Compliance
ONC-ACB Certified Software
B10 Documentation Guide
Memphi Software Overview for ONC-HIT Certification (170.315(b)(10))
Memphi is a versatile data aggregation platform designed to pull information from a variety of health systems. It allows users to access and download data in CSV format, as well as other user-specified formats. Since Memphi interfaces with multiple disparate systems, the specific data elements available for export vary depending on the source system being accessed.
EHI Export Functionality (170.315(b)(10) Compliance)
To comply with ONC-HIT 170.315(b)(10), Memphi incorporates functionality to export Electronic Health Information (EHI). The system allows authorized users to export patient health information in accordance with the defined standard for EHI export.
Memphi offers user permissions that enable agencies to control access to its export features based on staff roles. Only users with the appropriate permissions can access the export functionality, allowing administrators to assign rights based on job responsibilities, including the ability to export data in CSV format.
Information about the data elements exported in the CSV can be found in the Data Dictionary, which includes the source data schema name, source table, field name, data type, and data type length.
| Column Name | Type | Description |
|---|---|---|
| Schema | Text | Describes the database where the EHI data resides. |
| Table Name | Text | Describes the database where the EHI data resides. |
| Field Name | Text | Describes the EHI data point name. |
| Data Type | Text | Identifies if the data element is an integer, varchar, text or date. |
| Length | Integer | Identifies how many characters each varchar and text field have. |
Below is the EHI data that can be exported. Please note that the names of the data points listed below may differ based on the Source EHR system. To receive an accurate list of EHI column names, please reference your customized client data dictionary in the Memphi Admin tool.
| Column Name | Type | Description |
|---|---|---|
| ID | Text | Universally unique patient identifier that is unique across all tables. |
| Last Name | Text | Patient’s Last Name. |
| First Name | Text | Patient’s First Name. |
| Date of Birth | Date | Patient’s date of birth ‘yyyy-mm-dd’. |
| Gender | Text | Gender of the patient. |
| Ethnicity | Text | Ethnicity of the patient. |
| Race | Text | Rate of the patient. |
| Street Address | Text | Patient’s home street address. |
| City | Text | Patient’s home City. |
| State | Text | Patient’s home State. |
| Zip Code | Text | Patient’s Home. |
| Phone Number | Text | Patient’s Home Phone Number. |
| Email Address | Text | Patient’s Personal Email Address. |
| Program | Text | Identifies the program the patient is admitted into. |
| Admit Date | Date | The date the patient was admitted ‘yyyy-mm-dd’. |
| Discharge Date | Date | The date the patient left care ‘yyyy-mm-dd’. |
| Discharge Reason | Text | The reason the patient left care. |
| Primary Payer | Text | First payer for the patient. |
Key Features of Memphi’s EHI Export:
- System Agnostic: Memphi supports a wide range of data structures by pulling data from various electronic health record (EHR) systems, laboratory systems, billing systems, and other health IT systems.
- Patient-Level and Bulk Data Export: Memphi allows both individual patient-level data exports and bulk EHI exports for larger datasets as required by 170.315(b)(10).
- Permission-Based Access: Administrators can assign specific user roles to control access to the EHI export functionality, ensuring that only authorized users can generate and download these files.
- Reference to Source System Data: The exported files are dependent on the components and data elements available in the source system. This ensures that the exported data mirrors the structure and content of the originating databases.
Challenges in Data Element Definition:
Since Memphi integrates with a broad spectrum of health systems, the exact data elements that are exportable cannot be predefined. The platform dynamically adjusts based on the structure of the data it receives from connected systems. However, Memphi ensures that all EHI data elements made available by the source systems are included in the export functionality, ensuring compliance with ONC-HIT requirements.
Privacy and Security – 170.315(d)(13) Multi-Factor Authentication
5EA-2-Factor-Authentication-Use-Case
Attestation
5E Analytics attests that the 5EA Memphi EcoSystem supports authentication, through the use of third party authentication modules including Microsoft, Google, Okta and Auth0.
Introduction
The intent of two-factor authentication is to prevent unauthorized access to the Memphi EcoSystem. A user can access the Memphi system only after their credentials are successfully verified by the two steps of authentication required by the system.
Description
Two-factor authentication in the 5EA Memphi EcoSystem software is used to verify a user’s credentials at the time of user login. Memphi uses both a secure login and password credentials.
Actors
The primary actor in this use case is the Memphi system user. The other entity included in the use case is the 5EA Memphi EcoSystem.
Goal – The goal of this test case is for the user to access their Memphi account securely.
Pre-Condition To access Memphi, an approved user must have the following:
- An account set up in Memphi
- A login name and password that meets the standards set by 5EA
- A working company email address
Use Case 1
Login Using Microsoft Account
Actor/Entity | Step | Procedure | Expected Result |
|---|---|---|---|
User | 1 | Click the customer 5E Memphi link (<client>.5eanalytics.com) | Memphi login screen displays. |
2 | Click the Login with Microsoft button | Microsoft will prompt the user for their MS login and Password and initiate 2FA. If successful the user will be logged in. If unsuccessful an error message will be sent to the system. | |
System | 3 | The Memphi EcoSystem will receive a token if successful. If Microsoft sends an error message stating the login was not successful then the user will be redirected to the Login Page | If successful the system authenticates the user and proceeds to the control panel. If unsuccessful the system proceeds to the login page and displays invalid login. |
Use Case 2
Login Using Google Account
Actor/Entity | Step | Procedure | Expected Result |
|---|---|---|---|
User | 1 | Click the customer 5E Memphi link (<client>.5eanalytics.com) | Memphi login screen displays. |
2 | Click the Login with Google button | Google will prompt the user for their Google login and Password and initiate 2FA. If successful the user will be logged in. If unsuccessful an error message will be sent to the system. | |
System | 3 | The Memphi EcoSystem will receive a token if successful. If Google sends an error message stating the login was not successful then the user will be redirected to the Login Page | If successful the system authenticates the user and proceeds to the control panel. If unsuccessful the system proceeds to the login page and displays invalid login. |
Use Case 3
Login Using Okta Account
Actor/Entity | Step | Procedure | Expected Result |
|---|---|---|---|
User | 1 | Click the customer 5E Memphi link (<client>.5eanalytics.com) | Memphi login screen displays. |
2 | Click the Login with Okta button | Okta will prompt the user for their Okta login and Password and initiate 2FA. If successful the user will be logged in. If unsuccessful an error message will be sent to the system. | |
System | 3 | The Memphi EcoSystem will receive a token if successful. If Okta sends an error message stating the login was not successful then the user will be redirected to the Login Page | If successful the system authenticates the user and proceeds to the control panel. If unsuccessful the system proceeds to the login page and displays invalid login. |
Use Case 4
Login Using Auth0 Account
Actor/Entity | Step | Procedure | Expected Result |
|---|---|---|---|
User | 1 | Click the customer 5E Memphi link (<client>.5eanalytics.com) | Memphi login screen displays. |
2 | Click the Login with Auth0 button | Auth0 will prompt the user for their Auth0 login and Password and initiate 2FA. If successful the user will be logged in. If unsuccessful an error message will be sent to the system. | |
System | 3 | The Memphi EcoSystem will receive a token if successful. If Auth0 sends an error message stating the login was not successful then the user will be redirected to the Login Page | If successful the system authenticates the user and proceeds to the control panel. If unsuccessful the system proceeds to the login page and displays invalid login. |
Required Tests
(d)(13) (i) Attesting ‘yes’
Criteria | System Under Test | ONC-ACB Verification |
|---|---|---|
(d)(13)(i) | 1. The health IT developer attests, “Yes, the Health IT Module supports authentication, through multiple elements, of the user’s identity with the use of industry-recognized standards,” and; | 1. The ONC-ACB verifies the health IT developer attests, ”Yes, the Health IT Module supports the authentication, through multiple elements, of the user’s identity with the use of industry-recognized standards.” |
2. The health IT developer submits a description of the supported use cases. | 2. The ONC-ACB verifies the health IT developer provided a description of the supported use cases. |