Monday, April 16, 2012

Around and Around we go

I have spent the last three days in DC at a face-to-face meeting with the S&I Framework - Data Segmentation for Privacy (DS4P). We have gotten nothing accomplished. No matter what direction the agenda tries to approach this, we end up discussing the 'yes but' rat-holes.

The Project has 5 parts. These 5 parts are well defined, and we could focus on any one of them and make progress.
  1. How do you PUSH clinical documents from one organization to another while carrying enough information that the receiving organization can protect them
  2. How do we PULL clinical documents from one organization to another while protecting the the information 
  3. How do we manage consents in an HIE that chooses to have central management and HIE-wide consents. 
  4. What would centrally managed consent look like. Documenting the CDA consent-directive, and how it can be used for specific use-cases.
  5. What are the rules that one would use to determine the 'tagging' of data that you are about to send.
Privacy Rules
The biggest problem is of course that the rules one would need to apply for (5) and the rules one would need to encode in (4) are not well defined, even in the paper world. If they could be defined in the paper world this would be a much quicker problem to solve. Because of this lack of clarity even in the paper world, it is hard to discuss how to move this from paper to electronic. I would like to offload much of this work until the ONC e-Consent project is further along. This project should help give us some clarity on the rules, hopefully starting with some reasonable stepping stones.

Communicating Segmentation 
Items 1-3 are available today, but not well understood. This is especially true if one focuses on Document exchange where the control necessary is applied to the whole document. It is true that CDA does have some ability to drive controls at the section level, and there are some hacks available for the entry level. This CDA mechanism is really not well understood, and I struggle to find any real-world use of it. Further this mechanism is under revision with the CDA R3 project, revision that could really do a better job if given some reasonable input. Thus, I would like to see the S&I Framework project focus the fine-grained controls within CDA on documenting the need and use-cases for these fine-grained controls.

The point I would like to emphasize is that the transport can do one level, totally independent of the more fine-grained controls that could be applied within a CDA document. The industry would gain greatly simply through the documentation of the kind of controls that the transport can offer. This would be very useful to moving forward.

Conclusion
We can document some solutions that are available today but not well understood or documented. I am perfectly fine with explaining that they are not perfect solutions. I am simply not willing to let perfection get in the way of good. I want to move the Healthcare industry along using stepping stones.


Thursday, April 12, 2012

The French Health Information Systems Interoperability Framework -- Now available in English

I first pointed at the French National EHR based on IHE XDS back in June. The good news today is that there is now an English translation of their documents. The important part about this is not just that they used XDS, and did a fine job of explaining XDS better than IHE ever have. The important part is that because this is an operational environment, they document those things that are beyond the scope of IHE. This means document content, vocabularies, security model, privacy model, etc.

The documents now available in English are:
  • Introduction to the HIS-IF
  • Common Rules and Templates for CDA Content Modules
  • Service Layer for Document  Sharing
  • Synchronous Transport Layer
To get access to these, Please go to this article on the release of these documents

Tuesday, April 10, 2012

Meaningful Transmission into Oblivion

Today I heard that the Meaningful Use Stage 2 criteria require only that PHI can be Transmitted, never Received. I was shocked and didn't believe it was so. I asked around and indeed we couldn’t find any case where the Meaningful Use Stage 2 criteria ever requires a certified product be capable of receiving PHI that was transmitted by another.

This kind of one-sided conversation is typical of government work, but that surely can’t be the intention. Surely ONC didn’t mean that they want everyone to be able to Send health information while at the same time no-one is required to be able receive it. But clearly that is all that the ONC rule calls for. “transmit to 3rd party”, and “transmit summary of care record”. One could include “download” by the patient. Never includes receive or upload…


Oblivion is a dark place, where all Health data probably  already exists. Why send more of it there?

This is so absurd that I had described the receiving side when I covered the Meaningful Use Transports. Indeed all discussions of Health Information Exchange always speak of how one receives the documents. It is the reception of the documents (pushed or pulled) that ultimately provide the benefit of a HIE. The original author or custodian doesn’t get any benefit from their participation in the Exchange. So, it could be that ONC simply figures that reception is obviously needed and thus will happen naturally.

Hope springs eternal, is an unreliable way to get change.

Some of the use-cases such as immunizations, surveillance, or reportable cases are indeed one-way. There is no need for these to have receive sides.

Receiving externally sourced documents does have struggles that are unique and difficult. The Meaningful Use stage 1 included criteria to Display documents, I guess one could assume this is enhanced at MU2 without need for clarity? I think it needs to be made clear. Specifically CDA documents by definition only require that the narrative part be displayed. There is no CDA criteria that I am aware of that requires that any of the structured and coded part be used in any display or even used in anyway at all. Just that the narrative block can be displayed.

Typically the Reception side is done through some human mediation. This is done to allow for quality controls to check that the content is intact, that the patient is identified and matched, that there is proper coding or manipulation of coding, that there is appropriate permissions applied, that there is appropriate routing to appropriate people, etc. So, typically there is not much that one can do purely in technology. This is especially true with the Direct Project, when the sender didn't utilize the XDM.zip content packaging with the defined XD* Metadata. But even when metadata is perfect, codes are aligned perfectly, and there is clear need and permissions; the automated flow directly into the Legal Medical Record will be carefully controlled by Medical Records oversight. I think that the legal Medical Records domain is not considered enough.

Patient Provided data is important yet a difficult topic due to plenty records of intentional abuse (drug seeking behavour) or unintended (forgetting some critical factor). Patient provided 'upload' is even harder as it also has to deal with issues of potential falsification. I have had these discussions with some as well, people really wanting Digital Signatures. I think Digital Signatures will eventually happen, but they are not a panacea and there are other ways for a provider to check on the accuracy of another provider's authored content. Such as, ask the other provider for confirmation. For truly patient authored content, the kind of thing the doctor first asks you in the exam room: "What is the problem?"; this is always considered suspicious until the doctor confirms with his own observations... (I would say taken with a grain of salt, but we all know salt is bad for the health).


Conclusion
Thus at best the Reception side should be expected to be a human mediated queue (inbox). There will be cases where it is more automated, especially with Query/Retrieve exchanges. But that is a different topic.

Updates
Note that the NPRM does require the capability to incorporate the summary of care record and to reconcile clinical information [§170.314(b)(1) Incorporate summary of care record] and [§ 170.314(b)(4) Clinical information reconciliation]. But I would stress that in order to incorporate one must first catch it.


Note2 that the NPRM [§170.314(b)(1)] does say what should be done after one catches a 'summary of care record'. And it is right in line with my concern above. But it still doesn't say what precedes the 'incorporation' functionality, nor what one would do with anything that might come in on the defined 'Transports'.

§ 170.314(b)(1)(1) Transitions of care – in corporate summary care record . Upon receipt of a summary care record formatted according to the standard adopte d at § 170.205(a)(3), electronically incorporate, at a minimum, the following data elements: Patient name; gender; race; ethnicity; preferred language; date of birth; smoking status; vital sign s; medications; medicati on allergies; problems; procedures; laboratory tests and va lues/results; the referring or  transitioning provider’s name and contact information; hospital admission and  discharge dates and locations; discharge instructions; reason(s) for hospita lization; care plan, including goals and instructions; names of  providers of care during hospitalizations; and names and contact information of any additional known care team members beyond th e referring or transitioning  provider and the receiving provider. 


Monday, April 9, 2012

FW: NIST - Safeguarding Health Information: Building Assurance through HIPAA Security

This just crossed my desk. Wish I could be there. Please let me know how it goes.

NIST, HHS and OCR Sponsored Event: 
“Safeguarding Health Information: Building Assurance through HIPAA Security”
The National Institute of Standards and Technology (NIST) and the Department of Health and Human Services (HHS), Office for Civil Rights (OCR) are co-hosting the 5th annual conference Safeguarding Health Information: Building Assurance through HIPAA Security on June 6 & 7, 2012 at the Ronald Reagan Building and International Trade Center in Washington, D.C.  
The conference will explore the current health information technology security landscape and the Health Insurance Portability and Accountability Act (HIPAA) Security Rule. This event will highlight the present state of health information security, and practical strategies, tips and techniques for implementing the HIPAA Security Rule. The Security Rule sets federal standards to protect the confidentiality, integrity and availability of electronic protected health information by requiring HIPAA covered entities and their business associates to implement and maintain administrative, physical and technical safeguards.

The conference will offer important keynote addresses and plenary sessions as well as breakout sessions following two learning tracks around specific areas of security management and technical assurance. Presentations will cover a variety of current topics including updates on HHS health information privacy and security initiatives, OCR's enforcement of health information privacy and security activities, integrating security safeguards into health IT, safeguards to secure mobile devices, removing sensitive data from the Internet, and more.




Friday, March 30, 2012

FW: IHE Radiology Technical Framework Supplements Published for Public Comment

 This just crossed my desk


Integrating the Healthcare Enterprise

IHE Radiology Technical Framework Supplements Published for Public Comment

The IHE Radiology Technical Committee has published the following supplements to the IHE Radiology Technical Framework for Public Comment in the period from March 30 through April 30, 2012:
These profiles will be available for testing at subsequent IHE Connectathons. Comments submitted by April 30, 2012 will be considered by the Radiology Technical Committee in developing the trial implementation version of the supplements. The documents are available for download at http://ihe.net/Technical_Framework/public_comment.cfm. Comments should be submitted at http://ihe.net/radiology/radiologycomments.cfm.

Complexity

HIE solution that is Just as complex as it needs to be and no more complex. (analogous to Occam’s razor)

I have had multiple discussions this week around how complex this or that HIE standard is. This usually comes back to the statements from the HIT Standards NwHIN Power Team evaluation of Direct vs Exchange. In their recommendation they indicate that Exchange was complex. It is amazing how these things keep coming up. I argue that they have two different goals that have overlap. The solution to this overlap is logical progression, not totally different. Thus, we should not be looking to choose one or the other; but rather choose both and apply them to the use-case that they target.

Page count:Given that our government continues to back projects like HITSP and S&I Framework that consider Page Count an important aspect, let’s look at the page count between Direct and Exchange. 

Direct Project                                                                   89 Pages
NwHIN-Exchange Currently in Effect                             133 pages
So using page count alone, Exchange is only 50% more complex than Direct, for all the more functionality of Exchange over Direct. At this rate, I wonder why we would want to use Direct over FAX, FAX doesn’t require any healthcare documentation. Or pony-express, very simple just a man and his horse. Or better yet, smoke signals.

Reality
Yes you caught me… I didn’t include the page counts of the IHE specifications, OASIS specifications, W3C specifications, or IETF specifications that they both reference. It is clear page count is a hard thing to figure out. I would argue too that complexity is also a hard thing to figure out. The only reason why e-mail seems easy today is because the last 20 years have worked out the kinks. In the 80s wrote an SMTP system for DOS, it ran as a TSR. That was not easy to do, but I will admit that anything that could run as a DOS TSR must be pretty simple. Well it didn’t support all the protocols we include today in the simple term ‘e-mail’, and didn’t support S/MIME at all.

There is far more similarity in technology between the two. Where Direct uses MIME, this is very similar to the Exchange use of SOAP carrying multiple parts. One can easily argue that the Direct use of S/MIME to secure the communications is far harder than mutually-authenticated-TLS; yet both rely on X.509 Digital Certificates to prove identity and authentication. I would actually argue that none of this matter at all as these are off-the-shelf libraries that are not specific to healthcare. Even in the healthcare space: Where Direct includes XDM and XDR, Exchange uses XCA and XDR. Much of the complexity of XD* shows up in both, just different modes.

In both cases there are Open-Source reference implementations. Actually for Direct there is only ONE that I know of, whereas Exchange has 2 or more (NIST, Open Health Tools). See: http://wiki.ihe.net/index.php?title=Implementation

complex or neededSo, yes the NwHIN-Exchange specifications are harder, significantly harder. They are more complex because they are trying to achieve more than simple push. This is not in any way to say that Direct isn’t what it should be, it was designed to be a simple push replacement for FAX. What angers me is that blanket arguments of complexity are being used to indicate that Exchange is bad.

The NwHIN-Exchange provides in addition to what Direct can do:
  1. Service Endpoint Configuration Discovery 
  2. Patient Identity discovery
  3. Patient data location discovery
  4. Patient data query, when the data is needed
  5. Pull of documents, when the data is needed
  6. Security model that supports federated identity and layers
  7. Privacy model that supports confidentiality classifications and consents
  8. Metadata that is queryable, yet independent of the document format
    1. type of document (clinical type, format type, mime type)
    2. provenance (author, role, specialty, institution, type)
    3. the patient identity 
    4. tags the privacy/security classification 
    5. integrity protection independent of transport
    6. relationships between documents (predecessor, successor, signs, transform, amendment, etc)
    7. date ranges of the healthcare information
  9. Support for Digital Signatures
  10. Platform for multi-organizational workflows
  11. Deployment models for XDS or other HIE architecture
I likely overstated Exchange, but not by much. And my overstatement is far less than the negativity promulgated by those that do nothing but spread Fear, Uncertainty, and Doubt. I am very glad to help anyone understand, go ahead and ask me a question.
The complexity is really needed. In order to support the above capabilities we need to define a Metadata model that is comprehensive enough without being tied to a specific document type, or being overly descriptive of the healthcare condition. This is a difficult tradeoff but I think XDS* got it right, and have it defined in a way that local policy can choose to be expressive or conservative. In the absence of a National Patient ID, we are forced to do all kinds of tricks to discover where a patient's data might be in a way that doesn't expose that patient unnecessary and has enough controls to allow a really high quality match. See: NwHIN-Exchange use of XCPD. In order to support a privacy and security model that can handle patient consent, yet also handle the fact that this exchange is between competing healthcare organizations, IHE called upon the power of SOAP, SAML, and TLS. Yes these are not a simple as REST, OpenID, and HTTPS; but the additional capabilities are needed in the backbone. This is not inconsistent with mHealth use of REST, OpenID, and HTTPS. There are more...

I am involved in S&I Framework – Data Segmentation for Privacy workgroup. This is not a simple topic, but it is made simple by the fact that IHE considered these use-cases when making that ‘complex’ XDS profile. The thing is that IHE didn’t even consider these things complex, they were very clearly needed given the use-case needs that were brought before us. This long term, yet realistic term, view has paid off. The XD* profiles could have been far more complex. Take a look at all that is in the OASIS ebXML Registry specification, really great stuff that we simply don’t need… yet.

Conclusion
Getting to some goal requires stepping stones. I do think that Direct is an appropriate stepping stone, I think the next one is XDS for regional exchanges, XCA for federation of regional exchanges. Eventually we might get to the attribute level exchanges defined in the PCAST report.

References

Thursday, March 29, 2012

Meaningful Use Stage 2 :: SHA-1 vs SHA-2

The Meaningful Use Stage 2 Certification NPRM asks about the use of SHA-1 vs SHA-2.

My short answer is: I agree with the current Meaningful Use Stage 2 decision to stick with SHA-1

Although the life of SHA-1 is shorter than SHA-2; the expected use of the hashing algorithm in Meaningful Use Stage 2 for EHR technology is sufficiently covered by SHA-1.

The longer details:The specific text in the preamble is well written, and captures the specific concerns.
The certification criterion at § 170.314(d)(8) is consistent with the recommendation and recommended certification criterion by the HITSC for the 2014 Edition EHR certification criteria. The capability to detect changes to an audit log has been removed from this proposed certification criterion and added to the proposed certification criterion for “auditable events and tamper resistance” at § 170.314(d)(2). The adopted certification criterion at § 170.304(b) specifies that EHR technology must be able to create a message digest in accordance with the standard specified at § 170.210( c). The adopted standard is: “A hashing algorithm with a security strength equal to or greater than SHA-1 (Secure Hash Algorithm (SHA-1))…must be used to verify that electronic health information has not been altered.” After consultation with NIST, we understand that the strength of a hash function in digital signature applications is limited by the length of the message digest and that in a growing number of circumstances the message digest for SHA-1 is too short for secure digital signatures (SHA-2 produces a 256-bit message digest that is expected to remain secure for a long period of time). We also understand that certain operating systems and applications upon which EHR technology may rely use SHA-1 and do not or cannot support SHA-2 at the present time. Thus, we request public comment on whether we should leave the standard as it currently reads or replace SHA-1 with SHA-2.
Some Regulation References:
  • §170.210(c) - A hashing algorithm with a security strength equal to or greater than SHA-1 (Secure Hash Algorithm (SHA-1) as specified by the National Institute of Standards and Technology (NIST) in FIPS PUB 180-3 (October, 2008) must be used to verify that electronic health information has not been altered
  • §170.314(d)(8) Integrity. (i) Create a message digest in accordance with the standard specified in § 170.210(c). (ii) Verify in accordance with the standard specified in § 170.210(c) upon receipt of electronically exchanged health information that such information has not been altered.
First:I am not sure there is any references left to §170.210(c). Which seems to question keeping it in there at all.

Second: The uses of a SHA-1 algorithm that the Meaningful Use Stage 2 is calling for are sufficiently covered by the use of SHA-1. A deployment today of EHR technology using only SHA-1 will still be quite safe for a decade or more. This is mostly because the uses of SHA-1 that are being called for in Meaningful Use Stage 2 are of the type that are not going to be weakened.

Specifically the use of SHA-1 is in things like the “§170.202 transports”, yes it is in the transports today to use SHA-1 everywhere. The point I have here is that the use of SHA-1 in the transports is to prove that the communication did not get changed during the transfer. These transfers take minutes in most cases, might take days for the Direct transport (secure e-mail). The point is that the receiver checks the integrity right away, so there is no opportunity to falsify the integrity checks.

The second place where SHA-1 would be used is in the secure messaging with patients. This will either use the Direct project (see above), or far more likely will use a Web Portal. With the requirements to secure the communications this Web Portal will use common HTTPS, just like we use with many sensitive web sites like banking. HTTPS commonly uses SHA-1, so it meets the criteria. Like the “transports” discussion, the integrity checks is done right away, so no opportunity to falsify the communications.

Third:They point out that there is concern in the cryptographic community that SHA-1 is potentially not strong enough for digital signatures. This point is well said. The problem is that all cryptographic algorithms eventually succumb to either a vulnerability that is discovered or simply Moore’s-law of computer advancement. The point is also very specific to digital signatures. These two points are important to keep together. It is only when one has something like a Digital Signature that this concern should become important. A Digital Signature is something that needs to last for dozens or more years. A Digital Signature would be applied to documents where there is high value in proving that they had been signed by someone for a specific reason. It is only with a Digital Signature that one has a high enough value to falsification to leverage the vulnerabilities in SHA-1.

But, there is no call for Digital Signatures in Meaningful Use Stage 2. I might predict that by Meaningful Use Stage 3 we might have legitimate use of Digital Signatures for workflows like: Confirming provenance integrity on documents communicated through the patients PHR, Proving signing authority for prescription drugs including narcotics, and legal agreements such as Patient Privacy Consents. But today these are not called for, and I think it is right that they are not yet called for. I would encourage the use of Digital Signatures for these, but the value doesn’t overcome the cost today; especially not enough to mandate that everyone in the USA use them.
The most real of these is already covered by the DEA rule on Electronic Prescription of Controlled Substances.

Forth:
The last factor is that SHA-1 is commonly available in operating systems and tools today, SHA-2 requires technology changes that would cost Healthcare industry greatly. I have covered this in the past around the earlier proposed mandates for SHA-2. These conditions have changed, but Healthcare is still a slow moving industry.


Conclusion:If anything they could change § 170.210(c) from being specific to SHA-1, and be consistent with how they handled Encryption. Simply state that the Integrity algorithm needs to be one specified in FIPS 180-3. This would be effectively the same as we have today, but puts the algorithm specification in the hands of FIPS where it should be.

Update: added the Forth factor.