The Patient Choice ProjectProject Kickoff

December 14th, 2015

2

Call Logistics

• If you are not speaking, please keep your phone on mute

• Do not put your phone on hold – if you need to take a call, hang up and dial in again when finished with your other call

• This meeting is being recorded

• Feel free to use the “Chat” feature for questions, comments or any items you would like the moderator or participants to know

3

Agenda

• Introductions

• Background and Overview

• Goals

• Project Scope

• Future Applications

• Timeline

• Next Steps

4

Project Staff - Introductions

• OCPO-ONC Lead – Jeremy Maxwell

• Project Coordinator – Johnathan Coleman

• Project Manager – Ali Khan

• Project Support – Taima Gomez

• Staff Subject Matter Experts

» Kathleen Connor

» David Staggs

Background

• In the age of increasing electronic information exchange, patients are often asked to make a “consent decision”.

• This consent decision concerns the sharing and accessing of the patient’s health information for treatment, payment, and health care operation purposes, even when the law may not require written consent.

• The increased capacity of data sharing has led to additional questions such as when and how should patients consent to sharing their information electronically for purposes where consent was traditionally captured on paper or health information was not shared at all.

5

Overview

• This project seeks to address patient trust of health information exchange as the way health care providers and participants share and access health information.

• The aim is to assist the healthcare ecosystem by analyzing and developing technical standards to fulfill the technical capability for implementing and sharing individual consent (basic and granular choice) for the sharing of health information in healthcare settings and in a research environment.

6

What is Computable Privacy?

7

• To achieve health, an individual’s electronic health data need to be digitally connected to their consent choices.

• Health care providers and their health IT systems need to know what to do when the individual does not document a choice.

• Telemedicine, community health supports, and other innovative delivery processes will be stunted if we cannot make privacy computable.

Permitted Uses = Background Rules

Basic Choice

Granular Choice

This is HIPAA

If offered, use

standards

8

Connecting Health and Care for the NationA Shared Nationwide Interoperability Roadmap

• Basic Choice is the choice offered to an individual to prevent his/her PHI from being available for electronic exchange when it otherwise would be for purposes of treatment, payment and operations (without an individual’s permission) because it is allowed by the HIPAA Privacy Rule, and no other laws requiring permission such as 42 CFR Part 2, or state enacted laws, apply.

» Covered entities may (and often do) voluntarily choose to obtain an individual's consent ("basic choice") to use and disclose information about them for TPO.

• Granular Choice is the choice an individual makes regarding the distinctions between legally sensitive clinical conditions, such as mental health or HIV/AIDS status and evolves over time to enable choice about disclosure to specifically identified participants in the health care system.

• Call to Action 2015-2017

» ONC, standards development organizations, technology developers and appropriate stakeholders should harmonize technical standards and implementation guidance for consistently capturing, communicating and processing Basic Choice across the ecosystem.

Project Timeline Overview

9

Sep 15 Jan 16 Jul 16 Jan 17 Jul 17 Jan 18 Jul 18 Jan 19 Jul 19 Mar 20

Phase 1: Basic Choice

Phase 2: Basic Choice for Research Consent

Phase 3: Granular Choice

10

Project Goals

Phase 1: Basic Choice

• To develop Basic Consent Use Cases and Functional Requirements which can be used to guide a Piloting process

• Conduct pilots which test the functional requirements and scenarios described in the Use Case Development Phase

• Develop a best practices implementation guide based on lessons learned from piloting efforts.

• Align work efforts with Standards Developing Organizations (SDO) when possible

• Develop implementation guidance in form of a standard or artifact

Phase 2: Basic Choice for Research Consent and Phase 3: Granular Choice

• Build upon artifacts and lessons learned from Phase 1 and repeat the process for Phases 2 & 3

11

Phase 1: In-Scope

• Semantic understanding of a Basic Choice consent decision and the corresponding information that comprises a privacy consent directive

• Information that must be available a the time of a query for patient data to enable a data source to determine if the requester is authorized to receive a response

• Demonstrate the use of computable consent to enable privacy policy implementation and information access control decisions

12

Phase 1: Out of Scope

• Methods for Capturing Consent

• Patient Interfaces

• Mechanisms for managing a consent directive

» Policies surrounding information that has already been shared when a patient changes their privacy consent directive to “Do not share”

» Mechanisms to update privacy consent directives

• Maintenance and updating of consent registries

• Maintenance and updating of consent repositories

13

Patient Centered Outcomes Research (PCOR) Privacy and Security Research Scenario Initiative and Legal Analysis and Ethics Framework Development

• Determining how health information from a variety of data sources can be used for PCOR/CER, consistent with principles of bioethics and the legal requirements governing privacy of health information, including patient consent

• Phase 1:

» Develop research data use scenarios with the stakeholder group

• Phase 2:

» Assess the legal, regulatory, and policy environment governing the use of health information for PCOR/CER

» Develop a legal and ethics framework for protecting patient privacy during conduct of PCOR/CER

14

Future Applications

• Interoperable semantic description of a consent directive to be used for a variety of use cases

» Sharing information for research (Phase 2)

» Personal Health Record (PHR)

» Mobile Health Applications

» Behavioral Health Systems

• Setting the groundwork for granular consent models

» Phase 3: Granular Choice

» Consenting to share specific types of information

15

Stakeholder Levels of Commitment

• Committed contributors

» Regular attendance on weekly working calls

» Ad hoc review of project documents or discussion on confluence site

» Active participation on developing use cases

» Feedback on key deliverables

• Interested Parties

» No formal commitment

» Provide feedback and comments on monthly community report out calls

Phase 1 - Timeline

16

Nov Dec Jan Feb Mar Apr May Jun July Aug Sept Oct Nov(Today)

Begin Pilot Work

Kick Off Pilot Activities

Use Case Working Group Kick Off Session

Conduct Pilots Needs Assessment

Review and development of formal use cases

Develop Best Practices IG

Draft Basic Choice Standard

Scenario 1: Query for Consent Directive

Provider/ Healthcare Provider Organization

Start

1. Determines that Patient data should be requested

2. Sends query for Patient data to the HIO

Data Holder/HIO Consent Directive Registry Consent Repository

3. Receives query for Patient data

4. Determines if consent is required to share Patient data

5. Sends query to Consent Directive registry for Privacy Consent Directive location

6. Sends Privacy Consent Directive location

7. Sends query to Privacy Consent Directive Repository

9. Review Privacy Consent Directive to determine the data that may be disclosed

8. Sends Privacy Consent Directive to HIO

10. Sends Patient data to requesting Provider

11. Receives Patient data

End

18

Scenario 2: Push Consent Directive and Authorization

Data Requester Data Holder

Start

1. Data Requester sends Privacy Consent Directive and request for Patient data to provider 2

3. Data Holder decides which information to return and assembles response.

2. Data Holder receives Privacy Consent Directive and request for Patient data

5. Data Requester receives response from Data Holder 4. Data Holder sends response to Data Requester

End

19

Next Steps

• Schedule Weekly Working Group Meeting

• Visit Confluence Page

» http://confluence.siframework.org/display/PATCH/Patient+Choice+Home

• Review Background and Associated information posted to the Confluence

» http://confluence.siframework.org/display/PATCH/Patient+Choice+Home

20

Project Contact Information

OCPO-ONC Lead Jeremy Maxwell Jeremy.Maxwell@hhs.gov

Project Coordinator Johnathan Coleman jc@securityrs.com

Project Manager Ali Khan Ali.Khan@esacinc.com

Project Support Taima Gomez Taima.Gomez@esacinc.com

Staff SME Kathleen Connor klc@securityrs.com

Staff SME David Staggs drs@securityrs.com

@ONC_HealthIT @HHSONC

Thank you for joining!