1. esMD Author of Record L1 Use Case Meeting Wednesday, July 25, 2012

2. Meeting Etiquette Please announce your name each time prior to making comments or suggestions during the call Remember: If you are not speaking keep your phone on mute Do not put your phone on hold – if you need to take a call, hang up and dial in again when finished with your other call –Hold = Elevator Music = very frustrated speakers and participants This meeting, like all of our meetings, is being recorded –Another reason to keep your phone on mute when not speaking! Feel free to use the “Chat” or “Q&A” feature for questions or comments NOTE: This meeting is being recorded and will be posted on the esMD Wiki page after the meeting From S&I Framework to Participants: Hi everyone: remember to keep your phone on mute 2

3. Use Case Overview Agenda AgendaPresenterTime Frame General Announcements & Reminders Meeting Recap (7/20) and Today’s tasks Sweta Ladwa1:30 – 1:40 AoR Use Case Review feedback for Draft AoR Context Diagram & In-Scope and Out of Scope items Keith Salzman Lenel James 1:40 – 2:00 Introduce Glossary of Terms, Actors & Roles, Communities of Interest, and User Story Review Subworkgroup proposed structure and obtain community feedback Presha Patel Bob Dieterle Dan Kalwa 2:00 – 2:25 Weekly schedule moving forward Next Steps Presha Patel2:50 – 3:00 QuestionsAll 3

4. Announcements The Author of Record Charter is now consensus approved and available on the esMD Wiki. Thanks to everyone who took the time to review the AoR Charter and for providing their consensus votes. 4

5. Recap of Last Week Kicked off the Author of Record Level 1 Use Case Workgroup Reviewed Draft Context Diagram »Lenel James and Keith Salzman volunteered to provide feedback Reviewed draft In-Scope/Out-of-scope items Preliminarily reviewed approaches for the four proposed Sub- Workgroups 5

6. Today’s Objectives Review community feedback from the homework items from last week Introduce the draft User Story, Actors and Roles, Communities of Interest, and Glossary of Terms Discussion of the Sub-workgroups introduced last week 6

7. Provider Entity Payer Entity AoR L1 – Draft Context Diagram Digital Identities and Bundle Level Signatures Payer Provider (Individual or Organization) Provider (Individual or Organization) Contractors / Intermediaries Agent Payer Internal System Gateway esMD UC 2: Secure eMDR Transmission esMD UC 1: Provider Registration esMD AoR Level 1 Digital Identities Bundle Signatures Digital Signature on Aggregated Document Bundle Certificate Authoritity Registration Authority External Provider Directory External Provider Directory 7

8. Scope AoR (L1) In Scope Identity Proofing as part of Non-Repudiation of Actor Identity Digital Credential Management required for Non- Repudiation Actions (Signing and Delegation), Data Integrity and Encryption Digital Signatures and Signature Artifacts for Identity and Non-Repudiation Digital Credentials and Artifacts for Non- Repudiation of Delegation as required by UC1 and AoR L1 Data Integrity requirement actions and artifacts Encryption of PHI requirements Interactions between Provider Entity or Payer Entity and : Certificate Authority Registration Authority External Provider Directory And each other Out of Scope Interactions between: Payer and its Payer Contractors Provider and its Agent Payer or Payer Contractor and its Gateway Transaction level encryption Document level signatures and individual contribution signatures Defining delegation of rights within and between Providers and other authors 8

9. Introductions to the next few Use Case Sections Glossary of Terms Communities of Interest Actors & Roles User Stories 9

10. Glossary of Terms Posted here - http://wiki.siframework.org/AoR+L1+Use+Case+-+Glossary+of+Termshttp://wiki.siframework.org/AoR+L1+Use+Case+-+Glossary+of+Terms 10

11. Communities of Interest Section Description: The Communities of Interest section identifies relevant stakeholders that are potentially affected by the content of the Use Case. This list may vary per Initiative, but the stakeholder definitions will be consistent throughout the S&I Framework (where appropriate), as defined by the Use Case Simplification Workgroup (examples included below). Wiki link - http://wiki.siframework.org/UC+Simplification+- +Stakeholder+Classification+SWG http://wiki.siframework.org/UC+Simplification+- +Stakeholder+Classification+SWG 11 Members of Communities of Interest 1Individual Providers 2Provider Organizations 3Healthcare Administrators and Managers 4Payer Contractors 5Payers 6EHR/EMR/PHR Vendors 7Other Healthcare Vendors 8Patients 9Certificate Authority 10Registration Authority 11Standards Organizations 12Licensing and Certification Organizations 13Operating Rule Authoring Entities 14Beacon Communities 15Federal Agencies 16 Agent - (Clearing Houses and other entities as defined by Health Insurance Portability and Accountability Act (HIPAA) including Health Information Handlers) 17HIE / HIO 18Regional Extension Centers (REC) 19Health Information Service Providers

12. Actors and Roles Table (1 of 2) This table outlines the business actors that are participants in the information exchange requirements for each scenario. A business actor is a person or organization that directly participates in a scenario. Thus, as a person or organization, the actor can (and should) be a stakeholder. NOTE: A Business Actor may be a Stakeholder and also can have more than one role. 12 ActorSystemRole Provider Entity An individual provider A group of providers A Hospital/Health System or An Agent on their behalf Provider Information System Send Registration request to Payer Organization receive eMDRs Receive eMDRs from Payer Entity Send documents in response to eMDR Digitally attest to document submission Payer Entity Payer Payer Contractor Payer Gateway Payer Information System Send eMDR to Provider Entity Digitally authenticate submission of information to Provider Entity

13. Actors and Roles Table (2 of 2) This table outlines the business actors that are participants in the information exchange requirements for each scenario. A business actor is a person or organization that directly participates in a scenario. Thus, as a person or organization, the actor can (and should) be a stakeholder. NOTE: A Business Actor may be a Stakeholder and also can have more than one role. 13 ActorSystemRole Certificate Authority CA Information System Creates, Issues and manages security credentials and revocation lists May provide RA services Registration Authority RA Information System May assist in completion of information required to obtain a certificate Provides Identity proofing External Provider DirectoryProvider Directory Stores and manage Provider Information / ESI Responds to queries for Provider Information Provides appropriate ESI to receive eMDRs

14. User Story / Workflow Overall User Story Components 1)All Actors obtain and maintain a non-repudiation digital identity 2)Provider registers for esMD (see UC1)* 3)Payer requests documentation (see UC2)* 4)Provider submits digitally signed document (bundle) to address request by payer 5)Payer validates submission artifacts *User Stories for esMD UC 1 and 2 have already been defined. Workgroup will help further define bullets 1), 4), and 5) 14

15. Draft User Story Content (1 of 2) User Story Components Suggested steps in the process 1. Establishing Digital Identity All Actors (Payer and Provider Entities) obtain and maintain a non- repudiation digital identity using a similar process as outlined below 1.All Actors Initiate Request to obtain Certificate from a Federal Bridge cross certified Certificate Authority (CA) 2.Identity Information is sent by requestor and reviewed by Registration Authority (RA) 3.RA approves( or rejects) the requests and sends approved request to CA 4.CA generates and issues the credentials and sends notice to Actor 5.Actors obtain credentials and incorporate into their business process 2. Provider registers for esMD (see UC1) Note – May need to abbreviate the UC1 User Story Provider Entity submits request to Payer Entity to received electronic medical documentation requests (eMDR) Payer Entity checks providers ability to receive an electronic request Payer Entity requests and receives Electronic Service Information (ESI) Provider Entity is either confirmed or rejected to receive eMDRs by Payer Entity 15

16. Draft User Story Content (2 of 2) User Story Components Suggested Steps in the process 3. Payer requests documentation (see UC2)* Note – May need to abbreviate the UC2 User Story Payer Entity identifies a need for additional documentation for a claim Payer Entity checks to see if Provider Entity is registered to receive eMDR Payer Entity requests and receives current ESI from External Provider Directory for Provider Entity Payer Entity sends eMDR to provider 4. Submission of Document Bundle Provider Entity collects and combines requested patient documentation for claim Provider Entity digitally signs the entire document bundle keeping in mind Delegation of Rights to the signer by registered provider entity Signatures and Delegation of Rights must provide Non Repudiation Signature Artifacts must ensure that data integrity of document bundle is assured Provider Entity submits digitally signed document bundle to address request by payer 16

17. Draft User Story Content (2 of 2) User Story Components Suggested Steps in the process 5. Payer validates submission artifacts Validates Digital Certificate(s) and chain to Federal Bridge Validates delegation of rights if required Validates signer or rights delegation is registered provider Validates signature artifact Decrypts hash of document bundle and validates data integrity 17

18. AoR Subworkgroup Discussion Dan Kalwa & Bob Dieterle 18

19. Areas to Address (Recap from 7/20) Use Case TopicUC1: RegistrationUC2: eMDRAoR L1 Bundle Identity Proofing Required Digital Identity Management Required Digital Signatures & Signature Artifacts Required Delegation of Rights RequiredNot RequiredOptional PHI Encryption Not ApplicableRequiredTBD Other Topics Characteristics of solution Non-Repudiation* Required Characteristics of solution Data Integrity** Required Provider Directories Required TBD 19 *Non-repudiation (NIST) - Non-repudiation is a service that is used to provide assurance of the integrity and origin of data in such a way that the integrity and origin can be verified by a third party. This service prevents an entity from successfully denying involvement in a previous action. **Data Integrity (NIST) - Data integrity is a property whereby data has not been altered in an unauthorized manner since it was created, transmitted or stored. Alteration includes the insertion, deletion and substitution of data.

20. User Story Components / Workflow / Sub-workgroups (4) 1. Identity Proofing Federal Bridge / NIST Level 3 Individual and Organization Proof of identity requirements Allowed proofing processes 2. Digital Credentials Issuance Credential types and forms Credential uses (Identity, Signing, Proxy, Encryption, Data Integrity) Specific use credentials (e.g. Direct) Maintenance requirements Revocation 3. Signing Transaction and AoR L1 Workflow Artifacts 4. Delegation and Proxy Credential approach Delegation process Use and limitations on Use Revocation Note - Sub-workgroup leaders, charge, meeting schedule, and deliverables is TBD at this time 20

21. User Story -- Additional Components / Workflow Provider Directories (required for entire initiative) Information requirements Interactions (transactions) Entry validation standards Use and limitations on use esMD Policy Issues (following report from SWG 1-4) Requiring digital identities Requiring digital signing of transactions Requiring digital signing of submission Implications of attestation Other General Issues Non-repudiation Data integrity PHI encryption 21

22. Get Involved in the SWGs! Subworkgroup NameInterested Parties / Volunteers 1Identity Proofing 2Digital Credentials 3Signing 4Delegation and Proxy 22

23. SUNDAYMONDAYTUESDAYWEDNESDAYTHURSDAYFRIDAYSATURDAY 1234567 891011121314 15161718192021 22232425262728 29 3031 *Schedule and Timeline is subject to change AoR Use Case Schedule and Timeline* Note – Weekly Meetings on Wednesdays and Fridays July 2012 Use Case Kick Off UC Overview Context Diagrams Areas to Address In-Scope/Out-of-Scope Introduce SWG 23 HW items for 7/24 Review and provide feedback on 7/20 discussion Review HW items Glossary of Terms Communities of Interest Actors & Roles User Story Review 7/25 items Discuss detailed charge of each SWG Assumptions Pre Conditions Post Conditions HW items for 8/1 Review and provide feedback on 7/25 & 7/27 discussions

24. Next Steps / Reminders Need Volunteers to review the following by Friday 7/27 –Glossary Review http://wiki.siframework.org/AoR+L1+Use+Case+-+Glossary+of+Terms http://wiki.siframework.org/AoR+L1+Use+Case+-+Glossary+of+Terms –Communities of Interest for any that we have not identified –Actors and Roles Need Volunteers to draft a first pass for the following by next Wednesday 8/1 –User Story based on the bullets presented earlier 24