1. Mark Flotow Chief, Illinois Center for Health Statistics NAPHSIS President

2. Mission Statement To provide national leadership and advocacy on behalf of its members to ensure the quality, security, confidentiality, and utility of vital records and health statistics as well as their integral role with health information systems, for monitoring and improving public health. To provide national leadership and advocacy on behalf of its members to ensure the quality, security, confidentiality, and utility of vital records and health statistics as well as their integral role with health information systems, for monitoring and improving public health.

3. NAPHSIS Board of Directors President: Mark Flotow, Illinois President: Mark Flotow, Illinois President Elect: Jennifer Woodward, Oregon President Elect: Jennifer Woodward, Oregon Past President: Isabelle Horon, Maryland Past President: Isabelle Horon, Maryland Treasurer: Bruce Cohen, Massachusetts Treasurer: Bruce Cohen, Massachusetts Secretary: Kelly Baker, Oklahoma Secretary: Kelly Baker, Oklahoma Member at Large: Judy Moulder, Mississippi Member at Large: Judy Moulder, Mississippi Member at Large: Rich McCoy, Vermont Member at Large: Rich McCoy, Vermont Member at Large: Lou Saadi, Kansas Member at Large: Lou Saadi, Kansas Member at Large: Linette Scott, California Member at Large: Linette Scott, California

4. NAPHSIS Committees Board of Directors Board of Directors Annual Meeting Annual Meeting Audit Audit Awards Awards By-laws By-laws Communications Communications Cost Cost eHealth eHealth EVVE EVVE Innovations Innovations International & Territorial Affairs International & Territorial Affairs Inter-jurisdictional Exchange ( incl. STEVE) Inter-jurisdictional Exchange ( incl. STEVE) Membership Membership Nominating Nominating Past Presidents Past Presidents Registration Registration Research Proposal Review Research Proposal Review Resolutions Resolutions Security Security Statistics Statistics Training Training

5. NAPHSIS Projects State VSCP Contracts/NCHS State VSCP Contracts/NCHS EVVE EVVE Data Cleaning Tool Data Cleaning Tool STEVE /IJE STEVE /IJE Model Law Workgroup* Model Law Workgroup* Cause of Death e-learning Cause of Death e-learning Technical Assistance Technical Assistance Re-engineering EBRs / EDRs Re-engineering EBRs / EDRs Business Process Improvement Business Process Improvement * recently completed Security Guide + FEWS Security Guide + FEWS Vital Statistics Standards Vital Statistics Standards Monthly Webinars Monthly Webinars Web Training Resource Web Training Resource Statistical Definitions Statistical Definitions Reviews of researcher data requests to NCHS Reviews of researcher data requests to NCHS International Consulting International Consulting

6. NAPHSIS Committees Board of Directors Board of Directors Annual Meeting Annual Meeting Audit Audit Awards Awards By-laws By-laws Communications Communications Cost Cost eHealth eHealth EVVE EVVE Innovations Innovations International & Territorial Affairs International & Territorial Affairs Inter-jurisdictional Exchange ( incl. STEVE) Inter-jurisdictional Exchange ( incl. STEVE) Membership Nominating Past Presidents Registration Research Proposal Review Resolutions Security Security Statistics Training

7. NAPHSIS Security Guide

8. Challenges to Vital Records Systems 9/11 Impact on reform -- heightened public awareness The Move toward Intelligence Reform The Move toward Intelligence Reform Certificate Filing and Review Certificate Filing and Review Out-of-Institution Births Out-of-Institution Births Delayed Certificate Filing Delayed Certificate Filing Application Processing and Verification of Identity Application Processing and Verification of Identity Open vs. Closed Records Open vs. Closed Records Who is applying? Who is applying? Is identification required and is it valid? Is identification required and is it valid? Is the applicant entitled? Is the applicant entitled? Identity Theft Identity Theft Internal Security Internal Security Physical Security Physical Security Paper Security Paper Security Personnel Personnel

9. Motion 2006 – 01 To promote an awareness and commitment to national security by... Each jurisdiction designates a security coordinator,Each jurisdiction designates a security coordinator, Each jurisdiction adopts nationally-developed best practices,Each jurisdiction adopts nationally-developed best practices, NAPHSIS adopts these best practices as a standard and designates a security coordinator, andNAPHSIS adopts these best practices as a standard and designates a security coordinator, and The NAPHSIS security coordinator serves as a focal point among jurisdictional security coordinators to establish and promote uniformity of security procedures.The NAPHSIS security coordinator serves as a focal point among jurisdictional security coordinators to establish and promote uniformity of security procedures.

10. Intelligence Reform& Terrorism Prevention Act - 2004 SEC. 7211. MINIMUM STANDARDS FOR BIRTH CERTIFICATES. 3(A) at a minimum, shall require certification of the birth certificate by the State or local government custodian of record that issued the certificate, and shall require the use of safety paper or an alternative, equally secure medium, the seal of the issuing custodian of record, and other features designed to prevent tampering, counterfeiting, or otherwise duplicating the birth certificate for fraudulent purposes; (D) may not require a single design to which birth certificates issued by all States must conform;

11. Why a NAPHSIS Security Guide? To meet NAPHSIS Motion 2006-1 To meet NAPHSIS Motion 2006-1 Intelligence Reform & Terrorism Prevention Act (IRTPA) of 2004 Regulations (pending) Intelligence Reform & Terrorism Prevention Act (IRTPA) of 2004 Regulations (pending) Supplement the Model Act Supplement the Model Act Establish uniformity among jurisdictions Establish uniformity among jurisdictions

12. Foundation of the Security Guide Model State Vital Statistics Act and Regulations Model State Vital Statistics Act and Regulations 1992 revision currently 1992 revision currently 2011 revision pending approval 2011 revision pending approval State/Jurisdictional Best Practices State/Jurisdictional Best Practices Intel Reform Workgroup Recommendations Intel Reform Workgroup Recommendations Input from Contributors Input from Contributors

13. Model State Vital Statistics Act (+) (+) Uniformity Among Jurisdictions: Registration of Vital Events Registration of Vital Events Disclosure of Information Disclosure of Information Amendments or Corrections Amendments or Corrections Security Features Security Features Penalties Penalties (-) Not mandated Influenced by States’ Rights Lacks legislative attention Cost may become a factor

14. Contributors to the Security Manual National Center for Health Statistics (NCHS) National Center for Health Statistics (NCHS) Dept. of State - Passport Services Dept. of State - Passport Services Dept. of Homeland Security - Forensic Labs Dept. of Homeland Security - Forensic Labs NAPHSIS Corporate Sponsors - Technical NAPHSIS Corporate Sponsors - Technical Document Security Alliance (DSA) Document Security Alliance (DSA) North American Security Products Association- (NASPO) North American Security Products Association- (NASPO) AAMVA – DMVs (Motor Vehicle Administration) AAMVA – DMVs (Motor Vehicle Administration)

15. Security Manual Contents Delayed and Out-of- Institution Birth Delayed and Out-of- Institution Birth Access to Vital Records Access to Vital Records Birth Certification Document Birth Certification Document Issuance Procedures Issuance Procedures Physical Security Measures Physical Security Measures Amendment/Correction Amendment/Correction Topics include... Security Coordinator Guidelines Security Paper, Records/Data, & Money Vendors Personnel Training Record Retention

16. Section 2 Access to Vital Records Vital records should be closed to the public Vital records should be closed to the public Restrict access to eligible requestors Restrict access to eligible requestors All employees required to sign confidentiality statements All employees required to sign confidentiality statements Government officials must present identification and written assurance the use is for official business Government officials must present identification and written assurance the use is for official business Maintain fraud activity files Maintain fraud activity files Standardized application Minimum set of biographic identifiers Requestor should provide proof of identity All birth records issued at local level should be from a central data base or image system Non-restricted vital records (e.g., 100 yrs birth, 50 yrs death)

17. Section 3 Birth Certification Document Four layers of security Four layers of security Overt, covert, and forensic features Overt, covert, and forensic features Certification Document should be provided or approved by State Registrar Certification Document should be provided or approved by State Registrar Security awareness Security features comparison chart Paper and printers: Printing in USA Level of security Supply chain Review product

18. Physical Security Measures Access Control Devices Access Control Devices Who has keys? Where are they? Who has keys? Where are they? Badges, pass cards, other access devices Badges, pass cards, other access devices General Access Questions General Access Questions Who has access? Who has access? Staff Safety Staff Safety Are your counter staff safe? Are your counter staff safe?

19. Physical Security Measures Surveillance Surveillance Who does your security? Who does your security? Procedures in place to report intruders? Procedures in place to report intruders? Fire, Smoke, Water, Alarms and Notification Systems Fire, Smoke, Water, Alarms and Notification Systems Are the systems in place? Do they have regular maintenance? Are the systems in place? Do they have regular maintenance? Are there emergency drills? Are there emergency drills? Disaster Preparedness/Business Continuity Disaster Preparedness/Business Continuity Do you have a comprehensive disaster plan? Do you have a comprehensive disaster plan? Are records backed up off-site? Are records backed up off-site?

20. Additional Topics for Guidelines Physical Security Measures (recently completed) Physical Security Measures (recently completed) Destruction of Original Records and Other Documents Containing Confidential and Sensitive Information (in progress) Destruction of Original Records and Other Documents Containing Confidential and Sensitive Information (in progress) Amendments/Corrections Amendments/Corrections Fee Accounting Fee Accounting Security Training and Personnel Security Training and Personnel Local Registrars and Satellite Offices Local Registrars and Satellite Offices Fraud Awareness Fraud Awareness

21. What is the Process for the Security Guidelines? Initial Draft crafted and reviewed by the Security Committee Initial Draft crafted and reviewed by the Security Committee Draft sent to the NAPHSIS Board of Directors Draft sent to the NAPHSIS Board of Directors Revised Draft sent to the Membership Revised Draft sent to the Membership Comments and additions reviewed Comments and additions reviewed Section made available on the NAPHSIS Website (for members only!) Section made available on the NAPHSIS Website (for members only!)

22. The NAPHSIS Security Guide: additional considerations... An Internal Document - not available to public An Internal Document - not available to public A Living Document - continually changed and updated as best practices, technology, regulations, etc. evolve A Living Document - continually changed and updated as best practices, technology, regulations, etc. evolve May require a State or jurisdiction to change laws and regulations May require a State or jurisdiction to change laws and regulations May need to be revised once 2011 Revised Model Act is adopted May need to be revised once 2011 Revised Model Act is adopted

23. What Else Is NAPHSIS Doing? EVVE EVVE Electronic Verification of Vital Events STEVE STEVE S tate and Territorial Exchange of Vital Events Model Act Partnering with NCHS to revise 1992 version (Workgroup mission completed) Fraud Early Warning System (FEWS) In conjunction with motor vehicle partners and law enforcement

24. Fraud Early Warning System (FEWS)

25. FEWS is... A secure system for reporting discovered fraudulent activities among the jurisdictions and with other government agencies A secure system for reporting discovered fraudulent activities among the jurisdictions and with other government agencies Administered by the American Association of Motor Vehicle Administrators (AAMVA) Administered by the American Association of Motor Vehicle Administrators (AAMVA) Functioning successfully Functioning successfully NAPHSIS now included in this system NAPHSIS now included in this system Funded and owned by the Federal Motor Carrier Safety Administration Funded and owned by the Federal Motor Carrier Safety Administration

26. FEWS Features A secure database system (i.e., not e-mail) consisting of Incidents, Alerts and Updates A secure database system (i.e., not e-mail) consisting of Incidents, Alerts and Updates Post fraud alerts and receive instant notifications Post fraud alerts and receive instant notifications Cross-referencing of incidents Cross-referencing of incidents Post photos and document examples Post photos and document examples No cost to jurisdictions No cost to jurisdictions Searchable Searchable Configurable by geography Configurable by geography Links to federal and association partners Links to federal and association partners

27. FEWS Timetable for NAPHSIS Initially, 8 states piloted for NAPHSIS (over two years) Initially, 8 states piloted for NAPHSIS (over two years) More than 10 additional jurisdictions have joined after a NAPHSIS invitation to the membership to join More than 10 additional jurisdictions have joined after a NAPHSIS invitation to the membership to join Training by AAMVA this month (October) for new participants and this new group will be part of the production whole in November or December Training by AAMVA this month (October) for new participants and this new group will be part of the production whole in November or December Goal is for all NAPHSIS jurisdictions to participate Goal is for all NAPHSIS jurisdictions to participate

28. Possible Enhancements or Uses for NAPHSIS FEWS Posting area for fraudulent death certificates Posting area for fraudulent death certificates List of suspicious addresses (e.g., get frequently used) List of suspicious addresses (e.g., get frequently used) Fraudulent registration activities or attempts to obtain a birth or death record Fraudulent registration activities or attempts to obtain a birth or death record Additional points... Certain information can be viewed only by Law Enforcement officials but there is no access by private entities Certain information can be viewed only by Law Enforcement officials but there is no access by private entities No access to Canadian jurisdictions for us in the USA No access to Canadian jurisdictions for us in the USA

29. Inter-Jurisdiction Exchange of Vital Records Information

30. The Challenge When a child is born in another state, who has responsibility for follow up? When a child is born in another state, who has responsibility for follow up? Getting birth information from another jurisdiction can be slow and unpredictable Getting birth information from another jurisdiction can be slow and unpredictable Residence jurisdiction may not get birth record, or it may be delayed Residence jurisdiction may not get birth record, or it may be delayed Residence jurisdiction has to re-distribute fact of birth information to its own programs and agencies Residence jurisdiction has to re-distribute fact of birth information to its own programs and agencies Critical interventions may be missed or delayed Critical interventions may be missed or delayed

31. Introducing STEVE – State and Territorial Exchange of Vital Events A secure messaging system for vital records exchange between jurisdictions and with other public health programs and agencies A secure messaging system for vital records exchange between jurisdictions and with other public health programs and agencies 57 vital records jurisdictions will become STEVE trading partners 57 vital records jurisdictions will become STEVE trading partners Based on Inter-jurisdictional Exchange Agreement administered by NAPHSIS Based on Inter-jurisdictional Exchange Agreement administered by NAPHSIS Automates and standardizes exchange process Automates and standardizes exchange process Improvement over current system of paper copies, abstracts and line lists Improvement over current system of paper copies, abstracts and line lists

32. What is Inter-jurisdictional Exchange? IJE File TypeFromTo Natality FileJurisdiction where birth occurred Jurisdictions of residence of newborns NCHS Roster File (short form death notice) Jurisdiction where death occurred Jurisdictions of birth of decedents For birth/death matching for fraud prevention Mortality File (sent twice, before and after coded cause) Jurisdiction where death occurred Jurisdictions of residence of decedents NCHS Fetal Death FileJurisdiction where fetal death occurred Jurisdictions of residence of patients NCHS ITOP (Induced Termination of Pregnancy) Jurisdiction where abortion occurred Jurisdictions of residence of patients

33. Standard IJE File Format Used for Exchange Uses standard flat file format Uses standard flat file format Five file types defined by IJE Committee Five file types defined by IJE Committee Natality Natality Mortality (includes cause of death literals and codes) Mortality (includes cause of death literals and codes) Roster (for birth/death matching) Roster (for birth/death matching) Fetal Death Fetal Death ITOP (induced terminations) – in development ITOP (induced terminations) – in development Marriage and divorce - future Marriage and divorce - future NCHS reportable data embedded within layouts NCHS reportable data embedded within layouts Data content of each file type is configurable by sender at the data element level Data content of each file type is configurable by sender at the data element level

34. Internet STEVE Transformation Modules (TMs) are installed at each jurisdiction for secure, point-to-point vital record exchange S Jurisdiction A’s TM Jurisdiction B’s TM IJE files

35. Receiving TM Vital Records Newborn Hearing Screening Immunization Child Support Enforcement Research If program mailboxes are set up by a jurisdiction, received IJE files are automatically delivered to them by the TM

36. When Is STEVE Coming? National rollout began in March 2009 National rollout began in March 2009 January 2014 deadline for implementation January 2014 deadline for implementation Until all jurisdictions are trading partners, STEVE will support alternate electronic record exchanges with non-participants Until all jurisdictions are trading partners, STEVE will support alternate electronic record exchanges with non-participants STEVE-ER implementation in 2011 in territories STEVE-ER implementation in 2011 in territories Each jurisdiction needs to have signed the IJE agreement Each jurisdiction needs to have signed the IJE agreement

39. Alaska California Idaho + Oregon Washington + Montana Wyoming + Utah Colorado Arizona New Mexico Texas Oklahoma Kansas Nebraska South Dakota North Dakota Minnesota Wisconsin Iowa Illinois Ohio Indiana Kentucky WV Virginia N. Carolina Georgia Florida Alabama MS Missouri Arkansas LA Nevada Hawaii Michigan Pennsylvania NJ New York CT MA VT NH Maine Tennesse e MD DE RI DC S. Carolina State and Territorial Exchange of Vital Events (STEVE) Implementation by Jurisdiction Updated August 2011 Installed In Preparation Puerto Rico Guam U.S. Virgin Islands American Samoa Northern Mariana Islands NYC + Sharing IJE Files without using STEVE Planning

40. Can Canadian Provinces and Territories Be Trading Partners in STEVE? Placeholders built into STEVE currently Placeholders built into STEVE currently File layout differences – at what level would such differences need to be “translated” or converted? File layout differences – at what level would such differences need to be “translated” or converted? Collection differences, such as race categories Collection differences, such as race categories Alternative: notification for fraud prevention purposes with a minimum of demographic characteristics for matching purposes (more than what is in current consular notices) Alternative: notification for fraud prevention purposes with a minimum of demographic characteristics for matching purposes (more than what is in current consular notices) Alternative: focus on border states and provinces/territories Alternative: focus on border states and provinces/territories

41. Other NAPHSIS Projects

42. Vital Statistics Standards Registration Registration Security Security Issuance Issuance Data Collection Data Collection Data Transmission Data Transmission Data Analysis and Release Data Analysis and Release Training Training Data and Record Preservation Data and Record Preservation Legal Authority Legal Authority

43. Alaska California Idaho Oregon Washington Montana Wyoming Utah Colorado Arizona New Mexico Texas Oklahoma Kansas Nebraska South Dakota North Dakota Minnesota Wisconsin Iowa Illinois Ohio Indiana Kentucky WV Virginia N. Carolina Georgia Florida Alabama MS Missouri Arkansas LA Nevada Hawaii Michigan Pennsylvania NJ New York CT MA VT NH Maine Tennessee MD DE RI DC S. Carolina EVVE Implementation – August 2011 New York City On-line with EVVE (34) Implementation in progress (11) Guam American Samoa Northern Mariana Islands Puerto Rico U.S. Virgin Islands

44. eHealth or Health Information Exchange huge interest from the states, cutting edge, future direction, etc. huge interest from the states, cutting edge, future direction, etc. new NAPHSIS committee new NAPHSIS committee may determine, ultimately, how VRs are viewed, even shaped, in the larger health world may determine, ultimately, how VRs are viewed, even shaped, in the larger health world VRs in the USA are both civil registration and health VRs in the USA are both civil registration and health Looking at possible technical solutions, reviewing national standards documents, track jurisdictional pilots, provide communication to the membership Looking at possible technical solutions, reviewing national standards documents, track jurisdictional pilots, provide communication to the membership

45. “Merci beaucoup” for your attention and patience! Contact information: Mark Flotow Illinois Center for Health Statistics/IL Dept Public Health 525 West Jefferson Street Springfield, IL 62761 217.785.1064 mark.flotow@illinois.gov www.naphsis.org