Automate Blue Button Initiative Push Workgroup Meeting December 17, 2012

Meeting Etiquette Remember: If you are not speaking, please keep your phone on mute Do not put your phone on hold. If you need to take a call, hang up and dial in again when finished with your other call o Hold = Elevator Music = frustrated speakers and participants This meeting is being recorded o Another reason to keep your phone on mute when not speaking Use the “Chat” feature for questions, comments and items you would like the moderator or other participants to know. o Send comments to All Panelists so they can be addressed publically in the chat, or discussed in the meeting (as appropriate). From S&I Framework to Participants: Hi everyone: remember to keep your phone on mute All Panelists 2

Agenda TopicTime Allotted Announcements, Timeline3 minutes Summary of Push Progress & Feedback from Annual Meeting5 minutes Blue Button Trust Bundle35 minutes Strawman: Sending via 15 minutes Next Steps / Reminders2 minutes 3

Announcements and Reminders 4 Meeting Reminders – Push Workgroup Meetings are Mondays from 2:00 – 3:00 pm Eastern. – Monday, December 24 th and December 31 st Push WG calls are cancelled. – Next PUSH Workgroup Meeting is Monday, January 7th, 2:00 pm Eastern. – The next Community Meeting will be held as needed. – Meeting information is on the Automate Blue Button Wiki Page: Community Homework – Provide comments and feedback on the Push Implementation Guides: dback – Identify 5 people that you know are interested in ABBI to share the Implementation Guide link with

Looking Forward ABBI Schedule November – October 22- November 19: Drafting and comment period on ABBI Implementation Guide (Part 1: Send via Direct + Content) – Nov 19 th : BEGIN Comment Period Round 2 on ABBI Implementation Guide (Part 1: Send via Direct, Content) – 26 th : Discuss Comments in workgroup calls – 28 th : END Comment Period on ABBI IG (Part 1) December – 3 rd : Review Implementation Guide Comments in Workgroup Calls and Finalize Guide – 6 th : ABBI Participates in Connect-a-thon – 10 th : “Public Release” of ABBI Implementation Guide (Part 1) – 11 th : ABBI Participates in Town ONC Annual Meeting – 21 st : BEGIN Comment Period on ABBI Implementation Guide (Part 2: Send via , Payer Content, and Developer Toolkit) January – ~ 10 th : END Comment Period on ABBI Implementation Guide (Part 2) – ~ 15 th : Release ABBI Implementation Guide (Part 2) – All of January: Testing Period; Identify and Respond to Reference Implementations February – Testing Period; Identify and Respond to Reference Implementations March – Complete Testing Period – HIMSS: Showcase ABBI Implementations – Release Final Automate Blue Button v2 Implementation Guide (Part 1 and Part 2 listed above)

Push and Content – Progress Over 3 Months Aug 20 – Scoping WorkgroupSep 14 – Deep Discussion

Push and Content – Progress Over 3 Months Oct 15 – Use Cases for PushNov 15 – Drafting Guide

Push and Content – Progress Over 3 Months Today – Implementation Guide

Integrating Feedback from Direct Objective: To ensure consumers can get their personal health data to their third party applications/locations. Additions: – Pulling Trust Anchors from Bundle – 3 rd Party Locations – Participate in Bundle – Bundle Strawman – HTTPS + PKCS7 (.P7B) – Senders signs w. an EV Certificate

Integrating Feedback from Direct

Trust Bundle ABBI implementation guide requires dataholders to download a “trust bundle” (or bundles) of certificates from 3 rd party apps and services. Only 3 rd parties that are in the trust bundle will be able to receive ABBI - PUSH Direct messages. Trust bundle requires: – 1) Policy & criteria for inclusion, – 2) Organization(s) to manage trust bundles, and – 3) Technical specifications for hosting and accessing trust bundles

1) Policy and Criteria for Inclusion Suggestions on Policy & Criteria? – PUSH is about enabling access, and letting the consumer choose which 3 rd party apps to use (not us choosing for them) – What is our minimum obligation to the consumer given that premise?

1) Policy and Criteria for Inclusion Proposal: – Ensure that companies disclose their privacy practices to the consumer and make them available online. This brings 3 rd parties under the jurisdiction of FTC. Can use the ONC Model Privacy Notice as a best practice, and evolve it over time (see next slide). – Ensure that companies use HTTPS to transmit data

1) Policy and Criteria for Inclusion

2) Organization(s) to manage trust bundles Criteria for organizations to host trust bundle: – Technical infrastructure to automatically update, host, and exchange bundles. – Non-profit, and this function not considered a profit- generating opportunity. – Non-partisan: that is, not affiliated with any particular stakeholder. Suggestions on organizations? – DirectTrust.org – State HIE(s) – Patient Privacy Rights

3) Technical specifications for hosting and accessing trust bundles

Thoughts for the Holidays Sending Health Information via – How can we articulate a best practice for this? – We heard suggestions in October: Packaging files in a password-protected ZIP Using PDF’s encryption feature – While we are putting the final touches on Transmit Using Direct, we should start creating strawmen for this use case. – Due: Friday, January 4 th to present at January 7 meeting

Next Steps / Reminders 18 Next Steps – Feedback on Policy & Criteria - Wednesday – Suggestions on Sponsoring Organization - Wednesday – Push using Implementation Guide – January 2013 – Reference Implementations / Pilots Meeting Reminders – Push WG meetings for December 24 th and December 31 st are cancelled. – Next PUSH Workgroup Meeting is Monday, January 7th, 2:00 pm Eastern. – The next Community Meeting will be held as needed. – For questions, please contact your support leads – Initiative Coordinator: Pierce Graham-Jones – Presidential Innovation Fellow: Ryan Panchadsaram – Project Manager: Jennifer Brush – S&I Admin: Apurva Dharia