Authorized Release of Information to a Trusted Entity and the NwHIN Exchange

1. Authorized Release of Informationto a Trusted Entityand the NwHIN Exchange July 11, 2012

2. SSA Background • Over 3 million initial disability applications a year • Over 15 million requests for medical evidence each year (3-4 medical records per case) • 500,000 sources: doctors, hospitals, etc • SSA is not a HIPAA covered entity • Require a patient’s authorization to obtain medical records • Initial Federal Agency on the Nationwide Health Information Network (NwHIN) Exchange

3. SSA and the NwHIN Exchange • In 2012, we will continue efforts to expand out to new partners • for Social Security’s health IT initiative • August, 2008 - Partnered with Beth Israel Deaconess Medical Center to build a prototype • February, 2010 - 12 contracts awarded to medical networks and providers using Recovery Act funds to expand the health IT project to 13 states • February, 2009 - Partnered with MedVirginia, a Health Information Exchange, to become the first to exchange medical information over the NwHIN Exchange • 2011 - 2013 – Recovery Act partners in production, pilots with VA / DoD and Kaiser Permanente, and targeted recruitment of new partners and expansion of existing

4. Where are we today SSA receives health IT data from 13 states with additional plans of expansion Production Locations: Partners in Production Partners Pending Production • In Production in 2012 -2013: • VA/DoD Pilot • Kaiser Permanente Pilot • Additional Partners Partners in Production: • Beth Israel Deaconess Medical Center • MedVirginia / MedVirginia Centra • Oregon Community Health Information Network • EHR Doctors • Douglas County Individual Practice Association • Marshfield Clinic • Inland Northwest Health Services • Community Health Information Collaborative • Wright State University • HealthBridge • LCF/New Mexico Health Information Collaborative • Regenstrief / Indiana Health Information Exchange • Southeastern Michigan Health Association

5. Authorized Release of Informationto a Trusted Entity Use Case • Use Case Scenario • Social Security Administration requests medical documentation from a healthcare provider with the patient’s authorization Patient Authorization Patient Authorization File Disability Claim Request Evidence Claimant SSA/DDS Providers Claim Determination Medical Evidence

6. SSA – 827 (Patient Authorization) • Requestor • Responder • Purpose • Effective Date • Effective Timeframe • Type of Information Requested • Signed

7. NwHIN Specifications & Standards • Content Structure • HL7 CDA Release 2 CCD • HITSP C32 • HITSP C62 • Unstructured Documents (pdf, txt, doc, rtf, tif, jpg, gif, png) • Vocabulary & Code Sets • ICD-9-CM • Systematized Nomenclature of Medicine--Clinical Terms (SNOMED-CT) • Logistical Observation Identifiers names and Codes (LOINC) • Consent Structure • IHE Basic Patient Privacy Consents • Transport and Security • Messaging Platform • Authorization Framework • Web Services Registry • Patient Discovery • Query for Documents • Retrieve Documents • Access Consent Policy

8. NwHIN Exchange Transaction Flow Patient Authorization Clinical Documents

9. Standards per Transaction

10. SAML Security Assertion • Subject ID - MEGAHIT • Subject Organization - Social Security Administration • Subject Organization ID - 2.16.840.1.113883.3.184 • Subject Role - SNOMED-CT (106328005) – Social Worker • Purpose of Use - Coverage • Patient Identifier – encoded per the NwHIN Authorization Framework specification

11. Authorization Decision Statement • NwHIN Exchange uses a Authorization Decision Statement to allow an entity to assert the requester should be permitted to execute the transaction based on a specific security policy • Access Consent Policy and Authorization Framework specifications define the format of the policy

12. Access Consent Policy XDS Metadata

13. Questions

14. For Further Information • Contact • Marty Prahl (martin.prahl@ssa.gov) • Tom Davidson (thomas.davidson@ssa.gov) • Bob Hastings (bob.hastings@ssa.gov)

15. Reference Materials • NwHIN Exchange Technical Specifications (all of the specifications can be found at http://www.nationalehealth.org/technical-specifications • Patient Discovery (requestor only) - http://www.nationalehealth.org/ckfinder/userfiles/files/Technical%20Specs/Patient_Discovery_Production_Specification_v2_0.pdf • Query for Documents (requestor only) - http://www.nationalehealth.org/ckfinder/userfiles/files/Technical%20Specs/QueryforDocumentsProductionSpecification_v3_0.pdf • Retrieve Documents (requestor only) - http://www.nationalehealth.org/ckfinder/userfiles/files/Technical%20Specs/Retrieve_Documents_Production_Specification_v3_0.pdf • Access Consent Policy (responder only) - http://www.nationalehealth.org/ckfinder/userfiles/files/Technical%20Specs/AccessConsentPoliciesProductionSpecification_v1_0.pdf • Core Capabilities that support the above transactions Messaging Platform -http://www.nationalehealth.org/ckfinder/userfiles/files/Technical%20Specs/MessagingPlatformProductionSpecification_v3_0.pdf Authorization Framework - http://www.nationalehealth.org/ckfinder/userfiles/files/Technical%20Specs/AuthorizationFrameworkProductionSpecification_v3_0.pdf