1. eHealth Information: Federal Activities and Implications for State Policy Susan M. Christensen Senior Advisor CSG Health Policy Forum On Mental Health Care and Wellness May 31, 2006

2. Overview Terminology – Getting on the Same Page Terminology – Getting on the Same Page Federal Landscape Federal Landscape AHRQ AHRQ Privacy and Trust Privacy and Trust Resources Resources Legal Issues Legal Issues Appendix: Case Study – Legal Issues Appendix: Case Study – Legal Issues

3. Terminology: HIE v. HIT No longer just about putting electronic medical records in hospitals No longer just about putting electronic medical records in hospitals  Electric health information systems across all care settings, as well as payers  Linking them together – interoperability for health information exchange (HIE) For HIE, communities and states (and some regions) are developing networked systems For HIE, communities and states (and some regions) are developing networked systems To do this, it’s not just about investing in the technology (HIT) ; we must research how to do so in a way that To do this, it’s not just about investing in the technology (HIT) ; we must research how to do so in a way that  Maximizes the value we hope to realize – clinically, economically, and for population health  Assures that security and privacy protections are “baked into” HIE

4. HIE Policy Issues In addition, a new market is being created, with all the technical and policy issues that entails, such as In addition, a new market is being created, with all the technical and policy issues that entails, such as  Standards for data exchange  Assuring consumer participation and patient protections  Security concerns  New business arrangements, new relationships  Disconnect between payment systems and new relationships/care delivery models

5. What’s the situation?

6. Federal Leadership President’s Executive Order 13335 (April 2004) – federal leadership for the development of a nationwide interoperable electronic health information system: Created Office of the National Coordinator for Health Information Technology in HHS (ONC) Created Office of the National Coordinator for Health Information Technology in HHS (ONC) ONC is required to develop a national strategic plan to support: ONC is required to develop a national strategic plan to support:  Public-private collaboration to develop, adopt and implement standards  Evaluate benefits of HIT  Address privacy and security issues ONC serves as principal advisor to Secretary on national HIT policy, coordinates federal activities, and coordinates public- private outreach and consultation ONC serves as principal advisor to Secretary on national HIT policy, coordinates federal activities, and coordinates public- private outreach and consultation

7. NOW WORKGROUPS COMMUNITY ONC INFRASTRUCTURE 2005 2004 FHA Strategic Plan Health IT Policy Council Established NHIN RFI Summary Health IT Strategic Framework JUL MARSEPOCT JAN FEB MAR...DEC Interoperable Electronic Healthcare Records Community Established Review Workgroup Recommendations 20072014 2006 GOALS Make Recommendations to the Community Workgroups Established Contracts Awarded ONC Health IT Roadmap To-Date Recommendations for: Biosurveillance Consumer Empowerment Chronic Care Electronic Healthcare Records 2006 Strategic Plan NHIN Architectures Standards Implementation Guidance Ambulatory Care Certification Criteria Recommendations Report to the Secretary of HHS

8. Four Major HHS Contracts HHS has entered into four significant contracts: http://www.hhs.gov/healthit/contracts.html Harmonize industry-wide health IT standards (ONC) Harmonize industry-wide health IT standards (ONC) Develop a conformance certification process for health IT (ONC) Develop a conformance certification process for health IT (ONC) Assess and develop plans to address variations business policies and state laws related to privacy and security (AHRQ) Assess and develop plans to address variations business policies and state laws related to privacy and security (AHRQ) Four contracts to develop nationwide health information network (NHIN) prototypes that can be used to test specialized network functions, security protections and monitoring, and demonstrate feasibility of scalable models (ONC) Four contracts to develop nationwide health information network (NHIN) prototypes that can be used to test specialized network functions, security protections and monitoring, and demonstrate feasibility of scalable models (ONC)

9. Agency for Healthcare Research and Quality (AHRQ) Mission To improve the quality, safety, efficiency, and effectiveness of health care for all Americans

10. Research at HHS: Where Does AHRQ Fit In? NIH -- basic biomedical bench research and “efficacy” clinical trials NIH -- basic biomedical bench research and “efficacy” clinical trials AHRQ -- “effectiveness” of healthcare services and the healthcare delivery system AHRQ -- “effectiveness” of healthcare services and the healthcare delivery system CDC -- the public health system and community-based interventions CDC -- the public health system and community-based interventions Other federal partners – CMS (Medicare and Medicaid), HRSA (capital and resources, workforce), and ONC (collaboration and coordination on health IT)

11. Intersection of Safety, Quality and Health IT AHRQ Support diffusion of HIT to 41 states 40 million Americans Improve medication safety CMS e-prescribing demos Provide HIT technical support to safety net Community health centers Critical access hospitals Public hospitals Privacy and Security

12. Focus on Adoption of Health IT AHRQ’s work focuses on the marriage of Health IT systems with the way work is done in health care AHRQ’s work focuses on the marriage of Health IT systems with the way work is done in health care Need to prepare for the impact of new Health IT systems Need to prepare for the impact of new Health IT systems  Health IT is “one part technical, and two parts culture and work process change.” Opportunity to design new and better workflows – and review work patterns that may never really have been examined. Opportunity to design new and better workflows – and review work patterns that may never really have been examined.

13. State and Regional HIT Demonstrations Five-year state-based contracts: Five-year state-based contracts:  Help states develop secure statewide networks  Ensure privacy of health information  Make an individuals’ health information more available to health care providers FY04: Five states awarded $1M/year FY04: Five states awarded $1M/year  Colorado  Indiana  Rhode Island  Tennessee  Utah  Delaware added in FY05

14. AHRQ National Resource Center for Health Information Technology Provides technical and expert support to health IT grantees, contractors, and selected other federal grantees (HRSA, CMS, IHS) Provides technical and expert support to health IT grantees, contractors, and selected other federal grantees (HRSA, CMS, IHS) Contract award to NORC (up to $18.5M over 5 years), in partnership with: Contract award to NORC (up to $18.5M over 5 years), in partnership with:  Vanderbilt University  Center for IT Leadership (Partners)  Indiana University  Foundation for the eHealth Initiative  CSC  Burness Communications healthit.ahrq.gov

15. Approaching the “Trust” Issue Why is this important to people? What are people thinking? What is the “threat”? Why is this important to people? What are people thinking? What is the “threat”? Can we break it down? Is HIPAA compliance enough? Why not? Can we break it down? Is HIPAA compliance enough? Why not? How to react? How to react? Who should be involved? Who should be involved? What message? What message? Guidance for leadership? Guidance for leadership?

16. “Trust” v. “Privacy” v. HIPAA Clarify the issues: HIPAA – legal requirement HIPAA – legal requirement Additional legal privacy requirements Additional legal privacy requirements  Federal  State  Contractual Privacy – common law, ethics, good business, protections beyond basic HIPAA compliance Privacy – common law, ethics, good business, protections beyond basic HIPAA compliance Trust – broader public concern about security and reliability Trust – broader public concern about security and reliability

17. Privacy and Security Contract In September 2005, AHRQ awarded “Privacy and Security Solutions for Interoperable Health Information Exchange” In September 2005, AHRQ awarded “Privacy and Security Solutions for Interoperable Health Information Exchange” Overall contract managed by RTI International in partnership with NGA Overall contract managed by RTI International in partnership with NGA 18-month period; $11.5 million 18-month period; $11.5 million RTI will subcontract with up to 40 states to: RTI will subcontract with up to 40 states to:  Identify within the state business practices that affect electronic health information exchange  Propose solutions and implementation plans  Collaborate on regional and national meetings to develop solutions with broader application Provide final report on overall project outcomes and recommendations Provide final report on overall project outcomes and recommendations

18. Contract Purposes Identify variations in organization-level business privacy and security policies and practices that affect electronic clinical health information exchange (HIE) Identify variations in organization-level business privacy and security policies and practices that affect electronic clinical health information exchange (HIE)  For those that are “best practices”, document and incorporate into proposed solutions  For those with a negative impact, identify source of the policy or practice and propose alternatives Preserve privacy and security protections as much as possible in a manner consistent with interoperable electronic health information exchange Preserve privacy and security protections as much as possible in a manner consistent with interoperable electronic health information exchange Incorporate state and community interests, and promote stakeholder identification of practical solutions and implementation strategies through an open and transparent consensus-building process Incorporate state and community interests, and promote stakeholder identification of practical solutions and implementation strategies through an open and transparent consensus-building process Leave behind in states and communities a knowledge base about privacy and security issues in electronic health information exchange that endures to inform future HIE activities Leave behind in states and communities a knowledge base about privacy and security issues in electronic health information exchange that endures to inform future HIE activities

19. Connecting for Health Common Framework A set of free resources: 16 policy guides and technical documents designed to advance HIE in a private and secure manner. A set of free resources: 16 policy guides and technical documents designed to advance HIE in a private and secure manner.  Technology neutral  Includes model contract language for HIE agreements The Common Framework puts forth a model of HIE that: The Common Framework puts forth a model of HIE that:  Protects patient privacy by allowing health information to remain under local control – avoiding the need for a large, centralized database or creation of a national patient ID  Avoids large-scale disruption and huge up-front capital investments by making use of existing hardware and software  Supports better informed policymaking around HIE  Establishes trust among collaborating organizations by applying well-vetted model contract language to fit their needs Series of activities to disseminate and provide education for how to use: AHRQ website, teleconferences, workshops Series of activities to disseminate and provide education for how to use: AHRQ website, teleconferences, workshops healthit.ahrq.gov and www.connectingforhealth.org healthit.ahrq.gov and www.connectingforhealth.org

20. Vanderbilt Center for Better Health Model Developed workshop design to explore trust issues, come to consensus, and make recommendations or develop workplan for moving forward Developed workshop design to explore trust issues, come to consensus, and make recommendations or develop workplan for moving forward  Goal: state/community controls the process and the outcome  Statewide: used principles in CFH model as kickoff for discussion about privacy and trust among stakeholders in disparate HIEs across state  Another new statewide initiative: used workshop to do concrete planning for both technology and governance in new HIE http://www.volunteer- ehealth.org/AHRQ/12142005/index.htm http://www.volunteer- ehealth.org/AHRQ/12142005/index.htm http://www.mc.vanderbilt.edu/vcbh/ds/0606_privacy/ http://www.mc.vanderbilt.edu/vcbh/ds/0606_privacy/ Working with AHRQ to make the workshop “portable” Working with AHRQ to make the workshop “portable”

21. Differing Approaches – Legal Issues Recognize that one approach, i.e., legislation, is not appropriate for every issue Recognize that one approach, i.e., legislation, is not appropriate for every issue  Federal legislation and mandates  National or regional consensus  Model state laws  State innovation through demonstrations or regulation  Model contracts  Private agreements Coordinate among initiatives; use them in combination Coordinate among initiatives; use them in combination

22. Summary Communities can and should make their own choices about HIE Communities can and should make their own choices about HIE The decision process on policies and implementation is as much a part of the solution as the technology The decision process on policies and implementation is as much a part of the solution as the technology Call on national initiatives for what they can offer to save money and accelerate the process Call on national initiatives for what they can offer to save money and accelerate the process

23. http://healthit.ahrq.gov For additional information: Susan Christensen susan.christensen@ahrq.hhs.gov

24. Case Study – One State Workgroup of stakeholders assumed time frame two years hence Workgroup of stakeholders assumed time frame two years hence Identified potential key legal, regulatory, and policy areas that could still be of concern as regional health information exchange implementation progresses Identified potential key legal, regulatory, and policy areas that could still be of concern as regional health information exchange implementation progresses Stratified issues by national, regional, local or private in nature (i.e., best resolved at what level to be most effective?), and split them into technical and non-technical categories Stratified issues by national, regional, local or private in nature (i.e., best resolved at what level to be most effective?), and split them into technical and non-technical categories Identified proposed approach: legislation, rule-making, consensus, private agreement, or some combination Identified proposed approach: legislation, rule-making, consensus, private agreement, or some combination Model legislation would be appropriate for many of the consensus issue areas, except data and communication standards Model legislation would be appropriate for many of the consensus issue areas, except data and communication standards

25. Technical Issues Issue Area NationalRegional/StatePrivate Data and communication standards Adopted at the national level; potential public/ private collaboration for identification; mandatory for Medicare to drive take-up; common standards identified for Medicaid Adopted for Medicaid by state programs Participation in identification and incorporation into product Safety standards for items like drugs and devices SameSameSame Standards enforcement Enforcement by regional exchanges as requirement for use; possibly mandatory for Medicaid Certification Requirements and administration/enforceme nt at regional level; possibly mandatory for Medicaid Bioterrorism/ defense systems Developed and funded federally Portions developed and funded at state/regional level in collaboration with federal efforts

26. Non-Technical Issues Issue Area NationalRegional/StatePrivate Research on HIT policy, standards and value Funding, dissemination and oversight; demonstrations Funding and adoption Payment reforms Medicare payment reform; Medicaid reform; FEHBP contracts Adopt Medicaid reforms; SCHIP and employee coverage reforms Pay for performance and IT utilization Startup funding Tax incentives, loans, grants, and demonstrations Licensure for health professionals Leader in developing standardized content that supports information exchange Adoption and enforcement of licensure rules Professional organization and payer support of “model” rules Liability protections/ accountability Leader in developing standardized content Adoption and enforcement Underserved populations Model legislation that supports interoperability Outreach, funding and enforcement

27. HIE Structure Issue Area NationalRegional/StatePrivate Governance/ structure Leadership in developing standardized options that support regional health information exchange State option to adopt by statute or rulemaking Private agreements can supplement or reflect state option, or may be stand-alone in absence of state action Responsibility/ accountability Leadership in developing standardized options that support regional health information exchange and interoperability State option to adopt by statute or rulemaking Taxing authority Leadership in developing options that support regional health information exchange State option to adopt by statute Funding authority Leadership in developing options that support regional health information exchange State option to adopt by statute or rulemaking Private agreements can supplement or reflect state option, or may be stand-alone in absence of state action Liability Leadership in developing standardized content to support interoperability State option to adopt by statute