Query Health Operations WG Face-to-Face Meeting 0ctober 18 & 19, 2011

Agenda Introductions & Meeting Objectives Overview of F2F Agenda Rules of the Road Review of Operations Workgroup Goals Discussion of Operational Requirements for Query Health Document Reference Materials HITPC Tiger Team Recommendations Policy Sandbox 2

Introductions & Meeting Objectives Introductions Name Organization How many miles did you travel to be at the F2F? Meeting Objectives Finalize the Operational Requirements for Query Health Document Discuss Data Use Agreement Template (time permitting) 3

Agenda for Tuesday, October 18th TimeSession Location 8:00AM – 9:00AMFull S&I Framework MeetingRegency Ballroom 9:00AM – 10:00AMQuery Health Initiative OverviewRegency Rooms C&D 10:15AM – 12:00PM Query Health Operations WG Breakout Regency Room D 12:00PM – 1:30PMLunch Break 1:30PM – 3:00PM Query Health Operations WG Breakout Regency Room D 3:15PM – 5:30PMQuery Health Operations WG BreakoutRegency Room D 4

Agenda for Wednesday, October 19th TimeSession Location 8:00AM – 10:00AMQuery Health Operations WG BreakoutRegency Room D 10:15AM – 12:00PMQuery Health Implementation WG MeetingRegency Room 12:00PM – 1:30PMLunch Break 1:30PM – 3:00PMQuery Health Operations WG BreakoutRegency Room D 3:15PM – 4:30PMQuery Health Operations WG BreakoutRegency Room D 4:30PM – 5:30PMJoint Query Health WG Closing ReviewRegency Room 5

Rules of the Road Be present at the meeting by limiting side conversations and closing computer Be respectful of others Be mindful of how much you are contributing to the conversation in comparison to others Facilitators reserve the right to parking lot issues for resolution at another date Thank you for volunteering with the Query Health Initiative! We understand if you need to step out briefly to address other business issues. 6

Defined Goals of Operations Workgroup Documented and Detailed the Operations Requirements for User Stories and inclusion in the Use Case and Requirements document being prepared by Clinical Workgroup; Ensure linkage between the Query Health Initiative and the guidance received from the Health IT Policy Committee (HITPC) and the Privacy and Security Tiger Team, and; Preparation of guidance documents (as prioritized by the work group), such as those related to: Adherence to privacy and security requirements and considerations; Evaluation of transaction cost / time to implement distributed queries; Other operational guidance (or feedback to other responsible groups) Review of Operations Workgroup Goals 7

Operational Requirements for Query Health Finalize Best Practice Considerations (Section 2.4) Finalize the following sections: Regulatory Issues (Section 2.5) Assumptions (Section 5.0) Risks, Issues, and Obstacles (Section 13.0) 8

Reference Materials 9

Public Health Considerations: Query Health should not substitute new Data Use Agreements or other restrictions and agreements to Public Health Public Health should not be equated with research and has well established rules and accountability. Any Public Health Query must be evaluated for feasibility and urgency of responses. Clarification around the use of PHI: For a public health permitted use, individually identifiable health information may be provided by the disclosing entity to the public health agency consistent with applicable law and regulation. Restrictions on Data Use: There should be clear agreement between the data source and the information request covering use or reuse of the query result data. The Data Use Agreement should permit follow-up queries based on previous query results as long as the data source controls all decisions to release data. Pilots Considerations The use of pilots is particularly valuable for uncovering issues with the sandbox restrictions, data use agreements and governance that can be addressed as policy issues by the HITPC. Recommendations from HITPC for the Operations WG 10

Policy Sandbox Query requests and responses shall be implemented in the pilot to use the least identifiable form of health data necessary in the aggregate within the following guidelines: 1.Disclosing Entity: Queries and results will be under the control of the disclosing entity (e.g., manual or automated publish / subscribe model). 2.Data Exchange: Data will be either 1) mock or test data, 2) de-identified data sets or limited data sets each with data use agreements 1 or 3) a public health permitted use 2 under state or federal law and regulation. 3.Small cells: For other than regulated/permitted use purposes, cells with less than 5 observations in a cell shall be blurred by methods that reduce the accuracy of the information provided 3. Query requests and responses shall be implemented in the pilot to use the least identifiable form of health data necessary in the aggregate within the following guidelines: 1.Disclosing Entity: Queries and results will be under the control of the disclosing entity (e.g., manual or automated publish / subscribe model). 2.Data Exchange: Data will be either 1) mock or test data, 2) de-identified data sets or limited data sets each with data use agreements 1 or 3) a public health permitted use 2 under state or federal law and regulation. 3.Small cells: For other than regulated/permitted use purposes, cells with less than 5 observations in a cell shall be blurred by methods that reduce the accuracy of the information provided 3. Notes: 1.It is understood that de-identified data sets do not require a data use agreement, but in the abundance of caution, and unless otherwise guided by the Tiger Team or HIT Policy Committee, the pilot will have data use agreements for de-identified data 2.For a public health permitted use, individually identifiable health information may be provided by the disclosing entity to the public health agency consistent with applicable law and regulation. 3.The CDC-CSTE Intergovernmental Data Release Guidelines Working Group has recommended limiting cell size to three counts presuming a sufficiently large population. This is also reflected in Guidelines for Working with Small Numbers used by several states. 11