Report from the Technical Committees

1. Document Number: HITSP 08 xxx Date: December 18, 2008 Report from the Technical Committees Arlington, VA | December 18, 2008 Presented by: Joyce Sensmeier MS, RN-BC, CPHIMS, FHIMSS HITSP Technical Committee Co-Chairs enabling healthcare interoperability

2. AHIC Use Cases 2008 Consumer Population Provider RemoteMonitoring Immunizationsand Response Management Consultations and Transfers of Care Patient – Provider Secure Messaging Public Health Case Reporting PersonalizedHealthcare

3. Technical Committee Leadership Provider Perspective – 218 members Allen Hobbs, PhD, Kaiser Permanente Steve Hufnagel, PhD, DoD/Medical Health System (MHS) Mike Lincoln, MD, Department of Veterans Affairs Consumer Perspective – 197 members Mureen Allen, MD, FACP, ActiveHealth Management Charles Parisot, EHR Association Scott Robertson, PharmD, Kaiser Permanente

4. Technical Committee Leadership Population Perspective - 172 members Floyd Eisenberg, MD, MPH, National Quality Forum Anna Orlova, PhD, Public Health Data Standards Consortium Eileen Koski, M. Phil, Quest Diagnostics Inc. Administrative and Financial Domain – 50 members Don Bechtel, Siemens Medical Solutions Durwin Day, Health Care Service Corporation Deborah Belcher, GE Healthcare

5. Technical Committee Leadership Security, Privacy & Infrastructure Domain - 172 members Glen Marshall, Grok-A-Lot, LLC John Moehrke, GE Healthcare Walter Suarez, MD, Institute for HIPAA/HIT Education and Research Care Management and Health Records Domain - 56 members Keith Boone, GE Healthcare Corey Spears, McKesson Health Solutions Total Technical Committee Membership – 522 individuals

6. 2009 Technical Committee Schedule February 17-19 (Tuesday – Thursday)Washington, DC area June 9-11 (Tuesday – Thursday)Washington, DC area September 1-3 (Tuesday – Thursday)Chicago, IL November 3-5 (Tuesday – Thursday)Phoenix, AZ

7. SPI-TC Report Topics: End-of-year summary of work for 2008 List of work items List of revised constructs, to include editorial updates and technical changes Overview of 9 New constructs developed to support 2008 use cases Activities planned for next year Report from the Security, Privacy & Infrastructure Domain Technical Committee

8. End-of-year summary of work for 2008: Work Items Renamed from Security and Privacy Technical Committee to Security, Privacy and Infrastructure (SPI) Domain Technical Committee Inherited and became responsible for 11 pre-existing Infrastructure constructs During the year, the TC: Completed minor revisions and updates to 7 S&P and 11 Infrastructure Constructs Developed 9 new constructs Formed Identity Credentials Management Work Group (WG tasks now complete) Conducted webinars and outreach activities Responded to NHIN clarification requests Worked with Foundations Committee on Privacy and Security Matrices Supported FHAs Security Strategy Subgroup Supported National Governors Association (NGA) State Alliance for eHealth Supported CCHIT through various means, including Cochair/Expert Panel participation Report from the Security, Privacy & Infrastructure Domain Technical Committee

9. Report from the Security, Privacy & Infrastructure Domain Technical Committee End-of-year summary of work for 2008: Updates to Existing Constructs • *TP13 - Manage Sharing of Documents • T14 - Send Lab Result Message • *TP21 - Query for Existing Data • *TP22 - Patient ID Cross-Referencing • *T23 - Patient Demographics Query • T24 – Pseudonymize • C25 - Anonymize • *T29 - Notification of Document Availability • *T31 - Document Reliable Interchange • *T33 - Transfer of Documents on Media • C44 - Secure Web Connection • *TP50 - Retrieve Form for Data Capture • *T15 - Collect and Communicate Security Audit Trail • *T16 - Consistent Time • *T17 - Secured Communication Channel • C19 - Entity Identity Assertion • *TP20 - Access Control • *C26 - Nonrepudiation of Origin • TP30 - Manage Consent Directives • TN900 – S&P Technical Note * Denotes updates requiring Panel Approval

10. Report from the Security, Privacy & Infrastructure Domain Technical Committee Maintenance Updates: • C26 - Nonrepudiation of Origin Component: • Updated to reflect minor updates in underlying standard which was republished in October, 2008. • Minor editorial changes for readability and clarity. • TP13 - Manage Sharing of Documents: Updated reference to IHE XCA Standard to: Integrating the Healthcare Enterprise (IHE) IT Infrastructure Technical Framework (ITI-TF) Supplement 2008-2009, Cross-Community Access (XCA), Trial Implementation, October 10, 2008 • T15 - Collect and Communicate Security Audit Trail : • Minor editorial changes • Editorial updates for standards version change to IHE ITI-TF Revision 5. • Updated quoted text from underlying standard that has been modified with the updated standard. • T17 – Secured Communication Channel: Incorporated the updated version of the IHE ATNA standard to IHE ITI-TF Revision 5.0 and made minor editorial changes.

11. Report from the Security, Privacy & Infrastructure Domain Technical Committee Maintenance Updates: • TP21 - Query for Existing Data Transaction Package: • Major update to reference the most recent version of the IHE QED Integration Profile supplement • Additional updates to reflect changes in the underlying standard with respect to the technical actors that are referenced, the transactions that are used by the technical actors, and a further refinement of the HL7 V3.0 standard • TP 22 – Patient ID Cross-Referencing: • The use of HL7 2.3.1 for the Patient Identity Feed has been clarified. • Changed the optionality for the technical actors: Patient Identifier Cross-Reference Manager, and Patient Identity Source in Section 2.1.2 Technical Actors. • Provided specific standard reference for HL7 V2.3.1 and HL7 V2.5 in Selected Standards Table 2.3.2. • T23 - Patient Demographics Query: Minor editorial changes.

12. Report from the Security, Privacy & Infrastructure Domain Technical Committee Maintenance Updates: • T29 - Notification of Document Availability: • Updated name of the IHE NAV selected standard. • Update the informative reference for IHE-ITI-TF to Revision 5.0. • T31 – Document Reliable Interchange: Minor editorial changes in addition to: • Updated the document to remove the mail option. This option is no longer specified by the underlying IHE XDR standard. • Updated Table 2.1.2-1 Technical Actors to remove mail option, and updated Unified Modeling Language (UML) diagram to show only the ITI-41 Provide and Register Document Set-b Transaction. • T33 - HITSP Transfer of Documents on Media: Minor editorial changes and changes resulting from Public Comment. • TP50 - Retrieve Form for Data Capture Transaction Package : Edited to incorporate minor version updates of the underlying standard, IHE NAV.

13. Report from the Security, Privacy & Infrastructure Domain Technical Committee Maintenance Updates: TP20: Access Control • This Transaction Package has been updated with editorial and minor updates of a technical nature as follows: • TN900 no longer has glossary or description of application of Security and Privacy constructs to HITSP Interoperability Specification’s, so updated Table 1.4-1 with this information • Provided further clarification on the standards for which the technical actors will be used • Corrected the optionality of the technical actors to indicate that at least one of the Service User or Service Provider actors is required to be implemented • Added high level overview narrative and Figure 2.1.3-1 to provide further details on the typical access control interactions between parties in the exchange of healthcare information • Reorganized the section narrative to provide clarity by moving supplemental, supporting material from Section 2.1.3 into the appendix in Section 4.0 • Edited the narrative to improve readability and consistency • Minor edits to the preconditions to improve readability • •

14. Report from the Security, Privacy & Infrastructure Domain Technical Committee Maintenance Updates: TP20: Access Control (continued) • Selected Standards • Moved the standard reference for OASIS WS-Federation from Table 2.3.2-1 Selected Standards to Table 2.3.3-1Informative Reference Standards • Updated the IHE ATNA profile reference to point to Revision 5.0 or later • Informative References • Added informative references to the OASIS XSPA SAML, OASIS XSPA WS-Trust, and OASIS XSPA XACML profiles as roadmapped references

15. Report from the Security, Privacy & Infrastructure Domain Technical Committee New Constructs • C62- Unstructured Document Component • T63 - Emergency Message Distribution Element Transaction • T64 - Identify Communication Recipients Transaction • T66 - Retrieve Value Set Transaction • T67 - Clinical Referral Request Transaction • T81 - Retrieval of Medical Knowledge Transaction • T85 - Administrative Transport to Health Plan Transaction • C87 - Anonymize for PHCR Component • C88 - Anonymize for IRM Component

16. Report from the Security, Privacy & Infrastructure Domain Technical Committee New Construct: HITSP/C62 - Unstructured Document Component • Key Capabilities: Provides the capture and storage of patient identifiable, unstructured document content, such as text, PDF, and images rendered in PDF. • Selected Standard(s): Cross-Enterprise Sharing of Scanned Documents (XDS-SD) profile from the Integrating the Healthcare Enterprise (IHE) IT Infrastructure Technical Framework (ITI-TF). • Used by: • IS 3 V:3.1.2 Consumer Empowerment • IS 4 V:1.2.2 Emergency Responder Electronic Health Record • IS 5 V:1.1.2 Consumer Empowerment & Access to Clinical Information via Media • IS 8 V:0.0.2 Personalized Healthcare • IS 9 V:0.0.2 Consultation and Transfers of Care • IS 10 V:0.0.2 Immunizations and Response Management • IS 11 V:0.0.2 Public Health Case Reporting • IS 12 V:0.0.2 Patient-Provider Secure Messaging

17. Report from the Security, Privacy & Infrastructure Domain Technical Committee New Construct: T63 Emergency Message Distribution Element Transaction • Key Capabilities: A multicast notification message sent to an identified population (assume this is not to the general public, but to specifically identified populations, such as emergency departments). • Selected Standard(s): Emergency Data Exchange Language (EDXL) Distribution Element (DE) v1.0 • Used by: • IS 4 V:1.2.2 Emergency Responder Electronic Health Record • IS 10 V:0.0.2 Immunizations and Response Management • IS 11 V:0.0.2 Public Health Case Reporting

18. Report from the Security, Privacy & Infrastructure Domain Technical Committee New Construct: T64 - Identify Communication Recipients Transaction • Key Capabilities: Identification of communication recipients and the subsequent purpose of delivery of alerts and bi-directional communications (e.g., public health agencies notifying a specific group of service providers about an event.) The method and criteria by which individuals are added to a directory is a policy decision, which is out of scope for this construct. • Selected Standard(s): Integrating the Healthcare Enterprise (IHE) Personnel White Pages profile which provides access to basic directory information for identifying one or more recipients. • Used by: IS 4 V:1.2.2 Emergency Responder Electronic Health Record • IS 8 V:0.0.2 Personalized Healthcare • IS 9 V:0.0.2 Consultation and Transfers of Care • IS 10 V:0.0.2 Immunizations and Response Management • IS 11 V:0.0.2 Public Health Case Reporting

19. Report from the Security, Privacy & Infrastructure Domain Technical Committee New Construct: HITSP/T66 - Retrieve Value Set Transaction • Key Capabilities: Used to transform human or computer vocabularies. For example, it can be used to convert the initial capture of a human-readable concept into a computer vocabulary captured in a document or message that will be communicated. It may also be used in the reverse, to take computer vocabulary and convert to human-readable form. • Selected Standard(s): • - Health Level Seven (HL7) Common Terminology Services (CTS) Release 1 • - IHE ITI-TF Supplement 2008-2009 Sharing Value Sets (SVS) Integration Profile • Used by: • IS 4 V:1.2.2 Emergency Responder Electronic Health Record • IS 8 V:0.0.2 Personalized Healthcare • IS 9 V:0.0.2 Consultation and Transfers of Care • IS 10 V:0.0.2 Immunizations and Response Management • IS 11 V:0.0.2 Public Health Case Reporting

20. Report from the Security, Privacy & Infrastructure Domain Technical Committee New Construct: HITSP/T67 – Clinical Referral Request Transaction • Key Capabilities: Used to transport the provider to provider (clinical) referral request interaction. • Selected Standard(s): Integrating the Healthcare Enterprise (IHE) Document-based Referral Request (DRR) profile which is used to bundle a referral request document with other relevant clinical documents of interest and optionally to send a trigger message to the receiving provider system. • Used by: • IS 4 V:1.2.2 Emergency Responder Electronic Health Record • IS 9 V:0.0.2 Consultation and Transfers of Care

21. Report from the Security, Privacy & Infrastructure Domain Technical Committee New Construct: HITSP/T81 - Retrieval of Medical Knowledge Transaction • Key Capabilities: Enables the request and receipt of additional knowledge about a medical concept based on specific context parameters. This transaction does not prescribe the knowledge content of the message returned but provides the specifications for the query for and receipt of additional knowledge. • Selected Standard(s): Health Level 7 (HL7) Context-Aware Information Retrieval (Infobutton) Specification: URL Implementation Guide. • Used by: • IS 3 V:3.1.2 Consumer Empowerment • IS 5 V:1.1.2 Consumer Empowerment & Access to Clinical Information via Media • IS 8 V:0.0.2 Personalized Healthcare • IS 10 V:0.0.2 Immunizations and Response Management • IS 11 V:0.0.2 Public Health Case Reporting

22. Report from the Security, Privacy & Infrastructure Domain Technical Committee New Construct:T85 - Administrative Transport to Health Plan Transaction • Key Capabilities: The transport for administrative transactions between a provider and a health plan. Examples include a pharmacy obtaining health plan eligibility, and a physician requesting referral or authorization information from a health plan. • Selected Standard(s): CAQH Phase II CORE #270 Connectivity Rule v2.0.0, which addresses the message envelope metadata, the message envelope standards, and the submitter authentication standards for administrative transactions, as well as communications-level errors, and acknowledgements. • Used by: • IS 4 V:1.2.2 Emergency Responder Electronic Health Record • IS 8 V:0.0.2 Personalized Healthcare • IS 9 V:0.0.2 Consultation and Transfers of Care • IS 77 V:0.0.2 Remote Monitoring

23. Report from the Security, Privacy & Infrastructure Domain Technical Committee New Construct: HITSP/C87 -Anonymize for PHCR Component • Key Capabilities: Provides specific instructions for anonymizing data that was created as part of routine clinical care data delivery in preparation for repurposing data for public health case reporting. This construct defines the Component specification that provides the ability to anonymize patient identifiable information. • Selected Standard(s): International Organization for Standardization (ISO) Health Informatics - Pseudonymisation, Unpublished Technical Specification # 25237 • Used by: • IS 11 V:0.0.2 Public Health Case Reporting

24. Report from the Security, Privacy & Infrastructure Domain Technical Committee New Construct: HITSP/C88 - Anonymize for IRM Component • Key Capabilities: Provides the ability to anonymize patient identifiable information for Immunization and Response Management. It provides specific instruction for anonymizing data that was created as part of routine clinical care delivery in preparation for repurposing the data . • Selected Standard(s): International Organization for Standardization (ISO) Health Informatics - Pseudonymisation, Unpublished Technical Specification # 25237 • Used by: • IS 10 V:0.0.2 Immunizations and Response Management

25. Activities Planned for Next Year TN900: Significant restructuring of the document is being undertaken to: Improve overall readability, Decrease emphasis on initial 3 use cases Include additional clarification resulting from user community feedback TP20: Access Control Provides greater clarity of previously specified OASIS standards and explains when standards should be used Specifies profiles for SAML, WsTrust, etc (Initial draft of XSPA due in May) TP20 will be a focus of a HITSP demo at HIMSS 2009 TP30: Manage Consent Directives Workgroup will be discussing transaction package upgrade based in part on the resolution of identified gaps Work with SDO to update HL7 Confidentiality codes, and ontology of roles Report from the Security, Privacy & Infrastructure Domain Technical Committee

26. Activities Planned for Next Year (continued) C19: Entity Identity Assertion Component Update to support Level of Assurance  T24: Pseudonymize Transaction – update to support provider and organizational pseudonyms 2009 Use Case / Gaps / Extensions work Report from the Security, Privacy & Infrastructure Domain Technical Committee

27. Conclusion We continue to make progress on Privacy and Security interoperability standards, working within the multiplicity of jurisdictional constrained policies. New Use-Cases were well satisfied through re-use of existing SPI constructs. Look forward to practical feedback from NHIN experience with SPI constructs. Need to continue to expand our membership and expand the base of ‘active’ members. Report from the Security, Privacy & Infrastructure Domain Technical Committee

28. Year end work summary List of CM&HR constructs Overview of new construct organization Continued activities planned for the coming year Report from the Care Management & Health Records Domain Technical Committee

29. Report from the Care Management & Health Records Domain Technical Committee New/Modified Care Management and Health Records Constructs • C48 - Encounter Document • TP89 - Sharing Imaging Results • C84 - Consultation, History and Physical Document • C32 - Summary Documents Using CCD • C78 - Immunization Content • C72 – Immunization Message • C70 - Immunization Query and Response • C76 - Case Report Pre-Populate • C83 - CDA and CCD Content Modules • C75 – Healthcare Associated Infection Report • C74 - Remote Monitoring Observation (RMON) • C80 - Clinical Document & Message Terminology • C90 - Clinical Genomic Decision Support • TN901 – Technical Note for Clinical Documents

30. Reference Constructs C80: Clinical Document and Message Terminology Clinical based terminologies and code sets for CM&HR constructs Terminologies/code sets for message or document based constructs Contains references and locations for contained terminologies Contains constrained code sets where applicable for certain use cases C83: CDA Content Modules Defines content modules for clinical document based HITSP constructs TN901: Technical Notes for Clinical Documents Describes the organization of CM&HR constructs as they relate to C80 and C83 Report from the Care Management & Health Records Domain Technical Committee

31. New Construct Organization

32. New/Modified Constructs C76: Case Report Pre-Populate Supports data mapping for public health case reports Currently focused on data attributes that are universal or pertain to drug safety reporting C75: Healthcare Associated Infection Report construct defining the electronic submission of Healthcare Associated Infection (HAI) reports to the National Healthcare Safety Network (NHSN) of the Centers for Disease Control and Prevention (CDC) C74: Remote Monitoring Observation Document Describes content for clinical content collected by remote healthcare monitoring devices C90: Family History Decision Support for Genetic Risk Analysis Defines communication of genetic and family history information for the purposes of clinical genomic decision support TP89: Sharing Imaging Results Previously TP49 – Sharing Radiology Results, expanded to include cardiology images Report from the Care Management & Health Records Domain Technical Committee

33. New/Modified Constructs C48: Encounter Document Using IHE Medical Summary Supports the process of communication patient encounter data (excluding lab and radiology) Modifications include constraints for referral and discharge summary C84: Consult and History and Physical Note Support consult notes and history and physical notes. C32: Summary Documents Using CCD Defines document content summarizing a consumers medical status for the purpose of exchange Report from the Care Management & Health Records Domain Technical Committee

34. New/Modified Constructs C78: Immunization Document immunization data content to be exchanged between healthcare entities C72: Immunization Message Defines the method to communicate updates to a patient’s vaccination record C70: Immunization Query and Response Specifies a message mechanism to query for immunization data as well as response messages Report from the Care Management & Health Records Domain Technical Committee

35. Continued Activities C83: CDA Content Modules Add CDA content modules from previously existing CDA based constructs not yet transitioned from the new organization. C38 Increase consistency and readability of existing content modules C80: Clinical Document and Messaging Terminology Add vocabulary from previously existing constructs not yet transitioned to new organization Add additional code and value sets based on continuing industry developments and feedback C35: Lab Terminology Move terminologies into C80 and update dependent constructs/IS (C36, C37, IS01, IS02, IS05) C38: Patient Level Quality Data Document Using IHE Medical Summary Merge into C48 (requires update to IS06) TN901: Technical Notes for Clinical Documents Improve understandability Report from the Care Management & Health Records Domain Technical Committee

36. Conclusion Re-organization of constructs to use generalized modules will promote re-use and consistency. Continue to re-use and modify existing constructs where possible to meet new use case requirements and add new constructs where required. Continued expansion and refinement of existing constructs to fill gaps or specific areas of interest. Continue to have a great amount of work and looking for additional members to assist. Report from the Care Management & Health Records Domain Technical Committee

37. Report from the Administrative and Financial Domain Technical Committee Completed editorial changes T40 - Patient Health Plan Generic Eligibility Verification Transaction Completed new construct T68 - Patient Health Plan Authorization Request and Response Transaction T79 - Pharmacy to Health Plan Authorization Request and Response Transaction Reviewed proposed 2009 Use Cases Long Term - Develop a Technical Note document for Administrative and Financial Domain TN902

38. Report from the Administrative and Financial Domain Technical Committee Construct Work

39. Report from the Administrative and Financial Domain Technical Committee Existing Constructs Modified to Meet New Use Case Requirements

40. Report from the Administrative and Financial Domain Technical Committee New Construct Development Work

41. Report from the Administrative and Financial Domain Technical Committee Current Work Plan

42. Report from the Population Perspective Technical Committee Immunization and Response Public Health Case Reporting Planned Updates: Biosurveillance IS02 Quality IS06

43. Report from the Population Perspective Technical Committee: Immunization and Response

44. Report from the Population Perspective Technical Committee: Immunization and Response – Privacy & Security

45. Report from the Population Perspective Technical Committee: Immunization and Response – Infrastructure

46. Report from the Population Perspective Technical Committee: Immunization and Response – Content

47. Report from the Population Perspective Technical Committee: Immunization and Response (IS10) – Roadmap • Harmonize Immunization Alerts (and Public Health Alerts) with structured messaging standards • Evaluate Supply Chain Management (Scenario 2) – Deferred in IS10 v1.0 • Evaluate Countermeasure and Response Administration – Deferred in IS10 v1.0 • Review next steps for Clinical Decision Support – CMHR • Vaccine Forecast • Communication of immunization schedules • Prioritization notices • Alerts

48. Report from the Population Perspective Technical Committee: Public Health Case Reporting

49. Report from the Population Perspective Technical Committee: Public Health Case Reporting – Privacy & Security

50. Report from the Population Perspective Technical Committee: Public Health Case Reporting – Infrastructure