1. Accelerating and Sustaining EHR Innovations Wednesday, May 7, 2014 Seong K. Mun, PhD President and CEO OSEHRA

2. Innovation and Ecosystem “Why great innovations fail: It's all in the Ecosystem” 2 JASON Report* “EHRs should not be things that one buys, but rather things that evolve through cultural change aided by technology” *A Robust Health Data Infrastructure JASON Report: November 2013 Forbes-2012 The Wide Lens: A New Strategy for Innovation By Ron Adner of Dartmouth

3. Open Source EHR Ecosystem Community Software Governance 3

4. “Greatness on your part is not enough. You are no longer an autonomous innovator. You are now an actor within a broader innovation ecosystem. Success in a connected world requires that you manage your dependence. But before you can manage your dependence, you need to see it and understand it. ” Innovation Strategy is Organic to OS Operations 4 The Wide Lens: A New Strategy for Innovation By Ron Adner of Dartmouth CommunityGovernance Software

5. I. Managing Vulnerability II. Scheduling Contest III. Managing Code IV. Product Management & Tools V. Code Transparency VI. Sustained Innovation VistA Innovation Areas 5

6. M2M Broker Vulnerability discovered by Georgia Tech grad student Doug Mackey on 7/31 Work under NDA – VA, IHS – DSS, Medsphere, iCare, Oroville NDA lifted Mid-October Coordination with VA for release Code Convergence Effort Eventual FOIA Release I: Managing Vulnerability 6

7. Two Security Models 7 Open source operating systems such as Android & Linux offer the ability to implement security policies down to the kernel level. Complete Control of Implementation OPEN SOURCE Partial Control of Implementation TRUST US TRUST US PROPRIETARY

8. Goals: – Knowledge Gathering exercise – Risk reduction for future RFP and Acquisition Overview: Two Phases – Phase 1: Evaluate level of integration and compatibility with open source VistA. – Phase 2: Evaluate broad features and functionalities II: VA MASS* Scheduling Contest 8 *Medical Appointment Scheduling System

9. America Competes Act Identify Solutions to Replace Medical Scheduling Package – Possibly with Open Source OSEHRA Tested Submissions for VistA Interoperability and Open Source Content 3 Winners Future Activity – Under Discussion Contest Implementation 9

10. VA701-14-I-0147 SOURCES SOUGHT Office of Health Informatics and Analytics (OIA) VistA Evolution Program (VEP) Challenges with Competition and Prizes VistA Evolution 10

11. Proprietary Products Proprietary Products Ecosystem Open and Proprietary 11 Open Community Activities Open Community Activities OS Products

12. III: Managing Code Managed – Code subject to formal review/certification – Changes reviewed and subject to configuration management – Examples: FOIA VistA, OSEHRA VistA Hosted – Code placed into repository by community – Storage and retrieval only – Could be certified – Could be incorporated into managed code base 12

13. Managed Code Submission Path VistA Patch Repositor y Approval Gerrit Review Managed Code Submission Instrumented VistA Instance Dashboard Forum Community Notification OSEHRA Technical Journal New Code Submission VistA-M Repository VistA-M Repository Automated Tool OSEHRA VistA Reference Instance FOIA VistA Reference Instance FOIA VistA Reference Instance Github Github and Gitorious MirrorsMirrors MirrorsMirrors Mirrors 13

14. Open Source Software Repositories 14 Generic Repositories OSEHRA Repositories Tools

15. Improves/ensures the quality of Open Source code Critical to making code reusable for code intake by the community NOT a replacement for acceptance, integration, or regression testing by new user organization Open Source Software Quality Certification 15

16. Usable: Appropriate licensing and documentation Safe: Individual code units do not cause errors in other components of the system and the code is robust to all code paths and conditions Compliant: Code meets agreed upon interface specifications and code conventions, and complies with all applicable laws and regulations Functional: Code has a defined set of requirements that are met when the code executes Maintainable: Integral unit tests are provided to facilitate regression testing OSEHRA Certification Standard 16

17. Certification Levels 17 Name/ Number Space Dependency / SAC Open Source License DocumentationCode Review Test Installation Regression Testing Functional Testing Level 1 Pass Apache 2None Large # Non- critical Issues Existing Tests Pass Large # Non- critical Issues Level 2 Pass Apache 2Basic Small # Non- critical Issues Existing + Some R. Tests Small # Non- critical Issues Level 3 Pass Apache 2SubstantialNo Issues Existing + >= 50% Coverage No Issues Level 4 Pass Apache 2All RequiredNo Issues Existing + >= 90% Coverage No Issues Level 1 is reserved for VistA legacy code. Levels 2-4 are growing certification compliance. For new code developed under VA contracts, OESHRA recommends a minimum certification level of Level 3.

18. IV: Product Management & Tools 18 VIVIAN Visualizing VistA and Name Space

19. Root view from VIVIAN “Collapse All” option. Clicking the “VistA” button expands the tree... 19

20. ...Now we see several categories of capabilities. (We can scroll down to view the ones that aren’t now visible.) We’ll select “Provider Services”... 20

21. ...and that subtree comes into view. Now we select “Order & Results Management”... 21

22. ...now we see the Order & Results Management capabilities. 22

23. When we click on “Order Entry Results Reporting”... 23

24. We see the namespaces of the M routines and globals that the package uses. (The leading exclamation points designate partial namespaces that are excluded.) 24

25. A “Dependencies & Code View” hyperlink lets us see lists of dependencies, globals, Fileman files and M routines... 25

26. The Dependencies window includes a hyperlink to package documentation in the Vista Documentation Library. 26

27. When we scroll further down the Dependencies window, we see a list of routines. Order Entry Results Reporting has over 1,000 routines! We can select a routine... 27

28. ...to get a screen of routine information and dependencies. A “Source Code” hyperlink can be clicked... 28

29. ...to get a view of the M source code. 29

30. Back on the modal window, an Interfaces frame contains hyperlinks to M APIs, Remote Procedure Calls, Web Service APIs, and HL7 messages. 30

31. The M API link lets us see all of the entry points in M code that have been documented for database integration agreements. 31

32. Here we see the routine names, tags, and additional descriptive information that is displayed for M-language application programmer interfaces. 32

33. We can click a hyperlink to see all of the remote procedure calls that the package provides through the VistA RPC Broker. 33

34. The Remote Procedure Call view shows RPC names, tags, routines, and availability within the VA Enterprise. 34

35. Another hyperlink lets us see all the package’s web services that can be invoked through VA’s MDWS (Medical Domain Web Services). 35

36. The Web Services view lists web service names, facades, parameter and descriptive information. We can select a web service... 36

37. ...to get descriptions and sample syntax for all the operations that the web service supports. 37

38. The last hyperlink in the modal window’s “Interfaces” frame lets us get a list of supported HL7 Version 2 messages. 38

39. V: Code Transparency 39

40. Transparency Enables Innovation ACCELERATE ADOPT Leverage Previous Investment ADAPT Re- Purpose Re-Architect INNOVATE New Solutions Continuous Innovation 40 Community Actors OS EHR ACCELERATE

41. OSEHRA Today 2,400+ Individual Members around the Globe 13 Corporate Members, 3 Collaborative Partners Approximately 15 staff members Headquartered in Arlington, Virginia Annual Budget: App. $5 Million 41

42. VistA is Deployed World-Wide 42

43. Working Group Roster 43 Group NameTypeGroup NameType Academic AffiliatesWork GroupInteroperabilityWork Group ArchitectureWork GroupM2M Code IntakeOpen Source Project Group CertificationWork GroupMDWSOpen Source Project Group Code ConvergenceWork GroupOpen AHLTA Project Group Open Source Project Group Development ToolsDiscussion GroupPatient-Centered CareWork Group EducationWork GroupProduct ManagementOpen Source Project Group Fileman and Lab Agile Project (FLAP) Open Source Project GroupReminders VAWork Group ForumOpen Source Project GroupVistA DialectsWork Group GenomicsOpen Source Project GroupVistA Evolution CITEDiscussion Group ImagingWork GroupVistA NovoOpen Source Project Group ImmunizationOpen Source Project GroupVisualizationOpen Source Project Group

44. Sustaining Innovation 44 Key IssuesOS Approach I. Vulnerability Security during collaboration Temporary security via NDA until patch available II. Contest: Scheduling Evaluation Criteria Collaborative definition of OS code quality Requirement for Open APIs III. Managing Code Adapt/Adopt Contribution Licensing Certification Standard VI. Product Management Architecture Open APIs Governance V. Code Transparency Finding code Sharing code and interfaces Communication and Collaboration Maximum exposure to submitted code OS Licensing

45. Industry Feeling Limits in Closed Code – Apple vs Dominance of Android – Closed Systems Embracing OS Methods – Spectacular Success of Netflix Main Challenges Today – Ownership vs. Sharing – Control vs. Open Innovation – Community Management State of Open Source 45

46. Where do we stand among our peers? Ad Hoc Opinion Leaders Single Moderator Committee- Based Commercial Support Members Only Closed Strong Copyleft Weak Copyleft Non- Copyleft Permissive License Governance Model (how contributions are managed and accepted) Linux Kernel Firefox Eclipse Android OSEHRA GENIVI Openstack The Foundation The Apache Foundation WHO DECIDES? - Courtesy of MARK RADCLIFF 46

47. Open Global Collaboration Total Transparency in Software 47 www.osehra.org