Comments on Life as a Healthcare CIO: The October HIT Standards Committee meeting

Dr. Halamka, I don't think many people realize ho...

2009-10-19T09:58:04.160-07:00

Dr. Halamka,

I don't think many people realize how much the work of the NHIN has contributed in the last 18 months towards several of the "enhancements" you mention in this post:
* SAML for healthcare
* A standard XML schema and vocabulary for representing consumer consents (let's call this one "XACML for healthcare")
* Specification of Health Information Exchange assumptions and associated privacy and security policy.

Taking the last one first, on the NHIN we specified some of those assumptions, key of which are:
* exchange of clinical information between HIEs (that is, the NHIN) is in the form of Clinical Documents
* these Clinical Documents follow HITSP standard formats and have metadata applied to them that can be used for (among other things) applying access restrictions
* all transactions on the NHIN will use a common transport (based on SOAP) and carry assertions about the requesting user's identity, role, and purpose for the request, so that information needed to apply access restrictions is available at the "decision point".

In addition, we specified the "SAML for Healthcare" (for user identity information) and "XACML for Healthcare" (for consumer consents) profiles that you rightly describe as being needed.

At the same time last year, a workgroup in OASIS was formed to address these same areas, and those specifications are currently under ballot in OASIS. Fortunately, several participants in the NHIN were able to join the OASIS working group before those specifications were finalized. Some of the NHIN thinking was adopted into the OASIS specs, and the OASIS standard has been written in to the next version of the NHIN specs that will be published in early 2010.

One reason that many people aren't aware of how much the NHIN has accomplished in this area is that the NHIN committees have operated under the restrictions that come with being formed under a federal contract -- that is, they are closed, with participation limited only to the contractors and federal agencies. But at the same time (I can tell you from experience), there are many people inside the Office of the National Coordinator who don't realize how far we've come, either.

But HITSP has now provided a venue for these specifications to be discussed in an open forum, with the newly created "Consumer Preferences Tiger Team". The name is not exactly right, because Consumer Preferences are only half the story -- your post describes the complete scope of where these concepts need to apply.

I think we can look forward to HITSP moving reasonably quickly to adopt a set of standards to cover the areas that you describe in this post. And I believe that it can be done in a way that supports "Baseline security and privacy policies" but doesn't restrict implementations that want to move beyond those baselines to grant consumers more flexible control.

My request is that those sitting on the HIT Policy and HIT Standards committees, high above the HITSP Tiger Teams and Technical Committees, keep their eye on the ground level so we don't end up forming committees to solve problems for which solutions already exist and are in the process of being specified.

Hello again Dr. The gaps are gritty, however if we...

2009-10-19T05:42:30.527-07:00

Hello again Dr. The gaps are gritty, however if we conceder mediation logic to assist in the transmographication of heritage systems, we can exert control points and canonical models to assist vendors in the path to more contemporary technologies.

Corrected link for the transcript of the 10-14 HIT...

2009-10-15T10:07:49.731-07:00

Corrected link for the transcript of the 10-14 HIT STandards Meeting

Thanks John. I'm pleased at the new focus on imple...

2009-10-15T09:38:53.166-07:00

Thanks John. I'm pleased at the new focus on implementation and adoption. But there are still loose ends to tie up so that people know what to implement. Since yesterday's meeting stated that there are some gaps that affect 2011 (including high cost imaging, patient access to EHR, patient education materials) as well as the vocabulary gaps and other gaps looking ahead to 2013, what is the plan specifically for providing guidance for the 2011 items? Will the November HIT SC meeting be dedicated only to Security, or will recommendations to resolve the 2011 gaps be presented at that time?

There should be a federal register posting today a...

2009-10-15T03:29:44.732-07:00

There should be a federal register posting today announcing the October 29 meeting formally.

Thanks John, I am glad to be able to get your pers...

2009-10-14T22:10:03.363-07:00

Thanks John, I am glad to be able to get your perspective from the meeting. I am also very pleased that next months meeting is taking a deep look at security. I do not see the October 29th meeting listed on the healthit.hhs.gov web site. Do you know when the official meeting announcement will be made?

I am particularly interested in the assumptions for HIE. Interoperability will be a key criteria for meaningful use and I think the eventual development of NHIN will be important to meeting many of our goals for lowering costs and improving quality.

The rough draft transcript from the meeting is again posted here:

http://ahier.blogspot.com/2009/10/hit-standards-meeting-101409.html