1. “ Jericho / UT Austin Pilot” Privacy with Dynamic Patient Review September 17, 2013 Presented by: David Staggs and Michael Dufel Jericho Systems Corporation

2. 209/17/2013 Agenda Administrative issues Pilot scope Pilot data flow Test scenarios Transaction and Document tests Discussion Pilot Timeline Plan of Action

3. 309/17/2013 Pilot Administrivia This pilot is a community led pilot –Limited support provided by the ONC Johnathan Coleman (Security Risk Solutions) Zachary May (ESAC) Penelope Hughes (ONC) Libbie Buchele (ONC Sponsor) In conjunction with DS4P bi-weekly return of an All Hands meeting Access to DS4P Wiki, teleconference, and calendar Meeting times: Tuesdays 11AM (ET) –Dial In: +1-650-479-3208 Access code: 662 197 169 URL: https://siframework1.webex.com/siframework1/onstage/g.php?t=a& d=662197169 https://siframework1.webex.com/siframework1/onstage/g.php?t=a& d=662197169

4. 409/17/2013 Scope of the Pilot 1.Define the exchange of HL7 CDA-compliant PCD between a data custodian and a PCD repository that includes a report on the outcome of the request to the healthcare consumer (subject). 2.Additional goal: use identifiers to identify the subject/ PCD repository for use in reporting the outcome of the “secondary user” request use case to subject by subsequent EHR custodians. 3.Stretch goal: mask and/or redact the clinical document based on data segmentation and PCD choices retrieved from the PCD repository.

5. 509/17/2013 Pilot Data Flow Custodian of Data being Provided at  Patient PCD Repository 2 nd Requestor 1 st Requestor   B ,  = Clinical data A,B = PCD data = audit record And Subsequent Custodian of Data being Provided at 

6. Test Approach Sections included in each test scenario in the DS4P Pilot Execution Script: 1.Scenario 2.Actors 3.Preconditions 4.Test steps 5.Test results 6.Log Capture 7.Data Set Verification 09/17/20136

7. Test Cases 09/17/20137 DS4P Pilot Execution Script: 1.Consent To Patient Discovery : No Consent 2.Consent To Patient Discovery : 1 st Requestor (1 st ) 3.Consent To Patient Discovery : 2 nd Requestor (2 nd ) 4.Consent To Document Query : No Consent 5.Consent To Document Query : 1 st To PC - Allow 6.Consent To Document Query : 2 nd To PC - Deny 7.Consent To Document Query : 2 nd to SC - Deny 8.Consent To Document Retrieve : No Consent 9.Consent To Document Retrieve : 1 st to PC - Allow 10.Consent To Document Retrieve : 2 nd To PC - Deny 11.Consent To Document Retrieve : 2 nd to SC - Deny 12.Consent To Document Retrieve : With Segmentation

8. Test Cases (Visual Representation) 09/17/20138 ScenarioPCDITI-55ITI-38ITI-39 1 st Requestor → PCY259 2 nd Requestor → PCY3610 2 nd Requestor → SCY711 1 st Requestor → PCN148 Clinical Data SegmentationY12 PC = Primary Custodian SC = Secondary Custodian

9. Original Query & Response 909/17/2013 Complete solution must retrieve PCD during ITI 55, ITI 38, ITI 39

10. J-UT Pilot Sequence Detail (A) 09/17/2013 10 Retrieving & applying PCD, reporting during patient discovery

11. J-UT Pilot Sequence Detail (B) 09/17/2013 11 Retrieving & applying PCD, reporting when returning document list

12. J-UT Pilot Sequence Diagram (C) 09/17/2013 12 Retrieving & applying PCD, reporting when returning a clinical document

13. 1309/17/2013 Transaction Tests (Last Meeting) NwHIN messages o Test messages must comply with NwHIN specification Request for PCD from Document Custodian o ITI 55: Data Set A o ITI 38: Data Set B o ITI 39: Data Set C ATNA audit record from Document Custodian o ITI 55: Audit data Set A o ITI 38: Audit data Set B o ITI 39: Audit data Set C

14. 1409/17/2013 Document Tests HL7 Documents o HL7 Documents must comply with HL7 specification Clinical document from Document Custodian o Must include a reference to the patient consent repository PCD document from PCD Repository o Must follow HL7 Privacy Consent Directive o Must include specific elements

15. 1509/17/2013 Discussion Review of J-UT DS4P Test Document Draft o Overview o Scenario Tests o Transaction Tests o Document Tests o Appendixes: Test Results

16. 1609/17/2013 Pilot Timeline General Timeline, conditioned on agreement of stakeholders

17. 17 Plan of Action Upon agreement of the participants the POA is: Identify the elements available from previous DS4P pilots Scope level of effort, decide on extended scenario Determine first draft of functional requirements Review standards available for returning information on requests Determine any gaps or extensions required in standards Stand up information holders and requestors Create XDS.b repository holding PCD Identify remaining pieces, create test procedures Document and update IG with results of our experience 09/17/2013

18. 1809/17/2013 Backup Slides

19. DS4P Standards Material Location of DS4P Standards Inventory: http://wiki.siframework.org/Data+Segmentation+-+Standards+Inventory Location of DS4P Standards Mapping Issues: http://wiki.siframework.org/file/view/Copy%20of%20DataMappingsIssues%20051 02012.xlsx/333681710/Copy%20of%20DataMappingsIssues%2005102012.xlsx General Standards Source List: http://wiki.siframework.org/file/view/General%20SI%20Framework%20Standards %20Analysis.xlsx/297940330/General%20SI%20Framework%20Standards%20A nalysis.xlsx Standards Crosswalk Analysis http://wiki.siframework.org/Data+Segmentation+for+Privacy+Standards+and+Har monizationhttp://wiki.siframework.org/Data+Segmentation+for+Privacy+Standards+and+Har monization (at bottom of page, exportable) Implementation Guidance http://wiki.siframework.org/file/view/Data%20Segmentation%20Implementation% 20Guidance_consensus_v1_0_4.pdf/416474106/Data%20Segmentation%20Impl ementation%20Guidance_consensus_v1_0_4.pdf 09/17/201319

20. 2009/17/2013 DS4P References Use Case: http://wiki.siframework.org/Data+Segmentation+for+Privacy+Use+C ases http://wiki.siframework.org/Data+Segmentation+for+Privacy+Use+C ases Implementation Guide: http://wiki.siframework.org/Data+Segmentation+for+Privacy+IG+Co nsensus http://wiki.siframework.org/Data+Segmentation+for+Privacy+IG+Co nsensus Pilots Wiki Page: http://wiki.siframework.org/Data+Segmentation+for+Privacy+RI+and +Pilots+Sub-Workgroup http://wiki.siframework.org/Data+Segmentation+for+Privacy+RI+and +Pilots+Sub-Workgroup

21. 2109/17/2013 Pilot Data Flow Custodian of Data being Provided at  Patient PCD Repository 2 nd Requestor 1 st Requestor   B ,  = Clinical data A,B = PCD data = audit record And Subsequent Custodian of Data being Provided at 

22. 2209/17/2013 Pilot Data Flow Custodian of Data being Provided at  Patient PCD Repository 2 nd Requestor 1 st Requestor Clinical exchange #  Clinical exchange #  B ,  = Clinical data A,B = PCD data = audit record And Subsequent Custodian of Data being Provided at  Fetch PCD Send audit

23. 2309/17/2013 Pilot Data Flow (1) Custodian of Data being Provided at  Patient PCD Repository 2 nd Requestor 1 st Requestor  ,  = Clinical data A,B = PCD data = audit record

24. 2409/17/2013 Pilot Data Flow (2) Custodian of Data being Provided at  Patient PCD Repository 2 nd Requestor 1 st Requestor  ,  = Clinical data A,B = PCD data = audit record

25. 2509/17/2013 Pilot Data Flow (3) Custodian of Data being Provided at  Patient PCD Repository 2 nd Requestor 1 st Requestor  B ,  = Clinical data A,B = PCD data = audit record And Subsequent Custodian of Data being Provided at 

26. 2609/17/2013 Pilot Data Flow (4) Custodian of Data being Provided at  Patient PCD Repository 2 nd Requestor 1 st Requestor  ,  = Clinical data A,B = PCD data = audit record And Subsequent Custodian of Data being Provided at 

27. 2709/17/2013 Pilot Data Flow (5) Custodian of Data being Provided at  Patient PCD Repository 2 nd Requestor 1 st Requestor ,  = Clinical data A,B = PCD data = audit record And Subsequent Custodian of Data being Provided at 

28. 2809/17/2013 Pilot Data Flow (updated) Custodian of Data being Provided at  Patient PCD Repository 2 nd Requestor 1 st Requestor   B ,  = Clinical data A,B = PCD data = audit record And Subsequent Custodian of Data being Provided at 