1. Be-Health as a driving force of electronic cooperation in the Belgian health care sector, based on the experience in the social sector Frank Robben General manager Crossroads Bank for Social Security CEO Smals Sint-Pieterssteenweg 375 B-1040 Brussels E-mail: Frank.Robben@ksz.fgov.beFrank.Robben@ksz.fgov.be Website CBSS: www.ksz.fgov.bewww.ksz.fgov.be Personal website: www.law.kuleuven.ac.be/icri/frobbenwww.law.kuleuven.ac.be/icri/frobben

2. 2 Frank Robben4th December 2007 Structure of the presentation objectives building blocks Be-Health platform existing validated authentic sources and value added services critical success factors

3. 3 Frank Robben4th December 2007 Objectives what ? –to optimize the quality and the continuity of health care delivery –to optimize patient safety –to avoid unnecessary bureaucracy for all actors in the health care sector –to support policymaking in health care how ? –through a well organized electronic information exchange between all actors in the health care sector –with the necessary guarantees for information security and privacy protection

4. 4 Frank Robben4th December 2007 Building blocks a platform for secure electronic exchange of information about patients, provided care and the results of the provided care, and for the exchange of electronic care prescriptions between all relevant actors in the health care sector –network –basic services –exchange standards –access channels for the users –no central storage of information !!! an institution, managed by representatives of the several actors in the health care sector that –manages the exchange platform –organizes electronic information exchange between the actors in the health care sector

5. 5 Frank Robben4th December 2007 Building blocks a Sectoral Committee of the Privacy Commission regulating (electronic) exchange of personal health data in cases not regulated by law a standardized content, format and methods for the exchange of electronic care prescriptions a minimal content of health care files that can be exchanged electronically gradually, a permanent, decentralized availability and accessibility of the minimal electronically communicable content of health care files an appropriate legal framework

6. 6 Frank Robben4th December 2007 Be-Health platform Patients and care providers Platform with basic services Be- Health VASVASVAS Suppliers Users Portal BeHealth Portal BeHealth PortaHealth SVA AVS Portal RIZIV Portal RIZIV SVA AVS MyCareNet SVA AVS Portal SS Portal SS SVA AVS FPS-SS SVA AVS VASVASVAS

7. 7 Frank Robben4th December 2007 Be-Health platform basic service –a service that has been developed and made available by Be- Health and that can be used by the supplier of an added value service added value service (AVS) –a service put at the disposal of the patients and/or the health care providers –the entity that develops and offers an added value service can use the basic services offered by Be-Health for this purpose validated authentic source (VAS) –a database containing information used by Be-Health –the administrator of the database is responsible for the availability and (the organization of) the quality of the information made available

8. 8 Frank Robben4th December 2007 Platform with basic services use of the existing network infrastructure (internet, social security extranet, FedMAN,...) with end-to-end encryption of the information (concept of virtual private network (VPN)) basic services –integrated user and access management –logging –orchestration of electronic processes –reference directory –coding and anonymizing –time stamping –portal environment including a content management system and a search engine (https://www.behealth.be)https://www.behealth.be –personal electronic mailbox for each health care provider

9. 9 Frank Robben4th December 2007 User and access management authentication of the identity: according to the required security level –electronic identity card –user number, password and citizen token –user number and password verification of statuses and mandates : access to validated authentic sources authorization to use an added value service: management by service supplier elaborated on the basis of a generic policy enforcement model

10. 10 Frank Robben4th December 2007 Policy Enforcement Model User Policy Enforcement (PEP) Application Policy Decision (PDP) Action on application Decision request Decision reply Action on application PERMITTED Policy Information (PIP) Information request/ reply Policy Administration (PAP) Policy retrieval Authentic source Policy Information (PIP) Information request/ reply Policy repository Action on application DENIED Manager Policy management Authentic source

11. 11 Frank Robben4th December 2007 APPLICATIONS AuthorisationAuthen- tication PEP Role Mapper USER PAP ‘’Kephas’’ Role Mapper DB PDP Role Provider PIP Attribute Provider Role Provider DB UMAF PIP Attribute Provider DB XYZ WebApp XYZ APPLICATIONS AuthorisationAuthen- tication PEP Role Mapper USER WebApp XYZ PIP Attribute Provider PAP ‘’Kephas’’ Role Mapper DB PDP Role Provider Role Provider DB Management VAS PIP Attribute Provider DB XYZ PIP Attribute Provider DB Gerechts- deurwaar- ders PIP Attribute Provider DB Mandaten Be-Health APPLICATIONS AuthorisationAuthen- tication PEP Role Mapper USER PAP ‘’Kephas’’ Provider DB Mandaten Social sector (CBSS) Non social FPS (Fedict) Management VAS DB XYZ Architecture

12. 12 Frank Robben4th December 2007 Existing validated authentic sources register of health care providers –administrator: FPS Public Health –contains information about the diploma and the specialization of a health care provider identified through his social security identification number (SSIN) database with recognitions of the National Institute for Sickness and Invalidity Insurance (RIZIV) –administrator : RIZIV –contains information about the RIZIV recognition of health care providers identified through their SSIN database with persons authorized to act on behalf of a health care institution –administrator : NOSS (division user management for companies) –contains information about which persons, identified through their SSIN, are authorized to use which applications on behalf of a health care institution

13. 13 Frank Robben4th December 2007 Existing added value services third party billing Medic-e: entering the evaluation of disabled persons electronically into the information system of the FPS Social Security input into and consultation of the cancer register Medattest: on-line ordering of care prescription forms support of electronic care prescription in hospitals electronic registration of birth

14. 14 Frank Robben4th December 2007 Third party billing supplier: National College of Sickness Funds users: nurses, their groupings and representatives functionality: send the third party billings electronically to the sickness funds basic services used –identification and authentication of the identity of the user (eID or user number-password-citizen token) –verification of the status of nurse with RIZIV recognition –verification of the mandate –electronic mailbox (publication of documents) –logging

15. 15 Frank Robben4th December 2007 Medic-e supplier: FPS Social Security users: medical doctors who evaluate disabled persons functionality: enter the evaluation of the disabled persons electronically into the information system of the FPS Social Security basic services used –identification and authentication of the identity of the user (eID or user number-password-citizen token) –verification of the status of medical doctor with RIZIV recognition –electronic mailbox (publication of documents) –logging

16. 16 Frank Robben4th December 2007 Input in cancer register supplier: Cancer Register users: oncologists in health care institutions and labs functionality: electronic input of information into the cancer register and access to the registered information basic services used –identification and authentication of the identity of the user (eID) –verification of the status of medical doctor with RIZIV recognition –electronic mailbox (publication of documents) –logging

17. 17 Frank Robben4th December 2007 Medattest supplier: RIZIV users: medical doctors, dentists, physiotherapists, nurses, speech therapists, orthopedists, health care institutions and their mandataries functionality: on-line ordering of care prescription forms basic services used : –identification and authentication of the identity of the user (eID or user number-password-citizen token) –verification of the status of users –verification of the mandate –logging

18. 18 Frank Robben4th December 2007 Electronic care prescription in health care institutions analysis of required functionalities –functionalities before a prescription can be processed authentication of the identity of the person who writes the prescription verification of the status of the person who writes the prescription system to ensure that the prescription cannot be modified unnoticeably after applying the methods to guarantee the integrity and the electronic time stamping authentication of the identity, verification of the status of the person who has written the prescription, guaranteeing the integrity and electronic date for each individual prescription the time necessary for authenticating the identity, verifying the status and guaranteeing the integrity must not exceed ¼ of a second per prescription a person that writes prescriptions must be able to switch between prescription places without overhead local validation that the prescription has not been modified after applying the methods to guarantee the integrity and the electronic time stamping

19. 19 Frank Robben4th December 2007 Electronic care prescription in health care institutions analysis of required functionalities –functionalities during the processing of the prescription the electronic time stamping must be requested immediately after applying the method to guarantee the integrity and must be placed within 30 seconds after the request –organizational requirements velocity of replacing an authentication tool when useless traceability of who has done which processing at which moment for the creation of a prescription (must be kept during a certain period) traceability of the content and of the exact date and time of each request and processing of a request to revoke an authentication tool –point of special interest avoid that care institutions have to work with different systems for the authentication of the identity, the verification of the status, the guarantee of the integrity of documents, electronic time stamping, … for different types of processes

20. 20 Frank Robben4th December 2007 Electronic care prescription in health care institutions possible solution –the authentication of the identity and the verification of the status are performed on the local level using at least a user-id, a password [and something one possesses], on condition that each person that writes prescriptions signs a document that stipulates that he is responsible for everything that is authenticated in terms of identity and status through his user id, his password [and the possessed element] –the prescriptions are hashed –the hashing results (not the content of the prescription itself !) receive an electronic time stamp from Be-Health –clear organizational rules concerning the management of user- id’s, passwords [and the possessed elements], based on the results of Elodis, are incorporated in an royal decree in implementation of article 21 of the royal decree n° 78 –a regulation is being elaborated that indicates under which conditions postscriptions are possible

21. 21 Frank Robben4th December 2007 Critical success factors cooperation between all actors in the health care sector, based on a division of tasks rather than on a centralization of tasks trust of all stakeholders in the preservation of the necessary autonomy and the security of the system firstly the development of the exchange platform and the creation of the necessary institutions (management organization for exchange platform, Sectoral Committee,...) and then further elaboration of processes between these institutions quick wins in combination with a long term vision legal framework

22. 22 Frank Robben4th December 2007 More information portal Be-Health –https://www.behealth.behttps://www.behealth.be website Crossroads Bank for Social Security –http://www.ksz.fgov.behttp://www.ksz.fgov.be personal website Frank Robben –http://www.law.kuleuven.ac.be/icri/frobbenhttp://www.law.kuleuven.ac.be/icri/frobben

23. Th@nk you ! Any questions ?