizens as a whole. | 5.4: Minimum Necessary Data | |
| Client Index System (CI) | Technology | ODHSOHA | Guidance | https://dhsoha.sharepoint.com/teams/Hub-ODHSOHA-OIS-CSS-ESM/Lists/Application List/DispForm.aspx?ID=63 | Oregon Internal Link | The Client Index System (CI) system contains core demographic data for individuals from multiple systems. | |||
| Additional information is available at https://dhsoha.sharepoint.com/teams/Hub-DHS-ET/SiteAssets/SitePages/Quick-Ref/QRG_Interfaces.pdf | Using correct and consistent client identities streamline operations and data management and enhance patient safety and privacy. | 5.5: Enterprise Citizen Index | |||||||
| REALD & SOGI Rule ORS 413.161-164 | Oregon Administrative Rule | State of Oregon | Mandatory (when relevant) | https://oregon.public.law/statutes/ors_413.161 | Oregon Public Link | Oregon State Rule ORS 413.161-164 and OAR 950-030-000 to -0200 directs OHAODHS to collect data supporting race, ethnicity, language, disability status, sexual orientation and gender identity, using uniform standards. | A MES ecosystem includes a mix of federally mandated, industry standards and state specific data. The needs of the business, as well as applicable federal and state regulations, dictate the data content of the system. Using uniform federal and industry standards for data formats and valid values sets a data management baseline for data interoperability to enhance state operations and efficiency and enable analytics to support the needs of citizens. | 5.7: Data and Information Specifications | |
| Equity and Inclusion OAR 950-030-000 to -0200 | Oregon Administrative Rule | State of Oregon | Mandatory (when relevant) | https://secure.sos.state.or.us/oard/displayChapterRules.action?selectedChapter=362 | Oregon Public Link | State specific extensions of national standards related to data supporting race, ethnicity, language, disability status, sexual orientation and gender identity. | These standards allow OHA to: meet federal reporting expectations; compare Oregon's progress with national trends; improve quality service delivery; and ensure equitable allocation of resources. | 5.7: Data and Information Specifications | |
| JSON Schema | Technology | Open Source Collective | Expected | https://json-schema.org/ | Internet Link | JavaScript Object Notation (JSON) schemas validate the format and structure of JSON-based data | JSON Schema provides a structure to enable JSON data consistency, validity, and interoperability at scale. Using correct and consistent data streamlines operations and data management and enhances patient safety and privacy. | 5.7.1: Schemas | |
| CMS defined Administrative Simplification data exchanges | Policy | CMS | Mandatory (when relevant) | https://www.cms.gov/priorities/key-initiatives/burden-reduction/administrative-simplification/transactions | Internet Link | Overview of the CMS mandate that HIPAA-covered entities must use ASC X12N or NCPCP standards to transmit data for specified transactions. | X12 EDI and NCPDP standards establish seamless data integration between healthcare provider and payer entities, enhancing operational efficiency, compliance, data access and innovation in the healthcare ecosystem. | 5.7.2: Data Transformation | |
| CMS T-MSIS data exchanges | Policy | CMS | Mandatory (when relevant) | https://www.medicaid.gov/medicaid/data-systems/macbis/transformed-medicaid-statistical-information-system-t-msis/index.html | Internet Link | T-MSIS collects Medicaid and Children's Health Insurance Program (CHIP) data from U.S. states, territories, and the District of Columbia into the largest national resource of beneficiary information. This link provides a description of the CMS T-MSIS data exchange, reporting, and analytic processes. | T-MSIS data is crucial for research and policy on Medicaid and CHIP and helping the Centers for Medicare & Medicaid Services (CMS) conduct program oversight, administration, and integrity. | 5.7.2: Data Transformation | |
| Internal Revenue Service Publication 1220 | Policy | IRS | Mandatory (when relevant) | https://www.irs.gov/pub/irs-pdf/p1220.pdf | Internet Link | Internal Revenue Service data exchange requirements for electronic tax returns. Covers Forms 1097, 1098, 1099, 3921, 3922, 5498, and W-2G. | Electronic Tax Return standards promote seamless, consistent data integration, enhancing operational efficiency, compliance, data access and innovation in the tax assessment and collection system. | 5.7.2: Data Transformation | |
| Social Security Administration Electronic Records Express Data Exchange | Policy | SSA | Mandatory (when relevant) | https://www.ssa.gov/dataexchange/ | Internet Link | Data exchange standards for the Social Security Administration. | Data exchange standards promote seamless, consistent data integration, enhancing operational efficiency, compliance, data access and innovation. | 5.7.2: Data Transformation | |
| CMS Mandated HL7 implementation guides | Technology | CMS | Mandatory (when relevant) | https://www.cms.gov/priorities/key-initiatives/burden-reduction/interoperability/implementation-guides-and-standards | Internet Link | Implementation guides for CMS-mandated HL7 FHIR API-based data interoperability. | FHIR APIs are the foundation of much more expansive healthcare data interoperability. Over time, better healthcare interoperability is expected to lower costs while providing better service to patients. | 5.7.2: Data Transformation | |
| W3C SOAP Version 1.2 | Technology | W3C | Expected | https://www.w3.org/TR/soap/ | Internet Link | Describes the W3C SOAP specification. The Simple Object Access Protocol (SOAP) is a protocol developed by the World Wide Web Consortium (W3C) for exchanging structured information in the implementation of web services. SOAP is an XML-based, transport-agnostic, message-based data interoperability standard. | SOAP is designed to enable communication between applications running on different operating systems, application platforms, and programming languages. SOAP is widely used in enterprise environments for its robustness and extensibility, especially in scenarios requiring high security and transactional reliability. | 6.2: Interface Standards | |
| XML Technologies | Technology | W3C | Expected | https://www.w3.org/TR/2006/REC-xml11-20060816/ | Internet Link | Describes the W3C XML specification. The eXtensible Markup Language is designed to store and transport data. | XML stores and transports data using data structure that are both human and machine readable, self-descriptive, robust and extensible. | 6.2: Interface Standards | |
| Representational state transfer (REST) OpenAPI v3.1.1 | Technology | W3C | Expected | https://spec.openapis.org/oas/latest.html | Internet Link | Overview of the Representational state transfer (REST) architecture, a software architectural style that was created to guide the design and development of the architecture for the World Wide Web. |
REST APIs was first defined in a Doctorial Disertation by Roy Fielding. https://ics.uci.edu/~fielding/pubs/dissertation/fielding_dissertation.pdf
| The wikipedia entry for RestAPI is here: https://en.wikipedia.org/wiki/REST | The REST architectural style is a foundational architecture of modern web-based applications. It is designed for network-based client-server applications. It is designed Internet-scale usage, so the coupling between the user agent (client) and the origin server must be as loose as possible to facilitate large-scale adoption between different operating systems and application stacks. | 6.2: Interface Standards | |||||||
| JSON (JavaScript Object Notation) | Technology | ECMA | Expected | https://www.json.org/json-en.html | Internet Link | Overview of the JSON (JavaScript Object Notation) data interchange format. JSON is based on a subset of the JavaScript Programming Language Standard ECMA-262 3rd Edition. | JSON is a lightweight data-interchange format that is self-describing, easy for humans to read and write, and easy for machines to parse and generate. It is language independent but uses conventions that are familiar to programmers of many languages. These properties make JSON an ideal data-interchange language to succeed XML and earlier data interchange formats and establish itself as the data foundation for the modern web. | 6.2: Interface Standards | |
| Office of the National Coordinator for Health Information Technology (ONC) Interoperability Standards Advisory (ISA) | Data Standards | CMS | Guidance | https://www.healthit.gov/isa/isa-publications | Internet Link | The Interoperability Standards Advisory (ISA) provides a comprehensive catalog of standards and implementation specifications to support healthcare interoperability in the U.S. It covers clinical, public health, and research interoperability domains. | The standards support the goal of seamless data integration between healthcare provider and payer entities, enhancing operational efficiency, compliance, data access and innovation in the healthcare ecosystem. | 6.2: Interface Standards | |
| Medicaid Information Technology Architecture (MITA) security framework | Security | CMS | Guidance | https://www.cms.gov/Research-Statistics-Data-and-Systems/Computer-Data-and-Systems/MedicaidInfoTechArch/Downloads/mitasecurity.pdf | Internet Link | The Medicaid Information Technology Architecture (MITA) security framework. | The MITA security framework provides a comprehensive security and privacy concept model designed to protect sensitive information and ensure compliance with regulations. | 6.11.1: MITA Security Framework | |
| CMS Risk Management Handbook on Security Assessment and Authorization | Policy | CMS | Guidance | https://security.cms.gov/policy-guidance/risk-management-handbook-chapter-4-security-assessment-authorization-ca | Internet Link | CMS Risk Management Handbook on Security Assessment and Authorization, Chapter 4, provides information about the Security Assessment & Authorization family of controls that lay the foundation for all CMS security and privacy. | The CMS Risk Management Handbook describes procedures that help HIPAA covered entities meet the security and privacy requirements for this control family. CMS requires that all MES modules must demonstrate how they follow this guidance. | 6.11.1: MITA Security Framework | |
| Executive Order (EO) 14028 “Improving the Nation’s Cybersecurity” §(3)(b)(ii) | Policy | Office of the President, USA | Guidance | https://www.govinfo.gov/content/pkg/FR-2021-05-17/pdf/2021-10460.pdf | Internet Link | Executive Order (EO) 14028 requires that federal agencies develop a plan to implement a Zero Trust Architecture (ZTA). | The Cybersecurity and Infrastructure Security Agency (CISA) Zero Trust Maturity Model (ZTMM) provides an approach to achieve continued modernization efforts related to zero trust within a rapidly evolving environment and technology landscape. This ZTMM is one of many paths that an organization can take in designing and implementing their transition plan to zero trust architectures in accordance with Executive Order (EO) 14028 “Improving the Nation’s Cybersecurity” § (3)(b)(ii),1 which requires that agencies develop a plan to implement a Zero Trust Architecture (ZTA). | 6.11.2: Zero Trust | |
| CISA Zero Trust Maturity Model | Security | CISA | Guidance | https://www.cisa.gov/sites/default/files/2023-04/CISA_Zero_Trust_Maturity_Model_Version_2_508c.pdf | Internet Link | Description of the Zero Trust Maturity Model. | The Zero Trust Maturity Model (ZTMM) represents a gradient of implementation across five distinct pillars, in which minor advancements can be made over time toward optimization. The pillars include Identity, Devices, Networks, Applications and Workloads, and Data. Each pillar includes general details regarding the following cross-cutting capabilities: Visibility and Analytics, Automation and Orchestration, and Governance. | 6.11.2: Zero Trust | |
| NIST Zero Trust Architecture | Security | NIST | Guidance | https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-207.pdf | Internet Link | The NIST SP 800-207 describes the NIST Zero Trust Architecture. | Zero trust architecture is a key feature of the modern "defense in depth" approach to application and data security. Application security establishes the foundation of trust in healthcare financial and clinical systems. | 6.11.2: Zero Trust | |
| ODHSOHA Metadata Management project (MDM) | Data Standards | ODHSOHA | Guidance | https://dhsoha.sharepoint.com/teams/Hub-ODHS-CO/Shared Documents/metadata-management-overview.pdf | Oregon Internal Link | Document describes the Data Governance Council's Metadata Management project (MDM) project to establish a data dictionary for each system, which will include a visualization of each database and how the elements relate to each other. | Metadata management enables easier knowledge sharing and faster speed to understanding the data and validating data quality, higher productivity because of data history and lineage transparency, simplified compliance statutory policy on data governance (access, control), inventory, publication, quality, justice, anti-racism and equity. | 6.12: Information Architecture Tools | |
| State Government Artificial Intelligence Advisory Council | Strategy | State of Oregon | Mandatory | https://www.oregon.gov/eis/pages/ai-advisory-council.aspx | Oregon Public Link | OHA/ODHS EIS council has been set up to ensure that all use of Artificial Intelligence must conform to the policies and guidelines set up by the State Government Artificial Intelligence Advisory Council via Executive Order No. 23-26. All vendors should be expected to provide a short description detailing how any AI services use and secure data, share or use data for training, and the extent and limits of automated decision making. | This council is established by Governor Kotek's Executive Order 23-26 to recommend an action plan to guide awareness, education, and usage of artificial intelligence in state government that aligns with the state's policies, goals and values and support public servants to deliver customer service more efficiently and effectively. This is a governor ordered council. | 7: Technical Reference Model | |
| Executive Order No. 23-26 establishes AI Council | Policy | State of Oregon | Mandatory | https://www.oregon.gov/gov/eo/eo-23-26.pdf | Oregon Public Link | Executive order No. 23-26 mandates that all use of Artificial Intelligence must conform to the policies and guidelines set up by the State Government Artificial Intelligence Advisory Council. All vendors should be expected to provide a short description detailing how any AI services use and secure data, share or use data for training, and the extent and limits of automated decision making. | Allowing responsible, safe, ethical and equitable use of Robotic Process Automation, Machine Learning or Artificial Intelligence within the applications that make up the MES will promote transparency and trust in government services. | 7: Technical Reference Model | |
| Web Hypertext Application Technology Working Group | Technology | W3C | Guidance | https://whatwg.org/ | Internet Link | Hypertext Markup Language (HTML) Living Standard specification from Web Hypertext Application Technology Working Group (WHATWG). | WHATWH is a multi-vendor organization that is driving forward a standards-based, real-world direction for HTML and XHTML. The WHATWG was founded by individuals from Apple, the Mozilla Foundation, and Opera Software in 2004, after a W3C workshop. | 7.2: User Interface (UI) | |
| HTML5 | Technology | W3C | Expected | https://html.spec.whatwg.org/multipage/ | Internet Link | Most recent major version of Hypertext Markup Language (HTML), currently HTML5 specification from W3C. | HTML is the core markup language for the web, HTML includes numerous standard web APIs like Web Workers, localStorage, etc. | 7.2: User Interface (UI) | |
| CSS3 | Technology | W3C | Expected | https://www.w3.org/TR/css-2023/ | Internet Link | Most recent major version of Cascading Style Sheets (CSS), currently CSS3 module specifications from W3C. | CSS (Cascading Style Sheets) is a stylesheet language used to describe the presentation of a document written in HTML or XML. It allows developers to control the visual style of web pages, including layout, colors, and fonts, making them more attractive and user-friendly. | 7.2: User Interface (UI) | |
| Web Accessibility Initiative - Accessible Rich Internet Applications | Technology | W3C | Expected | https://www.w3.org/WAI/standards-guidelines/aria/ | Internet Link | Most recent major version of WAI-ARIA accessibility and interoperability, to augment host application language accessibility semantics. | Accessibility compliance is mandatory for all state and federal agencies. WAI-ARIA guidelines provide direction that help developers build more accessible website while using HTML, JavaScript, and related technologies for dynamic content and advanced user interface controls. WAI-ARIA addresses accessibility challenges by defining ways for functionality to be provided to assistive technology such screen readers and mouse alternatives. | 7.2: User Interface (UI) | |
| ECMAScript | Technology | ECMA | Expected | https://ecma-international.org/publications-and-standards/standards/ecma-262/ | Internet Link | The annual ECMAScript standard published by Ecma International (applies to JavaScript). | JavaScript is a versatile programming language that enables dynamic and interactive elements on web pages, event and data management, and complex tasks directly in the browser. This makes web applications more functional and efficient than older user interface styles. | 7.2: User Interface (UI) | |
| The NIST Definition of Cloud Computing | Technology | NIST | Guidance | https://csrc.nist.gov/pubs/sp/800/145/final | Internet Link | The NIST Special Publication (SP) 800-145, NIST Definition of Cloud Computing. | The document provides guidance for consistent use of various cloud service and cloud deployment models. | 7.3.1: Cloud and on-premises hosting models | |
| Address Allocation for Private Internet RFC 1918 | Technology | IETF | Guidance | https://datatracker.ietf.org/doc/html/rfc1918 | Internet Link | Internet Engineering Task Force (IETF) Request for Comments (RFC) 1918 defines private address spaces for internally managed application services. | The Internet Engineering Task Force manages core specifications for TCP/IP and related internet technology. This document specifies Best Current Practices for Internet communities to create and maintain private address spaces. Compliance helps communities build private application spaces that do not conflict with public-facing web services. |
Private address spaces conserve the globally unique internet address space by using it only where global uniqueness is required.
| Private address spaces also make internal operations more convenient and help minimize the internet-visible security footprint of internal applications. | 7.5: Network Configuration and Accessibility | ||||||||
| Imaging and Records Management Services | Technology | ODHSOHA | Mandatory (when relevant) | https://dhsoha.sharepoint.com/Teams/Hub-ODHSOHA-IRMS/SitePages/Document-Management.aspx | Oregon Internal Link | The Imaging and Records Management Services (internal link) team at ODHSOHA manages centralized document management capabilities for the agency. Alternatives to Laserfiche require an exception to be granted by the Agency. | Leveraged services provide the MES environment with modern, consistent computing services at a more cost-effective scale. Laserfiche provides the capability to acquire, retain, manage and share content as needed. Laserfiche Workflow is a business process automation tool built into Laserfiche to support automatic document classification, organizing, routing, and archiving. It integrates with Microsoft 365 for simplified document generation and management. | 7.6.2: Document Management |
This is the start of the file's text. The full file is on GovTribe.
File details come from the government source that posted it. Updated .