1. Authorized Release of Information to a Trusted Entity and the NwHIN Exchange July 11, 2012

2. SSA Background Over 3 million initial disability applications a year Over 15 million requests for medical evidence each year (3-4 medical records per case) 500,000 sources: doctors, hospitals, etc SSA is not a HIPAA covered entity Require a patients authorization to obtain medical records Initial Federal Agency on the Nationwide Health Information Network (NwHIN) Exchange 2

3. SSA and the NwHIN Exchange 3 August, 2008 - Partnered with Beth Israel Deaconess Medical Center to build a prototype February, 2009 - Partnered with MedVirginia, a Health Information Exchange, to become the first to exchange medical information over the NwHIN Exchange February, 2010 - 12 contracts awarded to medical networks and providers using Recovery Act funds to expand the health IT project to 13 states 2011 - 2013 – Recovery Act partners in production, pilots with VA / DoD and Kaiser Permanente, and targeted recruitment of new partners and expansion of existing In 2012, we will continue efforts to expand out to new partners for Social Securitys health IT initiative

4. Where are we today 4 Partners in Production: Beth Israel Deaconess Medical Center MedVirginia / MedVirginia Centra Oregon Community Health Information Network EHR Doctors Douglas County Individual Practice Association Marshfield Clinic Inland Northwest Health Services Community Health Information Collaborative Wright State University HealthBridge LCF/New Mexico Health Information Collaborative Regenstrief / Indiana Health Information Exchange Southeastern Michigan Health Association Production Locations: In Production in 2012 -2013: VA/DoD Pilot Kaiser Permanente Pilot Additional Partners SSA receives health IT data from 13 states with additional plans of expansion Partners in Production Partners Pending Production

5. Authorized Release of Information to a Trusted Entity Use Case Use Case Scenario – Social Security Administration requests medical documentation from a healthcare provider with the patients authorization 5 Claimant SSA/DDS Providers File Disability Claim Request Evidence Claim Determination Medical Evidence Patient Authorization

6. SSA – 827 (Patient Authorization) Requestor Responder Purpose Effective Date Effective Timeframe Type of Information Requested Signed 6

7. NwHIN Specifications & Standards Content Structure – HL7 CDA Release 2 CCD – HITSP C32 – HITSP C62 – Unstructured Documents (pdf, txt, doc, rtf, tif, jpg, gif, png) Vocabulary & Code Sets – ICD-9-CM – Systematized Nomenclature of Medicine--Clinical Terms (SNOMED-CT) – Logistical Observation Identifiers names and Codes (LOINC) 7 Consent Structure – IHE Basic Patient Privacy Consents Transport and Security – Messaging Platform – Authorization Framework – Web Services Registry – Patient Discovery – Query for Documents – Retrieve Documents – Access Consent Policy

8. NwHIN Exchange Transaction Flow 8 Patient Authorization Clinical Documents

9. Standards per Transaction #Transactions Vocabulary & Code Set Content & Structure Transport & Security Access Services Cross Functional 11. Patient Discovery Request Messaging Platform Authorization Framework Patient Discovery Web Services Registry NwHIN Exchange 2 Access Consent 3. Query for Documents Request 4. Query for Documents Response LOINC Messaging Platform Authorization Framework Query for Document Access Consent Policy Web Services Registry NwHIN Exchange 3 Access Consent 5. Retrieve Document Request 6. Retrieve Document Response IHE BPPC Messaging Platform Authorization Framework Retrieve Document Access Consent Policy Web Services Registry NwHIN Exchange 48. Patient Discovery Response Messaging Platform Authorization Framework Patient Discovery Web Services Registry NwHIN Exchange 5 Clinical Document 9. Query for Documents Request 10. Query for Documents Response LOINC Messaging Platform Authorization Framework Query for Document Web Services Registry NwHIN Exchange 6 Clinical Document 11. Retrieve Document Request 12. Retrieve Document Response ICD-9-CM SNOMED-CT LOINC HL7 CCD HITSP C32 & C62 Unstructured Documents (pdf, txt, doc, rtf, tif, jpg, gif, png) Messaging Platform Authorization Framework Retrieve Document Web Services Registry NwHIN Exchange 9

10. SAML Security Assertion Subject ID - MEGAHIT Subject Organization - Social Security Administration Subject Organization ID - 2.16.840.1.113883.3.184 Subject Role - SNOMED-CT (106328005) – Social Worker Purpose of Use - Coverage Patient Identifier – encoded per the NwHIN Authorization Framework specification 10

11. Authorization Decision Statement NwHIN Exchange uses a Authorization Decision Statement to allow an entity to assert the requester should be permitted to execute the transaction based on a specific security policy Access Consent Policy and Authorization Framework specifications define the format of the policy 11

12. Access Consent Policy XDS Metadata XDS MetadataValue availabilityStatusurn:oasis:names:tc:ebxml-regrep:StatusType:Approved classCode57016-8 (LOINC) classCode DisplayNamePrivacy Policy Acknowledgement confidentialityCodeN (Normal) formatCodeurn:ihe:iti:bppc-sd:2007 formatCode codeSystem1.3.6.1.4.1.19376.1.2.3 healthcareFacilityTypeCode385432009 (SNOMED CT code for Not Applicable) mimeTypetext/xml practiceSettingCode385432009 (SNOMED CT code for Not Applicable) serviceStartTimeEffective start date of privacy policy (authorization) serviceStopTimeEffective end date of privacy policy (authorization) TitleAUTHORIZATION TO DISCLOSE INFORMATION TO THE SOCIAL SECURITY ADMINISTRATION 12

13. Questions 13

14. For Further Information Contact – Marty Prahl (martin.prahl@ssa.gov)martin.prahl@ssa.gov – Tom Davidson (thomas.davidson@ssa.gov)thomas.davidson@ssa.gov – Bob Hastings (bob.hastings@ssa.gov)bob.hastings@ssa.gov) 14

15. Reference Materials NwHIN Exchange Technical Specifications (all of the specifications can be found at http://www.nationalehealth.org/technical-specifications http://www.nationalehealth.org/technical-specifications Patient Discovery (requestor only) - http://www.nationalehealth.org/ckfinder/userfiles/files/Technical%20Specs/Patient_Discove ry_Production_Specification_v2_0.pdf http://www.nationalehealth.org/ckfinder/userfiles/files/Technical%20Specs/Patient_Discove ry_Production_Specification_v2_0.pdf Query for Documents (requestor only) - http://www.nationalehealth.org/ckfinder/userfiles/files/Technical%20Specs/QueryforDocum entsProductionSpecification_v3_0.pdf http://www.nationalehealth.org/ckfinder/userfiles/files/Technical%20Specs/QueryforDocum entsProductionSpecification_v3_0.pdf Retrieve Documents (requestor only) - http://www.nationalehealth.org/ckfinder/userfiles/files/Technical%20Specs/Retrieve_Docum ents_Production_Specification_v3_0.pdf http://www.nationalehealth.org/ckfinder/userfiles/files/Technical%20Specs/Retrieve_Docum ents_Production_Specification_v3_0.pdf Access Consent Policy (responder only) - http://www.nationalehealth.org/ckfinder/userfiles/files/Technical%20Specs/AccessConsentP oliciesProductionSpecification_v1_0.pdf http://www.nationalehealth.org/ckfinder/userfiles/files/Technical%20Specs/AccessConsentP oliciesProductionSpecification_v1_0.pdf Core Capabilities that support the above transactions Messaging Platform - http://www.nationalehealth.org/ckfinder/userfiles/files/Technical%20Specs/MessagingPlatfo rmProductionSpecification_v3_0.pdf http://www.nationalehealth.org/ckfinder/userfiles/files/Technical%20Specs/MessagingPlatfo rmProductionSpecification_v3_0.pdf Authorization Framework - http://www.nationalehealth.org/ckfinder/userfiles/files/Technical%20Specs/AuthorizationFra meworkProductionSpecification_v3_0.pdf http://www.nationalehealth.org/ckfinder/userfiles/files/Technical%20Specs/AuthorizationFra meworkProductionSpecification_v3_0.pdf 15