carin_for_blue_button_test_kit 0.15.0 → 0.15.2

data/lib/carin_for_blue_button_test_kit/client/v2.0.0/urls.rb

@@ -1,6 +1,6 @@
 module CarinForBlueButtonTestKit
-  TOKEN_PATH = '/mock_auth/token'.freeze
-  AUTH_PATH = '/mock_auth/authorization'.freeze
+  TOKEN_PATH = '/auth/token'.freeze
+  AUTHORIZATION_PATH = '/auth/authorization'.freeze
   JKWS_PATH = '/.well-known/jwks.json'.freeze
   SMART_CONFIG_PATH = '/.well-known/smart-configuration'.freeze
   PATIENT_PATH = '/fhir/Patient'.freeze
@@ -22,7 +22,7 @@ module CarinForBlueButtonTestKit
     end
 
     def authorization_url
-      @authorization_url ||= base_url + AUTH_PATH
+      @authorization_url ||= base_url + AUTHORIZATION_PATH
     end
 
     def jwks_url
@@ -33,16 +33,20 @@ module CarinForBlueButtonTestKit
       @smart_configuration_url ||= base_url + SMART_CONFIG_PATH
     end
 
-    def base_fhir_url
-      @base_fhir_url ||= base_url + BASE_FHIR_PATH
+    def fhir_base_url
+      @fhir_base_url ||= base_url + BASE_FHIR_PATH
+    end
+
+    def client_fhir_base_url # alias for OIDC from SMART / UDAP client tests
+      fhir_base_url
     end
 
     def patient_url
       @patient_url ||= base_url + PATIENT_PATH
     end
 
-    def submit_url
-      @submit_url ||= base_url + RESOURCE_API_PATH
+    def resource_api_url
+      @resource_api_url ||= base_url + RESOURCE_API_PATH
     end
 
     def resource_id_url

data/lib/carin_for_blue_button_test_kit/custom_groups/v2.0.0/c4bb_smart_launch_group.rb

@@ -51,6 +51,7 @@ module CarinForBlueButtonTestKit
 
       group from: :smart_discovery do
         run_as_group
+        verifies_requirements 'hl7.fhir.us.carin-bb_2.0.0@58'
 
         test from: :c4bb_v200_smart_capabilities do
           config(
@@ -95,6 +96,14 @@ module CarinForBlueButtonTestKit
 
           * [Standalone Launch Sequence](https://www.hl7.org/fhir/smart-app-launch/1.0.0/index.html#standalone-launch-sequence)
         )
+        verifies_requirements 'hl7.fhir.us.carin-bb_2.0.0@1', 'hl7.fhir.us.carin-bb_2.0.0@60',
+                              'hl7.fhir.us.carin-bb_2.0.0@68', 'hl7.fhir.us.carin-bb_2.0.0@69',
+                              'hl7.fhir.us.carin-bb_2.0.0@70', 'hl7.fhir.us.carin-bb_2.0.0@71',
+                              'hl7.fhir.us.carin-bb_2.0.0@72', 'hl7.fhir.us.carin-bb_2.0.0@73',
+                              'hl7.fhir.us.carin-bb_2.0.0@74', 'hl7.fhir.us.carin-bb_2.0.0@75',
+                              'hl7.fhir.us.carin-bb_2.0.0@76', 'hl7.fhir.us.carin-bb_2.0.0@77',
+                              'hl7.fhir.us.carin-bb_2.0.0@78', 'hl7.fhir.us.carin-bb_2.0.0@79',
+                              'hl7.fhir.us.carin-bb_2.0.0@80', 'hl7.fhir.us.carin-bb_2.0.0@81'
 
         test from: :c4bb_v200_smart_scopes do
           config(

data/lib/carin_for_blue_button_test_kit/custom_groups/visual_inspection_and_attestation/v200_client/authentication.rb

@@ -0,0 +1,30 @@
+module CarinForBlueButtonTestKit
+  class CARIN4BBAuthTest < Inferno::Test
+    title 'Uses appropriate authentication'
+    description <<~DESCRIPTION
+      The Health IT Module must
+      - Direct communication through authenticated, authorized, and secure channels.
+      - Use the SMART App Launch Framework’s standalone launch.
+    DESCRIPTION
+    id :c4bb_authentication
+
+    verifies_requirements 'hl7.fhir.us.carin-bb_2.0.0@1',
+                          'hl7.fhir.us.carin-bb_2.0.0@48'
+
+    run do
+      identifier = SecureRandom.hex(32)
+      wait(
+        identifier:,
+        message: <<~MESSAGE
+          I attest that the Health IT Module
+          - Directed communication through authenticated, authorized, and secure channels.
+          - Used the SMART App Launch Framework’s standalone launch.
+
+          [Click here](#{resume_pass_url}?token=#{identifier}) if the tester visually confirmed system **meets** these requirements.
+
+          [Click here](#{resume_fail_url}?token=#{identifier}) if the tester visually confirmed system **does not meet** these requirements.
+        MESSAGE
+      )
+    end
+  end
+end

data/lib/carin_for_blue_button_test_kit/custom_groups/visual_inspection_and_attestation/v200_client/last_updated.rb

@@ -0,0 +1,31 @@
+module CarinForBlueButtonTestKit
+  class CARIN4BBLastUpdatedTest < Inferno::Test
+    title 'Uses meta.lastUpdated value appropriately'
+    description <<~DESCRIPTION
+      The Health IT Module must use the meta.lastUpdated value to determine if the associated data is
+      accurate as of the date of service or as of the current date.
+    DESCRIPTION
+    id :c4bb_last_updated
+
+    verifies_requirements 'hl7.fhir.us.carin-bb_2.0.0@90',
+                          'hl7.fhir.us.carin-bb_2.0.0@94',
+                          'hl7.fhir.us.carin-bb_2.0.0@180',
+                          'hl7.fhir.us.carin-bb_2.0.0@184',
+                          'hl7.fhir.us.carin-bb_2.0.0@188'
+
+    run do
+      identifier = SecureRandom.hex(32)
+      wait(
+        identifier:,
+        message: <<~MESSAGE
+          The developer of the Health IT Module attests that the Health IT Module used the
+          meta.lastUpdated value to determine if the associated data is accurate as of the date of service or as of the current date.
+
+          [Click here](#{resume_pass_url}?token=#{identifier}) if the tester visually confirmed system **meets** these requirements.
+
+          [Click here](#{resume_fail_url}?token=#{identifier}) if the tester visually confirmed system **does not meet** these requirements.
+        MESSAGE
+      )
+    end
+  end
+end

data/lib/carin_for_blue_button_test_kit/custom_groups/visual_inspection_and_attestation/v200_client/must_support_absent_reason.rb

@@ -0,0 +1,26 @@
+module CarinForBlueButtonTestKit
+  class CARIN4BBMustSupportAbsentReasonTest < Inferno::Test
+    title 'Processes Must Support elements that assert missing information'
+    description <<~DESCRIPTION
+      The Health IT Module must process Must Support elements that assert missing information.
+    DESCRIPTION
+    id :c4bb_must_support_absent_reason
+
+    verifies_requirements 'hl7.fhir.us.carin-bb_2.0.0@8'
+
+    run do
+      identifier = SecureRandom.hex(32)
+      wait(
+        identifier:,
+        message: <<~MESSAGE
+          The developer of the Health IT Module attests that the Health IT Module processed
+          Must Support elements that asserted missing information.
+
+          [Click here](#{resume_pass_url}?token=#{identifier}) if the tester visually confirmed system **meets** this requirement.
+
+          [Click here](#{resume_fail_url}?token=#{identifier}) if the tester visually confirmed system **does not meet** this requirement.
+        MESSAGE
+      )
+    end
+  end
+end

data/lib/carin_for_blue_button_test_kit/custom_groups/visual_inspection_and_attestation/v200_client/must_support_display.rb

@@ -0,0 +1,26 @@
+module CarinForBlueButtonTestKit
+  class CARIN4BBMustSupportDisplayTest < Inferno::Test
+    title 'Can display Must Support data elements'
+    description <<~DESCRIPTION
+      The Health IT Module must be capable of displaying all Must Support data elements.
+    DESCRIPTION
+    id :c4bb_must_support_display
+
+    verifies_requirements 'hl7.fhir.us.carin-bb_2.0.0@4'
+
+    run do
+      identifier = SecureRandom.hex(32)
+      wait(
+        identifier:,
+        message: <<~MESSAGE
+          The developer of the Health IT Module attests that the Health IT Module can display all
+          Must Support data elements for human use.
+
+          [Click here](#{resume_pass_url}?token=#{identifier}) if the tester visually confirmed system **meets** this requirement.
+
+          [Click here](#{resume_fail_url}?token=#{identifier}) if the tester visually confirmed system **does not meet** this requirement.
+        MESSAGE
+      )
+    end
+  end
+end

data/lib/carin_for_blue_button_test_kit/custom_groups/visual_inspection_and_attestation/v200_client/must_support_missing.rb

@@ -0,0 +1,27 @@
+module CarinForBlueButtonTestKit
+  class CARIN4BBMustSupportMissingTest < Inferno::Test
+    title 'Interprets missing Must Support data elements'
+    description <<~DESCRIPTION
+      The Health IT Module must interpret missing Must Support data elements within resource instances as
+      data not present in the Health Plan API actors system.
+    DESCRIPTION
+    id :c4bb_must_support_missing
+
+    verifies_requirements 'hl7.fhir.us.carin-bb_2.0.0@6'
+
+    run do
+      identifier = SecureRandom.hex(32)
+      wait(
+        identifier:,
+        message: <<~MESSAGE
+          The developer of the Health IT Module attests that the Health IT Module interpreted missing Must Support
+          data elements within resource instances as data not present in the Health Plan API actors system.
+
+          [Click here](#{resume_pass_url}?token=#{identifier}) if the tester visually confirmed system **meets** this requirement.
+
+          [Click here](#{resume_fail_url}?token=#{identifier}) if the tester visually confirmed system **does not meet** this requirement.
+        MESSAGE
+      )
+    end
+  end
+end

data/lib/carin_for_blue_button_test_kit/custom_groups/visual_inspection_and_attestation/v200_client.rb

@@ -0,0 +1,25 @@
+require_relative 'v200_client/must_support_display'
+require_relative 'v200_client/must_support_missing'
+require_relative 'v200_client/must_support_absent_reason'
+require_relative 'v200_client/last_updated'
+require_relative 'v200_client/authentication'
+
+module CarinForBlueButtonTestKit
+  class CarinClientVisualInspectionAndAttestationGroup < Inferno::TestGroup
+    id :c4bb_client_v200_visual_inspection_and_attestation
+
+    title 'Visual Inspection and Attestation'
+
+    description <<~DESCRIPTION
+      Perform visual inspections or attestations to ensure that the Client is conformant to the CARIN for Blue Button® IG requirements.
+    DESCRIPTION
+
+    run_as_group
+
+    test from: :c4bb_authentication
+    test from: :c4bb_must_support_display
+    test from: :c4bb_must_support_missing
+    test from: :c4bb_must_support_absent_reason
+    test from: :c4bb_last_updated
+  end
+end

data/lib/carin_for_blue_button_test_kit/custom_groups/visual_inspection_and_attestation/v200_server/00_authorization_group/attestation_test_requirement_48.rb

@@ -0,0 +1,50 @@
+module CarinForBlueButtonTestKit
+  class AttestationTestCarinV2Requirement48_57 < Inferno::Test
+    title 'Secures data'
+    description <<~DESCRIPTION
+      The Health IT Module
+      - Enables members to direct the communication of CARIN4BB data through authenticated, authorized, and secure channels.
+      - Protects CARIN4BB data with proper security and privacy protections to avoid malicious or unintentional exposure of
+        such information.
+      - Secures all consumer-directed payer data exchanges in transit and limits access only to authorized individuals.
+      - Ensures that APIs fully and successfully implement privacy and security features such as, but not limited to, those
+        required to comply with HIPAA privacy and security requirements and other applicable law protecting the privacy and
+        security of protected health information.
+      - Uses either current or the immediately prior release of Transport Level Security (TLS) as specified by the current release
+        of NIST guidelines (SP 800-52).
+      - Supports the FHIR US Core [Patient Privacy and Security requirements](https://www.hl7.org/fhir/us/core/security.html).
+    DESCRIPTION
+    id :carin_server_requirement_48_57_attestation
+
+    verifies_requirements 'hl7.fhir.us.carin-bb_2.0.0@48',
+                          'hl7.fhir.us.carin-bb_2.0.0@49',
+                          'hl7.fhir.us.carin-bb_2.0.0@50',
+                          'hl7.fhir.us.carin-bb_2.0.0@51',
+                          'hl7.fhir.us.carin-bb_2.0.0@55',
+                          'hl7.fhir.us.carin-bb_2.0.0@57'
+
+    run do
+      identifier = SecureRandom.hex(32)
+      wait(
+        identifier:,
+        message: <<~MESSAGE
+          I attest that the Health IT Module
+          - Enables members to direct the communication of CARIN4BB data through authenticated, authorized, and secure channels.
+          - Protects CARIN4BB data with proper security and privacy protections to avoid malicious or unintentional exposure of
+            such information.
+          - Secures all consumer-directed payer data exchanges in transit and limits access only to authorized individuals.
+          - Ensures that APIs fully and successfully implement privacy and security features such as, but not limited to, those
+            required to comply with HIPAA privacy and security requirements and other applicable law protecting the privacy and
+            security of protected health information.
+          - Uses either current or the immediately prior release of Transport Level Security (TLS) as specified by the current release
+            of NIST guidelines (SP 800-52).
+          - Supports the FHIR US Core [Patient Privacy and Security requirements](https://www.hl7.org/fhir/us/core/security.html).
+
+          [Click here](#{resume_pass_url}?token=#{identifier}) if the system **meets** these requirements.
+
+          [Click here](#{resume_fail_url}?token=#{identifier}) if the system **does not meet** these requirements.
+        MESSAGE
+      )
+    end
+  end
+end

data/lib/carin_for_blue_button_test_kit/custom_groups/visual_inspection_and_attestation/v200_server/00_authorization_group/attestation_test_requirement_60.rb

@@ -0,0 +1,48 @@
+module CarinForBlueButtonTestKit
+  class AttestationTestCarinV2Requirement60_67 < Inferno::Test
+    title 'Supports SMART Core Capabilities'
+    description <<~DESCRIPTION
+      The Health IT Module supports the following “SMART Core Capabilities”:
+      - `launch-standalone`: support for SMART’s Standalone Launch mode
+      - `client-public`: support for SMART’s public client profile (no client authentication)
+      - `client-confidential-symmetric`: support for SMART’s confidential client profile
+      - `sso-openid-connect`: support for SMART’s OpenID Connect profile
+      - `context-standalone-patient`: support for patient-level launch context (requested by launch/patient scope, conveyed via patient token parameter)
+      - `permission-offline`: support for refresh tokens (requested by offline_access scope)
+      - `permission-patient`: support for patient-level scopes (e.g. patient Observation.read)
+      - `permission-user`: support for user-level scopes (e.g. user/Appointment.read)
+    DESCRIPTION
+    id :carin_server_requirement_60_67_attestation
+
+    verifies_requirements 'hl7.fhir.us.carin-bb_2.0.0@60',
+                          'hl7.fhir.us.carin-bb_2.0.0@61',
+                          'hl7.fhir.us.carin-bb_2.0.0@62',
+                          'hl7.fhir.us.carin-bb_2.0.0@63',
+                          'hl7.fhir.us.carin-bb_2.0.0@64',
+                          'hl7.fhir.us.carin-bb_2.0.0@65',
+                          'hl7.fhir.us.carin-bb_2.0.0@66',
+                          'hl7.fhir.us.carin-bb_2.0.0@67'
+
+    run do
+      identifier = SecureRandom.hex(32)
+      wait(
+        identifier:,
+        message: <<~MESSAGE
+          The Health IT Module supports the following “SMART Core Capabilities”:
+          - `launch-standalone`: support for SMART’s Standalone Launch mode
+          - `client-public`: support for SMART’s public client profile (no client authentication)
+          - `client-confidential-symmetric`: support for SMART’s confidential client profile
+          - `sso-openid-connect`: support for SMART’s OpenID Connect profile
+          - `context-standalone-patient`: support for patient-level launch context (requested by launch/patient scope, conveyed via patient token parameter)
+          - `permission-offline`: support for refresh tokens (requested by offline_access scope)
+          - `permission-patient`: support for patient-level scopes (e.g. patient Observation.read)
+          - `permission-user`: support for user-level scopes (e.g. user/Appointment.read)
+
+          [Click here](#{resume_pass_url}?token=#{identifier}) if the system **meets** these requirements.
+
+          [Click here](#{resume_fail_url}?token=#{identifier}) if the system **does not meet** these requirements.
+        MESSAGE
+      )
+    end
+  end
+end

data/lib/carin_for_blue_button_test_kit/custom_groups/visual_inspection_and_attestation/v200_server/00_authorization_group/attestation_test_requirement_97.rb

@@ -0,0 +1,41 @@
+module CarinForBlueButtonTestKit
+  class AttestationTestCarinV2Requirement97 < Inferno::Test
+    title 'Responds with appropriate error codes'
+    description <<~DESCRIPTION
+      The Health IT Module returns the following response classes:
+      - (Status 400): invalid parameter
+      - (Status 401/4xx): unauthorized request
+      - (Status 403): insufficient scope
+      - (Status 404): unknown resource
+      - (Status 410): deleted resource
+
+      The Health IT Module rejects any unauthorized request by returning an HTTP 401 "Unauthorized", HTTP 403 "Forbidden",
+      or HTTP 404 "Not Found".
+    DESCRIPTION
+    id :carin_server_requirement_97_attestation
+
+    verifies_requirements 'hl7.fhir.us.carin-bb_2.0.0@97', 'hl7.fhir.us.carin-bb_2.0.0@102'
+
+    run do
+      identifier = SecureRandom.hex(32)
+      wait(
+        identifier:,
+        message: <<~MESSAGE
+          I attest that the Health IT Module returns the following response classes:
+          - (Status 400): invalid parameter
+          - (Status 401/4xx): unauthorized request
+          - (Status 403): insufficient scope
+          - (Status 404): unknown resource
+          - (Status 410): deleted resource
+
+          I further attest that the Health IT Module rejects any unauthorized request by returning an HTTP 401 "Unauthorized",
+          HTTP 403 "Forbidden", or HTTP 404 "Not Found".
+
+          [Click here](#{resume_pass_url}?token=#{identifier}) if the system **meets** these requirements.
+
+          [Click here](#{resume_fail_url}?token=#{identifier}) if the system **does not meet** these requirements.
+        MESSAGE
+      )
+    end
+  end
+end

data/lib/carin_for_blue_button_test_kit/custom_groups/visual_inspection_and_attestation/v200_server/00_authorization_group.rb

@@ -0,0 +1,15 @@
+require_relative '00_authorization_group/attestation_test_requirement_48'
+require_relative '00_authorization_group/attestation_test_requirement_60'
+require_relative '00_authorization_group/attestation_test_requirement_97'
+
+module CarinForBlueButtonTestKit
+  class CarinSecurityAttestationGroup < Inferno::TestGroup
+    id :c4bb_security
+    title 'Security'
+    short_title 'Security'
+
+    test from: :carin_server_requirement_97_attestation
+    test from: :carin_server_requirement_48_57_attestation
+    test from: :carin_server_requirement_60_67_attestation
+  end
+end

data/lib/carin_for_blue_button_test_kit/custom_groups/visual_inspection_and_attestation/v200_server/01_must_support_group/attestation_test_requirement_10.rb

@@ -0,0 +1,26 @@
+module CarinForBlueButtonTestKit
+  class AttestationTestCarinV2Requirement10 < Inferno::Test
+    title 'Follows FHIR and US Core guidance when data is unavailable'
+    description <<~DESCRIPTION
+      The Health IT Module follows the FHIR core specification and US Core guidance when no data is available
+      for required data elements (minimum cardinality > 0).
+    DESCRIPTION
+    id :carin_server_requirement_10_attestation
+
+    verifies_requirements 'hl7.fhir.us.carin-bb_2.0.0@10'
+
+    run do
+      identifier = SecureRandom.hex(32)
+      wait(
+        identifier:,
+        message: <<~MESSAGE
+          I attest that the Health IT Module applies FHIR and US Core guidance
+          when the source system lacks data for required elements with minimum cardinality > 0.
+
+          [Click here](#{resume_pass_url}?token=#{identifier}) if the system **meets** this requirement.
+          [Click here](#{resume_fail_url}?token=#{identifier}) if the system **does not meet** this requirement.
+        MESSAGE
+      )
+    end
+  end
+end

data/lib/carin_for_blue_button_test_kit/custom_groups/visual_inspection_and_attestation/v200_server/01_must_support_group/attestation_test_requirement_2.rb

@@ -0,0 +1,29 @@
+module CarinForBlueButtonTestKit
+  class AttestationTestCarinV2Requirement2 < Inferno::Test
+    title 'Returns maintained data'
+    description <<~DESCRIPTION
+      The Health IT Module is capable of populating and returning all data elements maintained
+      by the payer as part of the query results, as specified by the CARIN Blue Button Health Plan API
+      CapabilityStatement.
+    DESCRIPTION
+    id :carin_server_requirement_2_attestation
+
+    verifies_requirements 'hl7.fhir.us.carin-bb_2.0.0@2'
+
+    run do
+      identifier = SecureRandom.hex(32)
+      wait(
+        identifier:,
+        message: <<~MESSAGE
+          I attest that the Health IT Module is capable of populating and returning all data elements maintained
+          by the payer as part of the query results, as specified by the CARIN Blue Button Health Plan API
+          CapabilityStatement.
+
+          [Click here](#{resume_pass_url}?token=#{identifier}) if the system **meets** this requirement.
+
+          [Click here](#{resume_fail_url}?token=#{identifier}) if the system **does not meet** this requirement.
+        MESSAGE
+      )
+    end
+  end
+end

data/lib/carin_for_blue_button_test_kit/custom_groups/visual_inspection_and_attestation/v200_server/01_must_support_group/attestation_test_requirement_5.rb

@@ -0,0 +1,29 @@
+module CarinForBlueButtonTestKit
+  class AttestationTestCarinV2Requirement5 < Inferno::Test
+    title 'Does not include absent data with unknown reason'
+    description <<~DESCRIPTION
+      In situations where information for a particular data element is not present and
+      the reason for its absence is unknown, the Health IT Module does not include the data element in
+      the resource instance returned as part of the query results.
+    DESCRIPTION
+    id :carin_server_requirement_5_attestation
+
+    verifies_requirements 'hl7.fhir.us.carin-bb_2.0.0@5'
+
+    run do
+      identifier = SecureRandom.hex(32)
+      wait(
+        identifier:,
+        message: <<~MESSAGE
+          I attest that in situations where information for a particular data element is not present and
+          the reason for its absence is unknown, the Health IT Module does not include the data element in
+          the resource instance returned as part of the query results.
+
+          [Click here](#{resume_pass_url}?token=#{identifier}) if the system **meets** this requirement.
+
+          [Click here](#{resume_fail_url}?token=#{identifier}) if the system **does not meet** this requirement.
+        MESSAGE
+      )
+    end
+  end
+end

data/lib/carin_for_blue_button_test_kit/custom_groups/visual_inspection_and_attestation/v200_server/01_must_support_group/attestation_test_requirement_7.rb

@@ -0,0 +1,30 @@
+module CarinForBlueButtonTestKit
+  class AttestationTestCarinV2Requirement7 < Inferno::Test
+    title 'Includes reason for missing Must Support elements'
+    description <<~DESCRIPTION
+      When a Must Support element is missing and the reason for the absence is known,
+      the Health IT Module includes a reason using either:
+      - a value such as a nullFlavor from the relevant value set, or  
+      - the `dataAbsentReason` extension.
+    DESCRIPTION
+    id :carin_server_requirement_7_attestation
+
+    verifies_requirements 'hl7.fhir.us.carin-bb_2.0.0@7'
+
+    run do
+      identifier = SecureRandom.hex(32)
+      wait(
+        identifier:,
+        message: <<~MESSAGE
+          The developer of the Health IT Module attests that when a Must Support element is missing and the
+          reason for the absence is known, the Health IT Module includes a reason using either:
+          - a value such as a nullFlavor from the relevant value set, or  
+          - the `dataAbsentReason` extension.
+
+          [Click here](#{resume_pass_url}?token=#{identifier}) if the system **meets** this requirement.  
+          [Click here](#{resume_fail_url}?token=#{identifier}) if the system **does not meet** this requirement.
+        MESSAGE
+      )
+    end
+  end
+end

data/lib/carin_for_blue_button_test_kit/custom_groups/visual_inspection_and_attestation/v200_server/01_must_support_group/attestation_test_requirement_9.rb

@@ -0,0 +1,26 @@
+module CarinForBlueButtonTestKit
+  class AttestationTestCarinV2Requirement9 < Inferno::Test
+    title 'Omits Must Support elements with cardinality >= 0 if data is not present'
+    description <<~DESCRIPTION
+      The Health IT Module omits `Must Support` data elements from the resource if the element's minimum
+      cardinality is 0 and no data is available from the source system.
+    DESCRIPTION
+    id :carin_server_requirement_9_attestation
+
+    verifies_requirements 'hl7.fhir.us.carin-bb_2.0.0@9'
+
+    run do
+      identifier = SecureRandom.hex(32)
+      wait(
+        identifier:,
+        message: <<~MESSAGE
+          I attest that the Health IT Module omits `Must Support` elements with minimum cardinality = 0
+          when the source system has no data available for them.
+
+          [Click here](#{resume_pass_url}?token=#{identifier}) if the system **meets** this requirement.
+          [Click here](#{resume_fail_url}?token=#{identifier}) if the system **does not meet** this requirement.
+        MESSAGE
+      )
+    end
+  end
+end

data/lib/carin_for_blue_button_test_kit/custom_groups/visual_inspection_and_attestation/v200_server/01_must_support_group.rb

@@ -0,0 +1,19 @@
+require_relative '01_must_support_group/attestation_test_requirement_2'
+require_relative '01_must_support_group/attestation_test_requirement_5'
+require_relative '01_must_support_group/attestation_test_requirement_7'
+require_relative '01_must_support_group/attestation_test_requirement_9'
+require_relative '01_must_support_group/attestation_test_requirement_10'
+
+module CarinForBlueButtonTestKit
+  class CarinMustSupportAttestationGroup < Inferno::TestGroup
+    id :c4bb_must_support
+    title 'Must Support'
+    short_title 'Must Support'
+
+    test from: :carin_server_requirement_2_attestation
+    test from: :carin_server_requirement_5_attestation
+    test from: :carin_server_requirement_7_attestation
+    test from: :carin_server_requirement_9_attestation
+    test from: :carin_server_requirement_10_attestation
+  end
+end

data/lib/carin_for_blue_button_test_kit/custom_groups/visual_inspection_and_attestation/v200_server/03_eob_group/attestation_test_requirement_105.rb

@@ -0,0 +1,29 @@
+module CarinForBlueButtonTestKit
+  class AttestationTestCarinV2Requirement105 < Inferno::Test
+    title 'Uses versioned references when point-in-time data is maintained'
+    description <<~DESCRIPTION
+      The Health IT Module uses versioned references when an ExplanationOfBenefit
+      references another resource whenever point-in-time data is maintained, reflecting the data
+      effective as of the date of service or admission on the claim.
+    DESCRIPTION
+    id :carin_server_requirement_105_attestation
+
+    verifies_requirements 'hl7.fhir.us.carin-bb_2.0.0@105'
+
+    run do
+      identifier = SecureRandom.hex(32)
+      wait(
+        identifier:,
+        message: <<~MESSAGE
+          I attest that the Health IT Module uses versioned references when an ExplanationOfBenefit
+          references another resource whenever point-in-time data is maintained, reflecting the data
+          effective as of the date of service or admission on the claim.
+
+          [Click here](#{resume_pass_url}?token=#{identifier}) if the system **meets** this requirement.
+
+          [Click here](#{resume_fail_url}?token=#{identifier}) if the system **does not meet** this requirement.
+        MESSAGE
+      )
+    end
+  end
+end

data/lib/carin_for_blue_button_test_kit/custom_groups/visual_inspection_and_attestation/v200_server/03_eob_group/attestation_test_requirement_108.rb

@@ -0,0 +1,29 @@
+module CarinForBlueButtonTestKit
+  class AttestationTestCarinV2Requirement108 < Inferno::Test
+    title 'Supports versioned and unversioned references'
+    description <<~DESCRIPTION
+      The Health IT Module supports both versioned and non-versioned ExplanationOfBenefit
+      reference approaches when referencing another resource,
+      and returns the same content for referenced resources in either case.
+    DESCRIPTION
+    id :carin_server_requirement_108_attestation
+
+    verifies_requirements 'hl7.fhir.us.carin-bb_2.0.0@108'
+
+    run do
+      identifier = SecureRandom.hex(32)
+      wait(
+        identifier:,
+        message: <<~MESSAGE
+          I attest that the Health IT Module supports both versioned and non-versioned ExplanationOfBenefit
+          reference approaches when referencing another resource,
+          and returns the same content for referenced resources in either case.
+
+          [Click here](#{resume_pass_url}?token=#{identifier}) if the system **meets** this requirement.
+
+          [Click here](#{resume_fail_url}?token=#{identifier}) if the system **does not meet** this requirement.
+        MESSAGE
+      )
+    end
+  end
+end

data/lib/carin_for_blue_button_test_kit/custom_groups/visual_inspection_and_attestation/v200_server/03_eob_group/attestation_test_requirement_115.rb

@@ -0,0 +1,24 @@
+module CarinForBlueButtonTestKit
+  class AttestationTestCarinV2Requirement115 < Inferno::Test
+    title 'Does not use a data absent reason for EOB.type'
+    description <<~DESCRIPTION
+      The Health IT Module does not assign a data absent reason to the `ExplanationOfBenefit.type` element.
+    DESCRIPTION
+    id :carin_server_requirement_115_attestation
+
+    verifies_requirements 'hl7.fhir.us.carin-bb_2.0.0@115'
+
+    run do
+      identifier = SecureRandom.hex(32)
+      wait(
+        identifier:,
+        message: <<~MESSAGE
+          I attest that the Health IT Module does **not** assign a data absent reason to `ExplanationOfBenefit.type`.
+
+          [Click here](#{resume_pass_url}?token=#{identifier}) if the system **meets** this requirement.
+          [Click here](#{resume_fail_url}?token=#{identifier}) if the system **does not meet** this requirement.
+        MESSAGE
+      )
+    end
+  end
+end