EHRs

1
EHRs PHRs ModelsPrivacy Architecture

• Kathleen Connor
• FOX Systems
• October 2006

2
Topics

• HL7 EHRs Functional Model
• EHRs Profiles Binding to Specifications
• EHRs Certification
• EHRs Semantic Interoperability Whats required
• MITA and EHRs PHRs
• PHRs Different Models
• Privacy Issues

3
HL7 EHR System Functional Model

• The HL7 EHRs FM is a standardized model of the
  functions that may be present in electronic
  health record systems
• Focus is on the system functionalities, not the
  content of electronic health records
• Functions are described from a user perspective
• Enables consistent expression of system
  functionality
• Could be a single system or a system-of-systems
• Implementation agnostic

4
HL7 EHRs Profiles

• The Functional Model is the superset of functions
  from which a user chooses the subset of functions
  they need within their EHRs
• This subset is specified in an EHRs profile
• Profiles
• Standardized description and common
  understanding of functions sought or available in
  a given setting
• E.g., intensive care, cardiology, office practice
  in one country or primary care in another
  country).
• Profiles are certified, not the Functional Model

5
EHRs Certification

• Testable Criteria based on Functional Conformance
  Criteria
• e.g., receive, read, persist electronic images
  demonstrate RBAC
• Display vs. Output Tests
• CCHIT has completed ambulatory and is beginning
  work on inpatient EHRs certification criteria
• Many Profiles are possible
• Behavioral Health, LTC, Pediatrics, etc
• Other Certification Approaches
• HL7 Conformance, NIST
• P4P will likely require Certified EHRs
• Not clear that CCHIT Certified EHRs will support
  AHIC break through use cases

6
-Direct Care-Supportive-Information
Infrastructure
3 Sections of the EHRs Functional Model
7
Functional Model Infrastructure
8
Semantic Interoperability

• Participants in the NHII must use standards for
  the EHRs functions
• Terminology, exchange and security standards are
  key
• Requires shared vocabulary and a common reference
  information model e.g., HL7 RIM
• HITSP recognizes the need for a common reference
  information model from which health care
  standards can derive shared meaning

9
Every VA Medical Center has Electronic Health
Records !

10
Chart Metaphor Combining Text and Images
11
MyHealtheVet PHR
12

• My HealtheVet online environment where
  veterans, family, and clinicians come together to
  optimize veterans health care
• Provides trusted information, online services,
  health record access, and messaging between
  veterans and clinicians.
• Combines essential health record information
  enhanced by online health resources to enable and
  encourage patient/clinician collaboration
• Provides powerful health education information
  and health self-assessment tools -gt A Veterans
  Health Education Library is available to look up
  information on medical conditions, medications,
  health news and preventive health.
• Online calendar to set and track their
  appointments
• Veterans will be able to securely view and
  maintain a copy of key portions of their health
  record from VAs health information system,
  VistA, and later from HealtheVet-VistA, when that
  is operational.
• As veterans build their health records, they will
  be able to share all or part of the information
  in their account with their health care
  providers, inside and outside VA

13
Patient Entered PHI
14
MITA Maturity Level 4

• Supports provider access to and capture of data
  within clinical processes
• Able to pull clinical data electronically from
  EHRs and other provider systems
• May generate clinical view of administrative
  data, e.g., claims, prior authorization, claims
  attachment with payer-based health records
• MMIS participates in health information exchange
  via RLS and Registries
• May provide RHIO infrastructure
• May act as Node PHIN and the NHII

15
MITA Maturity Level 4
Ability to interface with EHRs and PHRs
16
ASP EHRs

• Portal EHRs support provider access to capture
  of data during the provision of care
• Payers sponsor ASP EHRs for small paper-based
  providers as web-based or downloadable
  applications
• Facilitate generation of clinical data needed for
  reporting, for claims attachments, and for
  outcome or performance measures
• Help small providers engage in HIE
• Prepare for transition for full scale EHRs
• ASP could support PHRs

17
MITA Maturity Level 5

• Clinical Data stored only at source
• Real time Peer2Peer collaboration with EHRs
  PHRs
• Clinical data pushed electronically among systems
  
• Consumed Directly for both clinical and
  administrative purposes
• No need for transforming into billing or quality
  code systems

18
MITA Maturity Level 5
Ability to interact with EHRs and PHRs
19
PHRs Models

• Smart Card
• Payor PHRs
• PHR Banks
• Provider PHRs
• Digital Health Library

20
Smart Card PHRs

• Patients health record is electronically loaded
  on chip card
• Germany is testing this model
• Problems
• Patient must accompany card
• Interferes with provider2provider (P2P) health
  information exchange (HIE)
• A patients consent may contain sensitive
  information, but that must be accessible in the
  card in order for the receiver to know how to
  treat

21
Payer Provided PHRs

• Patients health record is derived from claims
  data and accessed online via payer portal
• PHR follows the patient from Payer2Payer
• Problems
• HIPAA Issue PHI was captured for Payment
  Purpose now used for Treatment Purpose
• Payer has more discretion about e.g., minimal
  necessary etc.
• Payers can now share PHI that HIPAA would not
  allow them to share for Payment Purposes
• Not clinical information
• Payer may have Medical Liability for practice of
  medicine
• Questionable use for providers
• Not attested
• Does not accurately reflect actual clinical care

22
PHR Banks

• Trusted 3rd parties acting as PHR repositories
• Patients can have more than one and can move
  their PHR around
• Banks can
• Enforce patient consent directives
• Control and audit access and use
• Problems
• Interferes with P2P exchanges Not all provider
  HIE can be done via Banks
• Redundant Capacity
• EHRs use RLS for P2P
• PHRs with 1gt Banks
• May be different records for same encounter

23
Provider PHRs

• Simply another view into the Providers EHR
• Like MyHealtheVet the Canadian model
• Trusted 3rd parties are RLS for both
• No overlapping capability (only RLS)
• Provider EHRS and RLS can
• Enforce patient consent directives
• Control and audit access and use
• Patients are less likely to change providers than
  they are to change payers
• No HIPAA issue PHI in PHR was captured for
  Treatment Purpose
• Patients trust providers more than payers

24
(No Transcript)
25
Digital Health Library

• PHRs Account on the Health Grid
• Account URL is controlled by consumers
• Records tagged with Metadata
• Metadata describes content and access rules
• Metadata content and consent indexed
• Only authorized entities can search
• Subsequent use is controlled

26
Digital Health Library
27
PHRs Privacy Issues

• Once a provider is given access to PHR data, that
  data is open to HIPAA disclosures
• Payers are accessing and using payment data for
  non-payment purposes (e.g., health analytics to
  profile enrollees risk) by creating pseudo
  clinical data
• Employers are requesting voluntary participation
  in care management programs for reduced premiums
  If employees Opt-in, then employer has access
  to PHI

28
Payer Health Analytics

• Parallax i is a fully integrated, web-based
  total health and productivity decision support
  tool allowing employers to track and evaluate the
  effectiveness of programs that impact group
  health results. Parallax i is designed to capture
  and compare information derived from multiple
  data sources for integrated health and
  productivity reporting and analysis. Data
  querying and access is straightforward, allowing
  you to quickly understand cost and utilization
  patterns and assess opportunities for cost
  savings.Because Parallax i integrates individual
  program attributes into one central data
  repository, experience can be viewed across the
  entire spectrum of the health care delivery
  system. Performance of each program can be viewed
  individually and holistically, assessing how
  employees access or utilize benefits across
  various offerings. By understanding what is
  really driving specific experience, you can
  understand how risks relate to one another and
  implement the right intervention programs and
  best practices. Employers have used Parallax i
  to  quantify the changes in plan costs and
  identify the drivers of expense  determine the
  quality of care being provided to employees 
  identify potential areas of excess care or
  unfavorable pricing  assess the performance of
  their carriers and networks  evaluate the need
  for, or performance of, specialty and carve-out
  benefit programs  structure future plan designs
  consistent with organizational strategy 
  forecast costs and establish budgets for future
  periods  present to senior management benefit
  plan results and rationale for change  prepare
  mandated financial reporting  evaluate the
  diagnostic causes of health-related claims,
  occupational injuries, and lost time  identify
  the interventions expected to have the most
  impact on a specific employee population, and 
  detect the individuals most likely to become high
  cost claimants in the near future, and facilitate
  early case management. http//www.ingenix.com/
  content/attachments/ParallaxiBrochure.pdf

29
EHR PHR Privacy Issues

• Only privacy requirements for RHIOs and their
  non-HIPAA related participants are by business
  associate agreements
• Providers Payers are accessing PHI for patients
  who are not under their care or coverage
• Opt-out models allow records to be loaded before
  a consumer has an opportunity to dissent
• Consents required by 42 CFR and other more
  stringent state laws are deemed infeasible,
  burdensome, obstacles to care management,
  barriers to care coordination, and impediments to
  measuring quality
• Clear need for privacy architecture like other
  countries