1. The Patient Choice Project Use Case Working Session February 12 th, 2016

2. Call Logistics If you are not speaking, please keep your phone on mute Do not put your phone on hold – if you need to take a call, hang up and dial in again when finished with your other call This meeting is being recorded Feel free to use the “Chat” feature for questions, comments or any items you would like the moderator or participants to know 2

3. Agenda 3 TopicTime Allotted General Announcements5 minutes Pre/Post Conditions5 minutes Use Case Document Review5 minutes Review “PULL” Use Case Scenarios Updated Activity Diagrams Finalized Functional Requirements Finalized Sequence Diagrams 15 minutes Revised Push Scenarios Notational Diagrams Functional Requirements Activity Diagrams 25 minutes Next Steps/Questions5 minutes

4. General Announcements The Patient Choice project will meet weekly on Fridays @ 11 am ET »The next working group meeting will be on Friday, February 19 th, 2016 at 11 am ET 4

5. Phase 1 - Timeline 5 Nov Dec Jan FebMar AprMayJunJulyAugSeptOctNov (Today) Begin Pilot Work Kick Off Pilot Activities Use Case Working Group Kick Off Session Conduct Pilots Needs Assessment Review and development of formal use cases Develop Best Practices IG Draft Basic Choice Standard

6. 6

7. Proposed Use Case & Functional Requirements Development Timeline WeekTarget DateWorking Session TasksReview and Provide Comments via Confluence (due Thursdays @ 11 am ET) 61/29Review: Finalized Pre/Post Conditions, PULL Base Flows and Information Interchange Requirements Introduce: PULL Activity Diagrams Review: PULL Base Flows and Information Interchange Requirements, and Activity Diagrams 72/5Review: Finalized PULL Base Flows and Information Interchange Requirements and Activity Diagrams. Introduce: Revised PUSH User Stories and PULL Functional Requirements & Sequence Diagram, Review: Revised PUSH User Stories and PULL Functional Requirements & Sequence Diagram 82/12Review: Scenario 5: Activity Diagram and Sequence Diagram Introduce: Scenarios 1 and 2 Review: All Scenarios flows and Diagrams 92/19Review: Finalized Scenarios Introduce: Dataset Considerations and Risks and Issues Review: Dataset Considerations and Risks and Issues 102/26Review: Dataset Considerations and Finalized Risk and Issues End-to-end Review 7

8. Section Review 1. Discuss and review the following sections: »Pre/Post Conditions »PUSH User Stories –Notational Diagrams –Base Flows –Functional Requirements –Activity Diagrams »PULL User Stories –Activity Diagrams –Functional Requirements –Sequence Diagram 8 Click the icon to open the Word Document

9. Pre-Conditions and Post-Conditions Pre Conditions Mechanisms are in place for handling missing or not yet recorded Patient preferences for data sharing Mechanisms are in place for systems having Patient data have to enforce the appropriate legal and policy requirements Mechanisms are in place to comply with Privacy Consent Directives and subsequent handling instructions Requesting system has a pre-existing relationship with the patient for which it requesting data for All of the patient data is available for a potential query with exception to what is limited by a patients consent directive Post Conditions Receiving system complies with ongoing obligations Sending and receiving systems have recorded the transactions in their security audit records 9

10. Push Scenario 1 - Provider pushes Consent Directive to Consent Directive Repository 10

11. Push Scenario 1 - Provider pushes Consent Directive to Consent Directive Repository User Story 1 Context »Alice’s PCP participates in the local HIO »Alice consents to her PCP sharing all of her records with other providers for Treatment through the HIO »The HIO accesses patient consent directives through an affiliated Consent Directive Repository User Story Alice recently moved to a new state and finds a new PCP. Her PCP wants to refer her to a Specialist. The PCP tells Alice about the local HIO and explains how the HIO enables her PCP to share her health information quickly and securely with this Specialist versus the alternative of using fax or mailing paper copies. Alice is comfortable with sharing her health information through the HIO for treatment purposes, so she signs the HIO opt-in consent directive. Alice’s PCP pushes Alice’s consent directive to the HIO’s affiliated Consent Directive Repository. Alice’s PCP makes a referral to her Specialist and informs the Specialist that Alice has consented to sharing her health information through the HIO. Alice’s Specialist is now able to request health information from the HIO. [Go to PULL use case.] 11

12. Push Scenario 1 - Provider pushes Consent Directive to Consent Directive Repository User Story 2(Change Of Mind) Alice has signed an opt-in consent directive, allowing the exchange of health information through the HIE to participating providers. Alice has been receiving care from a specialist, who is an authorized HIE participant. Alice decides she no longer wants her health information disclosed to other providers participating in the HIE. She signs an HIE opt-out consent directive. The specialist pushes Alice’s opt-out consent directive to the HIE (shown at ①). The HIE replaces her current opt-in consent directive stored in the consent system with Alice’s opt- out consent directive (shown at ①), The providers participating in the HIE are now no longer able to receive Alice’s health information. Alice already had an opt-in in the previous story, if this is a continuation, she would then opt-out - possibly because she no longer wants the treatment given by the specialist known to other providers using the HIE. 12

13. Push Scenario 1 - Provider pushes Consent Directive to Consent Directive Repository User Story 2 Consent System Clinical IT System Health Information Exchange HIE Security Domain 1 2 13

14. Push Scenario 2 - Provider pushes Consent Directive to HIO and Immunization Registry 14

15. Push Scenario 2 - Provider pushes Consent Directive to HIO and Immunization Registry User Story 1 User Story 1 State residents are required to receive immunizations unless the resident receives a medical or religious exemption. All immunizations must be reported to the state immunization registry. The Greater Regional Health Information Exchange (GRHIE) is allowed to access an individual's state immunization records only if the individual has electronically consented to the sharing of their state immunization record. Patient X has just moved into the Greater Regional area and is receiving an examination from Dr. Able prior to attending a public school. Patient X is uncertain which immunizations he may have received while living in another part of the state. Dr. Able is unable to access Patient X's state immunization records through GRHIE because there is no consent on file. With the agreement of Patient X, Dr. Able enters the consent of Patient X on a portal that communicates the consent to GRHIE. GRHIE records the consent and electronically sends the consent to the state immunization registry. 15

16. Push Scenario 2 - Provider pushes Consent Directive to HIO and Immunization Registry User Story 1 16

17. Next Steps Review and provide feedback to posted materials: Push and Pull Scenarios by the following Thursday at 11am ET »http://confluence.siframework.org/display/PATCH/Use+Case+Developmenthttp://confluence.siframework.org/display/PATCH/Use+Case+Development Next meeting is Friday, February 19 th, 2016 at 11 am ET Reminder: All Patient Choice Announcements, Schedules, Project Materials, and Use Case will be posted on the Patient Choice Confluence page »http://confluence.siframework.org/display/PATCH/http://confluence.siframework.org/display/PATCH/ 17

18. Project Contact Information OCPO-ONC LeadJeremy MaxwellJeremy.Maxwell@hhs.gov Project CoordinatorJohnathan Colemanjc@securityrs.com Project ManagerAli KhanAli.Khan@esacinc.com Project SupportTaima GomezTaima.Gomez@esacinc.com Staff SMEKathleen Connorklc@securityrs.com Staff SMEDavid Staggsdrs@securityrs.com 18

19. @ONC_HealthIT@HHSONC Thank you for joining!