1. The Patient Choice Project Use Case Working Session March 18th, 2016

2. Call Logistics If you are not speaking, please keep your phone on mute Do not put your phone on hold – if you need to take a call, hang up and dial in again when finished with your other call This meeting is being recorded Feel free to use the “Chat” feature for questions, comments or any items you would like the moderator or participants to know 2

3. Agenda 3 TopicTime Allotted General Announcements5 minutes Concert Series Presentations The Department of Veterans Affairs The United States Social Security Administration 50 minutes Next Steps/ Questions5 minutes

4. General Announcements The Patient Choice project will meet weekly on Fridays @ 11 am ET »The next working group meeting will be on Friday, March 18 th, 2016 at 11 am ET Use Case Update 4

5. Timeline 5 WeekTarget DateWorking Session TasksReview and Provide Comments via Confluence 102/26Review: Dataset Considerations and Finalized Risk and Issues Begin End-to-end Review End-to-end Review of Use Case Document 113/4Cancelled due to HIMSS 2016End-to-end Review Continued 123/11Review Comment Dispositions Introduce Standards Gap Analysis End-to-end Review Continued until 5pm ET, 3/15 133/18Concert Series Presentations: VA – Stephania Griffin and Mike Davis SSA – Marty Prahl N/A 14 3/25Standards Gap Analysis Continued Concert Series Presentation: TBD N/A 154/1Standards Gap Analysis Continued Pilots Phase Kickoff and Overview TBD N/A

6. Phase 1 - Timeline 6 Nov Dec Jan FebMar AprMayJunJulyAugSeptOctNov (Today) Begin Pilot Work Kick Off Pilot Activities Use Case Working Group Kick Off Session Conduct Pilots Needs Assessment Review and development of formal use cases Develop Best Practices IG Draft Basic Choice Standard

7. Concert Series Presentations 7

8. Patient Choice: Presentation to the Community 18 March 2016 John “Mike” Davis VHA Security Architect Mike.davis@va.gov Stephania Griffin VHA Director Information Access and Privacy Stephania.griffin@va.gov

9. VETERANS HEALTH ADMINISTRATION | Office of Informatics and Analytics VA Environment (As-Is) Governed by FISMA, PA, HIPAA, 38USC7332… Authorization Required for all TPO sharing under eHx and SSA (Coverage). Electronic Consent Directive (Authorization + Pre-Approved Restrictions) – Access through three VA portals – Must have access to “Premium Account” – Includes Veteran electronic signature and VA Notarization – One active CD for any period (currently 5yrs, changing to 10yrs) Pre-approved Restrictions – Currently limited to Organizational Restrictions

10. VETERANS HEALTH ADMINISTRATION | Office of Informatics and Analytics Veteran Informed Consent VA takes extensive measures to ensure Veterans understand their rights so that they can make informed consent to participate. See VA prototype clickable consent directive: VA online clickable consent directive

11. VETERANS HEALTH ADMINISTRATION | Office of Informatics and Analytics Gain Authorization at External Partners (POU=Treatment) Partner has copy of VA’s blanket Authorization, VA Form 10- 0485 Patient is already correlated – Uses VA internal identifier – Establishes authority for exchange Partner sends Authorization to VA with Request/Request for Docs Updated Authorization replaces current version held by VA

12. VETERANS HEALTH ADMINISTRATION | Office of Informatics and Analytics To-Be: Opt-in/Opt-Out Proof of Concept/Legislative Relief 12 Share millions of records, Eliminate paperwork bottlenecks, Reduce Veteran/VA burden. <200K shareable records As-Is To-Be A VA proof of concept which uses DS4P techniques to distinguish records containing 38USC7332 protected conditions (requiring authorizations) from those that are not sensitive and do not require an authorization. Success of the PoC offers the possibility to make millions of records shareable which today is limited to less than 200,000. VA is simultaneously seeking legislative relief to allow sharing without Authorization for treatment purposes only.

13. VETERANS HEALTH ADMINISTRATION | Office of Informatics and Analytics 13

14. VETERANS HEALTH ADMINISTRATION | Office of Informatics and Analytics 14

15. VETERANS HEALTH ADMINISTRATION | Office of Informatics and Analytics VA SDO Involvement in standards used to collect, manage and enforce veteran consent directives XSPA SAML/XACML for Requester authentication and consent directive rules for ACS incl exchange of Consent Directives HL7 for conceptual models [PASS Audit/Access Control/Trust/Obligations/Security Labeling Services, S&P DAM, SP Ontology, HCS, RBAC/ABAC Catalog] used to drive implementable standards: Consent Directive, DS4P, DPROV CDA IGs – including enhanced privacy constraints on IHE metadata standards used by Exchange and Direct exchange protocols FHIR Consent Directive, Security Labels, AuditEvent, and Provenance as components that can be orchestrated into Consent Directive Management systems 15

16. eHealth Exchange and the Social Security Patient Authorization March 18, 2016

17. SSA Background Over 3 million initial disability applications a year Over 15 million requests for medical evidence each year (3-4 medical records per case) 500,000 sources: doctors, hospitals, etc SSA is not a HIPAA covered entity Require a patient’s authorization to obtain medical records Initial Federal Agency on the eHealth Exchange – 2009 (formally called the Nationwide Health Information Network (NwHIN) Exchange) 17

18. Authorized Release of Information to a Trusted Entity Use Case Detailed Use Case Scenario – Social Security Administration requests medical documentation from a healthcare provider with the patient’s authorization 18 Claimant SSA/DDS Providers File Disability Claim Request Evidence Claim Determination Medical Evidence Patient Authorization There are a number of stakeholders that require a patient authorization. This is not unique to Social Security Administration.

19. SSA – 827 (Patient Authorization) Requestor Responder Purpose Effective Date Effective Timeframe Type of Information Requested Signed 19

20. eHealth Exchange Specifications & Standards Content Structure – HL7 CDA Release 2 CCD – HITSP C32 – HITSP C62 – Unstructured Documents (pdf, txt, doc, tif, jpg, gif, png) Vocabulary & Code Sets – ICD-9-CM – Systematized Nomenclature of Medicine--Clinical Terms (SNOMED-CT) – Logistical Observation Identifiers names and Codes (LOINC) 20 Consent Structure – IHE Basic Patient Privacy Consents – Patient Authorization is encoded a CDA document Transport and Security – Messaging Platform – Authorization Framework – Patient Discovery – Query for Documents – Retrieve Documents – Access Consent Policy – Leverages HITSP TP20 & TP30

21. eHealth Exchange Exchange Transaction Flow 21 Patient Authorization Clinical Documents Responding organization obtains the patient authorization and determines the extent of their response based their policies (HIPAA, State Regs, local policies, consents and authorizations)

22. Security Assertion Subject ID - MEGAHIT Subject Organization - Social Security Administration Subject Organization ID - 2.16.840.1.113883.3.184 Subject Role - SNOMED-CT (106328005) – Social Worker Purpose of Use - Coverage Patient Identifier – encoded per the eHealth Exchange Authorization Framework specification 22

23. Authorization Decision Statement eHealth Exchange uses a Authorization Decision Statement to allow an entity to assert the requester should be permitted to execute the transaction based on a specific security policy Access Consent Policy and Authorization Framework specifications define the format of the policy 23

24. Access Consent Policy XDS Metadata XDS MetadataValue availabilityStatusurn:oasis:names:tc:ebxml-regrep:StatusType:Approved classCode57016-8 (LOINC) classCode DisplayNamePrivacy Policy Acknowledgement confidentialityCodeN (Normal) formatCodeurn:ihe:iti:bppc-sd:2007 formatCode codeSystem1.3.6.1.4.1.19376.1.2.3 healthcareFacilityTypeCode385432009 (SNOMED CT code for Not Applicable) mimeTypetext/xml practiceSettingCode385432009 (SNOMED CT code for Not Applicable) serviceStartTimeEffective start date of privacy policy (authorization) serviceStopTimeEffective end date of privacy policy (authorization) TitleAUTHORIZATION TO DISCLOSE INFORMATION TO THE SOCIAL SECURITY ADMINISTRATION 24

25. Questions 25

26. Next Steps Next week: Continue Discussing Standards Gap Analysis Next meeting is Friday, March 25 th, 2016 at 11 am ET Reminder: All Patient Choice Announcements, Schedules, Project Materials, and Use Case will be posted on the Patient Choice Confluence page »http://confluence.siframework.org/display/PATCH/http://confluence.siframework.org/display/PATCH/ 26

27. Project Contact Information OCPO-ONC LeadJeremy MaxwellJeremy.Maxwell@hhs.gov Project CoordinatorJohnathan Colemanjc@securityrs.com Project ManagerAli KhanAli.Khan@esacinc.com Project SupportTaima GomezTaima.Gomez@esacinc.com Staff SMEKathleen Connorklc@securityrs.com Staff SMEDavid Staggsdrs@securityrs.com 27

28. @ONC_HealthIT@HHSONC Thank you for joining!