1. “ Jericho / UT Austin Pilot” Privacy with Dynamic Patient Review August 13, 2013 Presented by: Michael Dufel and David Staggs Jericho Systems Corporation

2. 208/13/2013 Agenda Administrative issues Pilot scope Today’s Demonstration Pilot data flow Familiarization with the Universal Client Viewing audit records Changing PCD Demo Discussion Pilot Timeline Questions Plan of Action

3. 308/13/2013 Pilot Administrivia This pilot is a community led pilot –Limited support provided by the ONC Zachary May (ESAC) Jeanne Burton (Security Risk Solutions) Libbie Buchele and Penelope Hughes (ONC) In conjunction with DS4P bi-weekly return of an All Hands meeting Access to DS4P Wiki, teleconference, and calendar Meeting times: Tuesdays 11AM (ET) –Dial In: +1-650-479-3208 Access code: 662 197 169 URL: https://siframework1.webex.com/siframework1/onstage/g.php?t=a& d=662197169 https://siframework1.webex.com/siframework1/onstage/g.php?t=a& d=662197169

4. 408/13/2013 Scope of the Pilot 1.Define the exchange of HL7 CDA-compliant PCD between a data custodian and a PCD repository that includes a report on the outcome of the request back to the healthcare consumer. 2.Additional goal: use of identifiers that can uniquely identify the healthcare consumer and PCD repository used to report the outcome of the request back to the healthcare consumer by healthcare consumer’s provider and subsequent EHR custodians. 3.Stretch goal: mask and/or redact the clinical document based on PCD choices retrieved from the PCD repository. 4.Stretch goal: use of the PCD repository as a proxy allowing direct authentication by the healthcare consumer to the provider, subsequently reducing correlation errors.

5. 508/13/2013 Today’s Demonstration 1.Use Universal Client to send NwHIN messages –Patient Discovery (ITI-55), Query for Documents (ITI-38), and Request Document (ITI-39). 2.Demonstrate consent based on recipient and patient consent directive (retrieved from a PCD repository) –Show result of different policies: 1 st requestor v. 2 nd requestor 3.Demonstrate PCD applied by 1 st requestor –1 st requestor retrieves document 2 nd requestor requests from 1 st requestor 4. Demonstrate consent based on purpose of use –change policy from “treatment” to “research” where request uses “research” attribute each time.

6. 608/13/2013 Pilot Data Flow Custodian of Data being Provided at  Patient PCD Repository 2 nd Requestor 1 st Requestor   B ,  = Clinical data A,B = PCD data = audit record And Subsequent Custodian of Data being Provided at 

7. 708/13/2013 Universal Client Orientation 1 1st Requestor starts CONNECT Universal Client

8. 808/13/2013 Universal Client Orientation 2 1st Requestor sees local matching patients

9. 908/13/2013 Universal Client Orientation 3 1st Requestor first time at “Patient Correlations” tab

10. 1008/13/2013 Universal Client Orientation 4 1st Requestor completes “patient discovery” (ITI-55) (ITI-55)

11. 1108/13/2013 Universal Client Orientation 5 1st Requestor first time at “Documents” tab

12. 1208/13/2013 Universal Client Orientation 5 1st Requestor completes “request for documents” (ITI-38) (ITI-38)

13. 1308/13/2013 Universal Client Orientation 5 1st Requestor retrieves document from primary custodian (ITI-39) (ITI-39)

14. 1408/13/2013 Reviewing Audit Records

15. 1508/13/2013 Changing PCD

16. Live Demo 08/13/201316

17. 1708/13/2013 Discussion Lessons learned from current demonstration: o Communicating use of the Universal Client o Local demographic data o Patient Discovery (ITI-55), Query for Documents (ITI-38), and Request Document (ITI-39). o Communicating use of the PCD repository o Communicating use of OpenATNA Audit Message Viewer o Communicating how PCD is changed and the affects o Unexpected benefits/problems

18. 1808/13/2013 Pilot Timeline General Timeline, conditioned on agreement of stakeholders

19. 1908/13/2013 Questions? What do the consent directives look like? How is the PCD identifiers encoded into the clinical document? What happens if 1 st requestor has a different PCD repository for the subject of the clinical document?

20. 20 Plan of Action Upon agreement of the participants the POA is: Identify the elements available from previous DS4P pilots Scope level of effort, decide on extended scenario Determine first draft of functional requirements Review standards available for returning information on requests Determine any gaps or extensions required in standards Stand up information holders and requestors Create XDS.b repository holding PCD Identify remaining pieces Document and update IG with results of our experience 08/13/2013

21. 2108/13/2013 Backup Slides

22. DS4P Standards Material Location of DS4P Standards Inventory: http://wiki.siframework.org/Data+Segmentation+-+Standards+Inventory Location of DS4P Standards Mapping Issues: http://wiki.siframework.org/file/view/Copy%20of%20DataMappingsIssues%20051 02012.xlsx/333681710/Copy%20of%20DataMappingsIssues%2005102012.xlsx General Standards Source List: http://wiki.siframework.org/file/view/General%20SI%20Framework%20Standards %20Analysis.xlsx/297940330/General%20SI%20Framework%20Standards%20A nalysis.xlsx Standards Crosswalk Analysis http://wiki.siframework.org/Data+Segmentation+for+Privacy+Standards+and+Har monizationhttp://wiki.siframework.org/Data+Segmentation+for+Privacy+Standards+and+Har monization (at bottom of page, exportable) Implementation Guidance http://wiki.siframework.org/file/view/Data%20Segmentation%20Implementation% 20Guidance_consensus_v1_0_4.pdf/416474106/Data%20Segmentation%20Impl ementation%20Guidance_consensus_v1_0_4.pdf 08/13/201322

23. 2308/13/2013 DS4P References Use Case: http://wiki.siframework.org/Data+Segmentation+for+Privacy+Use+C ases http://wiki.siframework.org/Data+Segmentation+for+Privacy+Use+C ases Implementation Guide: http://wiki.siframework.org/Data+Segmentation+for+Privacy+IG+Co nsensus http://wiki.siframework.org/Data+Segmentation+for+Privacy+IG+Co nsensus Pilots Wiki Page: http://wiki.siframework.org/Data+Segmentation+for+Privacy+RI+and +Pilots+Sub-Workgroup http://wiki.siframework.org/Data+Segmentation+for+Privacy+RI+and +Pilots+Sub-Workgroup

24. 2408/13/2013 Pilot Data Flow Custodian of Data being Provided at  Patient PCD Repository 2 nd Requestor 1 st Requestor   B ,  = Clinical data A,B = PCD data = audit record And Subsequent Custodian of Data being Provided at 

25. 2508/13/2013 Pilot Data Flow Custodian of Data being Provided at  Patient PCD Repository 2 nd Requestor 1 st Requestor Clinical exchange #  Clinical exchange #  B ,  = Clinical data A,B = PCD data = audit record And Subsequent Custodian of Data being Provided at  Fetch PCD Send audit

26. 2608/13/2013 Pilot Data Flow (1) Custodian of Data being Provided at  Patient PCD Repository 2 nd Requestor 1 st Requestor  ,  = Clinical data A,B = PCD data = audit record

27. 2708/13/2013 Pilot Data Flow (2) Custodian of Data being Provided at  Patient PCD Repository 2 nd Requestor 1 st Requestor  ,  = Clinical data A,B = PCD data = audit record

28. 2808/13/2013 Pilot Data Flow (3) Custodian of Data being Provided at  Patient PCD Repository 2 nd Requestor 1 st Requestor  B ,  = Clinical data A,B = PCD data = audit record And Subsequent Custodian of Data being Provided at 

29. 2908/13/2013 Pilot Data Flow (4) Custodian of Data being Provided at  Patient PCD Repository 2 nd Requestor 1 st Requestor  ,  = Clinical data A,B = PCD data = audit record And Subsequent Custodian of Data being Provided at 

30. 3008/13/2013 Pilot Data Flow (5) Custodian of Data being Provided at  Patient PCD Repository 2 nd Requestor 1 st Requestor ,  = Clinical data A,B = PCD data = audit record And Subsequent Custodian of Data being Provided at 

31. 3108/13/2013 Pilot Data Flow (updated) Custodian of Data being Provided at  Patient PCD Repository 2 nd Requestor 1 st Requestor   B ,  = Clinical data A,B = PCD data = audit record And Subsequent Custodian of Data being Provided at 