Authorized Release of Information to a Trusted Entity and the NwHIN Exchange July 11, 2012

SSA Background Over 3 million initial disability applications a year Over 15 million requests for medical evidence each year (3-4 medical records per case) 500,000 sources: doctors, hospitals, etc SSA is not a HIPAA covered entity Require a patients authorization to obtain medical records Initial Federal Agency on the Nationwide Health Information Network (NwHIN) Exchange 2

SSA and the NwHIN Exchange 3 August, Partnered with Beth Israel Deaconess Medical Center to build a prototype February, Partnered with MedVirginia, a Health Information Exchange, to become the first to exchange medical information over the NwHIN Exchange February, contracts awarded to medical networks and providers using Recovery Act funds to expand the health IT project to 13 states – Recovery Act partners in production, pilots with VA / DoD and Kaiser Permanente, and targeted recruitment of new partners and expansion of existing In 2012, we will continue efforts to expand out to new partners for Social Securitys health IT initiative

Where are we today 4 Partners in Production: Beth Israel Deaconess Medical Center MedVirginia / MedVirginia Centra Oregon Community Health Information Network EHR Doctors Douglas County Individual Practice Association Marshfield Clinic Inland Northwest Health Services Community Health Information Collaborative Wright State University HealthBridge LCF/New Mexico Health Information Collaborative Regenstrief / Indiana Health Information Exchange Southeastern Michigan Health Association Production Locations: In Production in : VA/DoD Pilot Kaiser Permanente Pilot Additional Partners SSA receives health IT data from 13 states with additional plans of expansion Partners in Production Partners Pending Production

Authorized Release of Information to a Trusted Entity Use Case Use Case Scenario – Social Security Administration requests medical documentation from a healthcare provider with the patients authorization 5 Claimant SSA/DDS Providers File Disability Claim Request Evidence Claim Determination Medical Evidence Patient Authorization

SSA – 827 (Patient Authorization) Requestor Responder Purpose Effective Date Effective Timeframe Type of Information Requested Signed 6

NwHIN Specifications & Standards Content Structure – HL7 CDA Release 2 CCD – HITSP C32 – HITSP C62 – Unstructured Documents (pdf, txt, doc, rtf, tif, jpg, gif, png) Vocabulary & Code Sets – ICD-9-CM – Systematized Nomenclature of Medicine--Clinical Terms (SNOMED-CT) – Logistical Observation Identifiers names and Codes (LOINC) 7 Consent Structure – IHE Basic Patient Privacy Consents Transport and Security – Messaging Platform – Authorization Framework – Web Services Registry – Patient Discovery – Query for Documents – Retrieve Documents – Access Consent Policy

NwHIN Exchange Transaction Flow 8 Patient Authorization Clinical Documents

Standards per Transaction #Transactions Vocabulary & Code Set Content & Structure Transport & Security Access Services Cross Functional 11. Patient Discovery Request Messaging Platform Authorization Framework Patient Discovery Web Services Registry NwHIN Exchange 2 Access Consent 3. Query for Documents Request 4. Query for Documents Response LOINC Messaging Platform Authorization Framework Query for Document Access Consent Policy Web Services Registry NwHIN Exchange 3 Access Consent 5. Retrieve Document Request 6. Retrieve Document Response IHE BPPC Messaging Platform Authorization Framework Retrieve Document Access Consent Policy Web Services Registry NwHIN Exchange 48. Patient Discovery Response Messaging Platform Authorization Framework Patient Discovery Web Services Registry NwHIN Exchange 5 Clinical Document 9. Query for Documents Request 10. Query for Documents Response LOINC Messaging Platform Authorization Framework Query for Document Web Services Registry NwHIN Exchange 6 Clinical Document 11. Retrieve Document Request 12. Retrieve Document Response ICD-9-CM SNOMED-CT LOINC HL7 CCD HITSP C32 & C62 Unstructured Documents (pdf, txt, doc, rtf, tif, jpg, gif, png) Messaging Platform Authorization Framework Retrieve Document Web Services Registry NwHIN Exchange 9

SAML Security Assertion Subject ID - MEGAHIT Subject Organization - Social Security Administration Subject Organization ID Subject Role - SNOMED-CT ( ) – Social Worker Purpose of Use - Coverage Patient Identifier – encoded per the NwHIN Authorization Framework specification 10

Authorization Decision Statement NwHIN Exchange uses a Authorization Decision Statement to allow an entity to assert the requester should be permitted to execute the transaction based on a specific security policy Access Consent Policy and Authorization Framework specifications define the format of the policy 11

Access Consent Policy XDS Metadata XDS MetadataValue availabilityStatusurn:oasis:names:tc:ebxml-regrep:StatusType:Approved classCode (LOINC) classCode DisplayNamePrivacy Policy Acknowledgement confidentialityCodeN (Normal) formatCodeurn:ihe:iti:bppc-sd:2007 formatCode codeSystem healthcareFacilityTypeCode (SNOMED CT code for Not Applicable) mimeTypetext/xml practiceSettingCode (SNOMED CT code for Not Applicable) serviceStartTimeEffective start date of privacy policy (authorization) serviceStopTimeEffective end date of privacy policy (authorization) TitleAUTHORIZATION TO DISCLOSE INFORMATION TO THE SOCIAL SECURITY ADMINISTRATION 12

Questions 13

For Further Information Contact – Marty Prahl – Tom Davidson – Bob Hastings 14

Reference Materials NwHIN Exchange Technical Specifications (all of the specifications can be found at Patient Discovery (requestor only) - ry_Production_Specification_v2_0.pdf ry_Production_Specification_v2_0.pdf Query for Documents (requestor only) - entsProductionSpecification_v3_0.pdf entsProductionSpecification_v3_0.pdf Retrieve Documents (requestor only) - ents_Production_Specification_v3_0.pdf ents_Production_Specification_v3_0.pdf Access Consent Policy (responder only) - oliciesProductionSpecification_v1_0.pdf oliciesProductionSpecification_v1_0.pdf Core Capabilities that support the above transactions Messaging Platform - rmProductionSpecification_v3_0.pdf rmProductionSpecification_v3_0.pdf Authorization Framework - meworkProductionSpecification_v3_0.pdf meworkProductionSpecification_v3_0.pdf 15