Ensure Patient Access to Remote, High-Assurance Portal Account Provisioning

Recommendation: To ensure patients can establish patient portal accounts securely and conveniently online:

1. ONC/CEHRT Requirement: Certified Health IT (CEHRT) offering patient portal capabilities must include the functionality to enable at least one pathway for new patient account provisioning that is fully remote and electronic, and relies on a high-assurance identity proofing process comparable to NIST 800-63 Identity Assurance Level 2 (IAL2).
2. CMS/Provider Requirement: Healthcare provider organizations participating in Medicare and/or Medicaid programs must configure and offer such a compliant remote, high-assurance patient portal account provisioning option to their patients, leveraging the capabilities of their CEHRT. This could be established, for example, as a Condition of Participation or through other relevant program requirements.

Rationale & Specifics: The fundamental goal is to make secure, online patient portal account creation a standard, accessible option for all patients. This requires a two-pronged approach: CEHRT must provide the necessary robust technical capabilities, and healthcare providers must make these capabilities available to patients as part of their participation in federal healthcare programs.

1. CEHRT Capability as the Technical Foundation: ONC's certification ensures that the technology itself possesses the robust, implementable functionality for remote, high-assurance provisioning. This includes:
   • Supporting a fully remote, electronic process.
   • Meeting high-assurance identity proofing standards (e.g., IAL2-comparable). In routine use, patient authentication may be satisfied by on-device FIDO-based biometrics (e.g., Face ID, Touch ID, Windows Hello) that are cryptographically bound to the previously IAL2-verified identity, thereby meeting AAL2 with minimal user friction. Repeated user authentication should not be needed in the context of an ongoing authorization providing long-term access.
   • Flexibility for CEHRT developers in how this is achieved (e.g., integration with IAL2 IdPs, or direct implementation of a compliant workflow).
   • Certification would verify the functionality, security, integrity, and practical usability/configurability by provider organizations.
2. Provider Obligation for Patient Access: CMS's role is to ensure that providers make this ONC-certified capability operational for patients. By establishing this as an expectation for program participation:
   • It makes remote, high-assurance account creation a standard offering, critical for equitable patient access and convenience.
   • It leverages the security enhancements built into CEHRT, ensuring accounts are established on a strong identity basis.
   • It drives adoption of modern, patient-centric digital services.
3. Enhanced Security and Trust: This coordinated approach ensures that remotely provisioned accounts are based on a strong, verifiable identity proofing process, establishing a consistent, high bar for trust.
4. Patient Convenience: Eliminates mandatory in-person steps or reliance on lower-assurance methods, aligning with modern digital service expectations.