In order to obtain certification, an applicant shall: Provide evidence that the applicant is accredited or certified by a qualified accreditation or certification organization; and Meet the following standards for certification: Demonstrate compliance with the HIPAA privacy standards set forth in 45 CFR Parts 160 and 164; Demonstrate compliance with HIPAA security standards set forth in 45 CFR Parts 160, 162, and 164; Provide an attestation signed by an officer of the applicant that to the extent required by Health-General Article, §4-302.5, Annotated Code of Maryland, the applicant: Possesses the technological capability to filter and restrict from disclosure legally protected health information; Is parsing restricted codes and conveying all other information in the health record that is not prohibited by law to exchange; and Possesses the technological capacity to allow a consumer to request and consent to the exchange of legally protected health information to a specific treating provider; Provide evidence of ability to measure technical performance and manage future capacity demands; Provide evidence of initial and ongoing employee training in HIPAA privacy and security requirements and customer communication procedures; and Provide additional information requested by the Commission as necessary to determine the applicant's compliance with the standards for certification. The Commission shall issue certification to an applicant that has met all the requirements of §A of this regulation.