--- title: Integration & Production slug: net2net-rest/guide/integration-and-production docTags: createdAt: 2026-06-12T09:48:23.733Z --- The following section defines related technical and support elements needed to achieve certification for moving into production, along with our Integration, Compliance, and Certification processes. ## Integration Process Once Surescripts assigns an Integration resource, customers will be contacted to begin the project(s) and will be guided through the Surescripts Integration process. The Integration resource will provide Surescripts documentation, product education, access to the Surescripts staging environment, assistance during design and development milestones, and testing to prepare for message validation. The Integration resource will perform message validation testing and, once successful, will provide the customer access to the Surescripts production environment. :::hint{type="info"} **Note: **The time frame of the project can vary depending on the customer's resource allocation for the project. ::: **Meeting Requirements** During Integration, customers undergo message validation testing to demonstrate all requirements are met. Certification focuses on message format and, when appropriate, application workflow and display in accordance with Surescripts documentation and the associated Application Certification Requirements (ACRs). Upon successful completion of message validation and, when applicable, other pre-production network requirements (e.g., Identity Proofing, DEA audit), customers will be enabled in production. For requirements, consider the following: - Surescripts ACRs are required to be met to achieve production status on the Surescripts network and will be enforced as part of certification. - Surescripts business rules are data validations applied by Surescripts beyond the schema requirements that will cause a message to be successful or rejected. - Surescripts test cases do not cover all possible scenarios in production. Customers are responsible for testing all scenarios specific to their production environment. - In accordance with the customer’s legal agreement with Surescripts, each customer is responsible for ensuring compliance with all applicable laws including, but not limited to, local and state laws/regulations where doing business. ## Transition to Production Once message validation and the contract are complete and approved by the Surescripts Certification Review Board, the customer is ready to move into production. Surescripts will configure the production connection and validate successful operations with the customer. Prior to the transition to production, Surescripts Account Management will work with the customer and internal Surescripts teams to discuss the following: - Production support contacts (Escalation Matrix) - Support process and training - Support hours :::hint{type="info"} **Note: **The transition to production is concluded with a Lessons Learned discussion and/or Satisfaction Survey. ::: ## Terminology Usage For terminology usage throughout this Guide, consider the following: | **Term** | **Term usage** | | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | must | Requirements that are enforced as part of the production code or Surescripts business rules. | | shall | The requirements customers are required to meet in order to be certified on the Surescripts network. These requirements will be enforced as part of certification. | | should | Used for guidance and best practices. Best practices can also be found in Best Practice sections. Customers are encouraged, but not required, to meet best practices in order to be certified on the Surescripts network. | | C.### | This designates a PMBC workflow application certification requirement. | ## Communication Rules Please refer to the Connectivity and Authentication Guide for additional connectivity and authentication information. For the network to be reliable, there are communication rules to which all customers must adhere. ## Timeouts For timeouts, consider the following: - When sending a message to Surescripts, the initiator should set the http timeout to 30 seconds. - The Receiving System must reply with a valid Status/Error response within 24 seconds. - When a Status 000 is sent as a reply to a Clinical Message, the Receiving System must follow-up with a Verify or Error message within 55 minutes, because Surescripts may return a timeout error if no Verify or Error message has been received. ## UTC Time Format By using Coordinated Universal Time (UTC), the receiver of a message will know the time regardless of their time zone. For example: If a message was sent from Boston at 5:30PM EDT (Eastern Daylight Time), the time would be sent as 21:30 UTC time. If this message was received in Chicago CDT (Central Daylight Time), the 21:30 UTC could be converted to the local CDT time of 4:30PM. Refer to [http://en.wikipedia.org/wiki/Coordinated\_Universal\_Time](http://en.wikipedia.org/wiki/Coordinated_Universal_Time), or [http://www.w3.org/XML/](http://www.w3.org/XML/) for more information. Synchronize UTC time with NIST (National Institute of Standards and Technology). Drift of no more than one minute will be acceptable. When sending only a Date (not Date and Time), it should be sent in your local time zone, and the receiver should interpret it in their local time. Neither party should attempt to convert the Date to UTC. All standard programming languages should have a function for generating a date in the UTC time zone or displaying a date in the local time zone. The format of the date/time fields in the XML schema must use the xsd\:dateTime format. Examples of that format are: CCYY-MM-DDTHH\:MM\:SS.FZ, where the UTC time zone may be specified as Z, + 00:00, or - 00:00. For example, 2013-01-01T16:09:04.5Z, or 2013-01-01T16:09:04.5-00:00, or 2013-01-01T16:09:04.5+00:00, where 16:09:04.5Z would be 16 hours, 09 minutes, 04 seconds, 5 fractional seconds. UTC time is denoted by either the “Z” in the first example or the “-00:00” in the second example, or the “+00:00” in the third example. The fractional seconds is not required. Refer to xsd\:dateTime for more information. For simple date fields that do not include the time portion, the format is: CCYY-MM-DD. ## Character Set | **The character set contains ASCII values 32 – 126, which include:** | | | -------------------------------------------------------------------- | ----------------------------------------------------------------------- | | Symbols | ! " # $ % & ' ( ) \* + , - . / : ; \< = > ? @ \[ \ ] ^ \_ \` \{ \| } \~ | | Numerals | Ø to 9 | | Letters, upper and lower case | A to Z, a to z | Unprintable characters, such as control characters, are not used within the field sets. Defined unprintable characters are used as delimiters. UTF-8 is the required character encoding for XML. Other encoding formats are not supported by Surescripts. It is recommended that customers declare their UTF-8 formatting in the message header. ## Handling Optional Fields Customer shall be able to process any valid message request or response that they are certified on (conditional/optional, valid data elements and values shall not cause processing failure of the message). ## Numeric Representation The decimal point is represented by a period and shall be used as follows: - Only when there are significant digits to the right of the decimal. - When there is a digit before and after the decimal point. - Not with whole numbers. For example, consider the following possible values: | **Correct** | 2.515 | 251.5 | 25.15 | 2515 | 0.2515 | 2.5 | | ------------- | ----- | ----- | ----- | ---- | ------ | --- | | **Incorrect** | .2515 | 2515. | 3.00 |   |   |   | ## Requirement Designation **Segmnet Attributes:** | **Code** | **Description** | | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | M | Required/Mandatory - the segment must be used. | | C | Situational/Conditional - the segment must be used if conditions are met. Some fields may not have specific conditions. Data should be sent if available. Where comments are "Not used by Surescripts", information will be passed on, but not used, by Surescripts for processing. | | NU | Not used or for future use. | :::hint{type="info"} **Note: **Elements that are grouped together in a composite may be marked as mandatory; however, if the group itself is marked as conditional, then these are only required if you use the group. ::: In the example below, the DocumentType and DocumentData are mandatory only if the File is sent. | **Element Name** | **Code** | **Comments** | | ---------------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------ | | File | conditional  | This Type of attachment can be used by the send to include a file attachment. | | DocumentType | mandatory  | If a file attachment is included, then a DocumentType must be specified and should be a valid MIME type.
For example: application/pdf | | DocumentVersion | conditional  | Optional version number for the document type | | DocumentData | mandatory  | The Base64 Encoded string of the file attachment | ## Compliance Surescripts goal is efficiency and consistency across the network so that all customers can meet the highest measures of patient safety, end-to-end reliability, and quality. To ensure that customers comply with, and adhere to, the approved certification requirements, Surescripts: - Initiates a remediation process for identified compliance issues. - Monitors customers in production to ensure all network customers remain in compliance with certification requirements and contractual terms. Customers agree to notify Surescripts when they have altered, reconfigured, or disabled any portion of a Surescripts certified software product or module, before moving such changes into production, as they may create a circumstance of non-compliance with the Surescripts certification issued. In those instances, Surescripts will work with the customer to perform a timely re-certification, if required, to ensure network compliance and safety. This guide is intended for certification on our network only and is not intended to ensure compliance with state and federal law. In accordance with the customer’s legal agreement with Surescripts, each customer is responsible for conducting its own due diligence to ensure compliance with all applicable laws and requirements, including, but not limited to, local and state laws and regulations in which the customer’s application is deployed and used. As a reminder, Surescripts conducts certification with customers to ensure the application adheres to network requirements. Surescripts will enforce mandatory fields as required by the Standards body and Surescripts guide requirements. To maximize interoperability, customers are recommended to support optional fields that have been created to address gaps in discrete data needs and the many solutions that are in place for the benefit of the receiver. Surescripts encourages, but does not guarantee, the use of optional discrete fields to support end user workflows.