Connecting Health and Care for the Nation: A Shared Nationwide Interoperability Roadmap – DRAFT Version 1.0 Joint FACA Meeting Chartese February 10, 2015

Shared Nationwide Interoperability Roadmap Overview of the Process and Timeline Initial roadmap development FACA review and recommendations Roadmap released for public comment Nationwide Interoperability Roadmap Version 1.0 Q2/Q3 2015

Why Interoperability? Significant progress in digitizing the care experience Consumers increasingly expect and demand real-time access to their electronic health information Evolving delivery and payment models are not only driving appropriate data sharing, but depend on it Successes and promising practices exist and can be built on Technology is rapidly evolving Opportunities to improve care and advance science in a learning health system environment demand rapid action First, we have made significant progress in digitizing the care experience such that there is now data to be shared. Second, consumers increasingly expect and demand real-time access to their electronic health information.  Third, evolving delivery and payment models are driving appropriate data sharing.  Fourth, best practice models of information exchange and interoperability across the nation indicate it is possible to achieve. Fifth, technology is evolving in ways that will greatly simplify the challenge. Sixth, opportunities to improve care and advance science in a learning health system environment demand rapid action

DRAFT Shared Nationwide Interoperability Roadmap - Version 0.5 The Vision 2015 - 2017 Nationwide ability to send, receive, find, use a common clinical data set 2018 - 2020 Expand interoperable data, users, sophistication, scale 2021 - 2024 Broad-scale learning health system What are we trying to achieve?

Principle-based Interoperability

Functional and Business Requirements for a Learning Health System Core technical standards and functions Consistent data formats and semantics Consistent, secure transport technique(s) Standard, secure services Accurate identity matching Reliable resource location Certification to support adoption and optimization of health IT products and services 6. Stakeholder assurance that health IT is interoperable Privacy and security protections for health information 7. Ubiquitous, secure network infrastructure 8. Verifiable identity and authentication of all participants 9. Consistent representation of permission to collect, share, and use identifiable health information 10. Consistent representation of authorization to access health information 1. Consistent Data Formats and semantics: Common formats (as few as necessary to meet the needs of learning health system participants) are the bedrock of successful interoperability. Systems that send and receive electronic health information generate these common formats themselves or with the assistance of interface engines or intermediaries (e.g., HIOs, clearinghouses, third-party services.) The meaning of electronic health information must be maintained and consistently understood as it travels from participant to participant. Systems that send and receive information may or may not store standard values natively and therefore may rely on translation services provided at various points along the way. 2. Standard, secure services: Services should be modular, secure and standards-based wherever possible. 3. Consistent, secure transport technique(s): Interoperability requires transport techniques that are vendor-neutral, easy to configure and widely and consistently used. The fewest number of protocols necessary to fulfill the needs of learning health system participants is most desirable. 4. Accurate identity matching: Whether aggregated in a repository or linked "just in time," electronic health information from disparate sources must be accurately matched to prevent information fragmentation and erroneous consolidation. As a learning health system evolves, more than individual/patient-specific information from health records will be matched and linked, including provider identities, system identities, device identities and others to support public health and clinical research. 5. Reliable resource location: The ability to rapidly locate resources, including individuals, APIs, networks, etc. by their current or historical names and descriptions will be necessary for a learning health system to operate efficiently. 6. Stakeholder assurance that health IT is interoperable: Stakeholders that purchase and use health IT must have a reasonable assurance that what they are purchasing is interoperable with other systems. 7. Ubiquitous, secure network infrastructure: Enabling an interoperable, learning health system requires a stable, secure, widely available network capability that supports vendor-neutral protocols and a wide variety of core services. 8. Verifiable identity and authentication of all participants: Legal requirements and cultural norms dictate that participants be known, so that the context and access to data and services is appropriate. This is a requirement for all individual and organizational participants in a learning health system regardless of role (individual/patient, provider, technician, hospital, health plan, etc.) 9. Consistent representation of permission to collect, share, and use identifiable health information: Though legal requirements differ across the states, nationwide interoperability requires a consistent way to represent an individual's permission to share their electronic health information, including with whom and for what purpose(s). 10. Consistent representation of authorization to access health information: When coupled with identity verification, this allows consistent decisions to be made by systems about access to electronic health information. 11. A supportive business and regulatory environment that encourages interoperability: Rules that govern how health and care is paid for must create a context in which interoperability is not just philanthropic, but is a good business decision. 12. Individuals are empowered to be active managers of their health: A learning health system is person-centered, enabling individuals to become active partners in their health by not only accessing their electronic health information, but also providing and managing electronic health information through mobile health, wearable devices and online services. 13. Care providers partner with individuals to deliver high value care: Providers work together with patients to routinely assess and incorporate patient preferences and goals into care plans that achieve measurable value for the individual and the population. 14. Shared governance of policy and standards that enable interoperability: Nationwide interoperability across the diverse health IT ecosystem will require stakeholders to make collective decisions between competing policies, strategies, standards in a manner that does not limit competition. Maintaining interoperability once established will also require ongoing coordination and collaborative decision-making about change Supportive business, clinical, cultural, and regulatory environments 11. A supportive business and regulatory environment that encourages interoperability 12. Individuals are empowered to be active managers of their health 13. Care providers partner with individuals to deliver high value care Rules of engagement and governance 14. Shared governance of policy and standards that enable interoperability

Supportive Business, Clinical, Cultural, and Regulatory Environments Shared Nationwide Interoperability Roadmap Draft v1.0 Supportive Business, Clinical, Cultural, and Regulatory Environments Supportive Business and Regulatory Environment: New models of care reward providers for outcomes, help create an environment where interoperability makes business sense HHS announcement: 30 percent Medicare fee-for-service payments in alternative payment models by the end of 2016 50 percent of payments by the end of 2018 90 percent tied to quality by 2018 Requirements for participants in these new models can reinforce interoperability Other topics addressed in this section of the roadmap: Individuals are empowered to be active managers of their health Care providers partner with individuals to deliver high value care Alternative payment models include models such as Accountable Care Organizations (ACOs) and bundled-payment arrangements where health care providers are accountable for the quality and cost of the care they deliver to patients.

Supportive Business, Clinical, Cultural, and Regulatory Environments Shared Nationwide Interoperability Roadmap Draft v1.0 Critical Actions for Near Term Wins Supportive Business, Clinical, Cultural, and Regulatory Environments Federal govt: Link policy and funding activities beyond MU to adoption and use of certified health IT and electronic information sharing according to national standards Example of current: DoD EHR RFP Example for the future: CMS conditions of participation State govt: “call to action” to use available levers and Medicaid purchasing power to expand upon existing efforts to support interoperability and explore new options Non govt payers/purchasers: “call to action” to explore financial incentives and other ways to emphasize the interoperable exchange of health information among provider networks Public and private sector actors can encourage interoperable health IT, through new incentives to adopt and use interoperable health information systems to create additional demand for interoperability. Public and private sector actors can also explore requirements/penalties that raise the costs of not moving to interoperable systems. Example of current: DoD EHR RFP requires ONC certification, robust interface strategy for devices and external data trading partners, open systems architecture Example for the future: CMS conditions of participation and/or survey and certification required for Medicare reimbursement could be updated to include electronic exchange of clinical data for safe transitions in care when consistent with clinical and safety statutory requirements

Rules of Engagement and Governance

Rules of Engagement and Governance Shared Nationwide Interoperability Roadmap Draft v1.0 Rules of Engagement and Governance Proliferation of data sharing arrangements has created many different processes and rules for interoperability that do not facilitate interoperability nationwide Achieving nationwide interoperability will require a single governance framework and process to facilitate trust and agreement on policy, operation, and standards issues Governance framework and associated rules of the road should address: Policy Operations Standards Proliferation of health information networks, HIEs, and other data sharing arrangements has created many different processes and rules for interoperability that do not facilitate interoperability nationwide Policy Access to Personal Health Information Individual Control Transparency Security Individual Access and Correction Operations Open Exchange Standards

Rules of Engagement and Governance Shared Nationwide Interoperability Roadmap Draft v1.0 Critical Actions for Near Term Wins Rules of Engagement and Governance ONC: establish a common governance framework with rules of the road for interoperability of a common clinical data set ONC: identify a process for recognizing organizations that comply with the rules of the road Evaluating regulatory and certification options Public and Private Stakeholders: establish a single coordinated governance process • The proliferation of health information networks, HIEs, and other data sharing arrangements has created many different processes and rules for interoperability that do not facilitate interoperability nationwide • To get to nationwide interoperability, there must be agreement on the policies, operations and technical standards that will enable trust and allow information to be shared appropriately across the ecosystem • ONC is committed to establishing a governance framework for nationwide interoperability, including overarching rules of the road (for purposes of treatment in the near term, expanding to additional purposes over the long term) • ONC is also committed to identifying a method for recognizing the organizations that comply with the rules and hold them accountable for continuing to do so • ONC is evaluating regulatory options for this as well as how to leverage its certification program • We are calling industry to action to establish a public/private process for addressing implementation and/or operational-level issues that must be resolved to advance interoperability nationwide Public and Private Stakeholders: establish a single coordinated governance process to establish more detailed policies regarding implementation of the rules of the road and business practices, and to identify the technical standards that will enable interoperability for specific use cases

Privacy and Security Protections for Health Information

Privacy and Security Protections for Health Information Shared Nationwide Interoperability Roadmap Draft v1.0 Privacy and Security Protections for Health Information Permission to Collect, Use, and Disclose Identifiable Health Information: Legal requirements for health information sharing are philosophically aligned, but differ in content across states Nationwide interoperability requires a consistent way to represent an individual's permission to collect, share, and use their individually identifiable health information Software systems need to capture and persist both written individual permission and what is permitted without written individual permission (computable privacy) Other topics addressed in this section of the roadmap: Ubiquitous, secure network infrastructure Verifiable identity and authentication of all participants Consistent representation of authorization to access data or services This difficulty is because systems don't know what to adjudicate as the variation makes it hard to consistently identify yes/on vs no/off items and that is how computers analyze things. Legal requirements for health information sharing are philosophically aligned, but differ in content across states Nationwide interoperability requires a consistent way to represent an individual's permission to collect, share, and use their individually identifiable health information, including with whom and for what purpose(s) in a mobile population that crosses state lines for care, or for telemedicine Variation in rules makes it difficult to build software systems that accurately capture, maintain, and persist this data Software systems need to capture and persist both written individual permission and what is permitted without written individual permission (computable privacy)

Privacy and Security Protections for Health Information Shared Nationwide Interoperability Roadmap Draft v1.0 Critical Actions for Near Term Wins Privacy and Security Protections for Health Information OCR and ONC: Educate stakeholders on current federal laws Federal and state govt: Reach consensus on what is permissible to exchange (use & disclosure) for TPO without consent for information that is regulated by HIPAA (referred to as “background rules” in the roadmap) Standardize existing laws pertaining to "sensitive" health information, so that laws mean the same thing in all U.S. jurisdictions, without undermining the privacy protections individuals have today Stakeholders broadly: Align organizational policies for information sharing regulated by HIPAA with HIPAA permitted uses and disclosures for TPO, and actively share health information in accordance with the law HIPAA is our operating framework for achieving the 3 year goal – we make no assumption about that context changing, and focus instead on how to effectively enable nationwide interoperability within it.

Core Technical Standards and Functions Certification and Testing to Support Adoption and Optimization of Health IT Products and Services

Core Technical Standards and Functions Shared Nationwide Interoperability Roadmap Draft v1.0 Core Technical Standards and Functions Health Information must be properly standardized, packaged, and securely transported in order for meaning to be retained across systems and to be parsed and displayed in useful ways.  Topics addressed in this section of the roadmap: Consistent data formats and semantics Consistent, secure transport techniques Secure, standard services Accurate individual data matching Reliable resource location

Core Technical Standards and Functions Shared Nationwide Interoperability Roadmap Draft v1.0 Critical Actions for Near Term Wins Core Technical Standards and Functions Technical Standards: ONC: publish annual list of best available technical standards for core interoperability functions Stakeholders broadly: Tightly define a common clinical data set C-CDA data provenance RESTful APIs Individual Data Matching: SDOs and stakeholders: standardize the minimum individual attributes to be used for matching Technical Standards: ONC: publish annual list of best available technical standards for core interoperability functions Stakeholders broadly: Tightly defining a common clinical data set to achieve semantic interoperability Constrain implementation of the C-CDA Advance standards for data provenance at the document and data element level Advance standard, open RESTful APIs to support simple, scalable interoperability Individual Data Matching: SDOs and stakeholders: standardize the minimum recommended data elements that should be consistently included in all queries for individual clinical health information and used to link individual clinical health information from disparate systems

DRAFT Shared Nationwide Interoperability Roadmap - Version 0.5 Building Blocks Certification and Testing to Support Adoption and Optimization of Health IT Products and Services Stakeholders who purchase and use health IT need reasonable assurance that what they are purchasing is interoperable with other systems. Certification is designed to provide confidence to stakeholders without the expertise to individually evaluate whether a product meets specific requirements. Topics addressed in this section of the roadmap: Certification Ongoing testing Erica

DRAFT Shared Nationwide Interoperability Roadmap - Version 0.5 Critical Actions for Near Term Wins Certification and Testing to Support Adoption and Optimization of Health IT Products and Services ONC: improve rigor of certification program and reach to health IT used in additional care settings ONC and federal partners: Continue to develop and provide testing tools for ONC HIT certification program Stakeholders broadly: Accelerate suite of testing tools that can be used pre and post-implementation Help identify gaps and provide feedback to ONC regarding certification criteria Erica

Summary & Next Steps

Tracking Progress and Measuring Success Using existing data sources and measures in the near term Working with Julia Adler-Milstein on better measures and data sources

Public Comment on the Roadmap January 30, 2015 through April 3, 2015 Public comments can be submitted at http://www.healthit.gov/policy-researchers-implementers/interoperability-roadmap-public-comments FACA workgroups will be reviewing key sections of the Roadmap

FACA Workgroup Assignments Workgroups Roadmap Assignments HITPC Advanced Health Models and Meaningful Use Appendix H – Use Case Prioritization Consumer C. Individuals are empowered to be active managers of their health D. Care providers partner with individuals to deliver high value care Interoperability & Health Information Exchange M. Accurate Identity Matching N. Reliable Resource Location Privacy and Security G. Consistent representation H. Consistent representation of authorization to access health information HITSC Architecture, Services & APIs Secure, standard services Consistent, secure transport techniques Implementation, Certification & Testing I. Stakeholder assurance that technology can interoperate (Testing semantic interoperability) Content Standards J. Consistent Data Formats and Semantics Semantic Standards Transport and Security Standards E. Ubiquitous, secure network infrastructure F. Verifiable identity and authentication of all participants Not assigning these sections to a WG: Governance Measurement Policy levers