Health Information Technology   Electronic Health Networks    EHN Certification Process

Networks initiate the certification process by submitting the MHCC EHN application and supporting documents.  Click here to download the MHCC EHN Certification/Recertification Application.

Steps to Certification/Recertification

  1. All EHNs applying for certification or recertification must complete an application and submit their responses to MHCC for review. The completed application should be submitted to MHCC by email at:  New applicants are considered to be in Candidacy Status after MHCC receives their application.  EHNs then have up to one year to achieve accreditation or certification from a national accreditation organization currently recognized by MHCC[1], and to submit the assessment documentation evaluated by the accreditation or certification entity.  
  2. EHNs applying for national certification or accreditation are encouraged to complete MHCC’s Electronic Health Network Cybersecurity Readiness Assessment, A Best Practices Review (assessment).  The MHCC requests EHNs that complete the assessment to include it in their application for certification and recertification. The assessment is aimed at helping EHNs better understand cybersecurity best practices and will be reviewed by MHCC.  The guide may be found here.  
  3. EHNs must provide documentation of certification or accreditation by a national accreditation/certification organization currently recognized by MHCC where standards are evaluated related to privacy and confidentiality, business practices, physical and human resources, technical performance, and security.  The EHN must submit documents that show the network complies with established standards.
  4. EHNs that wish to request MHCC consider an alternate national accreditation organization or certification, not currently recognized by MHCC, should contact MHCC at: for further instructions.
  5. Documentation must be submitted as follows:
    • Email the documents to Multiple emails up to 15 MB may be sent as needed; or
    • Provide MHCC with account/access to the network’s SFTP site.  Please contact MHCC by email at to provide account access; or
    • Another means as proposed by the network.
  6. EHNs are required to include in their application the name of the national certification or accreditation entity.  The MHCC may require that EHNs use an alternate organization to meet the regulatory requirements.  
  7. The MHCC is required to charge a processing fee for EHN Certification/Recertification.

    Application Fee Schedule
    # of Operating Sites
    Initial Fees
    Renewal Fees
    EHN with One Operating Site 
    EHN with Multiple Operating Sites
    $400 + $250 for each additional site
    $250 + $125 for each additional site

  9. All Checks should be made out to the Maryland Health Care Commission and submitted to:
     Bridget Zombro, Director of Administration
     Maryland Health Care Commission
     4160 Patterson Avenue
     Baltimore, MD 21215  
  10. Networks will be notified in writing of the determination of their application in approximately 14 days of submitting a completed application.  The MHCC Certified EHNs will be listed on MHCC’s website here.  First time applicants should include a copy of the current logo in JPEG format.  For recertification applicants, if your logo has changed since the last certification cycle, please provide MHCC with your new logo in JPEG format. 
  12. EHNs may request an extension for unforeseen challenges from MHCC for the application renewal by submitting a written request at least 15 days prior to the application due date. Extension requests must include reasons for the extension and a proposed submission date.  The MHCC will review extension requests and will respond to the EHN by email.

 1.National accreditation/certification organizations currently recognized by MHCC include: The Electronic Healthcare Network Accreditation Commission (EHNAC); and The Health Information Trust Alliance (HITRUST). The following documentation must be provided if an EHN chooses EHNAC accreditation: 1) responses to the EHNAC self-assessment manual, and 2) the EHNAC site visit scoring sheet. If an EHN chooses HITRUST certification, the EHN must provide the HITRUST CSF Validated Assessment Report for one of the following two types of assessments: “HITRUST CSF Security and Privacy Assessment” or “HITRUST CSF Comprehensive Security and Privacy Assessment”.  If an EHN chooses to use a network other than EHNAC or HITRUST, or would like to request consideration of an alternate entity, MHCC should be contacted at: for further instructions.

Last Updated: 3/19/2019