Nationwide Health Information Network Exchange and the SSA Patient Authorization June 18, 2012

SSA Background Over 3 million initial disability applications a year Over 15 million requests for medical evidence each year (3-4 medical records per case) 500,000 sources: doctors, hospitals, etc SSA is not a HIPAA covered entity Require a patients authorization to obtain medical records Initial Federal Agency on the Nationwide Health Information Network (NwHIN) Exchange 2

Authorized Release of Information to a Trusted Entity Use Case Use Case Scenario – Social Security Administration requests medical documentation from a healthcare provider with the patients authorization 3 Claimant SSA/DDS Providers File Disability Claim Request Evidence Claim Determination Medical Evidence Patient Authorization

SSA – 827 (Patient Authorization) Requestor Responder Purpose Effective Date Effective Timeframe Type of Information Requested Signed 4

NwHIN Specifications & Standards Content Structure – HL7 CDA Release 2 CCD – HITSP C32 – HITSP C62 – Unstructured Documents (pdf, txt, doc, tif, jpg, gif, png) Vocabulary & Code Sets – ICD-9-CM – Systematized Nomenclature of Medicine--Clinical Terms (SNOMED-CT) – Logistical Observation Identifiers names and Codes (LOINC) 5 Consent Structure – IHE Basic Patient Privacy Consents Transport and Security – Messaging Platform – Authorization Framework – Patient Discovery – Query for Documents – Retrieve Documents – Access Consent Policy

NwHIN Exchange Transaction Flow 6 Patient Authorization Clinical Documents

Security Assertion Subject ID - MEGAHIT Subject Organization - Social Security Administration Subject Organization ID Subject Role - SNOMED-CT ( ) – Social Worker Purpose of Use - Coverage Patient Identifier – encoded per the NwHIN Authorization Framework specification 7

Authorization Decision Statement NwHIN Exchange uses a Authorization Decision Statement to allow an entity to assert the requester should be permitted to execute the transaction based on a specific security policy Access Consent Policy and Authorization Framework specifications define the format of the policy 8

Access Consent Policy XDS Metadata XDS MetadataValue availabilityStatusurn:oasis:names:tc:ebxml-regrep:StatusType:Approved classCode (LOINC) classCode DisplayNamePrivacy Policy Acknowledgement confidentialityCodeN (Normal) formatCodeurn:ihe:iti:bppc-sd:2007 formatCode codeSystem healthcareFacilityTypeCode (SNOMED CT code for Not Applicable) mimeTypetext/xml practiceSettingCode (SNOMED CT code for Not Applicable) serviceStartTimeEffective start date of privacy policy (authorization) serviceStopTimeEffective end date of privacy policy (authorization) TitleAUTHORIZATION TO DISCLOSE INFORMATION TO THE SOCIAL SECURITY ADMINISTRATION 9

Questions 10

For Further Information Contact - Marty Prahl at - Bob Hastings at 11

Reference Materials NwHIN Exchange Technical Specifications (all of the specifications can be found at Patient Discovery (requestor only) - ry_Production_Specification_v2_0.pdf ry_Production_Specification_v2_0.pdf Query for Documents (requestor only) - entsProductionSpecification_v3_0.pdf entsProductionSpecification_v3_0.pdf Retrieve Documents (requestor only) - ents_Production_Specification_v3_0.pdf ents_Production_Specification_v3_0.pdf Access Consent Policy (responder only) - oliciesProductionSpecification_v1_0.pdf oliciesProductionSpecification_v1_0.pdf Core Capabilities that support the above transactions Messaging Platform - rmProductionSpecification_v3_0.pdf rmProductionSpecification_v3_0.pdf Authorization Framework - meworkProductionSpecification_v3_0.pdf meworkProductionSpecification_v3_0.pdf 12