Find a Doctor
Nurse Line
Provider Portal
Contact Us
aA Accessibility Tools
GrayscaleAAA

English
Spanish

English

English Spanish Hmong Panjabi Vietnamese Arabic Chinese Portuguese Russian Tagalog Korean Persian

For Members
For Providers
For Communities
Health Plans
About Us

Home > Developer Questionnaire

Developer Resources

Developer Application Form
Developer Portal

Developer Questionnaire

Step 1 of 4

25%

This field is hidden when viewing the form

Consent Management, Use and Disclosure

Your application is compliant with the FTC Principle of Collection Limitation of personal data(Required)

Yes

Your Application is compliant with the FTC User Limitation which describes data should be used only for the purposes specified at the time of collection(Required)

Yes

Your application provides members the ability to request the secure and complete disposal of their identifiable health data(Required)

Yes

Your application provides each individual a right to see any data bout him or herself. Your application also allows them to annotate any data that is not timely, accurate, relevant, or complete(Required)

Yes

Security and Incident Management

On behalf of Central California Alliance for Health's members, your application request a copy of their health data (ePHI) from the HIPAA designated record set, maintained by a health care provider, health plan or health information exchange as per below mentioned methods:

By relying on a health care provider or health plan portal's 'Identity Credential' using SMART or, by accepting a 'Digital Identity Credential' for the member that is at least NIST Identity Assurance level2 (IAL2) and Authenticator Assurance level2 (AAL2)(Required)

Yes

By clearly indicating the destination for sending the personal data including ePHI(Required)

Yes

Your application protects personal data through mechanisms including, at minimum:(Required)

Secure storage
Encryption of digital records, both in transit and at rest
Data use Agreements and Contractual obligations
Accountability measures

Yes

Your application practices a defined policy to handle dormant accounts(Required)

Yes

Your application adopts internal policies and secure contractual commitments with third parties to prohibit the re-identification of de-identified or anonymized data(Required)

Yes

Your application provides a mechanism to verify that ePHI/personal data has not been altered, modified, or destroyed in an unauthorized annotation, or disclosure manner(Required)

Yes

You agree to comply with applicable breach notification laws and provide meaningful remedies to address security breaches, privacy or other violations incurred because of misuse of the member's health information(Required)

Yes

Your application has proper authentication and authorization controls, as per best practices(Required)

Yes

Application and Data Security

Your application mitigates the OWASP top 10 Application Security Risks(Required)

Yes

Your application has a mechanism to verify that ePHI has not been altered, modified, or destroyed in an unauthorized manner(Required)

Yes

Your application's error handling process ensures that no sensitive or personal information is disclosed(Required)

Yes

Your application does not use production data in the test environment for testing purposes(Required)

Yes

Your application ensures data backup and data recovery best practices(Required)

Yes

Your application generates system and application level audit logs as per HIPAA requirements(Required)

Yes

Your application audit logs are secured and reviewed periodically(Required)

Yes

Your application mitigates the OWASP Mobile Top 10 Security Risks(Required)

Yes

Your application follows industry best practices for data encryption(Required)

Yes

Does your application require a usage fee either from members or plans(Required)

Yes

Is your application hosted and developed outside of the United States(Required)

Yes

Information Attestation(Required)

I hereby confirm and owe that the information provided herein, is accurate, correct and complete. I am attesting on behalf of my organization in capacity of third-party or vendor who I represent and I am associated with. I stand accountable for the information and the documents submitted with regards to their authenticity and validity. The Alliance shall not be responsible or accountable for any of the information provided herein. I understand and agree that a false statement may disqualify me for the opportunity and the benefits presented herein.

CAPTCHA

This field is for validation purposes and should be left unchanged.

Glossary of Terms
Privacy Policy
Terms and Conditions
Nondiscrimination Notice
Notice of Privacy Practices
Regulatory Information
Site Map

Developer Resources

Developer Questionnaire

Consent Management, Use and Disclosure

Security and Incident Management

Application and Data Security

Get Help

Member Resources

The Alliance

Accessibility Tools