Duane Steward, DVM, MSIE, PhD Nemours, Chief Computer Scientist for Clinical Informatics University Central Florida, Assistant Professor

Agenda Define Health Information Exchange Key Issues Of Identification Truth Table Standards National Efforts As Context FHIN Architecture Florida RHIOs Minimal Data Set FHIN White Paper Recommendations

What is a Regional Health Information Organization? Clinical Source Systems RHIO Infrastructure Business Convener Bring together health care stakeholders. Manage Business Associate Agreements Enable data-sharing among providers Web-based Portal Pharmacy Inpatient Security Management Certify providers to access health care records Authorize access to records Log record access activity Physician Portal Laboratory Identity Management Identify patient records with MPI Match patient records with an RLS Physicians Information Management Gathers patient data into Minimal Clinical Dataset Provide data access through a Web-based portal Provide access to the FHIN Patient Portal Slide courtesy of Christopher Sullivan, PhD AHCA

Florida Health Information Network Statewide Architecture RHIOs Tampa Bay Miami Jacksonville Orlando, etc. Medicaid Data Health Statistics DoH SHOTS DoH Clinics DoH Vital Stats Government Databases Web Services (CCR) Web Services (CCR) FHIN Server Web Services (CCR) Web Services (CCR) Payor Databases Claims Data Medications Miscellaneous Databases Lab Results IDN Databases FQHC Databases

Identity: The Root Of Security Issues Who do we need medical records for? Whose medical records are these? Do we have all the pieces? For a given request there are theoretically four results True positive, true negative False positive, false negative What consequence for each case? True False Pos Neg

Healthcare Data Standards Standards for test requested (e.g., LOINC) order sets guidelines, protocols & standards of care for results (e.g., LOINC) for terminology of signs & symptoms (e.g., Snomed) for media carrying data (e.g., Dicom) for continuity of care, transfer of custody (e.g., CCR, [EMS]) for set of data considered minimal elements necessary (e.g., FHIN Minimal Clinical Dataset) for structuring the envelop that will carry the message containing the data (e.g., SOAP, HL7)

Health Information Technology Standards Panel (HITSP) Function Multi stakeholder coordinating body, partnership of the public and private sectors operating with a neutral and inclusive governance model Administered by the American National Standards Institute Provide a process to identify, select, and harmonize standards i.e., Specifications, Implementation Guides, Code Sets, Terminologies, and Integration Profiles development of harmonized Interoperability Specifications and information policies, including Standards Development Organization (SDO) work products essential for establishing privacy, security and interoperability among healthcare software applications Goal to be Use Case driven, using information from stakeholders and basing decisions on industry needs

How Use Cases and HITSP Interoperability Specifications are Developed The American Health Information Community, as the representative of public and private health sector stakeholders, identified the three Use Cases (available at hitsp.org) that drove the initial efforts of the HITSP. Nationwide public and private health sector priorities continue to focus the efforts of the HITSP. The Use Case driven HITSP harmonization process is implemented by formally chartered Technical Committees. The volunteers that comprise a Technical Committee followed an 8 step process, depicted below. HITSP Harmonization Process Steps From the Forward of the TP13 HITSP Manage Sharing of Documents Transaction Package (v 2.1)

The Standards Harmonization initiative is just one element of interoperability The Certification Commission for Health Information Technology (CCHIT) The Health Information Security and Privacy Collaboration (HISPC) American Health Information Community Health Information Technology Standards Panel (HITSP) National Health Information Network (NHIN) Architecture Projects The Community serves as the hub for identifying breakthrough opportunities CCHIT will focus on developing a mechanism for certification of health care IT products HITSP will bring together all relevant stakeholders to identify appropriate IT standards HISPC is a partnership focused on addressing variations in business policy and state law that affect privacy and security NHIN is focused on interoperability pilots Evaluation of Standards Harmonization Process for HIT

FHIN State Level Server Health Care Data: Florida Center Medicaid DOH SHOTS & Vital Statistics Physicians Certified with DOH Licensing Database Florida s RHIOs exchange records via the state level server Slide courtesy of Christopher Sullivan, PhD AHCA

Data Data Providers RHIO Data Sharing Server: Staging Area, Handles Queries Data RHIO Registry Server: Maintains Minimal Clinical Dataset and EMPI RHIO Specific RLS Server RHIO Network RHIO Data Sharing Server: Staging Area, Handles Queries Diagram Diagram of of FHIN FHIN and and Regional Health Health Information Organization Network Network Topology Network Network participants participants forward forward patient patient identification identification and and encounter encounter information information to to the the RHIO RHIO Registry Registry Server. Server. Each Each participant participant has has a a small small staging staging data data sharing sharing server server that that handles handles queries queries to to support support fetch fetch and and view view behavior behavior (required (required for for performance performance requirements). requirements). Data Data sharing sharing servers servers lie lie just just outside outside local local enterprise enterprise firewalls. firewalls. User User authentication authentication and and access access audit audit functions functions are are supplied supplied by by either e either RHIO RHIO RLS, RLS, a a Network Network LDAP LDAP server server or or equivalent. equivalent. RHIO Data Sharing Server: Staging Area, Handles Queries Data Regional DOH Research and Policy Data Monitoring For Public Health and Syndromic Surveillance Note: Note: EMR/EHR EMR/EHR Systems Systems are are varied varied vender vender products. products. Prepared by Duane Steward, DVM, MSIE, PhD; College of Health and Public Affairs, UCF on behalf of the Technical Committee of the Central Florida Regional Health Information Organization

Central Florida RHIO Architecture Phase I Fetch & View Physician Associates Of Florida Healthcare Center for the Homeless Orlando Regional Healthcare Jewett Orthopedic Clinic Central Florida RHIO RHIO Registry Link to other RHIOs via State Switch Florida Hospital May be within or external to RHIO Research Databases (deidentified data) Cognoscenti Health Institute All network participants forward patient identification and encounter information to the RHIO Registry may include CCR data Orange County PCAN

Central Florida RHIO Architecture Phase I Fetch & View Physician Associates Of Florida Healthcare Center for the Homeless Returned Patient Information Orlando Regional Healthcare Jewett Orthopedic Clinic Link to other RHIOs via State Switch Florida Hospital Request Patient Information Central Florida RHIO May be within or external to RHIO Research Databases (deidentified data) Cognoscenti Health Institute Available Patient Information ED Patient Information Request RHIO Registry All network participants forward patient identification and encounter information to the RHIO index may include CCR data Orange County PCAN

HIE Architecture in Florida

NE Florida Health Information Consortium 21

Big Bend R H I O

Big Bend RHIO Regional Health Information Network (RHIN) Architecture pman Connectivity Dedicated fiberbased Private Medical Area Network & VPN gateway VPN Small organizations can connect either directly to the RHIN or through a VPN gateway Organizations can connect bidirectly to feed their data and receive data directly into their EMR In the early Phases CHP, CRMC & TMH will provide a one way feed of their data. They have the largest repositories and the priority is to make their data available ASAP

Data Exchange: Big Bend RHIO Applications e Prescribing and Medication History Clinical data display including: labs, radiology reports, allergies, problems, providers, and medication history

Palm Beach County Community Health Alliance (PBCCHA) Hospitals Private Funders Public Funders Free Clinics PBC Community Health Alliance (An Alliance of Funders and Providers Serving Health Care Consumers) Health Dept. Social Services Care Expansion Language Access Project Access Shared EHR Common Eligibility 25

Tampa Bay RHIO

Escambia Health Information Network

Community Health Informatics Organization

South Florida Health Information Initiative

DOH Health Maintenance System Integration Broker - High Level View View (ELR) (ELR) Rabies Results MUMPS BOLIMS (Receives Orders, Sends Result Rpts) MERLIN (Sends Orders, Rcvs Result Rpts) Reportable Disease Results (Sends Electronic Orders, Receives Result Reports) BOLIMS Billing Data STD Database Hepatitis Results STD Results IRL Private Physicians (via a common portal) External Partners (via the Internet) LabCorp Quest Diagnostics DOH Cloverleaf Integration Broker Environmental Health Bureau of TB HIV-AIDS CTRS II HIV-AIDS Surveillance Internet HIV-AIDS Results HIV-AIDS Results RHIO Switch FHIN Connection Integration Broker Role: Receive Data, Translate Format, Transmit Data to Stakeholders CDC Other Outside Agencies Slide courtesy of Christopher Sullivan, PhD; AHCA

FHIN White Paper - Recommendations Authentication of Users End-user authentication and authorization should be handled at a regional or RHIO level, with a trust relationship set up between RHIOs and the state server. The state server shall act as a broker of all transactions among individual entities such as RHIOS, state agency databases or other sources of health care information. This would ensure that the authentication of clinicians and other end users does not need to occur at every single step of the data request and process.

FHIN White Paper - Recommendations Detailed logging of all requests to the FHIN server, or between RHIOs and other entities must be kept at all times, preferably both by the requesting entity and by the requested entity.

FHIN White Paper - Recommendations Patient Consent The technical design of the FHIN and RHIOs needs to be defined in such a way that patients have control over the medical information stored within their medical record. Patients should have the right to determine who is able to view their shared information, revoke the right if they choose to do so, request an audit of who has been viewing their information, and be notified of any event that breaks these rights.

FHIN White Paper - Recommendations The authors of this paper recommend that consideration be given to alternative systems to ensure patient rights, such as the adoption of a personal identification number (PIN) model external to both the source systems and the RHIO.

dsteward@nemours.org www.fhin.net www.hitsp.wikispaces.com www.ansi.org/hitsp/ Special thanks to: Christopher Sullivan, PhD and colleagues at AHCA Members of [Florida] Governor s Health Information Infrastructure Advisory Board Contributing members of American Health Information Community