1. The Patient Choice Project Project Kickoff December 14 th, 2015

2. Call Logistics If you are not speaking, please keep your phone on mute Do not put your phone on hold – if you need to take a call, hang up and dial in again when finished with your other call This meeting is being recorded Feel free to use the “Chat” feature for questions, comments or any items you would like the moderator or participants to know 2

3. Agenda Introductions Background and Overview Goals Project Scope Future Applications Timeline Next Steps 3

4. Project Staff - Introductions OCPO-ONC Lead – Jeremy Maxwell Project Coordinator – Johnathan Coleman Project Manager – Ali Khan Project Support – Taima Gomez Staff Subject Matter Experts »Kathleen Connor »David Staggs 4

5. Background In the age of increasing electronic information exchange, patients are often asked to make a “consent decision”. This consent decision concerns the sharing and accessing of the patient’s health information for treatment, payment, and health care operation purposes, even when the law may not require written consent. The increased capacity of data sharing has led to additional questions such as when and how should patients consent to sharing their information electronically for purposes where consent was traditionally captured on paper or health information was not shared at all. 5

6. Overview This project seeks to address patient trust of health information exchange as the way health care providers and participants share and access health information. The aim is to assist the healthcare ecosystem by analyzing and developing technical standards to fulfill the technical capability for implementing and sharing individual consent (basic and granular choice) for the sharing of health information in healthcare settings and in a research environment. 6

7. What is Computable Privacy? 7 To achieve health, an individual’s electronic health data need to be digitally connected to their consent choices. Health care providers and their health IT systems need to know what to do when the individual does not document a choice. Telemedicine, community health supports, and other innovative delivery processes will be stunted if we cannot make privacy computable. Permitted Uses = Background Rules Basic Choice Granular Choice This is HIPAA If offered, use standards

8. Connecting Health and Care for the Nation A Shared Nationwide Interoperability Roadmap Basic Choice is the choice offered to an individual to prevent his/her PHI from being available for electronic exchange when it otherwise would be for purposes of treatment, payment and operations (without an individual’s permission) because it is allowed by the HIPAA Privacy Rule, and no other laws requiring permission such as 42 CFR Part 2, or state enacted laws, apply. »Covered entities may (and often do) voluntarily choose to obtain an individual's consent ("basic choice") to use and disclose information about them for TPO. Granular Choice is the choice an individual makes regarding the distinctions between legally sensitive clinical conditions, such as mental health or HIV/AIDS status and evolves over time to enable choice about disclosure to specifically identified participants in the health care system. Call to Action 2015-2017 »ONC, standards development organizations, technology developers and appropriate stakeholders should harmonize technical standards and implementation guidance for consistently capturing, communicating and processing Basic Choice across the ecosystem. 8

9. Project Timeline Overview 9 Sep 15Jan 16Jul 16Jan 17Jul 17Jan 18Jul 18Jan 19Jul 19Mar 20 Phase 1: Basic Choice Phase 2: Basic Choice for Research Consent Phase 3: Granular Choice

10. Project Goals Phase 1: Basic Choice To develop Basic Consent Use Cases and Functional Requirements which can be used to guide a Piloting process Conduct pilots which test the functional requirements and scenarios described in the Use Case Development Phase Develop a best practices implementation guide based on lessons learned from piloting efforts. Align work efforts with Standards Developing Organizations (SDO) when possible Develop implementation guidance in form of a standard or artifact Phase 2: Basic Choice for Research Consent and Phase 3: Granular Choice Build upon artifacts and lessons learned from Phase 1 and repeat the process for Phases 2 & 3 10

11. Phase 1: In-Scope Semantic understanding of a Basic Choice consent decision and the corresponding information that comprises a privacy consent directive Information that must be available a the time of a query for patient data to enable a data source to determine if the requester is authorized to receive a response Demonstrate the use of computable consent to enable privacy policy implementation and information access control decisions 11

12. Phase 1: Out of Scope Methods for Capturing Consent Patient Interfaces Mechanisms for managing a consent directive »Policies surrounding information that has already been shared when a patient changes their privacy consent directive to “Do not share” »Mechanisms to update privacy consent directives Maintenance and updating of consent registries Maintenance and updating of consent repositories 12

13. Patient Centered Outcomes Research (PCOR) Privacy and Security Research Scenario Initiative and Legal Analysis and Ethics Framework Development Determining how health information from a variety of data sources can be used for PCOR/CER, consistent with principles of bioethics and the legal requirements governing privacy of health information, including patient consent Phase 1: »Develop research data use scenarios with the stakeholder group Phase 2: »Assess the legal, regulatory, and policy environment governing the use of health information for PCOR/CER »Develop a legal and ethics framework for protecting patient privacy during conduct of PCOR/CER 13

14. Future Applications Interoperable semantic description of a consent directive to be used for a variety of use cases »Sharing information for research (Phase 2) »Personal Health Record (PHR) »Mobile Health Applications »Behavioral Health Systems Setting the groundwork for granular consent models »Phase 3: Granular Choice »Consenting to share specific types of information 14

15. Stakeholder Levels of Commitment Committed contributors »Regular attendance on weekly working calls »Ad hoc review of project documents or discussion on confluence site »Active participation on developing use cases »Feedback on key deliverables Interested Parties »No formal commitment »Provide feedback and comments on monthly community report out calls 15

16. Phase 1 - Timeline 16 Nov Dec Jan FebMar AprMayJunJulyAugSeptOctNov (Today) Begin Pilot Work Kick Off Pilot Activities Use Case Working Group Kick Off Session Conduct Pilots Needs Assessment Review and development of formal use cases Develop Best Practices IG Draft Basic Choice Standard

17. Scenario 1: Query for Consent Directive Provider/ Healthcare Provider Organization Start 1. Determines that Patient data should be requested 2. Sends query for Patient data to the HIO Data Holder/HIO Consent Directive Registry Consent Repository 3. Receives query for Patient data 4. Determines if consent is required to share Patient data 5. Sends query to Consent Directive registry for Privacy Consent Directive location 6. Sends Privacy Consent Directive location 7. Sends query to Privacy Consent Directive Repository 9. Review Privacy Consent Directive to determine the data that may be disclosed 8. Sends Privacy Consent Directive to HIO 10. Sends Patient data to requesting Provider 11. Receives Patient data End

18. Scenario 2: Push Consent Directive and Authorization 18 Data RequesterData Holder Start 1. Data Requester sends Privacy Consent Directive and request for Patient data to provider 2 3. Data Holder decides which information to return and assembles response. 2. Data Holder receives Privacy Consent Directive and request for Patient data 5. Data Requester receives response from Data Holder 4. Data Holder sends response to Data Requester End

19. Next Steps Schedule Weekly Working Group Meeting Visit Confluence Page »http://confluence.siframework.org/display/PATCH/Patient+Choice+Home Review Background and Associated information posted to the Confluence »http://confluence.siframework.org/display/PATCH/Patient+Choice+Home 19

20. Project Contact Information OCPO-ONC LeadJeremy MaxwellJeremy.Maxwell@hhs.gov Project CoordinatorJohnathan Colemanjc@securityrs.com Project ManagerAli KhanAli.Khan@esacinc.com Project SupportTaima GomezTaima.Gomez@esacinc.com Staff SMEKathleen Connorklc@securityrs.com Staff SMEDavid Staggsdrs@securityrs.com 20

21. @ONC_HealthIT@HHSONC Thank you for joining!