1. HIT Standards Committee Privacy and Security Workgroup Recommendations for Electronic Health Record (EHR) Query of Provider Directories Dixie Baker, Chair Walter Suarez, Co-Chair May 18, 2011

2. Privacy and Security Workgroup Dixie Baker, SAIC John Blair, Taconic Anne Castro, BlueCross BlueShield of South Carolina Aneesh Chopra, Federal Chief Technology Officer Mike Davis, Veterans Health Administration Lisa Gallagher, HIMSS Ed Larsen David McCallie, Cerner Corporation John Moehrke, General Electric Steve Findlay, Consumers Union Jeff Jonas, IBM Wes Rishel, Gartner Walter Suarez, Kaiser Permanente Sharon Terry, Genetic Alliance

3. Needs Identified by HIT Policy Committee Identified need for consistent approach to cross-organizational provider directories to support the exchange of health information September 2010 Testimony resulted in narrowing of focus to: 1.Interoperability among existing directories (no rip and replace) 2.Interoperability between EHRs and provider directories: Capability for EHRs to query national (federated) enterprise-level provider directory Central need: Capability to search for and find discoverable information essential for enabling exchange of health information between enterprises Enterprise-level provider directory (ELPD) content should be limited to: 1.Basic entity information (e.g., name, address, human point-of-contact) 2.Externally accessible information exchange services (e.g., domains, message protocols, transport protocols, inbox locations) 3.Security credentials

4. Two-Phased Approach for Developing Recommendations for Provider Directory Standards 1.To meet immediate need for standards to support Stage 2 EHR certification, recommend standards, implementation specifications, and certification criteria for EHR query of enterprise-level provider directories Recommendations presented today 2.Develop recommendations for Enterprise-Level and Individual- Level Provider Directories in concert to address needs identified by the HIT Policy Committee Recommendations for Enterprise-Level Provider Directories received in February 2011 HITPC approved Information Exchange Workgroups recommendations for Individual-Level Provider Directories May 11, 2011

5. Standards Requirements

6. Public Testimony Received to Date by the P&S WG NwHIN requirements for directory services Direct Project Exchange Veterans Health Administration HIEs Department of Vermont Health Access New England Healthcare Exchange Network (NEHEN) Standards Integrating the Healthcare Enterprise (IHE) Healthcare Provider Directory (HPD) Profile and Social Security Administration (SSA) experience with IHE HPD ASC X12 Provider Directory transaction HL7/OMGs collaborative effort on the Healthcare and Community Services Provider Directory (HCSPD)

7. Scope of Current Recommendation Standards, implementation specifications, and certification criteria to support Stage 2 meaningful-use of EHRs to query enterprise- level provider directories Standards and implementation specifications needed: –Schema –Vocabulary –Transport –Query Language Certification functionality needed: –Search for and discover entity (i.e., search => list => select) –Search for and discover services entity offers for exchanging information with other entities (including entitys URL or electronic address to receive information) –Search for and discover entitys security credential

8. NwHIN Standard Discovery of Entities Discovery of Exchange Capabilities Discovery of Security Credentials Transport Standard DirectDNSNonePrimarily DNS; some LDAP 1 SMTP ExchangeServices Registry UDDI v3 over SOAP mPKI CASOAP 1 While the LDAP family of standards does not explicitly address identity federation, multiple strategies exist for federating LDAP directories. Because DNS is inherently federated, the Direct Project chose to use it for credential discovery, while recognizing that an LDAP approach would be a more complete solution. Current NwHIN Standards

9. Standards/ Profiles Schema (Structure) Standards of the Query/Response message between EHR and PD Content (Vocabulary) Standards of the Query/Response message between EHR and PD Transport Standards of the Query/Response message between EHR and PD Query Language IHE HPDLDAP/DSML (DSML is XML representation of LDAP data model) LDAP + ISODSML supports both SOAP and REST LDAP ASC X12N 274 X12X12 Data Dictionary; External Code Sets for selected data elements Not defined; Supports SOAP, REST, other ITI-58 HL7/OMG HCSPD Not specified Expected to support both SOAP and REST Not specified Comment: HCSPD exists in abstract form only – HL7 has defined the requirements, and OMG is currently specifying the standard for meeting these needs. The OMG work is expected to be completed in 1 year. Schema, Content, Transport, and Query Standards

10. Standards/ Profiles Supports Discovery of Entity Supports Discovery of Entitys Services and IE Capabilities Supports Discovery of Entitys Security Credentials Supports Discovery of Individual Provider 1 Supports Discovery of Individual Providers Locations 1 IHE HPDYes ASC X12N 274 No Comment: The X12 274 transaction is a push transaction used mainly by provider entities to send their lists of providers to a health plan. X12 has expressed its willingness to work with the HITSC to adapt X274 to support the ELPD query functionality. HL7/OMG HCSPD In scope Comment: HCSPD exists in abstract form only – HL7 has defined the requirements, and OMG is currently specifying the standard for meeting these needs. The OMG work is expected to be completed in 1 year. 1 Individual-Level Provider Directories are outside the scope of the current task, but need to be anticipated Functionality Supported

11. Recommended Standards, Implementation Specifications, and Certification Criteria RequirementStandardImplementation Specification Certification Criteria SchemaDSMLIHE HPD subsetCapability to securely send to an ELPD service a DSML query for entities, and entities exchange services, and to receive a response, as specified in the IHE HPD profile. Capability to enable a user or software to list and select from ELPD responses. Capability to retrieve the digital certificate for a selected entity. VocabularyLDAP + ISOIHE HPD subset TransportREST or SOAP 1 IHE HPD Query LanguageLDAPIHE HPD + HPD Federation Profile 2 1 The Standards and Interoperability Framework team should select either REST or SOAP, as most appropriate within the context of the NwHIN standards currently being defined. 2 To support LDAP federation, a profile specifying a standardized way to federate LDAP directories is needed.