1. PDMP & Health IT Integration All-Hands Meeting January 28 th, 2014

2. Meeting Etiquette Remember: If you are not speaking keep your phone on mute Do not put your phone on hold – if you need to take a call, hang up and dial in again when finished with your other call – Hold = Elevator Music = very frustrated speakers and participants This meeting, like all of our meeting is being recorded – Another reason to keep your phone on mute when not speaking Feel free to use the “Chat” feature for questions, comments or any items you would like the moderator or participants to know. NOTE: This meeting is being recorded and will be posted on the Meeting Artifacts Wiki page after the meeting From S&I Framework to Participants: Hi everyone: remember to keep your phone on mute 2

3. Agenda 3 TopicTime Allotted General Announcements5 minutes Concert Series Presentation OneHealthPort & Washington State Department of Health 30 minutes PDMP & HITI Use Case Development Assumptions, Context Diagram, User Stories Introduce: Pre/Post Conditions, Actors and Roles 50 minutes Next Steps/Questions5 minutes

4. General Announcements… Starting today we will be extending the time of our All-Hands call 30 minutes to ensure we can get through our use case keeping with our timeline. – 12:00-1:30 pm (ET) We will be rescheduling our February 18 th, 2014 meeting – Friday February 21 st – same time 12:00-1:30 pm (ET) OneHealthPort (Washington State) will be presenting as part of our concert series today. 4

5. General Announcements continued To join our weekly webinars, visit the PDMP & Health IT Integration initiative Homepage for the latest meeting information: http://wiki.siframework.org/PDMP+%26+Health+IT+Integration +Homepage http://wiki.siframework.org/PDMP+%26+Health+IT+Integration +Homepage 5 To subscribe to our mailing list, simply complete the PDMP & Health IT Project Signup Form: http://wiki.siframework.org/PDMP+%26+Health+IT+Inte gration+Join+the+Initiative http://wiki.siframework.org/PDMP+%26+Health+IT+Inte gration+Join+the+Initiative To access current and archived meeting materials, visit the Project Meeting Artifacts section: http://wiki.siframework.org/PDMP+% 26+Health+IT+Integration+Meeting+Art ifacts http://wiki.siframework.org/PDMP+% 26+Health+IT+Integration+Meeting+Art ifacts Note: Please check the meeting schedule weekly to get the most up-to-date meeting information

6. WA State Department of Health PMP Transaction Processing through the OneHealthPort “statewide” HIE

7. Today’s Discussion Brief Overview of the HIE Key Drivers Prescription Monitoring Program (PMP) Transaction PMP Security PMP Transaction Standards Lessons Learned Additional Levers Questions

8. Brief Overview of the HIE Washington State HITech grant dollars were used to fund a statewide health information exchange. –OneHealthPort managed the vendor selection process and designed the HIE model based on community/constituent input –OHP HIE is an “exchange” model – no central repository –OHP HIE can leverage many large existing repositories (EPIC, EHRs, DOH, HCA, etc.) –OHP HIE provides secure, trusted trading options Hosted central web services Central meeting point for secure connections Leveraging and promoting data standards

9. The Initiative’s Key Drivers To reduce Rx misuse we need to Increase Provider Use: –SAMHSA Grant Funding Opportunity –Operational funding for PMP program is in place –Medicaid budget proviso requiring ER prescribers to register for PMP access (effective June 2012) –DOH pain management rules recommend PMP use (from ESHB 2876 – all rules effective by January 2012) –LNI guideline for opioid prescribing requires PMP use http://www.lni.wa.gov/ClaimsIns/Files/OMD/MedTreat/FINALOpioidGuideline0107 13.pdf (effective July 2013)http://www.lni.wa.gov/ClaimsIns/Files/OMD/MedTreat/FINALOpioidGuideline0107 13.pdf

10. Prescription Monitoring Program The WA State Department of Health (DOH) operates a repository of dispensed medications, known as the Prescription Monitoring Program (PMP) hosted by Health Information Designs, LLC (HID). Repository represents a history of controlled substance prescriptions dispensed from licensed pharmacies or licensed practitioners. Access to that data is provided via the Health Information Exchange (HIE) to: –licensed practitioners (valid current registration with the online PMP system) –making a secure query from a health information system connected to the HIE.

11. The response provided from the PMP database via the HIE is: A real-time transaction based on the authentication of the requestor’s license (pre-registration of the user in the online PMP system) and… A match of the patient record requested The request and response utilize the NCPDP Script standard for medication history. –OHP HIE is utilizing the NCPDP 2013.12 standard. Prescription Monitoring Program

13. Secure, encrypted connectivity –Certificate exchange and authentication –Certificate handling by the HIE hub for signing and encrypting all messages Specifically with HID the PMP vendor, certificate authentication rules applied for signing and encrypting all messages is in the order specified by HID as SignBeforeEncryptAndEncryptSignature –Secure handling includes signature validation and encryption of ALL messages as well as transport over https. –The messages are fully secured and posted to secure URLs designated by the DOH vendor, HID, and OHP-HIE. The keys for this process are only shared between the HIE hub and the DOH vendor. PMP Security

14. Secure, encrypted connectivity –The response message is a synchronous transaction. The message channel is open for the response which is a few second wait at most. –The HIE receives the response on the same thread programmatically decrypting, stripping the PMIX SOAP wrapper, re- encrypting and forwarding to the querying trading partner. –No PHI is exposed or stored by the HIE. –The HIE provides an audit trail of all transactions traded and can identify which trading partners are involved in the information exchange via message metadata including the routing identification of the trading partners PMP Security

15. OneHealthPort was a “stakeholder” participant in the earlier S & I workgroup evaluating PMP standards. –The recommendation from that work was that NCPDP standards should be incorporated in PMP exchanges to facilitate adoption and minimize development efforts for EHR vendors. Concurrently, the WA State DOH came to OHP for assistance in moving forward their SAMHSA grant for connecting EHRs to the State PMP WA DOH, their vendor - HID, and OHP jointly evaluated options with the standards recommendations in mind and moved forward with a solution for interoperability PMP Standards

17. PMP Standards – PMIX Soap Wrapper

18. Lessons Learned If you build it, “they” may not necessarily come –Must have business reason and/or regulatory requirements to truly engage healthcare providers who have limited resources It’s not rocket science, but… –It takes willing, ready and able vendors, exchanges, and trading partners –Creative problem solving –Development effort –Tenacity, professionalism, and sometimes, good humor

19. Additional Levers Stage 2: Meaningful Use Approval: WA DOH has obtained approval to list the PMP as an official “other specialized registry” in compliance with stage 2 meaningful use –It will be listed as an Eligible Professionals (EP) Menu item –We feel this will assist trading partners with finding a business reason to connect DOH and other state agencies are moving towards mandated participation in the state-wide health information exchange (HIE) –DOH has several health systems that will be accessed via the HIE

20. Questions?

21. PDMP & Health IT Integration Use Case & Functional Requirements January 28, 2014 21

22. Proposed Use Case & Functional Requirements Development Timeline 22 Week Target Date (2014) All Hands WG Meeting Tasks Review & Comments from Community via Wiki page due following Monday @ 12 noon 11/7 Use Case Kick-Off & UC Process Overview Introduce: In/Out of Scope, Context Diagram and Scenario Concert Series Presentation: ASAP Review: In/Out of Scope, Assumptions, Context Diagram 21/14 Review: In/Out of Scope, Context Diagram, Assumptions, Scenario Introduce: User Stories Review: User Stories, In/Out of Scope, Assumptions, Context Diagram 31/21 Review: In/Out of Scope, Context Diagram, Assumptions, Scenario Introduce: User Stories Review: User Stories, In/Out of Scope, Assumptions, Context Diagram 41/28 Review: Context Diagram and User Stories Introduce: Pre/Post Conditions, Actor and Roles Concert Series Presentation: OneHealthPort & WADOH Review: Pre/Post Conditions, Actors and Roles, User Stories 52/4 Review: Finalize User Stories, Pre/Post conditions, Actors and Roles Introduce: Activity Diagram and Base Flow Review: Activity Diagram and Base Flow 62/11 Review Activity Diagram and Base Flow Introduce: Functional Requirements and Sequence Diagram Review: Functional Requirements, Sequence Diagram, Activity Diagram and Base Flow 72/21 Review Functional Requirements and Sequence Diagram Introduce: Data Requirements and Issues and Risks Review: Data Requirements and Issues and Risks 2/25HIMSS Meeting 83/4 Review: Data Requirements and Risks & Issues Begin End-to-End Review End-to-End Review by community 93/11End-to-End Comments Review & dispositionEnd-to-End Review ends 103/18Finalize End-to-End Review Comments & Begin ConsensusBegin casting consensus vote 113/25Consensus Vote*Conclude consensus voting

23. Note- Below sections will be reviewed within the separate Use Case word document: 1.Discuss and review the following sections: 1.Assumptions 2.Context Diagram 3.User Stories 2.Introduce and review the following sections: 1.Pre-Conditions 2.Post-Conditions 3.Actors and Roles Section Review 23 Click the icon to open the Word Document

24. Use Case Assumptions 1.Health IT system is capable of querying a PDMP 2.All Healthcare Professionals have appropriate legal authority based on state regulations to request and receive information from state PDMP 3.Healthcare Professionals accessing the PDMP follow state guidelines as appropriate, including any privacy and security requirements as required by each individual state PDMP authority 4.The PDMP returns high positive matches to the Healthcare Professional 1 5.The Healthcare Professional accesses information that already exists within the PDMP at the time of querying 6.Each organization has the responsibility to figure out how query response is presented and integrated To be reviewed in Word Document 1 Question for Community: What are the responses you receive when querying a PDMP? 24

25. Generic Scenario & Context Diagram Pre-Step: Healthcare Professional logs into Health IT System 1. Sends query to state PDMP Healthcare Professional receives requested information PDMP & HIT Integration Use Case Scope 2. PDMP sends query response Pre-Step: Healthcare Professional logs into Health IT System 1. Sends query to state PDMP Healthcare Professional receives requested information PDMP & HIT Integration Use Case Scope 2. PDMP sends query response Interstate Hub AND/OR To be reviewed in Word Document 25

26. User Story 1: A legally authorized provider queries PDMP before writing a prescription for a patient Trigger: Patient needs medication for chronic back pain 1. Healthcare Professional logs into Health IT System 2. Sends query to state PDMP to check if patient has been prescribed narcotics/controlled substance in past X weeks 4. Healthcare Professional makes an informed decision to prescribe medication based on information received Use Case Scope 3. PDMP sends query response 26 Draft User Story: A patient arrives at the physician’s office or hospital for treatment of chronic back pain. If necessary, the Healthcare Professional authenticates to the Health IT system. At the appropriate point in the workflow, the query is sent to the State PDMP to see if the patient had been prescribed a controlled substance in the past X weeks. The PDMP processes the request and identifies the appropriate response to send back to the requestor. After receiving the query response from the PDMP, the Healthcare Professional makes an informed decision of whether or not to prescribe the medication or modify the dosage based on the information received. To be reviewed in Word Document

27. User Story 2: A legally authorized provider queries PDMP through a Hub before writing a prescription for a patient Trigger: Patient needs medication for chronic back pain 1. Healthcare Professional logs into Health IT System 2. Sends query to state PDMP to check if patient has been prescribed narcotics/controlled substance in past X weeks 4. Healthcare Professional makes an informed decision to prescribe medication based on information received Use Case Scope 3. PDMP sends query response 27 Draft User Story: A patient arrives at the physician’s office for treatment of chronic back pain. If necessary, the Healthcare Professional authenticates to the Health IT system. At the appropriate point in the workflow, the query is sent to a Hub through his Health IT system to see if the patient had been prescribed a controlled substance in the past X weeks. The Hub receives the query, and reroutes the query to the appropriate state PDMP(s) (Note: this transaction implies that a Memorandum of Understanding is already in place between state PDMPs). The PDMP(s) process the request and identify the appropriate response to send back to the requestor. The PDMP(s) send the query response to the Hub involved in the transaction. The Hub reroutes the query response back to the Health IT system where the query originated. After receiving the query response(s), the Healthcare Professional makes an informed decision of whether or not to prescribe the medication or modify the dosage based on the information received. To be reviewed in Word Document Interstate Hub

28. User Story 3: Pharmacist queries PDMP prior to dispensing opioids to a patient Trigger: Patient arrives at pharmacy and drops off prescription to be filled 1. Pharmacist logs into Pharmacy Dispensing System 2. Sends query to state PDMP to check if patient has received narcotics/controlled substance in past X weeks 3. PDMP sends query response 4. Pharmacist makes an informed decision to dispense medication based on information received Use Case Scope 28 Draft User Story: A patient arrives at the pharmacy to have his prescription filled. The pharmacist logs into the Pharmacy Dispensing system, and she enters her credentials. After, she sends a query to the State PDMP through her Pharmacy Dispensing system to see if the patient had filled a prescription for a controlled substance in the past X weeks. The PDMP processes the request and identifies the appropriate response to send back to the requestor. After receiving the query response from the PDMP, the pharmacist makes an informed decision of whether or not to dispense the medication based on the information received. To be reviewed in Word Document

29. Pre/Post Conditions Pre-Conditions 1.The necessary access controls and authorization protocols based on State and/or Federal regulations (which could include patient consent or privacy permissions) for any of the systems or users described, are in place 1.The Health IT system application can provide any necessary authorization, authentication or privacy information to the PDMP 2.An intermediary, such as a Hub, provides necessary technology infrastructure to allow PDMP data exchange from the PDMP to the Health IT system 3.Query parameters required to create the query in a standardized format by the Health IT system/Hub are recognized and accepted by the PDMP system 4.The PDMP system can provide a query response in a standardized format recognized and accepted by the Hub/Health IT system 5.The PDMP system has knowledge about the Hub and the Hub has knowledge about the Health IT system to send a query response (this is in the event a request is parsed out to other states and the other states respond back) 6.Health IT System and PDMP have a common understanding of the shared vocabulary that is used to create the queries and provide the query results 7.Health IT System is able to determine which state PDMP(s) should receive the query To be reviewed in Word Document 29 Post-Conditions 1.Health IT System has sent a query 2.PDMP system has received the query 3.PDMP system has sent a response to the Health IT system 4.Health IT system has successfully received the query results from the PDMP system 5.Health IT system can display/present query response

30. Actors and Roles To be reviewed in Word Document 30 ActorSystemRole Health Care Professional Health IT System  Send query  Receive query response PDMPPDMP System  Receive query  Send query response Hub ????

31. Looking Forward: Proposed Use Case & Functional Requirements Development Timeline 31 Week Target Date (2014) All Hands WG Meeting Tasks Review & Comments from Community via Wiki page due following Monday @ 12 noon 11/7 Use Case Kick-Off & UC Process Overview Introduce: In/Out of Scope, Context Diagram and Scenario Concert Series Presentation: ASAP Review: In/Out of Scope, Assumptions, Context Diagram 21/14 Review: In/Out of Scope, Context Diagram, Assumptions, Scenario Introduce: User Stories Review: User Stories, In/Out of Scope, Assumptions, Context Diagram 31/21 Review: In/Out of Scope, Context Diagram, Assumptions, Scenario Introduce: User Stories Review: User Stories, In/Out of Scope, Assumptions, Context Diagram 41/28 Review: Context Diagram and User Stories Introduce: Pre/Post Conditions, Actor and Roles Concert Series Presentation: OneHealthPort & WADOH Review: Pre/Post Conditions, Actors and Roles, User Stories 52/4 Review: Finalize User Stories, Pre/Post conditions, Actors and Roles Introduce: Activity Diagram and Base Flow Review: Activity Diagram and Base Flow 62/11 Review Activity Diagram and Base Flow Introduce: Functional Requirements and Sequence Diagram Review: Functional Requirements, Sequence Diagram, Activity Diagram and Base Flow 72/21 Review Functional Requirements and Sequence Diagram Introduce: Data Requirements and Issues and Risks Review: Data Requirements and Issues and Risks 2/25HIMSS Meeting 83/4 Review: Data Requirements and Risks & Issues Begin End-to-End Review End-to-End Review by community 93/11End-to-End Comments Review & dispositionEnd-to-End Review ends 103/18Finalize End-to-End Review Comments & Begin ConsensusBegin casting consensus vote 113/25Consensus Vote*Conclude consensus voting

32. Next Steps Review: Pre/Post Conditions, Actors and Roles, and User Stories Next Meeting is Tuesday, February 4 from 12:00pm - 1:30pm EST Reminder: All PDMP & HIT Integration Announcements, Meeting Schedules, Agendas, Minutes, Reference Materials, Use Case, Project Charter and general information will be posted on the PDMP Wiki page – http://wiki.siframework.org/PDMP+%26+Health+IT+Integration +Homepage http://wiki.siframework.org/PDMP+%26+Health+IT+Integration +Homepage 32

33. Contact Information For questions, please feel free to contact your support leads: – Initiative Coordinators: Johnathan Coleman jc@securityrs.comjc@securityrs.com Sherry Green sgreen@namsdl.orgsgreen@namsdl.org – ONC Leads: Mera Choi mera.choi@hhs.govmera.choi@hhs.gov Jennifer Frazier Jennifer.Frazier@hhs.govJennifer.Frazier@hhs.gov Helen Caton-Peters Helen.Caton-Peters@hhs.govHelen.Caton-Peters@hhs.gov – SAMHSA Leads Jinhee Lee Jinhee.Lee@samhsa.hhs.govJinhee.Lee@samhsa.hhs.gov Kate Tipping Kate.Tipping@samhsa.hhs.govKate.Tipping@samhsa.hhs.gov – Support Team: Project Management: – Jamie Parker jamie.parker@esacinc.comjamie.parker@esacinc.com – Ali Khan Ali.Khan@esacinc.com (Support)Ali.Khan@esacinc.com Use Case Development: – Ahsin Azim Ahsin.Azim@accenturefederal.comAhsin.Azim@accenturefederal.com – Presha Patel presha.patel@accenture.compresha.patel@accenture.com Vocabulary and Terminology Subject Matter Expert: – Mark Roche mrochemd@gmail.commrochemd@gmail.com 33