In Wisconsin we have Interoperability

There is much talk on the blogs about the USA government trepidation around Health Information Exchange interoperability. Some samples:

• Geek Doctor -- Interoperability and the Trough of Disillusionment 
• Motorcycle Guy -- Who should be in charge of developing HealthIT Standards for the US

I live in Wisconsin, and it seems I live in one of the few areas where Health Information Exchange is alive and well. See below an interesting monthly report I get from the Wisconsin HIE. It shows the health of this system. A very healthy and Quality producing HIE: 2.6 Million Patients, Almost 15 Million Lab transactions, and Almost 200 Thousand Radiology transactions.

 

I am on the Technical Advisory Committee for WISHIN.

This is a Standards based HIE, based on IHE-XDS and XCA. Fully federated.

I also find it interesting that opt-out has only happened 33 times, total, out of 2.6 million patients. Yes, this is an 'implied consent' state. There are many ways offered for patients to opt-out. Note, one patient has chosen to opt back in...

John

From: Wisconsin Statewide Health Information Network [mailto:wishin@wishin.org]

Subject: WISHIN Connections - May 2015

May 2015 Welcome to WISHIN Connections, the monthly e-Newsletter from the Wisconsin Statewide Health Information Network (WISHIN).  We will keep you up to date with WISHIN activities, news on health information exchange (HIE) and new product developments. WISHIN Pulse Dashboard Data through April 30, 2015 Pulse Transaction Statistics ADT Transactions: 65,635,193  Lab/Pathology Reports: 14,710,937 Radiology Reports: 196,700 Transcribed Reports: 144,121 Public Health Syndromic  Surveillance: 55,350,072 Pulse Patient Statistics # of unique patients: 2,609,548 # of patients opted out: 33 # of patients opted back in: 1     Pulse User Statistics # of Pulse Users: 1,018 Users Who Logged in 1+ Times in Month: 322 # of Chart Accesses in Month: 5,964 # of Unique Patients Queried in Month: 1,176 EKG Results Now Available Through WISHIN Pulse <![if !vml]><![endif]>Earlier this month Ministry Health and Affinity Health System became the first WISHIN clients to share EKG reports via WISHIN Pulse. This marks the first instance of adding attachments to Pulse messages. By adding a PDF of the EKG report, connected physicians are able to view EKG wave form images along with a cardiologist's interpretation of the results. Receiving both the wave form images and interpretations allow providers to make even more informed decisions about their patients' care plans.  Contact WISHIN to share your EKG results through WISHIN Pulse.  EHR Vendors Eliminate Fees; Ease Path to Interoperability The path to statewide interoperability has become a bit easier with the announcement by several electronic health record (EHR) vendors that they would eliminate fees that caused concern for some health care organizations seeking to participate in health information exchange (HIE). In April, the Office of the National Coordinator for Health Information Technology sent a report to Congress, criticizing information technology developers as well as health care organizations for "blocking" state and federal efforts at HIE.  Later in the month, Epic Systems, Athenahealth, and other EHR vendors announced plans to halt charges for interfaces and transactions related to HIE. In its April 27th edition, Wisconsin Health News reported that Epic, the largest EHR vendor in Wisconsin, previously charged providers 20 cents for each clinical message sent to a health information exchange with inbound messages charged at a rate of $2.35 per patient per year. The vendor eliminated the fees retroactively to April 1 and plans to continue with no-charge data sharing until 2020. Elimination of HIE-related fees is just one piece of the puzzle for interoperability. As Jitin Asnaanii, Executive Director of CommonWell Health Alliance points out, free exchange doesn't necessarily equal effective exchange. "There are two key factors that will drive real-world exchange and usage of health information," Asnaanii told Healthcare Dive, "(a) availability of functioning interoperability services to those who need them; and (b) access to the data when and where it is needed." So while many EHR vendor fees have been eliminated for the moment, it remains to be seen if the vendors will also remove technical and practical barriers to exchange with other EHR vendors' products. WISHIN's vendor-agnostic, one-to-many architecture advances true interoperability. One connection with WISHIN circumvents the complexity of multiple point-to-point connections between providers and delivers access to information from all other participating organizations. With clinical information for more than 2.6 million unique patients (and growing) WISHIN is a critical tool for advancing interoperability for seamless, complete and improved patient care statewide.   EHR Adoption Rates Help Wisconsin Rank Second in Nation for Health Care Quality <![if !vml]><![endif]>In a report released early this month by the federal Agency for Healthcare Research and Quality (AHRQ) Wisconsin placed second among the 50 states in quality of health care. The report, which ranks states on more than 200 criteria, produces a score based on a state's achievements in relation to "achievable benchmarks in health care quality." A number of Wisconsin's highest-scoring measures were related to electronic health record (EHR) use and capabilities in hospitals. In Wisconsin many hospitals were early adopters of EHR systems and the state scored 44% better than the national benchmark in "hospitals with computerized system that allows for electronic clinical documentation including physician notes."  A high rate of EHR adoption is one of the factors that make Wisconsin poised to lead in development of successful statewide health information exchange (HIE) and achieve widespread interoperability. HIE is positioned to thrive in Wisconsin because so many hospitals and providers have already digitized their health care information. As an independent, EHR-agnostic HIE utility, WISHIN is able to connect to any EHR system including those created by popular vendors such as Cerner, MEDITECH and Epic as well as those of smaller organizations or custom-built EHRs. One connection with WISHIN provides access to exchange and use information from all other participating organizations. WISHIN can play a key role in continuing to advance health care quality in Wisconsin. WISHIN Pulse makes information available to those who need it, when they need it. Enabling vital information to follow patients wherever they seek care can mean better outcomes, fewer preventable readmissions, and lower administrative costs.  Contact WISHIN for more information regarding how Pulse could be integrated into your EHR system.  HIT & HIE News CMS Official on Future of Health IT: "It's Time to Build Something Magnificent" Wisconsin Health Care Ranks Second Highest in Nation  How Technology Drives Care Coordination and Improves Transition of Care

Strawman on Consent Directive

The Healthcare community continue to struggle with Patient Consent Directives. I assert it is because we have two very different forces:

1. Healthcare Business -- that are under many regulatory, ethical, and business forces. This makes it very hard to change, especially hard to make radical changes. So this community needs very small realistic changes suggested that eventually produce the result desired.
2. Patient Advocates -- that want a very different User Experience. This community wants all of the Privacy Principles implemented. They accept nothing less, likely because of the limited movement so far.

I support both views! But we can't go from one view to the other without taking some small steps.

We can't change Healthcare by writing very complex standards like the current FHIR ConsentDirective, which is fundamentally a "Contract" resource. And the CDA ConsentDirective is even less realistic. First I recommend that FHIR make ConsentDirective a resource rather than just profiles of Contract. I have defended this model so far, but the negatives are more powerful. People simply want a ConsentDirective resource.

Might I suggest that the ConsentDirective project include a "Basic-ConsentDirective" that supports blanket consents without exceptions. Essentially the common HIE policies from BPPC. These would be scoped to sharing beyond the original organization and purpose for which the health information was created. This form of a Consent Directive would need only (identifier, issued, applies, subject, authority, domain, type=consent, subtype=<some vocabulary>, and possibly friendly and legal). This Basic Consent Directive would support the following HIE subtypes:

• Opt-In -- Agree to publish "All" healthcare information. Agree to Use and Disclosure to "any" authorized individual of a "Treatment" or "Payment" organization "For the Purpose" of "Treatment" or "Payment". No Redisclosure allowed without further authorization. This agreement does not authorize other accesses.
• Opt-Out allowing break-glass -- Agree to publish "All" healthcare information. Agree to Use and Disclosure to "any" authorized individual of a Treatment organization for specifically "Emergency Treatment" PurpoeOfUse, and Payment of those treatment. This agreement does not authorize other accesses.
• Opt-In summary access only -- Agree to publish "All" healthcare information. Agree to Use and Disclosure to "any" authorized individual of a "Treatment" or "Payment" organization "For the Purpose" of "Treatment" or "Payment"; to only the medications and allergies summary. No Redisclosure allowed without further authorization. This agreement does not authorize other accesses.
• Opt-In break-glass summary access only -- Agree to publish "All" healthcare information. Agree to Use and Disclosure to "any" authorized individual of a "Treatment" organization "For the Purpose" of "Emergency Treatment" and Payment of those treatment; to only the medications and allergies summary. No Redisclosure allowed without further authorization. This agreement does not authorize other accesses.
• Opt-Out no break-glass -- Agree to publish "All" healthcare information. This agreement does not authorize any accesses.
• Opt-Out completely -- Agree to publish "No" healthcare information beyond originating organization intended use.

I will also note that I think we should look to ‘Creative Commons’, which I explain on my blog.

                http://healthcaresecprivacy.blogspot.com/2014/08/healthcare-patient-consent-lessons.html

More advanced consents can be made once we have this basic vocabulary in place. For example we an then add exceptions, which can be computable rules. For example an "Opt-In" but not to Doctor Bob. All of the Opt-In logic is understood from the reference to Opt-In, the only thing that needs to be added is the exception for Doctor Bob. No need to duplicate the logic of Opt-In in each patient chart.

References:

Patient Privacy controls (aka Consent, Authorization, Data Segmentation)

• Healthcare Patient Consent -- Lessons learned from Creative Commons
• Enabling Patients to Delegate Healthcare Information Access Authority
• Define Atom -- Too many definitions in use today 
• Defining Privacy
• Safety vs Privacy
• Privacy Consent State of Mind
• Universal Health ID -- Enable Privacy
• Texas HIE Consent Management System Design
• Simple and Effective HIE Consent
• IHE - Privacy and Security Profiles - Basic Patient Privacy Consents
• Data Segmentation - now I know where the term comes from

Access Control (Consent enforcement)

• What does the SAML assertion mean in a XDS/XCA query/retrieve?
•  Healthcare Privacy and Security Classification System (HCS) 
• Define Atom -- Too many definitions in use today 
• Healthcare access control scope constraints on OAuth tokens
• Advanced Access Controls to support sensitive health topics
• Policy Enforcing XDS Registry 
• Healthcare Metadata
• Texas HIE Consent Management System Design
• IHE - Privacy and Security Profiles - Access Control
• Data Classification - a key vector enabling rich Security and Privacy controls
• Healthcare Access Controls standards landscape
• Handling the obligation to prohibit Re-disclosure
• Access Controls: Policies --> Attributes --> Implementation