Practice EDI Administrator’s Workshop Pathology Messaging Implementation Programme (PMIP)

Objectives of the Day Introduce the HA/local team Overview of the project – nationally Overview of the project – locally The practice EDI administrator: Roles and responsibilities Cryptography requirements in the practice Practice installation testing using “NMAS” Testing with local labs The practice implementation pack

The > Team Introduce the Presenter(s) Introduce the Project Manager Who is involved at the HA/PCGs/PCTs Who is involved from the Trusts/labs

PMIP National Overview Clinically safe and robust without information loss, substitution or addition  Builds upon NHS and supplier experience of Pathology links All practices enabled to electronically receive pathology results for:  Haematology, Biochemistry and Microbiology All NHS pathology laboratories in Trusts to be sending messages for the above disciplines to the new standard within the time-scale  PHLS are also planning implementation

PMIP Implementation “Road Map” 60% of practices enabled by Mar ’02  Need to tackle the huge job of 8,800 practices upgrades independent of labs  Work with suppliers to upgrade and test 100% of practices enabled by Dec ’02  Labs must undergo through testing  Concerned with proven ability to receive messages from local labs Local “Benefits Realisation”  Introducing procedural changes for the practice team  Starting daily use of pathology messages by the practice  Maximising use and value of pathology messaging

PMIP – The Benefits Improved privacy and confidentiality Improved data quality Improved tracking and auditing of results Improved legibility of results Improved local clinical analysis Capability to set alert facilities Enhanced efficiency at practices Time reduction spent locally searching for records and results

PMIP –The New Bits Developed by users, suppliers and centre Acknowledgements and audit trails “Cryptography” (scrambling of data) RFA 99 v1.1 for GP systems NMAS central testing system Clinical good practice guidance

PMIP – GPSS Implementation RFA 99 v1.1 upgrade and configuration Load of national dummy patient database  Enables local end to end testing Pre-configuration of NMAS as a “Trading Partner” (a local lab)  EDI S/R ID  X.400 address Systems training as required for the practice

PMIP – Local Overview Context (within the LIS) Scope (what is in/out) Plan (how is this going to be delivered) Who is responsible for what Timetable for roll out and implementation

The Practice EDI Administrator Role

Practice EDI Administrator - Primary Role Generates and administers the practice’s security keys Undertakes the formal practice installation test Administers and sets up the new/upgraded, GP clinical system’s functionality for messaging

Practice EDI Administrator - Secondary Role Acts as first point of contact for supplier installation and training Liases with the HA on Tracking Database information updates Liases with the HA and NHS trust for maintenance of the pathology messaging link Contributes to the ongoing work process changes within the practice for benefits realisation

Cryptography

Cryptography Also referred to as encryption or PKI encryption Why are we using it?  Guarantees the accuracy of the record  Satisfies the Data Protection Act and the General Medical Council about confidentiality  Enables GPs common law duty of care towards their patients

Crypto Demystified Public Keys: Anybody can use Private Key: Opens all padlocks, I have the only one

So Many Padlocks… Problems:  Lots of public keys to give out  Lots of people giving out lots of public keys  What happens if I lose my private key?  How do we manage all these damn public keys? Solution:  Public Key distribution via a “Key Server”  A means of verifying the public keys before they are made available (this IS Dr Blogg’s & Partners Key)  Ease of management of public key when cancelled or no longer trusted

Overview of the Service Tracking Database maintained by HA/PCT staff and used to register for keys Public Key Server NHSnet Labs Private Keys Practices Private Keys

Practice Role: Key Generation Pre Registration  Coordinating with RFA 99 v1.1 upgrade Requesting registration for cryptography Receiving the authentication code (direct) Receiving the reference code (from the HA) Generating the keys Re-inputting the Password  Who does it, when and in case of absence

Example Authentication Code Subject: "Electronic Pathology Messaging Security Authorisation Code". As you know, electronic pathology messaging is currently being implemented in your health community. This contains your “authorisation code” which you will need in order to set your computer system up to receive encrypted pathology messages. Please ensure that you keep the contents of this safely so as to avoid losing the information it contains. Your authorisation code is: XXX XXX XXXX To complete the set up of your system for secure pathology messaging you will also require a “reference code”. Please see below for details of how you will be provided with your reference code. Please note that both of these codes have a limited lifespan of 30 days. The authorisation code provided in this , and its associated reference code, will expire on.

Practice Role: Key Revocation Planned Revocation  Surgery closure/merger  GP system change (new EDI S/R ID) Emergency Revocation  “Disaster” or security breach Practice Policy  Who in the practice can request revocation  Who to contact when requesting revocation  How are results handled in the interim

HA Role: GP Key Revocation Planned Revocation  Via Tracking Database Emergency Revocation  Via Escalation Contacts Escalation Contacts for GPs  Who from the practice can request revocation  What procedures for authentication will be used  Will it be HA or PCT level

National Message Assurance Service (NMAS)

What is NMAS National Message Assurance Service A centrally provided tool for:  Systems suppliers  Local implementations Provides 5 services:  Message checking  Message testing  Clinical governance message checking  GP practice installation testing  RFA testing

Why is NMAS Required? Clinical safety & robustness Enable appropriate responsibility VFM – improved efficiency of testing and development Strategic – EHR and the need for standardised information

NMAS: Overview NMAS TDbase Lab Practice Testing reports & example acks Path reports and acks Path reports and testing reports Org details & updates

NMAS Practice Installation Test Conducted by Practice EDI Administrator request to NMAS Report returned to Practice EDI Administrator and GP system supplier Tracking Database automatically updated on pass Tests practice: Communication links Acknowledgement generation Cryptography Tracking Database details

End to End Testing - Overview Tests: Communication links Acknowledgement generation Cryptography Range of report types Procedures Occurs after: Lab message testing Practice installation test Uses: National dummy patients (test messages) End to end testing does not test systems

Implementing End to End Testing This will vary from HA to HA Complete this slide to reflect your own plans

Information available from the HA Leaflets: Implementation of National Standard Pathology Report Messaging in General Practice Encryption of Pathology Result Messages in General Practice Implementation Pack for General Practices Local Escalation Contact Information Project Plan By contacting ______ >

Additional Sources of Information Local trading partner agreements From your HA or Lab (clarifies responsibilities) GP system supplier handouts Shows how to generate keys and complete NMAS installation testing The national pathology website: