“Jericho / UT Austin Pilot” Privacy with Dynamic Patient Review April 16, 2013 Presented by: David Staggs, JD, CISSP Jericho Systems Corporation

204/16/2013 Agenda Administrative issues User stories Review and approval of notional diagram of expected data flow Scope and goal of the pilot (add extension with actual VUID for third party requests?) (Optional) Extended data flow for third party requests Questions from the Audience POA&M user stories and requirements documents Call for new members Summary

304/16/2013 Pilot Administrivia This pilot is a community led pilot –Limited support provided by the ONC Apurva Dharia (ESAC) Jeanne Burton (Security Risk Solutions) Melissa Springer (HHS) In conjunction with DS4P bi-weekly return of an All Hands meeting Access to DS4P Wiki, teleconference, and calendar Meeting times: Tuesdays 11AM (ET) –Dial In: Access code: URL: d= d=

404/16/2013 User Stories Requestor makes request to a provider for patient data on eHealth Connect Provider receives request from eHealth Connect for patient information, retrieves PCD from PCD repository and applies, returns status to PCD repository PCD repository receives request for PCD from eHealth Connect partner, returns PCD, accepts status from AC decision PCD repository receives request for new account from healthcare consumer, possibly involving providers PCD repository allows management of PCD from healthcare consumer Healthcare consumer manages PCD from PCD repository account, views AC status reports

504/16/2013 Data Flow Expected Patient’s Provider Patient PCD Repository 2 nd Requestor Requestor   B ,  = Clinical data A,B = PCD data = reporting

604/16/2013 Scope of the Pilot 1. Define the exchange of HL7 CDA-compliant PCD between a PCD repository and a provider evaluating an access control request that includes a report on the outcome of the request back to the healthcare consumer. 2. Additional goal: use of identifiers that can uniquely identify the healthcare consumer and PCD repository used to report the outcome of the request back to the healthcare consumer by healthcare consumer’s provider and subsequent EHR custodians. 3. Stretch goal: use of the PCD repository as a proxy allowing direct authentication by the healthcare consumer to the provider, subsequently reducing correlation errors.

704/16/2013 Secondary Goals of the Pilot Exchange and enforce privacy metadata to ensure proper policy- based disclosure and redisclosure of PHI Accept and display reports from information owners on access control decisions for requests for the patient’s PHI Create a token passing scheme that facilitates secondary use reporting Demonstrate dynamic reporting of access to a patient’s PHI and their ability to change their PCD using their PCD central repository

804/16/2013 Available Roles Holder of PHI that is participating on the eHealth Exchange –Accepts eHealth Exchange compliant request –Retrieves PCD and reports result of request –Synthetic Patient Data is Available Requester of PHI that is participating on the eHealth Exchange –Makes eHealth Exchange compliant request Repository holding subject’s Patient Consent Directive (PCD) –Transmits PCD to trusted eHealth Exchange requesters –Accepts policy created by subject of shared PHI –Passes HL7-compliant PCD –Displays result of the request transmitted from holder of PHI

904/16/2013 Questions? For example: How long will this take? What level of commitment is expected?

10 Plan of Action Upon agreement of the participants the POA is Identify the elements available from previous DS4P pilots Scope level of effort, decide on extended scenario Review standards available for returning information on requests Determine gaps or extensions required in standards Create XDS.b repository holding PCD Stand up information holders and requestors Identify remaining pieces Document and update IG with results of our experience 04/16/2013

11 Call for Pilot Team Members 04/16/2013 NameRoleOrganization David StaggsParticipantJericho Systems Corporation Michael FieldParticipantUT Austin HIT Lab

1204/16/2013 DS4P References Use Case: ases ases Implementation Guide: nsensus nsensus Pilots Wiki Page: +Pilots+Sub-Workgroup +Pilots+Sub-Workgroup