The ONC Whitepaper on Consent

Last week was a busy one for healthcare IT. In addition to the DEA Interim Final Rule on e-prescribing of controlled substances, the launch of NHIN Direct, and the introduction of new ONC interoperability framework processes, HHS released the Whitepaper on Consent.

The entire document and its 3 appendixes are worth reading. The Executive summary contains a great classification of consent models found throughout the world:

No consent

Health information of patients is automatically included—patients cannot opt out

Opt-out

Default is for health information of patients to be included automatically, but the patient can opt out completely

Opt-out with exceptions

Default is for health information of patients to be included, but the patient can opt out completely or allow only select data to be included

Opt-in

Default is that no patient health information is included; patients must actively express consent to be included, but if they do so then their information must be all in or all out

Opt-in with restrictions

Default is that no patient health information is made available, but the patient may allow a subset of select data to be included.

Appendix A is a very helpful list of State-Led Examples of Exchange in the U.S

For more details about the Massachusetts efforts to date, including the educational materials we used, see my blog about patient privacy preferences.

Appendix B is an overview of Selected State Laws which can be empowering as we implement consent models.

Appendix C contains examples of Exchange in Other Developed Countries.

I've worked closely with the county council in Jonkoping, Sweden which has a very high percentage of EHR and hospital information system adoption

The consent whitepaper was timed perfectly to align with the HIT Standards Committee review of existing standards for storing and transmitting consent preferences.

Well done!

The ONC Interoperability Framework

In my summary of the March HIT Standards Committee meeting I mentioned the new ONC Interoperability Framework and the related RFPs. Here's the detail I promised in my previous blog about ONC. Thanks to Doug Fridsma for this overview and his hard work on it.

ONC announced several projects to support Standards and Interoperability Framework and Nationwide Health Information Network (NHIN).

Over ten requests for proposals were released in February 2010 under the existing contract vehicle: National Institutes of Health (NIH) Information Technology Acquisition and Assessment Center (NITACC) CIO-SP2 Task Order. The funding will support activities for two years that are designed to develop the standards, tools, interoperability framework, and technical infrastructure to support the overall goals of improving adoption of HIT. Key areas for RFP include:

Use case development and functional requirements for interoperability

ONC anticipates leveraging the National Information Exchange Model (NIEM) for health care and develop consistent process for use case development. Working closely with consumers, providers, government organizations and other stakeholders, ONC will identify real-world needs, prioritize them through a governance process, and create explicit, unambiguous documentation of the use cases, functional requirements and technical specifications for interoperability.


Harmonization of standards and interoperability specifications

The harmonization process integrates different views of health care information into a consistent view. This process will include merging related concepts, adding new concepts, and mapping concepts from one view of health care information into another view. This process will also identify gaps that can point the way towards development of new interoperability standards. ONC anticipates leveraging NIEM process to support data exchange harmonization.


Standards Development

In order to meet the needs of the use cases and increased use of HIT, there will be a need to modify or extend the existing standards or develop new standards. ONC will work with standards development organizations and with research organizations to extend existing ones, or develop new standards as necessary. 



Tools and Standards Repository

To accelerate the development, use, maintenance and adoption of interoperability standards across the industry, and to spur innovation, ONC will develop tools to facilitate the entire standards lifecycle and maximize re-use of concepts and components, including tools and repository for browsing, selecting, and implementing appropriate standards.


Interoperability Specifications

In order to be able to test and implement the standards in real-life settings, they must be specified to a higher degree of detail. This project will focus on the development of interoperability specifications that are independent of specific software architecture (a platform-independent model, or PIM) as well as interoperability specifications that are specific to the NHIN architecture (a platform-specific model, or PSM). 


NHIN Architecture Refinement and Management

The NHIN architecture is a specific network architecture that realizes health information interoperability specifications based on open standards. This project will focus on the refinement and management of the NHIN Architecture to meet emerging needs of the health care market.

Reference Implementation

A reference implementation is the fully instantiated software solution that is analyzed to be compliant with the standards and serves as a “reference” to other software developers of what an interoperable solution looks like. The reference implementation will be accessible as a public resource with compiled code, source code and supporting documentation. 


Integration Testing

The current NHIN testing infrastructure needs to be refined to test and validate emerging needs of the network and planned NHIN capabilities as they are identified. ONC will work with NIST where NIST will provide testing tools to validate that particular implementation conforms to a set of standards specification; and ONC will support the development of an integration testing “harness” that will test how a particular component that has satisfied conformance testing requirements integrates into the reference implementation. 


NHIN Demonstrations and Emergent Pilots

Although a reference implementation provides value to the community through a thorough assessment of the technology; support for established standards, and vetting within the HHS, consumer, and other stakeholders, a reference implementation will need to be refined through real-world pilots and demonstrations. ONC will support efforts in the refinement of the reference implementation and interoperability specifications, through limited number of real world demonstration and pilots. 


NHIN Operations and Infrastructure

This project will focus on activities related to operational and infrastructure support for the ongoing demonstrations and production pilots of health information exchange across a trusted network. 


Each project will focus on specific activities within each area as well as collaboration across all other projects addressing overall effectiveness of the Standards and Interoperability framework, certification and NHIN that is critical to the wider adoption of HIT. ONC expects to award one contract for each project for a two-year project period to qualified applicants.

E-Prescribing Controlled Substances

Last week, the Drug Enforcement Administration released its long awaited Interim Final Rule on e-Prescribing of Controlled Substances

It's 334 pages long, but the most important portion is section § 1311.115 which describes the need for two factor authentication when prescribing controlled substances. Here's the detail

(a) To sign a controlled substance prescription, the electronic prescription application must require the practitioner to authenticate to the application using an authentication protocol that uses two of the following three factors:

(1) Something only the practitioner knows, such as a password or response to a challenge question.

(2) Something the practitioner is, biometric data such as a fingerprint or iris scan.

(3) Something the practitioner has, a device (hard token) separate from the computer to which the practitioner is gaining access.

(b) If one factor is a hard token, it must be separate from the computer to which it is gaining access and must meet at least the criteria of FIPS 140-2 Security Level 1, as incorporated by reference in § 1311.08, for cryptographic modules or one-time-password devices.

(c) If one factor is a biometric, the biometric subsystem must comply with the requirements of § 1311.116.

In a previous blog, I wrote about the many technologies which support strong authentication.

For e-Prescribing of controlled substances BIDMC will investigate 3 approaches

*The use of fingerprint biometrics using web-based software from Bio-Key as described in my cool technology blog.

*The use of hard tokens such as those provided by RSA.

*The use of cell phones as a two factor authentication device such as sending a PIN number via SMS after each e-prescribing session. Anakam has a complete suite of tools to implement this workflow.

Although there will be some burden/inconvenience imposed on clinicians through the use of two factor authentication, I believe it will ultimately save time. Why?

Today's e-prescribing workflow is fractured. I can write for Lipitor with fully electronic NCPDP 8.1 formatted, vocabulary controlled, end to end secure transactions. However I write for Oxycontin with a pen and paper. I have to split my time between a screen and a pen for the same encounter with the same patient depending on the drug I'm writing for. In the Emergency department, approximately 30% of all prescriptions are for controlled substances (i.e. pain control after trauma).

With fully electronic workflows, I can write for all meeds, digitally sign the enter order set, get a PIN sent to my cell phone in 2 seconds and then send the transactions to the pharmacy of the patient's choice without a pen, paper or hassle.

I look forward to our controlled substance e-prescribing pilots. Ultimately it will be a win/win/win for patients, providers, and pharmacies.

Cool Technology of the Week

Many Massachusetts homes have experienced flooding this month, so we're all a bit focused on plumbing.

I've had two plumbing issues recently, both involving interesting technology fixes.

I live in a 100 year old house with fragile plumbing and electrical infrastructure. Recently, the plumbing on two old pedestal bathroom sinks clogged to the point that no plunger or drain cleaner could clear them. In an old New England house, the bathroom sinks are often plumbed back to back together, making a plumbing snake impossible to use. The only option is to open the wall and replace the offending pipe…or so I thought until I discovered Kinetic Water Ram technology.

The idea is simple - use compressed air to create a shock wave of moving water at 5000 psi. The wave moves inside the pipe, not against the pipe walls, so it will not burst the plumbing. These devices are used by plumbers to clear very challenging clogs. Typically a plumber bills $150 for a visit. For $250, you can purchase one of your own.

Here's a video of how it is used.

The great news - I'll never need to use chemical drain cleaners or a plunger again. One device clears bathtubs, sinks, toilets etc. Clogs and accumulated corrosion deposits are both cured with a shock wave of water.

My wife and daughter thanked the home CIO for solving the problem.

In the recent floods, hundreds of basements in the Boston Metrowest area were flooded and damaged. Although my basement survived without damage, I realized that our 20 year old sump pump was a single point of failure. If the sump pump failed, we'd be flooded. If the electricity failed during a storm, we'd be flooded. Hence I investigated "disaster recovery" hardware for basements. I found the Wayne battery backup sump pump.

Last weekend, I replaced our 20 year old sump pump with a new pedestal pump and discharge hose. This weekend, I'll add the disaster recovery system.

The end result will be a 2300 gallon per hour primary pump with a 2300 gallon per hour battery backup pump that should last for a day of pumping with a 75 amp battery.

Thus, I'll be covered for pump failure and power failure. The home CIO does for the basement what the work CIO does for the data center.

The Girl with 2 Brains

Last Thursday I wrote about the Yin to my Yang exploring the synergy between my left brain and my wife's right brain.

My daughter Lara turns 17 next week and she's definitely the girl with 2 brains (or a whole brain).

I cannot draw a stick figure (my attempts at drawing a human look more like a dinner fork than the Venus de Milo).

My daughter took a blank piece of paper and a pencil then drew the self portrait above.

Her greatest academic strength is math. She can visualize problems involving vector forces, geometry, or trigonometric functions then break them into solvable component parts. To me, the hardest part of advanced math and engineering is setting up the problem correctly, not solving it.

She's just completed her first resume. Today's high school students are expected to master college level topics, develop disciplined work habits at an early age, and complement their academics with sports/music/art/volunteer work, which she's tried to do in a balanced way. My own experience as a student was that I was not the smartest student in the class, but I was the most persistent due to minimal sleep needs, a great tolerance for any kind of discomfort - cold/fatigue/hunger, and a sense of impatience for the future.

My daughter has a different set of skills - a whole brain that can process the analytical and visual with equal competency, an ability to think about the greater good rather than personal gain, and a sense that anything is possible. She does not believe in political half truths. She does not judge success by a bank balance. She does not believe the ends justifies the means. She believes that the nice guy (or gal) can finish first.

I would like to believe that idealists can succeed through persistence and determination, always staying true to their values. Watching day to day activities in Washington has convinced me that it's critically important to have a strong moral compass.

Her current college search criteria on CollegeBoard.com are

Rural or Suburban location

Under 10,000 students

Strong Asian Studies/Japanese language program (for the right brain)

Strong Environmental Engineering program (for the left brain)

Studio art resources

If possible, a competitive collegiate archery team (she's ranked 6th in the US)

It's my hope that she has the best of both her parents without the downsides of either.

At very least, she can write a college essay entitled "Why I have a whole brain"!

The March HIT Standards Committee Meeting

Today's HIT Standards Committee included important discussions about NHIN Direct and a new Interoperability Framework supported by several ONC RFPs.

We began the meeting with a summary of the work in progress.

The Clinical Operations Workgroup is focused on vocabulary starter sets and ensuring implementation guidance is available.

The Clinical Quality Workgroup is focused on quality measure retooling to ensure meaningful use measures are EHR friendly.

The Privacy and Security Workgroup is focused on understanding all the consent standards currently available from different Standards Development Organizations and implementation guide writers.

The Implementation Workgroup is focused on creating a starter kit to accelerate EHR adoption and interoperability. Yesterday, I summarized the Implementation Workgroup "starter kit" testimony. During the meeting today the Workgroup synthesized the 10 lessons learned from the testimony into 3 major themes :

*Provide transparency to all the available resources - funding, tools, and technologies
*Clarify the requirements of meaningful use data exchanges through the use of FAQs and other online resources
*Provide simple interoperability guides with enough detail and samples so that a typical IT professional could implement interoperability

We discussed the best way to include specific implementation guidance in the Interim Final Rule, realizing that legal restrictions may limit our choices. In our IFR comment letter we recommend that broad families of standards be specified along with detailed implementation guide "floors" which will be amended through guidance letters issued outside the regulation. This strategy enables short term specificity and long term evolution/innovation. If the legal interpretation is that we cannot issue implementation guidance letters outside of regulation, there are existing government models that we can consider as alternatives i.e.

*NIST issues regular updates to the Federal Information Processing Standards (FIPS)
*CMS issues regular updates to the Physician Quality Reporting Initiative (PQRI)
*Private sector organizations provide updated implementation guidance via voluntary consensus groups (i.e. CAQH, WEDI, IHE)
*Open source communities provide continuous version releases. Although not a regulation or a single solution, such work provides reference implementations that can be widely adopted by stakeholders and become defacto standards.

We'll await legal guidance to determine next steps.

Next, Doug Fridsma presented NHIN Direct. David Blumenthal offered an introduction that identified NHIN direct as a "project" not a "product" that is designed to be responsive to customer requests, especially from small practices.

NHIN Direct does not replace existing NHIN standards, policies, and software. Instead NHIN Direct will explore simple data transport strategies for point to point communication. Over the next 6 months, it will explore the use of SMTP/TLS, REST, and SOAP implementations with running code. It will provide a way to transport data, not the only way.

Data exchanges required by stage one of Meaningful Use include e-prescribing, public health lab reporting, syndromic surveillance, immunization, and patient summary exchange (both provider to provider and provider to patient). The scope of NHIN Direct does not include new content/vocabulary standards, master patient indexes, or aggregations of data for quality reporting. It's complementary to existing NHIN Connect work and state HIE efforts. It is not to be feared and there is no reason for states to slow existing efforts while the NHIN Direct experiment is in process.

Next, Doug presented a framework for interoperability comprised of 7 components.

*Use Case Development and functional requirements
*Standards development
*Harmonization of Core Concepts
*Implementation specifics
*Pilot Projects
*Reference Implementation
*Conformance Testing

Several RFPs have been issued to support these efforts. They will leverage the lessons learned from HITSP and I'm confident that the HITSP efforts will be foundational to this next phase of work. I see the Harmonization of Core Concepts RFP as the evolution of HITSP and I suspect many HITSP volunteers will be involved, regardless of how the contract is awarded.

This seven step process will use the National Information Exchange Model (NIEM) approach as means to organize the work. Important aspects of the work ahead include:

*A b ottom up process to define requirements based on data exchanges that are needed to achieve meaningful use and meet the business priorities of stakeholders
*Delivery of fully integrated, well specified implementation guidance
*Electronic test scripts to ensure conformance and an active feedback loop to improve standards once testing has identified deficiencies

David Blumenthal emphasized that NIEM approaches, although used by the Department of Justice and Homeland Security, have absolutely no possibility of facilitating entry of healthcare data into law enforcement databases.

Carol Bean and Steve Posnack reported on the Certification NPRM temporary and permanent processes. Key points included

*Certification applies equally to EHRs and EHR modules
*Permanent certification separates the testing lab function from the certification function
*There will be multiple testing labs and certification organizations that will compete on price and service offerings. Accreditation processes for testing labs and certification organizations will ensure consistency among service providers.
*Site certification methods will be used for self developed EHRs
*No double certification will be necessary i.e. a site could purchase vendor products which are certified and self build portions of an EHR which will be site certified. There is no need to seek additional certification for the combination of the built and bought products. Making them work together to achieve meaningful use is the responsibility of the implementing organization.

A great meeting today. I look forward to the work ahead as we continue to provide tools, technologies, and educational materials in support of meaningful use data exchanges.

The Implementation Workgroup Starter Kit

On March 8, the Implementation Workgroup of the HIT Standards Committee held a day of hearings as part of the effort to create an "Implementation Starter Kit" which accelerates EHR adoption and interoperability.

The goals of the hearing were to

* Describe challenges and successes that may be instructive to others.

* Provide advice to help others with implementation.

* Contribute tools and technologies that can be made available to the public and private sector, such as roadmaps, blueprints.

Here are the top 10 lessons learned from those hearings

1. Provide emerging HIE guidelines to assist providers. The Nationwide Healthcare Information Network (NHIN effort) is posting a implementation guide that will include: policy, “trusted relationship”, standards, services, and four use cases.

2. Disseminate knowledge of tools and utilities. The National Cancer Institute (NCI) is providing software developer kits with vocabularies and metadata, vendor utilities, and specification documents. The National Institute of Standards and Technology (NIST) is providing conformance testing tools.

3. Communicate details of all available funding sources i.e.

Regional extension centers (RECs) $643 million

Health Information Exchange $564 million

Workforce Training Programs $118 million

Beacon Communities $235 million

Strategic Health Advanced Research Projects (SHARP) $60 million

Nationwide Health Information Network/Standards and Certification $64.3 million

4. Focus on workflow challenges such as clinician friendly approaches to workflow redesign, change management, and training.

5. Lengthen the current implementation timelines in key challenging areas such as reporting of quality data.

6. Develop standards for data exchange that ensure that the data will be trusted such as rich metadata (who created the data, for what purpose in what workflow), further definition of the transport layer, and message routing standards. Exporting the data is easy, but how do we trust the inbound data into our systems from an external source (i.e., HIE)? What data should be in a PHR? What is the interplay between the state privacy laws and interoperability?

7. Drive collaboration between the software vendors to advance ARRA. Host an EMR software vendor summit to create synergies between vendors.

8. Create detailed implementation guidance for interoperability standards. Additional standards will be required for some use cases such as HIEs communicating with other HIEs.

9. Leverage open source models, where practical, such as the work of the Veterans Administration.

10. Innovate to improve speed of adoption. New business models and innovation are required. Utilize disruptive innovation to accelerate the road to adoption of meaningful use.

Tomorrow, the HIT Standards Committee will hear the report from the Implementation Workgroup and I'll post those materials, as well as a full summary of the meeting.