The key thing was having the original report generated by AC: took a while to find! Also, having the security analysis done and I made a list of office policies concerning security to address each of the points brought up in the analysis. We had to successfully exchange vaccine data and also exchange medical records with another provider. I have a letter from the Alaska eHealth Network stating that there was no way to exchange vaccine data (back in 2012) and also that there was no way to exchange health surveillance data with the state. (There still is no way to do this.) I had a printout from the medical record exchange with another practice through the eHealth network, encrypted.
Anyone seeking to do MU, I recommend you save yourself the hassle and focus on seeing patients!
