Overview of the Connecting for Health Common Framework

Privacy and Confidentiality WorkshopeHealth Initiative and Vanderbilt Center for Better HealthSeptember 12, 2006Melissa M. Goldstein, JDDirector, Markle Foundation

What is Connecting for Health?A public-private collaborative of 100+ organizations representing the vast variety of viewpoints in healthcare (e.g., providers, patients, payers, etc.) A neutral forumFounded & supported by the Markle FoundationAdditional support from the Robert Wood Johnson Foundation

What is the Purpose of Connecting for Health?To catalyze changes on a national basis to create an interconnected, electronic health information infrastructure to support better health and healthcare

Sharing Health Information = Linking Existing Sources

Health information can stay where it iswith the doctors and others who created itSpecific information is shared only when and where it is needed.Sharing does not require an all new network or infrastructureSharing does not require a central database or a national IDSharing does require a Common Framework

A Common Framework Is Needed The Common Framework is the minimum necessary set of rules or protocols for everyone who shares health information to follow. Helps organizations overcome the barriers without reinventing the wheelEnables nationwide interoperabilityavoiding isolated islands of informationBuilds trust

Overview of Connecting for Health ArchitectureA sub-network organization (SNO) brings together a number of providers and other health information sourcesThey are linked together by contract (more from Gerry)Agree to follow common policies and proceduresAgree to create and use a shared index to where patient records are located (RLS)Agree to create and use a common gateway to share information with other networks (ISB)

What is a Record Locator Service (RLS)?An index containing patient demographic information and the location of a patients medical recordsContains no clinical information obtaining the clinical record is a separate transaction NOT involving the RLSParticipating entities decide whether or not to put record locations into the RLSDesigned to take a query in the form of demographic details and return only the location of matching records

How Was the Common Framework Developed?Connecting for HealthStarted with Design PrinciplesWrote a Roadmap in 2004Built a PrototypeDeveloped the Common Framework through field experience and the collaboration of experts

Technology and Policy are Intertwined

Choices about one necessarily shape the other. To build trust, you have to put policy decisions first.

Technical Principles

Make it ThinAvoid Rip and ReplaceSeparate Applications from the NetworkDecentralizationFederationFlexibilityPrivacy and SecurityAccuracy

Privacy Principles (more on these later)

Openness and TransparencyPurpose Specification and MinimizationCollection LimitationUse LimitationIndividual Participation and ControlData Integrity and QualitySecurity Safeguards and ControlsAccountability and OversightRemedies

The PrototypeThree sitesBostonIndianapolisMendocino County, CADiverse architecturesDiverse structures

If these 3 can all use the Common Frameworkanyone can!

Who Developed the Prototype and the Common Framework?Connecting for Health Steering GroupPolicy Subcommittee: Co-Chairs Bill Braithwaite and Mark FrisseTechnical Subcommittee: Chaired by Clay ShirkyThree communities and teams: Boston: MA-SHARE and technical partner CSCIndianapolis: Regenstrief Institute and Indianapolis Health Information Exchange (IHIE)Mendocino: Mendocino HRE and technical partner Browsersoft, Inc.

What Do the Common Framework Resources Consist of? Technical rules and standardsthat allow systems to talk to each otherPolicies on how to handle information that build trustModel contractual languagethat holds it all together

Sample Policy Documents

From P8 Breaches, p. 4Sample policy languageCFH Recommended policyFrom M2 Model Contract, p. 10

Sample Technical Documents (T2)

What is Available?Technical Documentation: 3 Categories Background DocumentsT6: Record Locator Service DesignT5: Data Cleanliness and QualitySpecific Technical DocumentsT1: Technical Overview and Implementation RequirementsT2: NHIN Message Implementation Guide (Record Locator Service/Inter-SNO Bridge)T3-T4: Standards GuidesMedication History: Adapted NCPDP SCRIPTLaboratory Results: ELINCS 2.0, with modificationsTechnical Code and InterfacesTest Interfaces: CA, IN, MACode base: CA, IN, MA

What is Available?Policy Documents: 3 Categories Background Document P1: Privacy Architecture for a Networked Health Care EnvironmentSpecific Policy DocumentsP2-P8: Model privacy policies, notification and consent, correctly matching, authentication, patient access, audits, and breachesSample Contract LanguageM1: Contact Topic ListM2: Model Contract

The Common Framework is Not a RHIO in a boxIt provides different models to considernot one right answer.It is intended as a partial solution. It does not address finance, governance, etc. There are topics (like how to aggregate data for research and public health) that Connecting for Health is still working on

The Common Framework is Still EvolvingImproving the resources to better meet the needs of communitiesExploring how patients/consumers can access their own informationExploring how researchers and public health can benefit from health dataConnecting for Health needs the input of organizations nationwide.

A Bit More on Privacy and Networked Environments

In a Networked Environment: Persistent and Aggregated Data ShadowIncreased RISKS (mis-use and re-use; not dealt with through consent)Privacy Protective Behavior: Opt-out of the systemDemands a systemic privacy protection architecture (fair information practices) to mitigate the risks and establish trust*

Healthcare is DifferentThe healthcare system is very diverseHealth information is especially sensitiveand privacy spills cant be fixedPatients/consumers are traditionally less involved than in some other areas (e.g., banking)

OpennessPurpose SpecificationCollection LimitationUse LimitationIndividual Participation and ControlRemediesAccountabilitySecurity Data IntegrityConnecting for Health Architecture for Privacy in a Networked Health Environment*

Common Framework ResourcesAll available free at www.connectingforhealth.orgPolicy and technical guides, model contractual languageRegistration for AHRQ/NRC Common Framework discussion forumSoftware code from regional prototype sites: Regenstrief, MAShare, OpenHREEmail to info@markle.org