Identity Proofing

A Level of Assurance (LOA) 3 is required to connect to HIway 2.0. LOA 3 is the government standard for electronic authentication of identity required for health information exchange.

For this purpose, your organization must assign an Health Care Organization (HCO) Representative, who must be either a Mass HIway Access Administrator or an Officer of the Organization, as determined in accordance with your organization's policies and procedures. The HCO Representative will be required to:

• Undergo an identity proofing process to serve as your HCO Administrator. This process is executed by DigiCert, a certification authority. Upon successful completion, DigiCert will issue the required key encipherment and digital signature certificates to the organization;
• Manage the completion of the required Health Care Organization (HCO) Account Request Form(s) relevant to the applicable connectivity type(s), as explained below.

Complete the DOID and HCO Forms

There are two forms that must be completed and submitted to the Mass HIway to proof the identity of your HCO Representative. Both forms must be completed and signed by the HCO Representative. Watch the tutorial video in the next section to review how to complete the required forms.

1. Declaration of Identity (DOID) Form for Direct Identity Verification and Authorization
   
   Click on the DOID form link in the table below to download the form. Complete this form to designate your HCO Representative with DigiCert for identity proofing. Also read the important information about this form included at the end of this page.

2. Communicate HCO Account Request Forms(s)
   
   Click on the HCO form link(s) in the table below corresponding to the HIway connection method(s) that will be used by your organization. Complete one form for each connection method. To learn more about these connection methods view this page.

* For HIway 1.0 this was called the LAND Appliance. For HIway 2.0, LAND Appliances were replaced with the new Connect Device.

Tutorial Video

Watch this tutorial video to review how to complete the required forms.

Notorization of the DOID Form

A Notary must witness the signing of the DOID Form, and the Notary must complete and sign the acknowledgement listed on the form. Please note that identity proofing is a time sensitive process. DigiCert must speak with the Notary directly within 30 days of the notarized date or the form becomes invalid, in which case the process must be repeated.

Submit the DOID and HCO Forms

The DOID Form and HCO Form(s) must be submitted at the same time and must be completed and signed by the same person.

The forms must be submitted to the Mass HIway as soon as possible after notorization.

Participants have the following options to submit the DOID and HCO Forms:

• Email to: MassHIwaySupport@state.ma.us
  Warning: Send this email from a secure or regular email account.
                  It will not arrive if you send it from a Direct Message account.
  Warning: Standard email security measures apply when sending by regular email.
• Regular mail to:
  Commonwealth of Massachusetts
  Executive Office of Health and Human Services
  Attention: Mass HIway
  100 Hancock Street, 9^th Floor
  Quincy, MA 02171

What to expect after submitting the required forms

After the completed DOID Form and HCO Form(s) have been submitted to the Mass HIway:

• The Mass HIway will review your DOID Form and your HCO Form(s). If there are any questions or issues with the forms, you will receive an email from MassHIwaySupport@state.ma.us. If there are no issues with the forms, the Mass HIway will immediately submit the forms to DigiCert via the secure support tracking system. The identity verification process by DigiCert can take up to 2 weeks to 30 days, depending on when DigiCert speaks with the Notary and informs the Mass HIway of its determination.
• Once DigiCert informs the Mass HIway if the applicant has been approved or denied, the Mass HIway will contact the applicant with the determination and outline of the next steps. This notification will be sent from MassHIwaySupport@state.ma.us.

     What happens next:

• If approved, the Mass HIway will work with your organization to schedule your technical connection timeline. We will do our best to schedule your connection at time that is convenient for your organization.
• If not approved, you will receive a notification from MassHIwaySupport@state.ma.us to restart the process.

Important information about the DOID Form

• Identity proofing is a time sensitive process. DigiCert must speak with the Notary directly within 30 days of the notarized date or the form is invalid.
• Submit your completed DOID form immediately after the form is notarized so Mass HIway can review and submit to DigiCert as soon as possible.
• Discuss the important information for the Notary on page 3 of the DOID Form with your selected Notary. The Notary must include a listed, verifiable telephone number, which DigiCert will use to contact the Notary to verify the HCO Administrator’s identity. DigiCert will call the Notary at that number from 801-701-9600, trying at least once a day within the 30 day window.
• Don't submit copies of identity proofing documents to the Mass HIway or DigiCert. These are for review by the Notary only. Only high level information about your identity proofing documents will be included on page 2 of the DOID form submitted to the Mass HIway and DigiCert.
• You have a choice of which identity proofing documents to show the Notary as a part of this process. See the list on page 3 of the DOID Form. Review the high level information about those documents to be submitted on page 2 when making your selection.
• Only the minimum number of individuals at the Mass HIway will have access to completed DOID Forms for processing purposes. All of these individuals have had HIPAA training and are subject to HIPAA requirements in handling personally identifiable information.
• The Mass HIway will not retain copies of the completed DOID Form. The submitted DOID Form will be stored in a secure tracking system, which will be used as the method for DigiCert to receive and review the Form to initiate the identity proofing process.

How to find a Notary

• Most banks and many retail photocopy shops and parcel shipping stores have Notaries on staff. Call ahead to confirm availability and services.
• Use this online search tool to find a Notary in your area.