1. HCQ P MEDICARES HEALTH CARE QUALITY IMPROVEMENT PROGRAM QualityNet Exchange Dennis Stricker Director, Information Systems Group Office of Clinical Standards and Quality Centers for Medicare & Medicaid Services

2. HCQ P MEDICARES HEALTH CARE QUALITY IMPROVEMENT PROGRAM Quality Improvement Organizations 53 Contractors for quality improvement for Medicare program Multiple parties and settings involved Privacy data extensively used

3. HCQ P MEDICARES HEALTH CARE QUALITY IMPROVEMENT PROGRAM End Stage Renal Disease Networks Only disease-specific way to become a Medicare beneficiary Three separate (soon consolidated into one) systems determine Medicare eligibility Privacy data historically collected via paper forms

4. HCQ P MEDICARES HEALTH CARE QUALITY IMPROVEMENT PROGRAM QIOs/ESRDs - Business Need Improve service to customers Streamline business processes Standardize data collection and information sharing across 50 States, DC, PR and VI Adhere to Congressional Mandates –GPEA –HIPAA

5. HCQ P MEDICARES HEALTH CARE QUALITY IMPROVEMENT PROGRAM QIOs/ESRDs - Challenges Implement an end-to-end trust model that scales across the country Authenticate users in a G to B environment Collect and securely transmit and store clinical & privacy data over the internet Limit access to data based on need-to-know Auditing that involves users and administrators

6. HCQ P MEDICARES HEALTH CARE QUALITY IMPROVEMENT PROGRAM QIOs/ESRDs - Program Objectives Identification – Ensure user is who they say they are Authentication – Ensure user is authorized to use system Access Control – Limit access to data based on need-to-know

7. HCQ P MEDICARES HEALTH CARE QUALITY IMPROVEMENT PROGRAM QIOs/ESRDs – Technologies Used PKI (Public Key Infrastructure) – Identity authentication and digital signatures Portals - Personalized for each user based on user role CKM® (Constructive Key Management®) – Confidentiality, tokens, credentials, and role-based access control to data using encryption

8. HCQ P MEDICARES HEALTH CARE QUALITY IMPROVEMENT PROGRAM PKI,CKM, Oracle and Notary Proofing CMS, through contractor support, provides Notary in-person-proofing at the customer level CKM has been integrated into the QualityNet web applications for role-based authorization and protection of data in transit and at rest Oracle database rules along with CKM credentials (roles) are used to enforce confidentiality and need-to-know access

9. HCQ P MEDICARES HEALTH CARE QUALITY IMPROVEMENT PROGRAM QIOs/ESRDs - Benefits Real Time Reporting Faster access to better information Eliminate/reduce paper forms Facilitate quality improvement at the provider level Protection of data in transit and at rest Access control to data based on need-to-know Digital Signatures

10. HCQ P MEDICARES HEALTH CARE QUALITY IMPROVEMENT PROGRAM Security Features- Identifying Users Digital Certificate – Identity authentication Digital signatures Bi-directional SSL connection User Token Tiny, safeguarded file Password protected User information – Credentials, Roles Store the digital certificate

11. HCQ P MEDICARES HEALTH CARE QUALITY IMPROVEMENT PROGRAM Registration to QualityNet Exchange Registration to QualityNet Exchange site where designated administrators use digital certificates to sign-off on users for access and roles Users receive a CKM token, digital certificate, CKM encryption access role, and database role : Current process :

12. HCQ P MEDICARES HEALTH CARE QUALITY IMPROVEMENT PROGRAM Authentication to QualityNet Exchange Users must have these components for authentication to QualityNet Exchange –x509 certificate for bi-directional (verification of user and web server) 128 bit SSL to QualityNet Exchange –Pass the Certification Revocation List (CRL) –CKM token –QualityNet Exchange Database ID Users login into QualityNet Exchange web application that seamlessly verifies all security components through a single sign-on

13. HCQ P MEDICARES HEALTH CARE QUALITY IMPROVEMENT PROGRAM Auditing QualityNet Exchange Logging of all user activities Everyone is part of auditing the system Auditing reports filtered by: –Individuals can track what they have done –Designated QualityNet security administrators can track activity of their users –CMS and the CMS contractor can track user activity across QualityNet Exchange

14. Clinical Warehouse - Data Flow Providers CDACs QIOs QIO Clinical Warehouse Vendors Data

15. Clinical Warehouse - Data Flow Providers QIOs CMS QIO Clinical Warehouse Clinical indicatorsClinical indicators Provider specificProvider specific State aggregatesState aggregates Quality improvement reportsQuality improvement reports Aggregate reportsAggregate reports State & national indicatorsState & national indicators Comparisons to state and national normsComparisons to state and national norms Immediate feedback reportsImmediate feedback reports Information InformationInformation

16. HCQ P MEDICARES HEALTH CARE QUALITY IMPROVEMENT PROGRAM ESRD Facility CROWN Overview SSA ESRD Network QualityNet eXchange Secure Web Upload & Download (soft tokens with encryption key& digital certificates) CMS HL7 XML Initial Database Setup Patient Transfer Corrections / Updates Beneficiary Demographics + Part A Enrollment ESRD coverage Periods Export Import Extract Export Import Load Replicate Report File Exchange Legacy Migration Feedback / Status Paper Forms Transplant Event & follow up data Deaths, transplant failures, missing transplants Claims Data View File Exchange Feedback / Accretions C onsolidated R enal O perations W eb-enabled N etwork Internet

17. HCQ P MEDICARES HEALTH CARE QUALITY IMPROVEMENT PROGRAM Data Collection Abstraction tools File import according to specifications

18. HCQ P MEDICARES HEALTH CARE QUALITY IMPROVEMENT PROGRAM Functionality - File Exchange Secure distribution channel for any file Safe transfer of confidential or private data Encryption is transparent to users Files are encrypted at rest and in transit Monitoring activity in real-time by user (who, what, when and how often)

19. HCQ P MEDICARES HEALTH CARE QUALITY IMPROVEMENT PROGRAM Information Dissemination Immediate feedback reports Aggregate data reports Aggregate reports posted by QIOs Quality improvement progress by providers

20. HCQ P MEDICARES HEALTH CARE QUALITY IMPROVEMENT PROGRAM Users View

21. HCQ P MEDICARES HEALTH CARE QUALITY IMPROVEMENT PROGRAM Users View

22. HCQ P MEDICARES HEALTH CARE QUALITY IMPROVEMENT PROGRAM Users View

23. HCQ P MEDICARES HEALTH CARE QUALITY IMPROVEMENT PROGRAM Users View

24. HCQ P MEDICARES HEALTH CARE QUALITY IMPROVEMENT PROGRAM Users View

25. HCQ P MEDICARES HEALTH CARE QUALITY IMPROVEMENT PROGRAM Users View