1. 0 enabling healthcare interoperability 2009 Webinar Series Sponsored by the HITSP Education, Communications and Outreach Committee Presenters:Co-Chair & Facilitator - HITSP Security, Privacy and Infrastructure Technical Committee John Moehrke, GE Healthcare Johnathan Coleman, Security Risk Solutions, Inc. HITSP Service Collaborations for Privacy and Security Webinar #10 November 12, 2009 | 2:00 – 3:30 pm (Eastern)

2. Slide 1 HITSP – enabling healthcare interoperability 2009 Webinar Series Overview  Re-organization of HITSP’s Security, Privacy and Infrastructure constructs into a series of Service Collaborations — Leverage and reuse existing HITSP constructs — Align with the Health Information Technology (HIT) provisions of the American Recovery and Reinvestment Act of 2009 (ARRA).  Provide a simplified framework for HITSP’s ongoing activities, making future work products easier to understand and simpler to implement.

3. Slide 2 HITSP – enabling healthcare interoperability 2009 Webinar Series Learning Objectives  During this 90-minute webinar, participants will: — Understand the core concepts and components involved in HITSP’s Privacy and Security Service Collaborations, including Access Control, Security Audit, and Patient Identification Management. — Demonstrate how Privacy and Security Service Collaborations can support ARRA’s Meaningful Use, leveraging existing HITSP constructs and components. — Learn how to find, navigate, and use HITSP Service Collaborations documentation.

4. Slide 3 HITSP – enabling healthcare interoperability 2009 Webinar Series Agenda  What is ARRA and HITECH?  HITSP Harmonization Framework - Introduction of new “building blocks” — Capabilities, Service Collaborations, A new HITSP approach  HITSP Service Collaborations In Action — Helping meet ARRA Meaningful Use Requirements  Conclusions  Questions and Answers

5. Slide 4 HITSP – enabling healthcare interoperability 2009 Webinar Series What is ARRA?  Also known as the “economic stimulus package”  Signed into law by President Obama on February 17, 2009 What is HITECH?  A portion of ARRA referred to as the Health Information Technology for Economic and Clinical Health (HITECH) Act — TITLE XIII—Health Information Technology — TITLE IV—Medicare and Medicaid Health Information Technology  Contains numerous provisions related to Health Information Technology (HIT) and privacy with aggressive timelines for completion

6. Slide 5 HITSP – enabling healthcare interoperability 2009 Webinar Series To Address ARRA Requirements, Tiger Teams Were Created with Specific Focus Areas  A new EHR Centric Interoperability Specification to meet ARRA requirements  Security, Privacy & Infrastructure  Quality Measures  Data Architecture (Element, Template, and Value Set)  Exchange Architecture and Harmonization Framework  Clinical Research Tiger Team membership 232 technical experts

7. Slide 6 HITSP – enabling healthcare interoperability 2009 Webinar Series Putting the Pieces Together  HITSP created IS’s to harmonize standards and make them implementable  Before HITSP, there was a “custom puzzle” to build for every organization to talk to another organization  HITSP used existing Interoperability Specification (IS) constructs to create reusable Capabilities and Service Collaborations

8. Slide 7 HITSP – enabling healthcare interoperability 2009 Webinar Series HITSP Glossary  Interoperability Specifications (IS) – Integration of all constructs used to meet business needs or the business needs specified in a Use Case Interoperability Specifications (IS) — Components (C) – Logical grouping of base and composite standards that work together, such as messaging and terminology Components (C) — Transactions (T) – Logical grouping of actions that use components and/or composite standards to realize the actions — Transaction Packages (TP) – Logical grouping of transactions  Capability (CAP) – Specifies a business service that an EHR system addresses and specifies the contents and secure infrastructure needed for that business service  Service Collaboration (SC) – Defines a standards-based secure infrastructure needed for interoperable information exchanges and includes a secure transport mechanism with topology and other options regardless of content Service Collaboration (SC)

9. Slide 8 HITSP – enabling healthcare interoperability 2009 Webinar Series Standards “Real World” examples of Base and Composite Standards  XML (base)  IHE-XDS (composite)  HL7-CCD (base)  DICOM (base)  LOINC (base)  SNOMED-CT (base)  NCPDP-Script (composite)  etc. Base Standard  capable of fulfilling a discrete function Composite Standards  groupings of coordinated base standards Examples  Basic Specifications  Implementation Guides  Code Sets and Terminologies

10. Slide 9 HITSP – enabling healthcare interoperability 2009 Webinar Series Meeting Business Needs  Capabilities and Collaborations could be used to build any new Interoperability Specification to meet a particular business need

11. Slide 10 HITSP – enabling healthcare interoperability 2009 Webinar Series Two New HITSP Puzzle Pieces this Year Capabilities Service Collaborations

12. Slide 11 HITSP – enabling healthcare interoperability 2009 Webinar Series HITSP Capabilities  Enable systems to address a business need for interoperable information exchange  Bridge between business, policy and implementation views: — Define a set of information exchanges at a level relevant to policy and business decisions — Support stakeholder requirements and business processes — Define information content and secure infrastructure — Specify use of HITSP constructs sufficiently for implementation — Include constraints and identify specific network topologies Created To Simplify Design and Use of HITSP Specifications for ARRA Efforts and Beyond

13. Slide 12 HITSP – enabling healthcare interoperability 2009 Webinar Series What We Mean by Harmonization Framework

14. Slide 13 HITSP – enabling healthcare interoperability 2009 Webinar Series HITSP Service Collaborations HITSP Constructs Components, Transactions, Transaction Packages Base and Composite Standards HITSP Capabilities Building a HITSP Capability

15. Slide 14 HITSP – enabling healthcare interoperability 2009 Webinar Series Type 1: Base or Composite Standards Capability Complete Set Service Collaborations Pre-packaged groups of Component, Transaction and/or Transaction packages ALL working together to achieve an exchange purpose. Constructs 1.Components one base or composite standard 2.Transaction Construct two or more base or composite standards 'packaged' together 3.Transaction Packages Two or more Transaction constructs 'packaged' together Capability Pre-packaged combinations of Service Collaborations and/or Constructs (Components, Transactions, Transaction Packages) Working ALL together ALWAYS to achieve an exchange purpose Standards Underlying “DNA” of ALL HITSP Products

16. Slide 15 HITSP – enabling healthcare interoperability 2009 Webinar Series Base and Composite Standards Constructs Component, Transaction, or Transaction Packages Capabilities Service Collaborations Service Collaborations and Capabilities in Action

17. Slide 16 HITSP – enabling healthcare interoperability 2009 Webinar Series Multiple Capabilities = Interoperability Specification Interoperability Specification

18. Slide 17 HITSP – enabling healthcare interoperability 2009 Webinar Series Capabilities and Service Collaborations Allow Us to Develop New Technical Constructs As Needed

19. Slide 18 HITSP – enabling healthcare interoperability 2009 Webinar Series HITSP Capabilities

20. Slide 19 HITSP – enabling healthcare interoperability 2009 Webinar Series SPI Capabilities SPI Capabilities

21. Slide 20 HITSP – enabling healthcare interoperability 2009 Webinar Series HITSP Service Collaborations

22. 21 IS documents/Workflows EHR Centric IS ????? All other ISxxx Transactions (e.g. T29) Transactions (e.g. T29) Transaction Packages (e.g. TP30) Transaction Packages (e.g. TP30) Component (e.g. C26) Constructs Specified in Service Collaboration Service Collaborations Constructs as needed by the SC e.g. TP20, T15, T16, T17 Constructs as needed by the SC e.g. TP20, T15, T16, T17 Constructs as needed by the SC e.g. TP20, T15, T16, T17 Constructs as needed by the SC e.g. TP20, T15, T16, T17 Constructs as needed by the SC e.g. TP20, T15, T16, T17 Constructs as needed by the SC e.g. TP20, T15, T16, T17 SC108: Access Control SC109: Security Audit SC110: Patient Identification Management SC111: Knowledge And Vocabulary SC111: Knowledge And Vocabulary SC112: Healthcare Document Management SC112: Healthcare Document Management SC113: Query for Existing Data SC113: Query for Existing Data SC114: Administrative Transport to Health Plan SC114: Administrative Transport to Health Plan SC115: HL7 Messaging SC116: Emergency Message Distribution SC116: Emergency Message Distribution SCxxx: Future SCs SCxxx: Future SCs Task 2: SPI Service Collaboration Suite

23. Slide 22 HITSP – enabling healthcare interoperability 2009 Webinar Series Putting it all together Security Privacy

24. Slide 23 HITSP – enabling healthcare interoperability 2009 Webinar Series Exchange a prescription with an Ambulatory or Long-Term Care Organization What Is an Example of a Capability?  Requirement: Hospital wants to exchange a discharge prescription with an patient’s physician’s office. — This diagram shows how Capability (CAP) 117 was assembled to support this requirement using Transaction, Transaction Package and Service Collaboration T40 T42 TP43 TP46 SC114 T40 T42 TP43 TP46 SC114 CAP117 – Communicate Ambulatory and Long Term Care Prescription System Roles Medication Order Prescriber Medication Order Filler Health Plan Health Information Exchange

25. Slide 24 HITSP – enabling healthcare interoperability 2009 Webinar Series SC114 – Administrative Transport to Health Plan TP46 – Medication Formulary and Benefits Information TP46 – Medication Formulary and Benefits Information TP43 – Medication Orders Example: Capability 117 CAP117 – Communicate Ambulatory and Long Term Care Prescription T42 – Medication Dispensing Status T40 – Patient Health Plan Eligibility Verification PHARMACYPHARMACY  Requirement: Hospital wants to exchange a discharge prescription with an patient’s physician’s office.

26. Slide 25 HITSP – enabling healthcare interoperability 2009 Webinar Series Service Collaborations (SC)  Defines a standards-based secure infrastructure needed for interoperable information exchanges.  Includes a secure transport mechanism with topology and other options.  Uses HITSP Constructs to specify the secure infrastructure.  Does not specify the content of the information exchange but may include information to support the exchange (e.g., authorization information) Additional Keys to Simpler Definition and Implementation of HITSP Specifications

27. Slide 26 HITSP – enabling healthcare interoperability 2009 Webinar Series Service Collaboration – An Essential Component

28. Slide 27 HITSP – enabling healthcare interoperability 2009 Webinar Series SC109 - Security Audit Collaboration T15 - Collect and Communicate Security Audit Trail T16 - Consistent Time SC108 - Access Control Service Collaboration Example: Service Collaboration 114 SC114 – Administrative Transport to Health Plan H E A L T H PLAN C19 - Entity Identity Assertion (Optional) T17 - Secured Communication Channel TP20 - Access Control TP30 - Manage Consent Directives T85 - Administrative Transport to Health Plan T17 - Secured Communication Channel Provider

29. Slide 28 HITSP – enabling healthcare interoperability 2009 Webinar Series Binds content definition with secure infrastructure for a set of interoperable information exchanges How It All Fits Together

30. Slide 29 HITSP – enabling healthcare interoperability 2009 Webinar Series The Refined HITSP Harmonization Framework HITSP Capabilities Component Service Collaborations Service Collaboration Transaction Constructs Transaction Transaction Package SDOs = Standards Development Organizations

31. Slide 30 HITSP – enabling healthcare interoperability 2009 Webinar Series Exchange Architectures HITSP Specifications apply to information exchanges indicated by arrows in the figure

32. Slide 31 HITSP – enabling healthcare interoperability 2009 Webinar Series SC #Service Collaboration Title InterfacesPrimary Associated Constructs Integrated S&P Constructs/ SCs SC108Access Control  Request Access Control TP20, TP30, C19, T17 SC109Security Audit  Send Security Audit Event T15, T16 SC110Patient Identification Management  Request Patient Identification T23, TP22, T24SC108, SC109, T17 SC111Knowledge and Vocabulary  Request Medical Knowledge  Respond Medical Knowledge  Request Value-Set  Respond Value-Set T81 and T66T17 SC112Healthcare Document Management  Send Documents (dynamically choose method) o Send Documents Directly o Send Documents through email o Publish Documents through Media o Send Documents through Share o Publish Documents through Share  Receive Documents (dynamically choose method) o Receive Documents Directly o Receive Documents through email o Consume Documents through Media o Receive Documents through Share o Consume Documents through Share TP13, T31, T33, T29 SC108, SC110, SC109, T17, T64 SPI Service Collaboration Suite

33. Slide 32 HITSP – enabling healthcare interoperability 2009 Webinar Series SC #Service Collaboration Title InterfacesPrimary Associated Constructs Integrated S&P Constructs/ SCs SC113Query for Existing Data  Request Existing Patient Data  Respond Existing Patient Data TP21SC108, SC110, SC109, T17 SC114Administrative Transport to Health Plan  Request Administrative Response to Health Plan  Respond to Administrative Response to Health Plan T85SC108, SC110, SC109, T17 SC115HL7 Messaging  Request HL7 Message  Respond to HL7 Message HL7 v2.x MLLPSC108, SC109, T17 SC116Emergency Message Distribution Element  Send Emergency Message Distribution Element T63SC108, SC109, T17 SPI Service Collaboration Suite (continued)

34. Slide 33 HITSP – enabling healthcare interoperability 2009 Webinar Series Review of Selected Service Collaborations  SC108 – Access Control  SC109 – Security Audit  SC110 – Patient Identification Management  SC112 – Healthcare Document Management  SC113 – Query for Existing Data

35. Slide 34 HITSP – enabling healthcare interoperability 2009 Webinar Series Access Control – HITSP SC 108

36. Slide 35 HITSP – enabling healthcare interoperability 2009 Webinar Series Access Control – HITSP SC 108

37. Slide 36 HITSP – enabling healthcare interoperability 2009 Webinar Series Review of Selected Service Collaborations  SC108 – Access Control  SC109 – Security Audit  SC110 – Patient Identification Management  SC112 – Healthcare Document Management  SC113 – Query for Existing Data

38. Slide 37 HITSP – enabling healthcare interoperability 2009 Webinar Series Security Audit – HITSP SC 109

39. Slide 38 HITSP – enabling healthcare interoperability 2009 Webinar Series Security Audit – HITSP SC 109

40. Slide 39 HITSP – enabling healthcare interoperability 2009 Webinar Series Review of Selected Service Collaborations  SC108 – Access Control  SC109 – Security Audit  SC110 – Patient Identification Management  SC112 – Healthcare Document Management  SC113 – Query for Existing Data

41. Slide 40 HITSP – enabling healthcare interoperability 2009 Webinar Series Patient Identification Management – HITSP SC 110

42. Slide 41 HITSP – enabling healthcare interoperability 2009 Webinar Series Patient Identification Management – HITSP SC 110

43. Slide 42 HITSP – enabling healthcare interoperability 2009 Webinar Series Review of Selected Service Collaborations  SC108 – Access Control  SC109 – Security Audit  SC110 – Patient Identification Management  SC112 – Healthcare Document Management  SC113 – Query for Existing Data

44. Slide 43 HITSP – enabling healthcare interoperability 2009 Webinar Series Query for Existing Data – External View – HITSP SC 113

45. Slide 44 HITSP – enabling healthcare interoperability 2009 Webinar Series Query for Existing Data – Request

46. Slide 45 HITSP – enabling healthcare interoperability 2009 Webinar Series Query for Existing Data – Request Step Number Uses SC, T, TP or CInterfacePurpose 1HITSP/SC110 - Patient Identification Management Request Patient Identification To resolve the patient identity into the identity that the Clinical Data Service requires 2HITSP/SC108 - Access Control Service Request Access Control Decision To ensure that the user of this Service Collaboration has the right to use the HITSP/TP21 Transaction for this patient and this purpose 3HITSP/T17 - Secured Communication Channel Secure NodeTo open a secure communications channel for HITSP/TP21 to transmit clinical data 4HITSP/C19 - Entity Identity Assertion To provide the identity and attributes about the requestor of the HITSP/TP21 Transaction 5HITSP/TP21 - Query for Existing Data Clinical Data Consumer To request and receive the existing data 6HITSP/SC109 - Security AuditSend Security Audit Event To record the success or failure of the relevant information about the HITSP/TP21 Transaction

47. Slide 46 HITSP – enabling healthcare interoperability 2009 Webinar Series Query for Existing Data – Respond to

48. Slide 47 HITSP – enabling healthcare interoperability 2009 Webinar Series Query for Existing Data – Respond to Step # Uses SC, T, TP or CInterfacePurpose 1HITSP/ T17 - Secured Communication Channel Secure NodeTo receive a secure communications channel for HITSP/TP21 to transmit clinical data 2HITSP/ C19 - Entity Identity AssertionTo receive the identity and attributes about the requestor of the HITSP/TP21 Transaction 3HITSP/ TP21 - Query for Existing DataDepends on payload.Receive the request for existing Data 4HITSP/ SC110 - Patient Identification Management Request Patient Identification If required, resolve the patient identity into the identity that the Clinical Data Service requires 5HITSP/ SC108 - Access Control ServiceRequest Access Control Decision To ensure that the user of this Service Collaboration has the right to use the data for this patient and this purpose 6(Internal)Lookup the requested data 7HITSP/ SC109 - Security AuditSend Security Audit Event To record the success or failure of the relevant information about the HITSP/TP21 Transaction 8HITSP/ TP21 - Query for Existing DataDepends on payload.Return the requested Data

49. Slide 48 HITSP – enabling healthcare interoperability 2009 Webinar Series Review of Selected Service Collaborations  SC108 – Access Control  SC109 – Security Audit  SC110 – Patient Identification Management  SC112 – Healthcare Document Management  SC113 – Query for Existing Data

50. Slide 49 HITSP – enabling healthcare interoperability 2009 Webinar Series Healthcare Document Management – HITSP SC 112

51. Slide 50 HITSP – enabling healthcare interoperability 2009 Webinar Series Publish/Consume Documents through Media

52. Slide 51 HITSP – enabling healthcare interoperability 2009 Webinar Series Publish/Consume Documents through Share

53. Slide 52 HITSP – enabling healthcare interoperability 2009 Webinar Series Send/Receive Documents Directly

54. Slide 53 HITSP – enabling healthcare interoperability 2009 Webinar Series Send/Receive Documents through e-Mail

55. Slide 54 HITSP – enabling healthcare interoperability 2009 Webinar Series Send Documents through Share

56. Slide 55 HITSP – enabling healthcare interoperability 2009 Webinar Series Discussion / Questions Welcomed

57. Slide 56 HITSP – enabling healthcare interoperability 2009 Webinar Series NEW HITSP Team Members ALWAYS welcome! www.HITSP.org www.HITSP.org  All you need is passion to get the job done  Motivation to make a difference  Drive to push the nation forward  Volunteers ARE the life blood of HITSP to get the job done  If you knew enough to attend this webinar, you know enough to jump on in!

58. Slide 57 HITSP – enabling healthcare interoperability 2009 Webinar Series Webinar 1 Advances in Sharing Information in Healthcare IT Thursday, January 15, 2009 — 2:00-3:30 pm Eastern Webinar 7HITSP eTown Hall II with Dr. John Halamka Thursday, August 27, 2009 — 2:00-3:30 pm Eastern Webinar 2Personalized Healthcare Interoperability Specification (IS 08) Thursday, February 12, 2009 — 2:00-3:30 pm Eastern Webinar 8Medication Management Real World Sites Thursday, September 10, 2009 — 2:00-3:30 pm Eastern Webinar 3Consultations and Transfers of Care Interoperability Specification (IS 09) Thursday, March 12, 2009 — 2:00-3:30 pm Eastern Webinar 9HITSP EHR Centric Interoperability Specification Thursday, October 8, 2009 — 2:00-3:30 pm Eastern Webinar 4NHIN Real World Sites Thursday, April 16, 2009 — 2:00-3:30 pm Eastern Webinar 10Security, Privacy, and Infrastructure Thursday, November 12, 2009 — 2:00-3:30 pm Eastern Webinar 5HITSP eTown Hall I with Dr. John Halamka Thursday, June 18, 2009 — 2:00-3:30 pm Eastern Webinar 11Quality Management Tuesday, December 8, 2009 — 2:00-3:30 pm Eastern Webinar 6Health Information Exchange (HIEs) in the Real World Thursday, July 9, 2009 — 2:00-3:30 pm Eastern NOTE: Recent schedule changes reflect HITSP’s response to new efforts in HIT based on the ARRA Stimulus bill provisions. Further changes are possible due to priority changes and availability of speakers.  The 2009 Webinar Series www.HITSP.org/webinars        

59. Slide 58 HITSP – enabling healthcare interoperability 2009 Webinar Series View the Complete Set of HITSP Deliverables www.HITSP.org www.HITSP.org

60. Slide 59 HITSP – enabling healthcare interoperability 2009 Webinar Series Allyn Clemons, HIMSSTheresa Wisdom, HIMSS aclemons@himss.orgaclemons@himss.org twisdom@himss.orgtwisdom@himss.org Re: HITSP Technical Committees Michelle Deane, ANSI mmaasdeane@ansi.org Re: HITSP, its Board and Coordinating Committees Join HITSP in developing a safe and secure health information network for the United States Visit www.hitsp.org or contact:www.hitsp.org

61. Slide 60 HITSP – enabling healthcare interoperability 2009 Webinar Series Sponsor Strategic Partners www.HITSP.org