Identity Proofing

A Level of Assurance (LOA) 3 is required to connect to HIway 2.0. LOA 3 is the government standard for electronic authentication of identity required for health information exchange.

For this purpose, your organization must assign an Health Care Organization (HCO) Representative, who must be either a Mass HIway Access Administrator or an Officer of the Organization, as determined in accordance with your organization's policies and procedures. The HCO Representative will be required to:

• Undergo an identity proofing process to serve as your HCO Representative. This process is executed by DigiCert, a certification authority. Upon successful completion, DigiCert will issue the required key encipherment and digital signature certificates to the organization;
• Manage the completion of the required Health Care Organization (HCO) Account Request Form(s) relevant to the applicable connectivity type(s), as explained below.

COMPLETE ONLINE VERIFICATION AND HCO FORM(S)

There is one form and online verification that must be completed and submitted to Mass HIway to prove the identity of your HCO Representative. The HCO form must be completed by the HCO Representative and identify 2 Access Administrators on the Account.

1. Communicate HCO Account Request Forms(s)
   
   Click on the HCO form link(s) in the table below corresponding to the HIway connection method(s) that will be used by your organization. Complete one form for each connection method. To learn more about these connection methods view this page.

   FORM	CONNECTION METHOD	BLANK ONLINE FORM
   HCO	XDR/XPL Direct	Communicate Direct XDR HCO Account Request
   	Connect Device*	Communicate Connect Device HCO Account Request
   	Webmail	Communicate Webmail HCO Account Request

   * For HIway 1.0 this was called the LAND Appliance. For HIway 2.0, LAND Appliances were replaced with the new Connect Device.

2. Online Identity Verification and Authorization
   
   Once your HCO form is received, a request will be submitted by Orion Health to DigiCert to request the email for Online Verification. The HCO Rep will receive an Online Verification email with a secure link to complete the online verification process. Please read the important information about online verification below, and use the following document to complete online verification How to Verify your Identity.

IMPORTANT INFORMATION ABOUT ONLINE VERIFICATION

• The email link from DigiCert that the HCO representative will receive is valid for 14 days.
• If your credit is frozen you will not be able to complete the online verification until you unfreeze your credit.
• You will be given 5 multiple choice questions that will need to be answered within 5 minutes.
• After two failed attempts, the Online Verification option will no longer be available, and you will have to use Secondary option – DOID paper form, which involves signing in the presence of a notary.
• If you wish to use the Secondary option – DOID paper form instead, please scroll below to “Secondary option - DOID Paper Form” for steps on completing paper form.

WHAT TO EXPECT AFTER SUBMITTING THE ONLINE VERIFICATION AND HCO FORM(S)

After the completed HCO Form(s) and online verification has been completed and submitted:

• The Mass HIway will review your HCO Form(s) and DigiCert will review the online verification. If there are any questions or issues with the forms, you will receive an email from your Mass HIway Account Manager or Orion Health contact. The identity verification process by DigiCert can take up to 1-7 business days if there are no issues with either forms.
• Once DigiCert informs the Mass HIway that the applicant has been approved or denied, the Mass HIway will contact the applicant with the determination and outline of the next steps.

What happens next:

• If approved, the Mass HIway will work with your organization to schedule your technical connection timeline. We will do our best to schedule your connection at time that is convenient for your organization.

SECONDARY OPTION - DOID PAPER FORM

• Complete the Form

  Your Account Manager can send you a DOID form to complete or you can click on the link below to download and print the Declaration of Identity (DOID) Form .

• Notarize the DOID Form

  Take the completed DOID form and your identification documents to a notary for attestation. The notary must see you sign and date page 1 of the DOID form.

• Create a Digital Copy of the DOID Form

  Scan the notarized form. The scanned DOID form must be clearly legible, and can either be a PDF or an image file.

• Submit the Documents

  Upload the completed DOID form to this link Upload DOID forms

After the completed HCO Form(s) and online verification has been completed and submitted:

After the completed DOID Form and HCO Form(s) have been submitted to the Mass HIway:

• The Mass HIway will review your DOID Form and your HCO Form(s). If there are any questions or issues with the forms, you will receive an email from your Mass HIway Account Manager. If there are no issues with the forms, the Mass HIway will immediately submit the forms to DigiCert via the secure support tracking system. The identity verification process by DigiCert can take 2 weeks to 30 days, depending on when DigiCert speaks with the Notary and informs the Mass HIway of its determination.
• Once DigiCert informs the Mass HIway if the applicant has been approved or denied, the Mass HIway will contact the applicant with the determination and outline of the next steps.

What happens next:

• If approved, the Mass HIway will work with your organization to schedule your technical connection timeline. We will do our best to schedule your connection at time that is convenient for your organization.

Important information about the DOID Form

• Identity proofing is a time sensitive process. DigiCert must speak with the Notary directly within 30 days of the notarized date or the form is invalid.
• Submit your completed DOID form immediately after the form is notarized so Mass HIway can review and submit to DigiCert as soon as possible.
• Discuss the important information for the Notary on page 3 of the DOID Form with your selected Notary. The Notary must include a listed, verifiable telephone number, which DigiCert will use to contact the Notary to verify the HCO Administrator’s identity. DigiCert will call the Notary at that number from 801-701-9600, trying at least once a day within the 30 day window.
• Don't submit copies of identity proofing documents to the Mass HIway or DigiCert. These are for review by the Notary only. Only high level information about your identity proofing documents will be included on page 2 of the DOID form submitted to the Mass HIway and DigiCert.
• You have a choice of which identity proofing documents to show the Notary as a part of this process. See the list on page 3 of the DOID Form. Review the high level information about those documents to be submitted on page 2 when making your selection.
• Only the minimum number of individuals at the Mass HIway will have access to completed DOID Forms for processing purposes. All of these individuals have had HIPAA training and are subject to HIPAA requirements in handling personally identifiable information.
• The Mass HIway will not retain copies of the completed DOID Form. The submitted DOID Form will be stored in a secure tracking system, which will be used as the method for DigiCert to receive and review the Form to initiate the identity proofing process.

How to find a Notary

• Most banks and many retail photocopy shops and parcel shipping stores have Notaries on staff. Call ahead to confirm availability and services.
• Use this online search tool to find a Notary in your area.