HIT Standards Committee — Focus on Security Nov 19 Documents on Challenges, Threats, and Solutions

HIT Standards Committee–Focus on Security
Challenges, Threats, and Solutions: Documents
Plus Implementation Workgroup Update
November 19, 2009

Time: 9am to 5pm EST
See prior post for timed html agenda or pdf Agenda link below.
See end of this post for Webcast or audio dial-in info.
Also see John Halamka’s blog for his Nov 18, 2009 distillation of all the input Standards Committee has received on Standards since last month.

Meeting Materials (PDF, Word, or PPT)
Presenter Biographical Sketches
Agenda (pdf)
Implementation Workgroup Update & Review of Adoption Experience Hearing
HIT Security Issues, Challenges, Threats, and Solutions – Overview of the Security Issues Hearing

Systems Stability and Reliability
Roger Baker and Steph Warren, Chief Information Officer and Principal Deputy Assistant Secretary for Office of Information & Technology, Department of Veterans Affairs
Ryan Smith, Assistant Vice President eBusiness, Intermountain Healthcare
Paul Connelly, Chief Information Security Officer, Hospital Corporation of America
Lee Olson, Chief Information Security Officer, Mayo Clinic

Cybersecurity
Lisa Gallagher, Senior Director of Privacy & Security, HIMSS
               Gallagher, Security Survey
               Gallagher, Security Survey Report
Peter Tippett, Vice President Research & Technology, Verizon Business
David Cochran, CEO, Vermont Information Technology Leaders
Gerald Masson, Director, Information Security Institute, Johns Hopkins University

Data Theft, Loss, and Misuse
Michael  Mellor, Deputy Chief Information Security Officer, Centers for Medicare & Medicaid Services
Joanne Conroy, Chief Health Care Officer, Association of American Medical Colleges
Soumitra Sengupta, Information Security Officer, NY Presbyterian Hospital
Rodney Cain, CIO and Vice President, Healthbridge

Building Trust
Alain Sheer, Bureau of Consumer Protection, Federal Trade Commission
Chad Skidmore, Inland Northwest Health Services
J. Brent Williams, Chief Technology Officer, Anakam, Inc.
Thomas Hardjono, The Kerberos Consortium, Massachusetts Institute of Technology

How to participate:

Webcast: HIT Standards Committee Webcast
Audio: You may listen in via computer or telephone.
          US toll free:   1-877-705-6006
          International Direct:  1-201-689-8557
          Confirmation Code: HIT Committee Meeting

HIT Security Issues, Challenges, Threats, and Solutions: Nov 19 HIT Standards Cmte Agenda

HIT Standards Committee: HIT Security Issues, Challenges, Threats, and Solutions Agenda: November 19, 2009

A G E N D A   (pdf version)
November 19, 2009
9:00 a.m. – 5:00 p.m. (Eastern)

9:00 a.m. CALL TO ORDER
          Judy Sparrow, Office of the National Coordinator

9:05 a.m. Comments from the National Coordinator
         David Blumenthal, MD, MPP, National Coordinator for HIT

9:15 a.m. Overview of Meeting
         Jonathan Perlin, Chair
         John Halamka, Vice Chair

9:20 a.m. Implementation Workgroup Update & Review of Adoption Experience Hearing
         Aneesh Chopra, Chair, Implementation Workgroup
         Judy Murphy, Workgroup Member
         Cris Ross, Workgroup Member

10:30 a.m. HIT Security Issues, Challenges, Threats, and Solutions – Overview of the Security Issues Hearing
         Dixie Baker, Chair, Privacy & Security Workgroup

10:45 a.m. Systems Stability and Reliability
          Roger Baker and Steph Warren, Chief Information Officer and Principal Deputy Assistant Secretary for Office of Information & Technology, Department of Veterans Affairs
         Ryan Smith, Assistant Vice President eBusiness, Intermountain Healthcare
         Paul Connelly, Chief Information Security Officer, Hospital Corporation of America
         Lee Olson, Chief Information Security Officer, Mayo Clinic

12:00 p.m. LUNCH BREAK

12:45 p.m. Cybersecurity
          Lisa Gallagher, Senior Director of Privacy & Security, HIMSS
          Peter Tippett, Vice President Research & Technology, Verizonbusiness
          David Cochran, CEO, Vermont Information Technology Leaders
          Gerald Masson, Director, Information Security Institute, Johns Hopkins University

2:00 p.m. Data Theft, Loss, and Misuse
          Michael Mellor, Deputy Chief Information Security Officer, Centers for Medicare & Medicaid Services
          Joanne Conroy, Chief Health Care Officer, Association of American Medical Colleges
          Soumitra Sengupta, Information Security Officer, NY Presbyterian Hospital
          Rodney Cain, CEO, Healthbridge

3:15 p.m. BREAK

3:30 p.m. Building Trust
         Alain Sheer, Bureau of Consumer Protection, Federal Trade Commission
         Chad Skidmore, Inland Northwest Health Services
         J. Brent Williams, Chief Technology Officer, Anakam, Inc.
         Thomas Hardjono, The Kerberos Consortium, Massachusetts Institute of Technology

4:45 p.m. Public Comment

5:00 p.m. Adjourn

How to participate:
Webcast: HIT Standards Committee Webcast
Audio: You may listen in via computer or telephone.
          US toll free:   1-877-705-6006
          International Direct:  1-201-689-8557
          Confirmation Code: HIT Committee Meeting

ONC Blog: Overhage of Regenstrief on ‘Real World Experience: Standards’

ONC Blog
Overhage of Regenstrief: ‘Real World Experience: Standards’

Marc Overhage, MD, PhD, member of the HIT Standards Committee, shares lessons learned and standards implemented at Regenstrief Institute in Indiana on his November 9, 2009 post on the ONC Blog, Federal Advisory Committee Blog. Overhage is Director of Medical Informatics and Research Scientist at Regenstrief. Regenstrief has been a leader in standards development for 30 years, including electronic messaging, Health Level 7, and LOINC. Focus has been on “good enough standards” and “good enough tools.”

Previous ONC Blog Posts by Standards Committee Members
John Halamka: What is a Standard?
Aneesh Chopra: HIT Standards Committee: Pulling Forward the Benefits of Healthcare IT
Judy Sparrow: A Blog to Support Transparency and Collaboration

House Health Care Reform Bill includes Health IT Measures

“Affordable Health Care for America Act” (AHCAA) includes Health IT Measures
Bernie Monegain, of Healthcare IT News reported on November 9, 2009, on response of Medical Group Management Association (large and small practices), AMA, and insurance industry to the Health IT and other aspects of bill.
Joseph Goedert, HealthData Management, reports on November 9, 2009, the bill retains ”administrative simplification language to make more uniform the HIPAA transaction sets for claims and related transactions.”

Original summary from e-Healthcare Marketing, Nov 8, 2009: The 1990-page healthcare reform bill (US H.R. 3962), passed by the US House of Representatives late on November 7, 2009, includes several references to Health Information Technology, Electronic Health Records, Health Information Exchange, and the Office of the National Coordinator for Health IT.  Based on an initial scan, this post notes several of those health IT references and serves as a basis for a more thorough review. Comments, additions, and corrections are invited. Page numbers intended to indicate location in pdf file where the Health IT term is shown.

State Health Access Program Grants/Standardize Electronic Administrative Actions (p. 83)
Programs to “expand access to affordable health care coverage for the uninsured population in the State” in programs such as state insurance exchanges, community coverage program, reinsurance plan program, transparent marketplace program, automated enrollment program, innovative stratgies, and purchasing collaboratives.” Administrative Electronic Transactions need to be standardized by HIT Policy and Standards Committees in conjunction with ONC.

Study and Report on Methods to Increase EHR Use
by Small Healthcare Providers
  (p. 153)
Study and report on impact of options to increase use of EHRs such as higher reimbursement, promoting lower cost EHRs (including VA’s VisTa), EHR training, or implementation assistance.

Integration of Physician Quality Reporting and EHR Reporting (p. 407)
HHS Secretary to develop plan to integrate clinical reporting on quality measures relating to meaningful use of EHRs for a patient’s health and to identify gaps in quality and coordination of care.

Institute of Medicine Study of Geographic Variation in Health Care Spending and Promoting High-Value Health Care (p. 505)
IOM to recommend changes for Medicare per capita payments considering 9 elements, including “leveraging the use of health information technology.” 

Center for Comparative Effectiveness Research (p. 756)
Housed in Agency for Healthcare Research and Quality (AHRQ), Center for Comparative Effectiveness Research, will “conduct, support, and synthesize research…with respect to outcomes, effectiveness, and appropriateness of health services and procedures…” including pharmaceuticals, medical devices, medical and surgical procedures, and other medical interventions.” This will involve the use of registries, research data networks from electronic health records, and other electronic health data. The Center will diseminate the information to physicians and EHR vendors to “assist the users of health information technology focused on clinical decision support  to promote the timely incorporation of such findings into clinical practices and promote the ease of use of such incorporation.”

Public Reporting by Hospitals and Ambulatory Surgical Centers on Health Care-Associated Infections (p. 914)
Transmission of this information to be coordinated with ONC and Centers for Disease Control with systems established by HITECH act.

Improving Accountability for Approved Medical Residency Training (p. 943)
Training medical residents for meaningful use for improved patient care and increased quality of the health of the community.

Implementation of Best Practices in the Delivery of Healthcare: Center for Quality Improvement (p. 1324)
Center for Quality Improvement to be charged with identifying, developing, and implementing standards “for health information technology used in the collection and reporting if quality information (including for purposes of the demonstration of meaningful use of certified electronic health record (EHR) technologu by physicians and hospitals under the Medicare program…” 

Assistant Secretary for Health Information (p. 1335)
This new position will be responsible for collecting and reporting on key health indicators regarding the “Nation’s health and the performance of the Nation’s health care.” Will coordinate with “the head of the Office of National Coordinator for Health Information Technology to ensure optimal use of health information technology.”

Community-Based Collaborative Care Network Program (p. 1447)
One of the programs to expand access to healthcare, this one is focused on  reducing unnecessary use of emergency departments through a ”health information technology network to track patients across collaborative networks.”

National Medical Device Registry: Electronic Exchange and Use in Certified Electronic Health Records of Unique Device Indentifiers (UID) (p. 1509)
This amends the Food, Drug and Cosmetics Act to “establish a national medical device registry …to facilitate analysis of postmarket safety and outcomes data on each covered device.” While there may be exceptions, each covered device is to be identified by “type, model, and serial number or other unique identifier,” and indicated in EHRs and via information exchange.

Health Service for Urban Indians (p. 1877)
Grants to support health information technology to improve individual and community health of Urban Indians.

“Affordable Health Care for America Act” (1990 pages):
 (AHCAA) US H.R. 3962  (pdf)

Blumenthal looks ahead: Privacy, Security plus National Network

Blumenthal Looks Ahead to Future Topics and New Workgroups
on HIT Policy and Standards Committees: Slide Set Info
Joseph Conn reported for Modern Healthcare/HITS, October 28, 2009, on the look ahead that National Coordinator of Healthcare IT David Blumenthal presented the prior day at the HIT Policy Committee. Two items that Blumenthal declared high priorities were development of a national policy for health information privacy and security and as Conn wrote a “fresh look at continued development of the proposed National Health Information Network, or NHIN.”

Information from the slides Blumenthal used are presented below.
Here’s a link to the Slide set (ppt) posted on ONC HIT Policy Committee site.

FUTURE TOPICS
HIT Policy Committee:

  1. Privacy and Security*
  2. 2013 and 2015 MU Objectives
  3. Adoption – EHR/HIT
  4. Standards Process
  5. NHIN and State HIEs*
  6. Strategic Plan
  7. Gaps in Measurements
  8. Medicaid MU (coordinate with CMS)

HIT Standards Committee:

  1. Gaps in Standards
  2. 2013 and 2015 Certification Standards
  3. Implementation and Adoption of Standards*
  4. Process to Support NHIN
  5. Privacy and Security Standards *
  6. Retooling Clinical Measurements for EHR*Boldface: Time Sensitive Topics

PROPOSED WORKGROUPS
HIT Policy Committee Workgroups

  1. Meaningful Use*
  2. Adoption of HIT/EHR
  3. Privacy and Security [new]*
  4. NHIN and HIEs [new]*
  5. Strategic Planning [new]

HIT Standards Committee Workgroups

  1. Implementation and Adoption of Standards*
  2. Privacy and Security*
  3. Clinical Measures
  4. Clinical Operations

*Boldface: Workgroups that need to be active now

  • NOTE: Policy & Standards Committee Workgroups will share Policy Committee and Standards Committee members.

High-level Plan for Priority Topics for HIT Policy Committee (PC), Standards Committee (SC)  and their Workgroups

  • Privacy and Security (PC and SC)

               –  Create new Privacy & Security Workgroup under Policy Committee to focus on these issues; add consumer representatives
              – Ask the P&S Policy Committee Workgroup to create recommendations  based on results of the September Privacy hearing
              – Continue leveraging HIT Standards Committee Privacy and Security Workgroup to focus on Standards – security hearing is scheduled on  November 19, 2009

  • NHIN and HIEs (PC)+

               – Create new NHIN Workgroup ( may include members from the current IE Workgroup); add other necessary experts
               – Hold inaugural Workgroup in-person meeting early November; present  issues, recommendations at December Policy Committee meeting

  • Meaningful Use Specialists Measures (PC)

             – Continue to leverage MU WG
             – Hearing is scheduled for October 27 and 28 on specialties, small practices

  • Implementation/Adoption Workgroup (SC)

               – New Implementation WG has been launched under the leadership of Aneesh Chopra
               – Public hearing on October 29th to hear adoption experiences; and web-site for public input will launch at that time

  • HIT Policy Committee and HIT Standards Committee

              – Both FACA committees will receive briefing from ONC on broad strategies; ONC programs and evaluation plans Dec 2009/Jan 2010

  • Strategic Planning Workgroup (PC and SC)

              – Consider framework/guiding principles for work of PC and SC with respect to creation of Nation-wide, interoperable, private and security health information system.
               – Relate that framework to strategic plan for work of ONC.
               – Begin work on recommendations for ONC concerning a strategic plan

Standard for Standards: Keep them simple; start them early

Standard for Standards: Keep them simple; start them early
ePrescribing, Lab, Admin, Quality: Implementation Workgroup
John Halamka on Implementation Workgroup Testimony–Oct 29, 2009
In his Oct 30, 2009 post on Life as a Healthcare CIO, John Halamka summarizes the HIT Standards Committee Implementation Workgroup testimony. As someone fortunate to have attended the workgroup session in Washington, DC, your e-Healthcare Marketing blogger was in awe of the testimony about non-healthcare standards which described development of standards for XML, Property & Casualty Insurance data, and the automotive industry, which when broken down to their basic development issues seemed awfully similar to healthcare data  exchange issues.
John Halamka on “What is a Standard” on ONC’s FACA Blog
In a parallel post on Oct 30, 2009 on ONC’s FACA Blog, Halamka describes the development of standards by the Healthcare Information Technology Standards Committee (Panel, turned into the HITSP acronym).

Feds urged to set simple, expandable HIE standards
“Technology executives from across the business world told a federal health IT advisory group yesterday it should establish simple but expandable health information exchange standards or risk overwhelming healthcare practitioners.”
Mary Mosquera reported on October 30, 2009 in Government Health IT,

Panel seeks Rx for secure health data exchange
Alice Lipowicz reported in FederalComputerWeek on Oct 29, 2009,
“Changing technology is easy; changing workflows is hard,” said Rich Warren, chief information officer of Allegiance Health community hospital. “Adoption is all about workflow, behavior modification and perceived value.”

eClinicalWorks CEO describes needs of small practices
One of the key points in the in the Oct 29, 2009 Implementation Workgroup testimony made by several  people was the need for standards to be accessible and usable by the smallest enterprises, which in the case of healthcare means small physician practices. In addition to the two physicians who testified, Louis Spikol, MD, of Allentown, PA, and Floyd “Tripp” Bradd, MD, Front Royal, VA, no one was in a better position among the witnesses to talk about small practice implementation than Girsih Kumar Navani, CEO, whose eClinical Works has focused on setting up thousands of EHRs in physician offices, and worked with several community initiatives, including New York City and Massachusetts ventures.

Navani described the need for vocabulary standards–LINC, CPT, ICD, SNOMED, NDC–”What we need is a most commonly used and physician friendly list,” for use in EHRs. With regard to governance for interoperability Navani said “In community projects where we have been most successful and implemented ambulatory practice to practice sharing of patient records, hospital system interoperability, there has been a strong community governance model and value proposition for the small provider practice.”

EHR Firms: Go with Existing Standards
Joseph Goedert, reported in HealthData Management on Oct 29, 2009, “A coalition of electronic health records vendors is urging the HIT Standards Committee to focus its efforts on achieving implementation of data standards that the committee already has recommended to federal officials, rather than reopening decisions already made.”
HIMSS EHRA Written Testimony for Oct 29, 2009 Implementation Workgroup (pdf)

For most of the testimony documents at the Oct 29, 2009 Implementation Workgroup meeting, go to this earlier post on e-Healthcare Marketing.

ONC Blog: Online Forum to Accelerate Benefits of Healthcare IT– http://healthit.hhs.gov/blog/faca

ONC Blog Opening Public Forum: 
Pulling Forward the Benefits of Healthcare IT

http://healthit.hhs.gov/blog/faca
From first post on ONC FACA Blog http://healthit.hhs.gov/blog/faca from Aneesh Chopra, U.S. Chief Technology Officer, and chair of Implementation Workgroup, on October 29, 2009, as your blogger is sitting in same conference room in DC where workgroup is meeting : “The public hearing draws to a close this afternoon but we will continue the conversation through an Online Forum over the next two weeks. Thanks to Committee Member Cris Ross for his leadership on this effort. Given the breadth of interests, we have arranged a series of Committee Member blog posts to begin the dialogue, starting with HIT Standards Committee Vice-Chair John Halamka’s summary of our work to date, which will post on Friday. We will concurrently enable ongoing discussion threads on the following topics:

“1) Proposed Standards (General Discussion)
2) Interoperability
3) Vocabularies
4) Privacy
5) Security
6) Quality
7) Implementation Case Studies (Your Story – the good, bad and in-between)

“We have also enabled a “voting” feature on submissions to allow you – the public – an opportunity to emphasize points raised in a given post. Our goal is to harness the shared wisdom of our community to inform the work of the HIT Standards Committee in the weeks and months ahead.

“The tight schedule of this process is designed to ensure that your ideas inform the HIT Standards Committee at its November 19th meeting. However, your ongoing feedback on our efforts is also encouraged via written submission or public comment at any of the subsequent monthly meetings of the HIT Standards Committee.”

By the way, Chopra has promoted the ONC blog address at least 6 times, if not more.

For the ONC blog go to  http://healthit.hhs.gov/blog/faca
Go to e-Healthcare Marketing for previous post about ONC blog.
For documents from Oct 29, 2009 Implementation Workgroup, see prior post in e-Healthcare Marketing.

HIT Standards Committee Implementation Workgroup Documents–Oct 29, 2009

HIT Standard Committee Implementation Workshop Documents
October 29, 2009
Excerpted from ONC site: contains pdfs and powerpoint documents.
See October 5, 2009 post on e-Healthcare Marketing for agenda times and brief  preview in html.

October 29, 2009 – Implementation Workgroup
Note about this meeting:The HIT Standards Committee has inaugurated an Implementation Workgroup which is charged with bringing forward “real-world” implementation experience into the HIT Standards Committee recommendations, with special emphasis on strategies to accelerate the adoption of proposed standards, or mitigate barriers, if any. The Implementation Workgroup is holding a public hearing on the topic of Adoption Experiences on Thursday, October 29, 2009, in Washington, DC. We have organized a series of panels to address the issue.

HIT Standards Committee Implementation Workgroup–First Public Meeting Oct 29, 2009

HIT Standards Committee Implementation Workgroup
Meets in First Public Meeting: Oct 29, 2009

Aneesh Chopra chairs the first public meeting of the Implementation Workgroup of the HIT Standards Committee on October 29, 2009. “The HIT Standards Committee has inaugurated an Implementation Workgroup which is charged with bringing forward “real-world” implementation experience into the HIT Standards Committee recommendations, with special emphasis on strategies to accelerate the adoption of proposed standards, or mitigate barriers, if any. The Implementation Workgroup is holding a public hearing on the topic of Adoption Experiences on Thursday, October 29, 2009, in Washington, DC. We have organized a series of panels to address the issue.”

AGENDA  (pdf version)
Thursday, October 29, 2009, 9 a.m. to 4 p.m./Eastern

9:00 a.m. Call to Order/Roll Call – Judy Sparrow, Office of the National Coordinator
9:05 a.m. Welcome and Introduction – Aneesh Chopra, Chair, Implementation Workgroup
9:15 a.m. Non‐Healthcare Industries Panel – Moderator: John Halamka, HIT Standards Committee Co‐Chair
          Skip Best, Covisint
          Adam Bosworth, XML, SQL
          TBD, Salesforce.com [invited]
10:30 a.m. Providers Panel ‐ Moderator: Judy Murphy, HIT Standards Committee member
         Andy Wiesenthal, Kaiser Permanente (IDN)
         Dick Taylor, CMIO, Providence Health, Portland, OR (IDN)
         Rick Warren, VP/CIO, Allegiance Health, MI (Community Hospital)
         Lisa Bewley, VP/CIO, Regional West Medical Center, Scotts Bluff, NE (Community Hospital) 
         Louis Spikol, MD, from Allentown PA (Small Practice)
         Roland Goertz, MD/Waco, Texas (Small Practice)[invited]
12:00 p.m. BREAK
12:45 p.m. Vendors Panel – Moderator: Cris Ross, HIT Standards Committee member
        Rick Ratliff, SureScripts
        Arien Malec, Relay Health
        Sean Nolan, MicroSoft
        Girish Kumar, eClinical Works
        Ian McCrae, Orion Health [invited]
2:00 p.m. Quality Measures Panel – Moderator: David McCallie, HIT Standards Committee member
        Ralph Brindis, American College of Cardiology
        Richard Gliklich, CEO, Outcome Sciences
        Kepa Zubeldia, Ingenix [invited]
        Jesse Singer, NYC Health [invited]
3:00 p.m. Meeting Summary – Aneesh Chopra, Chair
3:30 p.m. Public Comment
4:00 p.m. Adjourn

How to participate:
Webcast: HIT Standards Committee Webcast
Audio: You may listen in via computer or telephone.
          US toll free:   1-877-705-6006
          International Direct:  1-201-689-8557
          Confirmation Code: HIT Committee Meeting

HHS: Public Feedback Due 9pm EST Fri, Oct 16 for Consumer Preferences Draft Requirements Document

Public Feedback Due 9pm EST Tomorrow, Friday, October 16, 2009 for the Consumer Preferences Draft Requirements Document
This is the text from an email sent out by HHS afternoon of Oct 15, 2009:

“The Office of Interoperability and Standards (OIS) and ONC would like to remind you that feedback for the Consumer Preferences Draft Requirements Document is due 9pm EST tomorrow, Friday, October 16, 2009.  The Requirements Document and instructions for providing feedback can be found at http://healthit.hhs.gov/consumerpreferences.

“The Consumer Preferences Draft Requirements Document addresses the processes, information exchanges, stakeholders, functional requirements, and issues and obstacles surrounding consumer preferences in order to help in the development of standardized data exchanges.  This requirements document is intended to address the various types of consumer preferences and be supportive of current and potential future policies, although such policy decisions are beyond the scope of the requirements document.   

“The OIS Consumer Preference Team would greatly appreciate your feedback on the requirements document.  Please review the requirements document and provide any feedback you may have, if you have already not done so, by 9pm EST tomorrow, Friday, October 16, 2009.  Please note that submissions should not contain any proprietary or private information as they may be made available for public inspection.

“All comments will be analyzed, dispositioned and utilized where appropriate, in the development of the final Consumer Preferences Requirements Document. A disposition report outlining how comments were addressed will be made publicly available after the publication of the final document.

“Thank you for your time and attention to this important matter; your feedback is greatly appreciated by the OIS Consumer Preferences Team.”

e-Healthcare Marketing post on October 7, 2009 provides overview, preferences outline, and links to documents page and document.