So You Think You Can Prescribe? (Electronically) Andrew Premvardhan & Rachel Hiatt, Product Analysts April 2015

Today’s Agenda Electronic Prescribing of Controlled Substances (EPCS) Overview Regulatory and All that Jazz Modern Design Hip Hop through Prescriptions Demo Q&A

EPCS in Centricity™ Practice Solution 12.2 / Centricity EMR 9.10 Includes Support for Electronic Prescribing of Controlled Substances (EPCS) 12.1 / 9.9 Fixes and Enhancements New Family History/Social History Form Simplified Installation LA tracking to May/June Initially Targeting Customers in NY State NYS eRx Mandate Postponed to 3/27/16 GA in Q3 to Full Installed Base Speakers: Jon Mark Peter Don Kelly Potentially Terry Panelists for Q&A: 3 seed questions to kick us off Peter to deliver the questions Ray to prioritize Kristina

Regulatory and All that Jazz

Regulatory and All that Jazz The ruling time signature (Regulatory requirements) Selecting the music (Setting up for ePrescribing)

The Ruling Time Signature: Regulatory Electronic Prescribing of Controlled Substances §1311.05 Standards for technologies for electronic transmission of orders Authentication The system must enable a recipient to positively verify the signer without direct communication with the signer and subsequently demonstrate to a third party, if needed, that the sender’s identify was properly verified. Nonrepudiation The system must ensure that strong and substantial evidence is available to the recipient of the sender’s identify, sufficient to prevent the sender from successfully denying having sent the data. This criterion includes the ability of a third party vendor to verify the origin of the document. Message Integrity The system must ensure that the recipient, or a third party, can determine whether the contents of the document have been altered during transmission or after receipt.

The Ruling Time Signature: Regulatory In 2011, the #1 source of nonmedical use of prescription painkillers was a single doctor.1 1. Source: ONDCP National Survey on Drug Use and Health 2011, pg. 29: https://www.whitehouse.gov/sites/default/files/ondcp/policy-and-research/nsduhresults2011.pdf

The Ruling Time Signature: Regulatory Increasing legislation to combat drug abuse Source: CDC Vital Signs http://www.cdc.gov/vitalsigns/opioid-prescribing/infographic.html#infographic2

Selecting the Music: Setting up for ePrescribing Capability to enroll and approve providers Capability to disable and revoke users Administration Capability to add controlled substances Capability to capture 2nd factor authentication New HTML Renewal Form Prescribing Monthly and ad-hoc EPCS reports Activity Logs Record Keeping

PRESCRIBE TRANSMIT DISPENSE ENCRYPTED FIPS PUB 140-2 NIST 800-53 REPORTS FIPS PUB 140-2 NIST 800-53 INCIDENT RECORDS COMPARE HASH FIPS PUB 186-3 FIPS PUB 180-3 PRESCRIBE TRANSMIT DISPENSE AUTHENTICATION MGMT COMPLETED eRx DELIVERED eRx AUTHENTICATE NIST 800-63-1-Electronic Authentication Guideline NIST 800-76-1-Biometric Data Specification FIPS 186-3 – Digital Signature Standard FIPS 140-2 Security for Cryptographic Modules NIST 800-53 –Security and Privacy Controls FIPS 180-3 – Secure Hash Standard NIST 800-63-1 NIST 800-76-1 ORDER SIGN Descriptions of Future Functionality reflect current product direction, are for informational purposes only and do not constitute a commitment to provide specific functionality. Timing and availability remain at GE’s discretion and are subject to change and applicable regulatory clearance.

Selecting the Music: EPCS Requirements AUTHENICATION MANAGEMENT Selecting the Music: EPCS Requirements Identity Proofing Institutional or Individual Identity Proofing Credentialing Two-Factor Using Fingerprint or Token with Password Access Control  Configure and Approve Access in the EMR Auditing Audit Trail of All Activities

Two Types of Identity Proofing and Credentialing AUTHENICATION MANAGEMENT Two Types of Identity Proofing and Credentialing Institutional Identity Proofing “[The DEA] allows institutional practitioners, which are themselves DEA registrants, to conduct the identity proofing for any individual practitioner whom the institutional practitioner is granting access to issue prescriptions using the institution’s electronic prescribing application.” Individual Identify Proofing “For individual practitioners in private practice (i.e., those practitioners not seeking access to an institutional practitioner’s applications), DEA will use existing certification authorities (CAs) and similar credential service providers (CSPs) that have been approved by a Federal authority.”

Institutional Credentialing AUTHENICATION MANAGEMENT Institutional Credentialing Information Technology Synchronizes Imprivata® Confirm ID with AD accounts of practitioners Verifies practitioners are licensed and allowed to prescribe controlled substances Medical Credentialing Office Creates a list of practitioners that are allowed to electronically prescribe controlled substances Creates a list of users that can approve EPCS access in the EMR Sets EPCS access for practitioners in EMR that has been certified for EPCS EMR Administrator EMR Administrators must be a different entity/group than the Medical Credentialing Office Verifies photo IDs of practitioners match those on the list from the credentialing office Issues two-factor credentials to practitioners and supervises enrollment of credentials in Imprivata® Confirm ID Imprivata® Confirm ID creates records of IDs verified and issuance of credentials Enrollment Supervisors EPCS Access Approvers Approves EPCS access for practitioners in the EMR (does not require two factor authentication)  Approvers must be a different group than the EMR Admins (DEA registrants not required) EPCS

Individual Credentialing AUTHENICATION MANAGEMENT Individual Credentialing Imprivata® Confirm ID performs NIST Level 3 identity-proofing of practitioners using social security number, date of birth and credit card information Credential Service Provider Imprivata® Confirm ID registers and issues tokens to practitioners via two channels Practitioners can optionally self-enroll fingerprints with Imprivata® Confirm ID Imprivata® Confirm ID automatically creates records of issuance of credentials Information Technology Synchronizes Imprivata® Confirm ID with AD accounts of practitioners AD accounts must include the full legal name of practitioners and valid e-mail addresses Sets EPCS access for practitioners in EMR that has been certified for EPCS EMR Administrator EMR Administrators must be a different entity/group than the Credential Service Provider EPCS Access Approvers Approves EPCS access for practitioners in the EMR using Imprivata® Confirm ID two factor authentication  Approvers must be a different group than the EMR Admins (DEA registrants required) EPCS

Implementation Action Items AUTHENICATION MANAGEMENT Implementation Action Items List of practitioners who will require EPCS (AD group(s)) Credentials that will be issued (fingerprint vs. token) List of enrollment supervisors for institutional identity proofing List of EMR EPCS access approvers for individual identity proofing List of users who will Enroll users in the EMR List of users who will Approve users in the EMR Credentialing Team verifies approval checklist Identify Reviewer for EPCS Reports Identify eRx Administrator

Authentication Regulations Application uses an authentication protocol that uses two of the following three factors: Something the practitioner knows <password> Something the practitioner has <token> Something the practitioner is <fingerprint> Fingerprint readers and tokens (compliant with FIPS and NIST standards ) tokens must be separate from the computer used for prescription biometric must be co-located or built in to the computer used for prescription Application allows a practitioner to sign multiple prescriptions for a single patient Only prescribing practitioner is allowed to sign Surescripts® Requirement Prescriber vendors shall display a summary screen in order to allow the prescriber to review the prescription and ensure that it contains the correct information before it is sent to the pharmacy. must meet at least the criteria of FIPS 140–2 Security Level 1 Biometric devices NIST SP 800-76-1 as Testing should provide at least 95% confidence on false match rate

Modern Design

Modern Design Designing the steps (Designing for the users) Finding the right partners (Partnering for usability)

Modern Design: Research, Design, Test, Repeat Design Review & Revision Round 1 May-Jun 2014 Reviews with clinical specialists Patient Safety design evaluation Renewal Form Internal Review Regulatory Requirements Usability Tests Design Revision Design Revision Round 2 Sept 2014 Usability analysis Design simplification Formative Usability Round 1 Jul-Aug 2014 Three focused workflows 17 participants Regulatory Review Jul-Aug 2014 Surescripts® review Requirements analysis

Modern Design: Prototype 1: May-Aug 2014

Modern Design: Key Observations Focal point for medication management Data organization is critical for processing information Providers need maximum space to see all medications

Modern Design: Evolved Design Remove extra ‘Outgoing ePrescriptions’ list Make medication-disease connections obvious Make pharmacy changes simple Improve visibility of chart information without compromising prescription real estate

Hip-Hop Through Prescriptions

Hip-Hop Through Prescriptions Dancing with the legends Prescribing legend drugs electronically Dancing with control Prescribing controlled substances electronically

Demo

Questions?