170.314(d)(1) Authentication, Access Control and Authorization Setup ONC Test Data and Procedure Guidance Identify user information to be created for this step Test data must be supplied by Be prepared to enter passwords in a manner that is visible to the Proctor via an customer onscreen keyboard or copying/pasting text out of a separate document (e.g. Notepad) using your mouse (utilizing keyboard shortcut keys are prohibited) Step # Action to Perform Expected Outcome Reference Notes / Deviations TE1.01 1 Create a new user account with a unique identifier and User account with a unique user identifier is created, TE2.02-2.03 configure identification and authentication information identification and authentication information are IN1.01 (typically a username and password combination). configured, and appropriate permissions are assigned. IN2.02 Assign appropriate permissions to allow access to some Passwords and other authentication information were functions available through the EHR technology and entered correctly and in a way that was visible to the prevent access to other functions. Proctor (e.g. onscreen keyboard or copying/pasting). TE1.02 2 Login as the user created at Step 1 and attempt to The user is able to login and the authorized action was TE2.04-2.05 perform an action authorized by the assigned performed successfully. IN1.02 permissions. IN2.03 Password was entered in a way that was visible to the Proctor (e.g. onscreen keyboard or copying/pasting). TE1.03 3 Attempt to perform an action unauthorized by the The system does not allow the unauthorized action to be TE2.06-2.07 assigned permissions. performed. IN1.02 IN2.04 Log out. Logout successful. TE2.01 4 Attempt to login as the user created at Step 1 while using Login attempt fails. IN2.01 an invalid password. Password was entered in a way that was visible to the Proctor (e.g. onscreen keyboard or copying/pasting). TE1.04 5 Attempt to create a duplicate of the user identified at Duplicate user identifier is not created. IN1.03 Step 1.
170.314(d)(1) Authentication, Access Control and Authorization Setup Identify user information to be created for this step Be prepared to enter passwords in a manner that is visible to the Proctor via an onscreen keyboard or copying/pasting text out of a separate document (e.g. Notepad) using your mouse (utilizing keyboard shortcut keys are prohibited) ONC Test Data and Procedure Test data must be supplied by customer Guidance Step # Action to Perform Expected Outcome Reference Notes / Deviations 1 Create a new user account with a unique identifier and configure identification and authentication information (typically a username and password combination). Assign appropriate permissions to allow access to some functions available through the EHR technology and prevent access to other functions. User account with a unique user identifier is created, identification and authentication information are configured, and appropriate permissions are assigned. Passwords and other authentication information were entered correctly and in a way that was visible to the Proctor (e.g. onscreen keyboard or copying/pasting). TE1.01 TE2.02-2.03 IN1.01 IN2.02 2 Login as the user created at Step 1 and attempt to perform an action authorized by the assigned permissions. The user is able to login and the authorized action was performed successfully. Password was entered in a way that was visible to the Proctor (e.g. onscreen keyboard or copying/pasting). TE1.02 TE2.04-2.05 IN1.02 IN2.03 3 Attempt to perform an action unauthorized by the assigned permissions. Log out. The system does not allow the unauthorized action to be performed. Logout successful. TE1.03 TE2.06-2.07 IN1.02 IN2.04 4 Attempt to login as the user created at Step 1 while using an invalid password. Login attempt fails. Password was entered in a way that was visible to the Proctor (e.g. onscreen keyboard or copying/pasting). TE2.01 IN2.01 5 Attempt to create a duplicate of the user identified at Step 1. Duplicate user identifier is not created. TE1.04 IN1.03