Kibbe expect direct health information exchange in the context of state 2 meaningful use
•
2 recomendaciones•709 vistas
Recomendados
Recomendados
Más contenido relacionado
La actualidad más candente
La actualidad más candente (19)
Destacado
Destacado (9)
Similar a Kibbe expect direct health information exchange in the context of state 2 meaningful use
Similar a Kibbe expect direct health information exchange in the context of state 2 meaningful use (20)
Más de Trimed Media Group
Más de Trimed Media Group (20)
Último
Último (20)
Kibbe expect direct health information exchange in the context of state 2 meaningful use
- 2. www.DirectTrust.org 1101 Connecticut Ave NW, Washington, DC 20036 About DirectTrust • The ONC is establishing governance mechanisms for health information exchanges over the nationwide health information network, Nwin, in part through a Cooperative Agreement with DirectTrust. • The Stage 2 MU objectives require eligible providers engage in health information exchange via standards, used in a manner consistent with these governance mechanisms. • DirectTrust is a non‐profit national industry alliance of 90+ organizations that is supporting Direct exchange adoption and use through policy setting, accreditation, trust anchor distribution, and outreach activities. The AAFP is one of the founding members of DirectTrust. See:http://www.healthit.gov/buzz‐blog/health‐information‐exchange‐2/onc‐partners‐health‐ information‐exchange‐governance‐entities and also http://www.healthit.gov/buzz‐blog/electronic‐health‐and‐medical‐records/directtrust‐builds‐ transparency‐confidence‐direct‐exchange). 2
- 3. www.DirectTrust.org 1101 Connecticut Ave NW, Washington, DC 20036 Overview and goals of this talk • If you, your organization, or your health system plan to participate in Stage 2 Meaningful Use, you’ll need to: know how Direct exchange relates to Stage 2 MU certified EHRs, and to Stage 2 MU objectives and measures for meaningful use of EHRs. understand how Direct exchange works, and what it can do for your organization, providers, and patients. become familiar with the security and identity assurance roles of your HISP, CA, and RA, and know how to use Direct to connect with providers and patients who subscribe to other HISPs. prepare a set of questions to ask your EHR vendor and HISP about how they will enable Direct for your organization, and at what additional liability and cost.
- 4. www.DirectTrust.org 1101 Connecticut Ave NW, Washington, DC 20036 Stage 2 MU focus is on exchange
- 5. www.DirectTrust.org 1101 Connecticut Ave NW, Washington, DC 20036 The requirements for Stage 2 1. CPOE 2. E‐Prescribing 3. Record demographics 4. Record vitals 5. Record smoking status 6. Use clinical decision support 7. Patients view, download, transmit 8. Clinical summaries to patients 9. Protect electronic health information 10. Incorporate lab results 11. Generate patient lists 12. Reminders for follow‐up care 13. Patient educational resources 14. Medication reconciliation 15. Transmit care summaries for transitions of care 16. Report immunizations 17. Secure messaging with patients plus menu items…… 18. Report syndromic data 19. Record electronic notes 20. Imaging results 21. Record family history 22. Report cancer cases 23. Report other registry cases
- 6. www.DirectTrust.org 1101 Connecticut Ave NW, Washington, DC 20036 The HIE requirements for Stage 2 1. CPOE 2. E‐Prescribing 3. Record demographics 4. Record vitals 5. Record smoking status 6. Use clinical decision support 7. Patients view, download, transmit 8. Clinical summaries to patients 9. Protect electronic health information 10. Incorporate lab results 11. Generate patient lists 12. Reminders for follow‐up care 13. Patient educational resources 14. Medication reconciliation 15. Transmit care summaries for transitions of care 16. Report immunizations 17. Secure messaging with patients plus menu items…… 18. Report syndromic data 19. Record electronic notes 20. Imaging results 21. Record family history 22. Report cancer cases 23. Report other registry cases
- 7. www.DirectTrust.org 1101 Connecticut Ave NW, Washington, DC 20036 The Direct HIE requirements for Stage 2 1. CPOE 2. E‐Prescribing 3. Record demographics 4. Record vitals 5. Record smoking status 6. Use clinical decision support 7. Patients view, download, transmit 8. Clinical summaries to patients 9. Protect electronic health information 10. Incorporate lab results 11. Generate patient lists 12. Reminders for follow‐up care 13. Patient educational resources 14. Medication reconciliation 15. Transmit care summaries for transitions of care 16. Report immunizations 17. Secure messaging with patients plus menu items…… 18. Report syndromic data 19. Record electronic notes 20. Imaging results 21. Record family history 22. Report cancer cases 23. Report other registry cases
- 8. www.DirectTrust.org 1101 Connecticut Ave NW, Washington, DC 20036 Direct is all about interoperability of health information exchange 1) For the 2014 Edition Certification Criteria and for Stage 2 MU, EHRs must be tested and certified as compliant with the Direct standard, the purpose of which is to permit EHR users using EHRs from different vendors to send and receive secure messages and attachments across organizational and IT system boundaries, as well as to patients using web based Direct‐compliant systems. 2) For Stage 2 MU’s transitions of care and referrals objective, an EP, eligible hospital, or CAH must meet the requirement that more than 10% of the summary care records provided for transitions of care and referrals be electronically transmitted. 3) For Stage 2 MU’s patient engagement objective, patients must be able to “view, download, and transmit to a third‐party of their choice” a summary of care record provided by the EHR technology, and 5% must actually do so. Three Main Points to Remember
- 11. www.DirectTrust.org 1101 Connecticut Ave NW, Washington, DC 20036 Direct exchange capability is going to be ubiquitous • Direct exchange is not the only way that providers can meet the health information exchange requirements of Stage 2 MU. • However, since all certified EHR technology must enable use of Direct exchange, Direct may be the easiest solution to deploy. • And, there are benefits of using Direct exchange beyond Stage 2 MU, e.g. for secure exchanges of information with payers; with Medicare, Medicaid, and the VA; within the context of an ACO using multiple EHRs; for patient engagement generally.
- 12. www.DirectTrust.org 1101 Connecticut Ave NW, Washington, DC 20036 How Direct exchange works • Direct addresses are used to route information – Look like email addresses – Used only for health information exchange • An individual may have multiple Direct addresses
- 13. www.DirectTrust.org 1101 Connecticut Ave NW, Washington, DC 20036 1313 Health Information Service Provider (HISP) Healthcare Organization (HCO) Identity vetting at a specific level of Assurance, LoA. Certificate Authority (CA) Certificate Validation Service X.509 Certificate Issuance Service Revocation Services Certificate Signing Services Registration Authority (RA) Compile/Validate Identity and Trust Documentation The CA and RA enforce the policies specified in the DirectTrust and FBCA Certificate Policy (CP). Crediential issued on the basis of RA’s Identity vetting at specific LoA.. HCO Direct Addressees Basic services for user: DNS discovery; encryption; certificate signing and validation; send/receive MDNs; provide HISP-side of edge protocol connection compliance with Direct standard, The HISP enforces the policies specified in the DirectTrust HISP Policy (HP), and MUST use accredited RA and CA. The HCO relies on HISP, CA, and RA as accredited trusted agents, and bears ultimate responsibility for HIPAA privacy and security. NOTE: Three separate roles and responsibilities from “trusted agents” combine to enable Direct exchange 1. 2. 3.
- 19. www.DirectTrust.org 1101 Connecticut Ave NW, Washington, DC 20036 To review… • Privacy, security, and trust‐in‐identity controls of Direct exchange are VERY important! Consider HIPAA and the new penalties for breach of privacy. HISPs are Business Associates and “trusted agents” of Direct users. CAs/RAs are subcontractors. • EHRs have 3 options for enabling Direct exchange: 1. EHR can be a HISP for its customers (and patients?) 2. EHR can partner with a single full service HISP. 3. EHR can configure connections (SOAP XDR) to allow customers to choose a HISP, in which case an EHR vendor might have relationships with multiple HISPs. • In all three options, it is ultimately the provider’s responsibility that privacy is protected and identity is assured!
- 20. www.DirectTrust.org 1101 Connecticut Ave NW, Washington, DC 20036 • The Big Question in Direct exchange: – How does HISP A know it is safe and secure to exchange PHI with HISP B..X,Y,Z? – Contracts to agree one‐to‐ one on levels of assurance and degrees of security controls are costly and will not scale.
- 22. www.DirectTrust.org 1101 Connecticut Ave NW, Washington, DC 20036 A deeper dive into Direct • Before Direct users can exchange messages and attachments, they must interact with three entities that serve as “trusted agents,” each of which has separate roles and responsibilities. o A Health Information Service Provider, HISP, handles the encryption and identity validation on behalf of the Direct addressee, assigns accounts and addresses, and arranges for the addressees to be issued an X.509 digital certificate; o A Certificate Authority, CA, issues the X.509 digital certificate to the addressee, along with the public key, relying on the information supplied to it by the; o A Registration Authority, RA, which verifies and proofs the identity of the addressee applying for an X.509 digital certificate.
- 23. www.DirectTrust.org 1101 Connecticut Ave NW, Washington, DC 20036 2323 Health Information Service Provider (HISP) Healthcare Organization (HCO) Identity vetting at a specific level of Assurance, LoA. Certificate Authority (CA) Certificate Validation Service X.509 Certificate Issuance Service Revocation Services Certificate Signing Services Registration Authority (RA) Compile/Validate Identity and Trust Documentation The CA and RA enforce the policies specified in the DirectTrust and FBCA Certificate Policy (CP). Crediential issued on the basis of RA’s Identity vetting at specific LoA.. HCO Direct Addressees Basic services for user: DNS discovery; encryption; certificate signing and validation; send/receive MDNs; provide HISP-side of edge protocol connection compliance with Direct standard, The HISP enforces the policies specified in the DirectTrust HISP Policy (HP), and MUST use accredited RA and CA. The HCO relies on HISP, CA, and RA as accredited trusted agents, and bears ultimate responsibility for HIPAA privacy and security. How Direct works: Three separate roles and responsibilities from “trusted agents” combine to enable Direct exchange 1. 2. 3.
- 25. www.DirectTrust.org 1101 Connecticut Ave NW, Washington, DC 20036 DirectTrust Anchor Bundle for “scaling” of trust relationships Trust Community Anchor Distribution Site Bu Trust Bundle (PKCS7) HISP B Trust Store HISP C Trust Store HISP D Trust Store HISP A Trust Store HTTP(S) As of September, 2013, there are 10 accredited HISPs’ trust anchors in the Trust Anchor Bundle, leveraging 90 separate connections between the HISPs, and linking over 1,000 health care organizations to the DirectTrust network. https://bundles.directtrust.org
- 26. www.DirectTrust.org 1101 Connecticut Ave NW, Washington, DC 20036 Accredited Organizations 26 Full Accreditation • Cerner Corporation* • Informatics Corporation of America* • MaxMD* • Surescripts * • Inpriva, Inc.* •DigiCert* Candidate Accreditation • CareAccord • Covisint • Data Motion Inc.* •EMR Direct* • iMedicor • Informedtrix* •MRO Corporation • MedAllies • Secure Exchange Solutions • Simplicity Health Systems • Updox •Utah Health Information Network *Organizations anchor certificate is in the trust bundle
- 27. www.DirectTrust.org 1101 Connecticut Ave NW, Washington, DC 20036 DirectTrust members have established a standards‐based approach to trusted Direct exchange over the Internet 27 The goal is to make it easy and inexpensive for trusted agents, e.g. HISPs, CAs, and RAs to voluntarily follow the “rules of the road” for privacy, security, and trust-in-identity controls, while also easily and inexpensively knowing who else is following them. Security & Trust Framework EHNAC‐ DirectTrust Accreditation Program Trust Anchor Bundle Distribution
- 28. www.DirectTrust.org 1101 Connecticut Ave NW, Washington, DC 20036 Questions for EHR vendors • Has the software version of the EHR in use been fully certified for Stage 2 MU, including for compliance with Direct exchange? • Are the HISP, CA, and RA all accredited by EHNAC‐DirectTrust? • How will the Direct exchange “module” in the new EHR version fit into current workflows? • What will Direct integration for both transitions of care and for patient “view, download, and transmit” measures cost? • Is the EHR vendor going to offer HISP, CA, and RA services, or work with third parties? Will we have a choice as to what companies fill these roles? • How can we find the Direct addresses of parties with whom we wish to exchange via Direct?
- 29. www.DirectTrust.org 1101 Connecticut Ave NW, Washington, DC 20036 Specific business issues for HISPs, CAs, and RAs • Pricing • Support practices • Insurance and liability • BA and BAA • Notice when HISP communicates with non‐ accredited party • Support for custom domains • User documentation • Uniform agreement, ie. Federation Agreement with DirectTrust
- 31. www.DirectTrust.org 1101 Connecticut Ave NW, Washington, DC 20036 Short lexicon of terms Health Information Service Provider, HISP An entity or service providing its subscribers Direct accounts, addresses and secure, encrypted exchange of messages between users within the same domain, and also with users in different domains, that is, who are subscribers of different HISPs. It is typically also the responsibility for a HISP to arrange for its subscribers’ identity proofing and verification (the Registration Authority function) and for its subscribers’ digital certificate issuance and management (the Certificate Authority function). HISPs may be organized along several different business models. For example, an EHR technology vendor may operate a HISP internally for its customers. A so‐called “full service” HISP may operate a stand alone business, and partner with several EHRs as well as offer its Direct services through a web portal or other set of tools and devices.