1. Task Force Meeting Precision Medicine Task Force February 26, 2016 Leslie Kelly Hall, Co-Chair Andy Wiesenthal, Co-Chair

2. Agenda Call to Order/Roll Call Welcome, Opening Remarks Presentations from Subject Matter Experts – National Institutes of Health (NIH) – Office of the National Coordinator for Health IT (ONC) – Q & A Recap & Next Steps Public Comment Adjourn 1

3. Precision Medicine Task Force Members MemberOrganization Co-Chairs Leslie Kelly HallHealthwise Andrew M. WiesenthalDeloitte Consulting, LLP Members Gil AlterovitzHarvard Medical School Dixie BakerMartin, Blanck, and Associates Mary BartonNational Committee for Quality Assurance (NCQA) Steven KeatingMIT Media Lab and Mechanical Engineering David McCallie, Jr.Cerner Corporation Matthew MightHarvard University Andrey OstrovskyCare at Hand Ketan ParanjapeIntel Eric RoseIntelligent Medical Objects Joyce SensmeierHealthcare Information and Management Systems Society Federal Ex Officio James BreelingVeterans Health Administration (VHA) Josh DennyNational Institutes of Health (NIH) Christina HeideDepartment of Health and Human Services / Office for Civil Rights Betsy HumphreysNational Library of Medicine (NLM) Mitra RoccaFood and Drug Administration (FDA) Jon WhiteONC ONC Staff Maya UppaluruONC – Federal Staff Lead 2

4. ONC Role in Precision Medicine Initiative Accelerate opportunities for innovative collaboration around pilots and testing of standards that support health IT interoperability for research Adopt policies and standards to support privacy and security of cohort participant data Advance standards that support a participant-driven approach to patient data contribution 3

5. Task Force Charge Identify opportunities for ONC to support our federal partners’ PMI efforts and related health IT/interoperability challenges, including National Cancer Institute, Food and Drug Administration, National Institutes of Health, and Department of Veterans Affairs. Identify opportunities for ONC to collaborate with industry and pilot the use of standards to enable data donation and patient access through APIs using standards such as FHIR and OAuth 2.0. Identify standards for uses cases to support interoperability of data types that are critical to PMI-type research and prioritize piloting the exchange of those data types based on a phased approach, that would incorporate most structured/coded data first and add additional data types in subsequent pilot phases. 4

6. Interoperability Pathways Critical to PMI 5 Lab EHR Patient EHR Research Lab Patient Minimum data set, Standards, APIs, and recommendations to facilitate interoperability

7. MeetingsTask Friday February 12, 2016 10:00 AM-11:00 AM Progress and status of current initiatives NCI – PMI-Oncology FDA – Precision FDA needs to harmonize data standards  Friday February 26, 2016 1:00 PM - 2:30 PM ONC – Computable Consent NIH – Precision Medicine Initiative Progress & Sync for Science pilots Recap and discussion of issues to explore from other agencies Wednesday March 16, 2016 1:00 PM-2:30 PM Sync for Science discussion: What are the best FHIR resources to prioritize? (e.g., meds, labs, careplans, diagnoses) Lab data interoperability/patient access gaps VA / DOD Wednesday March 30, 2016 1:00 PM-2:30 PM FDA focus Patient rights and ownership of genomic pattern data Wednesday April 13, 2016 1:00 PM-2:30 PM Demographic data: what still needs to be done to improve structured data around race, ethnicity, gender, sexual orientation? What are the highest priority demographic data types for PMI? What specific activities or pilots ONC lead to support / advance progress? Thursday April 21, 2016 1:00 PM-2:30 PM VA/DOD focus Wednesday May 11, 2016 1:00 PM-2:30 PM NCI focus Wednesday May 25, 2016 1:00 PM-2:30 PM Final recommandations discussion Friday June 3, 2016 2:00 PM-3:30 PM Final recommandations conclusion Precision Medicine Task Force Workplan 6

8. Questions to Presenters 1.What is your agency’s specific mandate and contribution to the Precision Medicine Initiative? 2.Which data types are of the highest priority for your PMI-related work? 3.What is the minimum data set required for your PMI work? 4.Please share challenges or questions related to health IT standards, interoperability, and data exchange that the PMTF could address to advance your work. For example: a)What existing health IT standards are you using in your PMI projects? i.Are there challenges to working with those standards, or gaps that should be filled? ii.Are there existing standards you might consider working with if they were modified or improved in some way? What improvements or changes would you recommend? b)Are there areas where you are exchanging data but robust standards don’t exist? What are the practical implications of standards gaps that your agency/stakeholders face? c)What pilots could be launched to enhance technical capabilities related to data standardization, data donation or transfer (i.e., interoperability of precision medicine data)? 7

9. DRAFT - Assessment of Standards Results Data Type / Transfer Readily Applicable for PMI (can be put to use to support the cohorts) Promising PMI Standards (additional effort needed to bring to use) Standards Gaps for PMI (considerable work is needed) Accelerators (opportunities to advance / improve standards) Lab to EHR Standards for genetic data going from lab to EHR (specific standards?) To be discussed Minimum data set OMIM: Phenotypes, genotypes and links Patient to EHR Open ID Connect OAuth To be discussed ONC Pilots dpSNP and ClinVar EHR to Research Global Alliance for Genomics and Health (GA4GH Common Workflow Language (CWL) Docker containers Cert Rule Standards* HL7 Family Health History/Pedigree FHIR Human Phenome Ontology (HPO) IHE XUA, IUA** IOM Genomics Roundtable, GA4GH Computable patient consent Race and ethnicity Microbiome data standards Investigator training dbGaP process Consent Incorporation of HPO in the UMLS Meta-thesaurus and connections between HPO and SNOMED CT Lab to Patient To be discussed 8 *CCDA, Direct for transport, etc. **Authorization standards are compatible across disparate networks DRAFT

10. National Institutes of Health (NIH) 9 Josephine Briggs, Director, NCCIH William Riley, Director, Office of Behavioral and Social Sciences Research

11. Office of the National Coordinator for National Health IT 10 Lucia Savage, Chief Privacyy Officer

12. Office of the Chief Privacy Officer Update on Computable Privacy PMI Task Force, February 12, 2016 2/26/2016

13. Computable Consent PMI Task Force: Support Global Alliance for Genomics and Health (GA4GH) work to address computable consent in research context (C); ONC should convene a stakeholder group to address granular, dynamic computable consent. There are existing standards in this space, but without clear implementation guidance, and alignment between HIPAA and Common Rule should be addressed (A) Interoperability Roadmap: Technological advances are creating opportunities to automate privacy compliance by tracking when ePHI can be used, accessed or disclosed. If the rules being processed are a clear “Yes” (okay to disclose) or a clear “No” (not okay to disclose), technology can be programmed to support privacy compliance. ONC refers to this as computable privacy, the technical representation and communication of permission to share and use identifiable health information, including when law and applicable organizational policies enable information to be shared without need to first seek an individual’s permission. Once implemented effectively, using technology for privacy compliance saves time and resources, and can build trust and confidence in the system overall. 12

14. Overview: OCPO Computable Privacy Work Plan--Policy Policy (slides 5-7) – Explain HIPAA Better – State Privacy Law – Basic choice for exchange or research – Research Privacy & Security Policy Framework. – And (not covered today) Support PMI Policy Development Support Part 2 Reform (NPRM at https://s3.amazonaws.com/public- inspection.federalregister.gov/2016-01841.pdf) Support Common Rule evolution. NPRM comment period closed 13

15. Overview: Computable Privacy Work Plan --Technical Technical (slides 8-14) – Patient Choice Technical Project Covers any choice where there are only 2 possible options – Research yes/no – Exchange yes/no – Responds to recommendation to “address granular, dynamic computable consent” – Not covered today Best Practices for Identity Proofing and Credentialing system users Support PMI Security and Technical development API Task Force (not covered today) 14

16. What is Computable Privacy? 15 An individual’s electronic health information needs to be digitally connected to his/her sharing choices. All data holders and their health IT systems need to know what to do when an individual does not document a choice. Default rules cannot be ambiguous and should support data for health. Telemedicine, community health supports, and other innovative delivery processes will be stunted if the health care industry cannot make privacy computable.

17. Three Levels of Rules All Must Be Computable 16 HIPAA runs in the background and permits disclosure for health Basic Choice refers to the choice an individual makes about the use and disclosure of health information, including the electronic exchange of health information, irrespective of default rules. Granular Choice is the choice an individual makes regarding the distinctions between legally sensitive clinical conditions, such as mental health or HIV/AIDS status and evolves over time to enable choice about disclosure to specifically identified participants in the health care system. Permitted Uses = Background Rules Basic Choice Granular Choice This is HIPAA/back ground rules If offered, use standards

18. HIPAA Permitted Uses & Disclosures – HIPAA is media agnostic and has supported health information exchange through permitted uses and disclosures for which an individual’s authorization is not required for the past 17 years. – ONC/OCR Fact Sheets illustrating permitted sharing for : Treatment (Care planning & Referral) Health Care Operations of – Payor Case Management – Multi-provider Quality Assessment/ Improvement – Multi-provider reduction in hospital acquired infections HIPAA Right of Access – Gives patients the right to access their heath information electronically if stored electronically – Provides patients with the right to send information to a third party HIPAA Basics – See ONC Permitted Use Fact Sheets and Blog and OCR New Access GuidancePermitted Use Fact Sheets and BlogNew Access Guidance Explain HIPAA Better 17

19. Harmonizing State Privacy Law: Grant to the National Governors Association (NGA) 18 Learning & Dialogue Expert Roundtable State Interoperability Roadmap Technical Assistance & Implementation Timeline and Objectives Sept 2015 to May 2017 Jan 2016 Apr 2016Jul 2016 May 2017 http://www.grants.gov/web/grants/view-opportunity.html?oppId=277387

20. Basic Choice Choosing to share to exchange or for research is the same process: – Compare “Please let my data flow to other doctors/please do not let my data flow to other doctors” to Please use my data in this research project/please do not use my data in this research project. Basic Choice, then, is a process, for which documentation and standards can be developed in a context-neutral way Which led OCPO to – Apply concept of Basic Choice to project underway to develop privacy and legal & policy framework for research; and – Expand the scope of a project underway on technical standards for research choice 19

21. Research Privacy & Security Policy Framework—Phase I Recruit and engage Patient Centered Outcomes Research (PCOR) stakeholders, including researchers, patients, providers, health IT technologists, and legal experts that have experience relevant to PCOR data Develop 15-20 priority research data use scenarios that implicate consent choices based on feedback from the PCOR community including patients – Includes genomic medicine and precision medicine scenarios Produce a lessons learned report highlighting priority research scenarios, and next steps 20

22. Research Privacy & Security Policy Framework Phase II Building upon the work of phase I, assess and analyze the legal, regulatory, ethical and policy environment governing the use of health information for PCOR Identify and define data types Compile legal and ethical requirements related to privacy and security of identified data types including relevant state laws and regulations Map privacy and security legal requirements to the potential flow of data for the use cases Develop a privacy and security legal and ethics framework for protecting patient privacy during conduct of PCOR 21

23. Phase 2 Legal and ethical framework development Early 2016 to Sep. 2017 Research Privacy & Security Policy Framework Timeline 22 Phase 1 November 2015 December 2015 January 2016 February 2016 March 2016 April 2016 Use Case development Dec 2016 to April 2016

24. Patient Choice Technical Project aka: “Standards Development for Patient Choice Basic Choice and Granular Choice for Treatment Payment and Operations and for Patient-Centered Outcomes Research” What the project will accomplish: – Analysis of current research consent landscape – Analyze and develop technical standards for implementing and sharing individual consent for: Basic choice for TPO Basic choice for research Granular choice for TPO & research 23

25. Patient Technical Choice Project Goals Phase I: Basic Choice for TPO and Research Consent Landscape Analysis Develop Basic Consent Use Cases and Functional Requirements which can be used to guide a Piloting process Conduct pilots which test the functional requirements and scenarios described in the Use Case Development Phase Develop a best practices implementation guide based on lessons learned from piloting efforts. Align work efforts with Standards Developing Organizations (SDO) when possible Develop implementation guidance in form of a standard or artifact Analyze current research consent landscape Phase II: Basic Choice for Research Consent and Phase 3: Granular Choice Build upon artifacts and lessons learned from Phase 1 and repeat the process for Phases 2 & 3 24

26. Patient Technical Choice Project Timeline Overview 25 Sep 15Jan 16Jul 16Jan 17Jul 17Jan 18Jul 18Jan 19Jul 19Mar 20 Phase 1: Basic Choice Phase 2: Basic Choice for Research Consent Phase 3: Granular Choice Deliverable: Basic Choice for TPO Implementation Guide (IG) Research Consent Landscape Analysis Deliverable: Basic Choice for Research IG Deliverable: Granular Choice for Research IG

27. For More Information… Patient Choice Technical Project – http://confluence.siframework.org/display/PATCH/Patient+Choice+Ho me http://confluence.siframework.org/display/PATCH/Patient+Choice+Ho me P&S Research Scenario Initiative and Legal Analysis and Ethics Framework Development – http://confluence.siframework.org/display/PSRSI/PCOR+Privacy+and+ Security+Research+Scenario+Initiative+and+Legal+Analysis+and+Ethic s+Framework+Development+Home http://confluence.siframework.org/display/PSRSI/PCOR+Privacy+and+ Security+Research+Scenario+Initiative+and+Legal+Analysis+and+Ethic s+Framework+Development+Home Prior ONC materials – Electronic Consent Management Landscape Analysis: https://www.healthit.gov/sites/default/files/privacy- security/ecm_finalreport_forrelease62415.pdf https://www.healthit.gov/sites/default/files/privacy- security/ecm_finalreport_forrelease62415.pdf – TSSWG Computable Privacy Presentation, December 2014: https://www.healthit.gov/facas/calendar/2014/12/17/standards- transport-security-standards-workgroup 26

28. 27

29. Recap & Next Steps 28