1. Interoperability Roadmap Comments Package Transport & Security Standards Workgroup Dixie Baker, chair Lisa Gallagher, co-chair February 24, 2015

2. Principle-based Interoperability 2

3. HITSC - Transport and Security Standards (I) WorkgroupTransport and Security Standards ONC FACA Lead(s) Jeremy Maxwell ONC SMEs Chris Muir, Lucia Savage, Julie Chua Chair / Co-Chairs Dixie B. Baker, Chair, Martin, Blanck, and Associates Lisa Gallagher, Co-Chair, Healthcare Information and Management Systems Society General Questions (as they apply to the assigned Roadmap sections) Are the actions proposed in the draft interoperability Roadmap the right actions to improve interoperability nationwide in the near term while working toward a learning health system in the long term? What, if any, gaps need to be addressed? Is the timing of specific actions appropriate? Are the right actors/stakeholders associated with critical actions? Roadmap Sections E. Ubiquitous, secure network infrastructure F. Verifiable identity and authentication of all participants G. Consistent representation of permission to collect, share and use identifiable health information 3

4. HITSC - Transport and Security Standards (II) WorkgroupTransport and Security Standards Section E1)Cybersecurity: What should the federal government (specifically) focus on first to move towards a uniform approach to enforcing cybersecurity in healthcare (keeping HIPAA and CEHRT Rules in mind and possible new cybersecurity legislation)? Are there frameworks, methodologies, incentive programs, etc. that the healthcare industry has not, but should, consider? 2)Encryption: Are there other gaps (aside from lack of policies and guidance for implementing encryption)in technology and standards for encryption? Section FWhat ID proofing and authentication standards, policies, and protocols can we borrow from other industries? Is healthcare that different from banking, social media, or email? Section GWhat standards should we put forward in the 2016 standards advisory for basic choice? How much work should ONC be doing on other standards while clarifying permitted uses? If standards development needs to be done, what should we be working on (DS4CDS vs DS4P vs something else)? 4

5. TSS WG: Tasks & Dates 5

6. Interoperability Roadmap Section E Ubiquitous, secure network infrastructure LHS Requirement Ubiquitous, secure network infrastructure: Enabling an interoperable, learning health system requires a stable, secure, widely available network capability that supports vendor-neutral protocols and a wide variety of core services Charges: Cybersecurity: What should the federal government (specifically) focus on first to move towards a uniform approach to enforcing cybersecurity in healthcare (keeping HIPAA and CEHRT Rules in mind and possible new cybersecurity legislation)? Are there frameworks, methodologies, incentive programs, etc. that the healthcare industry has not, but should, consider? Encryption: Are there other gaps (aside from lack of policies and guidance for implementing encryption)in technology and standards for encryption? 6 Source: Connecting Health and Care for the Nation: A Shared Nationwide Interoperability Roadmap, DRAFT v 1.0, p. 55.

7. 1. Are the actions the right actions to improve interoperability nationwide in the near term while working toward a learning health system in the long term? 2. What, if any, gaps need to be addressed? 3. Is the timing of specific actions appropriate? 4. Are the right actors/stakeholders associated with critical actions? 7 Specific ChargesComments - Ubiquitous, secure network infrastructure 1. Cybersecurity: What should the federal government (specifically) focus on first to move towards a uniform approach to enforcing cybersecurity in healthcare (keeping HIPAA and CEHRT Rules in mind and possible new cybersecurity legislation)? 2. Cybersecurity: Are there frameworks, methodologies, incentive programs, etc. that the healthcare industry has not, but should, consider?

8. 1. Are the actions the right actions to improve interoperability nationwide in the near term while working toward a learning health system in the long term? 2. What, if any, gaps need to be addressed? 3. Is the timing of specific actions appropriate? 4. Are the right actors/stakeholders associated with critical actions? 8 Specific ChargesComments - Ubiquitous, secure network infrastructure 1.Encryption: Are there other gaps (aside from lack of policies and guidance for implementing encryption)in technology and standards for encryption?

9. Interoperability Roadmap Section E Ubiquitous, secure network infrastructure 9 Questions for Workgroup Discussion Are the actions the right actions to improve interoperability nationwide in the near term while working toward a learning health system in the long term? What, if any, gaps need to be addressed? Is the timing of specific actions appropriate? Are the right actors/stakeholders associated with critical actions? Category 2015-2017 Send, receive, find and use a common clinical data set 2018-2020 Expand interoperable health IT and users 2021-2024 Achieve nationwide LHS Section E, Cybersecurity Workgroup Member(s): Dixie B. Baker, Chair Lisa Gallagher, Co-Chair Jeff Brandt, Brian Freedman, John Hummel, LeRoy Jones, Boban Jose, Peter Kaufman, Steven Lane, Aaron Miri, Scott Rea, Jason Taule, Sharon F. Terry, Jeremy Maxwell, HHS 1.ONC will work with OCR to release an updated Security Risk Assessment tool and hold appropriate educational and outreach programs. 2.ONC will coordinate with the Office of the Assistant Secretary for Preparedness and Response (ASPR) on priority issues related to cyber security for critical public health infrastructure. 3.HHS will continue to support, promote and enhance the establishment of a single health and public health cybersecurity Information Sharing and Analysis Center (ISAC) for bi-directional information sharing about cyber threats and vulnerabilities between private health care industry and the federal government. 4.ONC will work with NIST and OCR to finalize and publish the NIST Critical Infrastructure Cybersecurity Framework and Health Insurance Portability and Accountability Act (HIPAA) Security Rule Crosswalk. 5.HHS will work with the industry to develop and propose a uniform approach to enforcing cybersecurity in healthcare in concert with enforcement of HIPAA Rules. 6. Stakeholder input requested 7. Stakeholder input requested Source: Connecting Health and Care for the Nation: A Shared Nationwide Interoperability Roadmap, DRAFT v 1.0, p. 57.

10. 1. Are the actions the right actions to improve interoperability nationwide in the near term while working toward a learning health system in the long term? 2. What, if any, gaps need to be addressed? 3. Is the timing of specific actions appropriate? 4. Are the right actors/stakeholders associated with critical actions? 10 2015-2017 Send, receive, find and use a common clinical data set Comments - Cybersecurity 1.ONC will work with OCR to release an updated Security Risk Assessment tool and hold appropriate educational and outreach programs. 2.ONC will coordinate with the Office of the Assistant Secretary for Preparedness and Response (ASPR) on priority issues related to cyber security for critical public health infrastructure.

11. 1. Are the actions the right actions to improve interoperability nationwide in the near term while working toward a learning health system in the long term? 2. What, if any, gaps need to be addressed? 3. Is the timing of specific actions appropriate? 4. Are the right actors/stakeholders associated with critical actions? 11 2015-2017 Send, receive, find and use a common clinical data set Comments - Cybersecurity 3. HHS will continue to support, promote and enhance the establishment of a single health and public health cybersecurity Information Sharing and Analysis Center (ISAC) for bi-directional information sharing about cyber threats and vulnerabilities between private health care industry and the federal government. 4. ONC will work with NIST and OCR to finalize and publish the NIST Critical Infrastructure Cybersecurity Framework and Health Insurance Portability and Accountability Act (HIPAA) Security Rule Crosswalk.

12. 1. Are the actions the right actions to improve interoperability nationwide in the near term while working toward a learning health system in the long term? 2. What, if any, gaps need to be addressed? 3. Is the timing of specific actions appropriate? 4. Are the right actors/stakeholders associated with critical actions? 12 2015-2017 Send, receive, find and use a common clinical data set Comments - Cybersecurity 5. HHS will work with the industry to develop and propose a uniform approach to enforcing cybersecurity in healthcare in concert with enforcement of HIPAA Rules.

13. 1. Are the actions the right actions to improve interoperability nationwide in the near term while working toward a learning health system in the long term? 2. What, if any, gaps need to be addressed? 3. Is the timing of specific actions appropriate? 4. Are the right actors/stakeholders associated with critical actions? 13 2018-2020 Expand interoperable health IT and users Comments - Cybersecurity 6. Stakeholder input requested 2021-2024 Achieve nationwide LHS Comments - Cybersecurity 7. Stakeholder input requested

14. Interoperability Roadmap Section E Ubiquitous, secure network infrastructure 14 Questions for Workgroup Discussion Are the actions the right actions to improve interoperability nationwide in the near term while working toward a learning health system in the long term? What, if any, gaps need to be addressed? Is the timing of specific actions appropriate? Are the right actors/stakeholders associated with critical actions? Category 2015-2017 Send, receive, find and use a common clinical data set 2018-2020 Expand interoperable health IT and users 2021-2024 Achieve nationwide LHS Section E, Encryption Workgroup Member(s): Dixie B. Baker, Chair Lisa Gallagher, Co-Chair Jeff Brandt, Brian Freedman, John Hummel, LeRoy Jones, Boban Jose, Peter Kaufman, Steven Lane, Aaron Miri, Scott Rea, Jason Taule, Sharon F. Terry, Jeremy Maxwell, HHS 1.ONC will work with OCR and industry organizations to develop "at rest" standards for data encryption and provide technical assistance. OCR will consider whether additional guidance or rulemaking is necessary. 2.ONC will work with OCR and industry organizations to develop "in transit" standards for data encryption and provide technical assistance. OCR will consider whether additional guidance or rulemaking is necessary. 3.ONC will develop guidance for implementing encryption policies. 4.ONC will work with payers to explore the availability of private sector financial incentives to increase the rate of encrypting, starting with discussions with casualty insurance carriers who offer cybersecurity insurance. 5. Stakeholder input requested6. Stakeholder input requested Source: Connecting Health and Care for the Nation: A Shared Nationwide Interoperability Roadmap, DRAFT v 1.0, p. 57.

15. 1. Are the actions the right actions to improve interoperability nationwide in the near term while working toward a learning health system in the long term? 2. What, if any, gaps need to be addressed? 3. Is the timing of specific actions appropriate? 4. Are the right actors/stakeholders associated with critical actions? 15 2015-2017 Send, receive, find and use a common clinical data set Comments - Encryption 1.ONC will work with OCR and industry organizations to develop "at rest" standards for data encryption and provide technical assistance. OCR will consider whether additional guidance or rulemaking is necessary. 2.ONC will work with OCR and industry organizations to develop "in transit" standards for data encryption and provide technical assistance. OCR will consider whether additional guidance or rulemaking is necessary.

16. 1. Are the actions the right actions to improve interoperability nationwide in the near term while working toward a learning health system in the long term? 2. What, if any, gaps need to be addressed? 3. Is the timing of specific actions appropriate? 4. Are the right actors/stakeholders associated with critical actions? 16 2015-2017 Send, receive, find and use a common clinical data set Comments - Encryption 3. ONC will develop guidance for implementing encryption policies. 4. ONC will work with payers to explore the availability of private sector financial incentives to increase the rate of encrypting, starting with discussions with casualty insurance carriers who offer cybersecurity insurance.

17. 1. Are the actions the right actions to improve interoperability nationwide in the near term while working toward a learning health system in the long term? 2. What, if any, gaps need to be addressed? 3. Is the timing of specific actions appropriate? 4. Are the right actors/stakeholders associated with critical actions? 17 2018-2020 Expand interoperable health IT and users Comments - Encryption 5. Stakeholder input requested 2021-2024 Achieve nationwide LHS Comments - Encryption 6. Stakeholder input requested

18. Parking Lot Comments 18 TopicComments TBD