1. So You Think You Can Prescribe? (Electronically)
Andrew Premvardhan & Rachel Hiatt, Product Analysts
April 2015

3. Today’s Agenda
Electronic Prescribing of Controlled Substances (EPCS) Overview Regulatory and All that Jazz Modern Design Hip Hop through Prescriptions Demo Q&A

4. EPCS in Centricity™ Practice Solution 12.2 / Centricity EMR 9.10
Includes
Support for Electronic Prescribing of Controlled Substances (EPCS)
12.1 / 9.9 Fixes and Enhancements
New Family History/Social History Form
Simplified Installation
LA tracking to May/June
Initially Targeting Customers in NY State
NYS eRx Mandate Postponed to 3/27/16
GA in Q3 to Full Installed Base
Speakers:
Jon
Mark
Peter
Don
Kelly
Potentially Terry
Panelists for Q&A:
3 seed questions to kick us off
Peter to deliver the questions
Ray to prioritize
Kristina

5. Regulatory and All that Jazz

6. Regulatory and All that Jazz
The ruling time signature
(Regulatory requirements)
Selecting the music
(Setting up for ePrescribing)

7. The Ruling Time Signature: Regulatory
Electronic Prescribing of Controlled Substances § Standards for technologies for electronic transmission of orders
Authentication The system must enable a recipient to positively verify the signer without direct communication with the signer and subsequently demonstrate to a third party, if needed, that the sender’s identify was properly verified.
Nonrepudiation The system must ensure that strong and substantial evidence is available to the recipient of the sender’s identify, sufficient to prevent the sender from successfully denying having sent the data. This criterion includes the ability of a third party vendor to verify the origin of the document.
Message Integrity The system must ensure that the recipient, or a third party, can determine whether the contents of the document have been altered during transmission or after receipt.

8. The Ruling Time Signature: Regulatory
In 2011, the #1 source of nonmedical use of prescription painkillers was a single doctor.1
1. Source: ONDCP National Survey on Drug Use and Health 2011, pg. 29:

9. The Ruling Time Signature: Regulatory
Increasing legislation to combat drug abuse
Source: CDC Vital Signs

10. Selecting the Music: Setting up for ePrescribing
Capability to enroll and approve providers
Capability to disable and revoke users
Administration
Capability to add controlled substances
Capability to capture 2nd factor authentication
New HTML Renewal Form
Prescribing
Monthly and ad-hoc EPCS reports
Activity Logs
Record Keeping

11. PRESCRIBE TRANSMIT DISPENSE ENCRYPTED FIPS PUB 140-2 NIST 800-53
REPORTS
FIPS PUB 140-2
NIST
INCIDENT
RECORDS
COMPARE
HASH
FIPS PUB 186-3
FIPS PUB 180-3
PRESCRIBE
TRANSMIT
DISPENSE
AUTHENTICATION
MGMT
COMPLETED
eRx
DELIVERED
eRx
AUTHENTICATE
NIST Electronic Authentication Guideline
NIST Biometric Data Specification
FIPS – Digital Signature Standard
FIPS Security for Cryptographic Modules
NIST –Security and Privacy Controls
FIPS – Secure Hash Standard
NIST
NIST
ORDER
SIGN
Descriptions of Future Functionality reflect current product direction, are for informational purposes only and do not constitute a commitment to provide specific functionality. Timing and availability remain at GE’s discretion and are subject to change and applicable regulatory clearance.

12. Selecting the Music: EPCS Requirements
AUTHENICATION MANAGEMENT
Selecting the Music: EPCS Requirements
Identity Proofing
Institutional or Individual Identity Proofing
Credentialing
Two-Factor Using Fingerprint or Token with Password
Access Control 
Configure and Approve Access in the EMR
Auditing
Audit Trail of All Activities

13. Two Types of Identity Proofing and Credentialing
AUTHENICATION MANAGEMENT
Two Types of Identity Proofing and Credentialing
Institutional Identity Proofing
“[The DEA] allows institutional practitioners, which are themselves DEA registrants, to conduct the identity proofing for any individual practitioner whom the institutional practitioner is granting access to issue prescriptions using the institution’s electronic prescribing application.”
Individual Identify Proofing
“For individual practitioners in private practice (i.e., those practitioners not seeking access to an institutional practitioner’s applications), DEA will use existing certification authorities (CAs) and similar credential service providers (CSPs) that have been approved by a Federal authority.”

14. Institutional Credentialing
AUTHENICATION MANAGEMENT
Institutional Credentialing
Information Technology
Synchronizes Imprivata® Confirm ID with AD accounts of practitioners
Verifies practitioners are licensed and allowed to prescribe controlled substances
Medical Credentialing Office
Creates a list of practitioners that are allowed to electronically prescribe controlled substances
Creates a list of users that can approve EPCS access in the EMR
Sets EPCS access for practitioners in EMR that has been certified for EPCS
EMR Administrator
EMR Administrators must be a different entity/group than the Medical Credentialing Office
Verifies photo IDs of practitioners match those on the list from the credentialing office
Issues two-factor credentials to practitioners and supervises enrollment of credentials in Imprivata® Confirm ID
Imprivata® Confirm ID creates records of IDs verified and issuance of credentials
Enrollment Supervisors
EPCS Access Approvers
Approves EPCS access for practitioners in the EMR (does not require two factor authentication) 
Approvers must be a different group than the EMR Admins (DEA registrants not required)
EPCS

15. Individual Credentialing
AUTHENICATION MANAGEMENT
Individual Credentialing
Imprivata® Confirm ID performs NIST Level 3 identity-proofing of practitioners using social security number, date of birth and credit card information
Credential Service Provider
Imprivata® Confirm ID registers and issues tokens to practitioners via two channels
Practitioners can optionally self-enroll fingerprints with Imprivata® Confirm ID
Imprivata® Confirm ID automatically creates records of issuance of credentials
Information Technology
Synchronizes Imprivata® Confirm ID with AD accounts of practitioners
AD accounts must include the full legal name of practitioners and valid addresses
Sets EPCS access for practitioners in EMR that has been certified for EPCS
EMR Administrator
EMR Administrators must be a different entity/group than the Credential Service Provider
EPCS Access Approvers
Approves EPCS access for practitioners in the EMR using Imprivata® Confirm ID two factor authentication 
Approvers must be a different group than the EMR Admins (DEA registrants required)
EPCS

16. Implementation Action Items
AUTHENICATION MANAGEMENT
Implementation Action Items
List of practitioners who will require EPCS (AD group(s))
Credentials that will be issued (fingerprint vs. token)
List of enrollment supervisors for institutional identity proofing
List of EMR EPCS access approvers for individual identity proofing
List of users who will Enroll users in the EMR
List of users who will Approve users in the EMR
Credentialing Team verifies approval checklist
Identify Reviewer for EPCS Reports
Identify eRx Administrator

17. Authentication Regulations
Application uses an authentication protocol that uses two of the following three factors:
Something the practitioner knows <password>
Something the practitioner has <token>
Something the practitioner is <fingerprint>
Fingerprint readers and tokens (compliant with FIPS and NIST standards )
tokens must be separate from the computer used for prescription
biometric must be co-located or built in to the computer used for prescription
Application allows a practitioner to sign multiple prescriptions for a single patient
Only prescribing practitioner is allowed to sign
Surescripts® Requirement
Prescriber vendors shall display a summary screen in order to allow the prescriber to review the prescription and ensure that it contains the correct information before it is sent to the pharmacy.
must meet at least the criteria of FIPS 140–2 Security Level 1
Biometric devices NIST SP as
Testing should provide at least 95% confidence on false match rate

18. Modern Design

19. Modern Design Designing the steps (Designing for the users)
Finding the right partners
(Partnering for usability)

20. Modern Design: Research, Design, Test, Repeat
Design Review & Revision Round 1
May-Jun 2014
Reviews with clinical specialists
Patient Safety design evaluation
Renewal Form
Internal Review
Regulatory Requirements
Usability Tests
Design Revision
Design Revision Round 2
Sept 2014
Usability analysis
Design simplification
Formative Usability Round 1
Jul-Aug 2014
Three focused workflows
17 participants
Regulatory Review
Jul-Aug 2014
Surescripts® review
Requirements analysis

21. Modern Design: Prototype 1: May-Aug 2014

22. Modern Design: Key Observations
Focal point for medication management Data organization is critical for processing information Providers need maximum space to see all medications

23. Modern Design: Evolved Design
Remove extra ‘Outgoing ePrescriptions’ list Make medication-disease connections obvious Make pharmacy changes simple Improve visibility of chart information without compromising prescription real estate

24. Hip-Hop Through Prescriptions

25. Hip-Hop Through Prescriptions
Dancing with the legends
Prescribing legend drugs electronically
Dancing with control
Prescribing controlled substances electronically

26. Demo

27. Questions?