CareConnect. Current State and Blueprint Context. Version 1.1

Transcription

1 Current State and Blueprint Context Version 1.1 VANCOUVER COASTAL HEALTH / PROVIDENCE HEALTH CARE INFORMATION MANAGEMENT / INFORMATION SYSTEMS (IMIS) EHEALTH PROJECTS

2 TABLE OF CONTENTS CareConnect 1. INTRODUCTION CARECONNECT OVERVIEW WHAT IS CARECONNECT? STRATEGIC OBJECTIVES CLINICAL INFORMATION IN CARECONNECT Clinical Portal Desktop Integration Services ACCESS TO CARECONNECT ENABLING TECHNOLOGIES CARECONNECT, EHR INFOSTRUCTURE & THE INFOWAY BLUEPRINT ARCHITECTURAL OVERVIEW REGISTRIES DATA & SERVICES Client Registry Provider Registry Location Registry Terminology Registry ANCILLARY DATA & SERVICES EHR DATA & SERVICES Shared Health Record Drug Information Diagnostic Imaging Laboratory DATA WAREHOUSE HEALTH INFORMATION LONGITUDINAL RECORD SERVICES EHR Index Business Rules Message Structures Normalization Rules EHR VIEWER HIAL COMMON SERVICES Security Services Privacy Services HIAL COMMUNICATION BUS POINT OF SERVICE APPLICATIONS CARECONNECT USER IMPACT BUSINESS REQUIREMENTS & CHANGE MANAGEMENT PRIVACY FRAMEWORK SUSTAINMENT & SUPPORT MODEL EVALUATION FRAMEWORK...25 Page i

3 1. INTRODUCTION The province of British Columbia has identified an interoperable Electronic Health Record (iehr) to be a foundational component of its ehealth strategy. An interoperable EHR will deliver a private and secure EHR service that will enable the sharing of iehr data across the continuum of care. Benefits of patient safety, quality of care, and cost and process efficiency are the key drivers of the iehr. The province is committed to the Infoway Blueprint as the road map towards a pan-canadian interoperable EHR. The Infoway Blueprint promotes reusable and replicable solutions that can be aligned with jurisdictional priorities and deployed across the country more cost-efficiently. It also provides guidance to jurisdictions to develop their strategic, tactical and operational plans to ensure rapid development and deployment of EHR solutions. With ehealth objectives that are consistent with those of the province, Vancouver Coastal Health (VCH) and Providence Health Care (PHC) have been developing a regional interoperable Electronic Health Record solution, known as CareConnect. This document outlines the current state of CareConnect, within the context of the provincial iehr. The document is divided into the following sections: Section 2 provides a general overview of CareConnect, including its core functional components, strategic objectives, clinical content and enabling technologies. Section 3 discusses in detail CareConnect within the context of an EHR Infostructure, looking at how CareConnect maps to the Infoway Blueprint. Section 4 focuses on the less technical aspects of CareConnect those that affect the impact of CareConnect on its users, including business requirements & change management, privacy, sustainment, and evaluation. Work completed in these areas could potentially be leveraged for the provincial iehr. Page 1

4 2. CARECONNECT OVERVIEW 2.1 WHAT IS CARECONNECT? CareConnect is the first version of a regional longitudinal, patient centric interoperable Electronic Health Record (iehr) for Vancouver Coastal Health (VCH) and Providence Health Care (PHC). CareConnect provides caregivers with shared, integrated electronic access to clinical information from sources across VCH, PHC and other external sources such as private labs and PharmaNet. The CareConnect iehr lends care providers at acute, community and primary care locations the ability to view patient encounter information from acute and community systems across the health authority as well as diagnostic images, lab results, and medication profiles. CareConnect also provides clinical information to primary care providers while working at acute care sites and remotely from their own facilities. CareConnect is a response to urgent clinical service delivery drivers within VCH/PHC as a result, pragmatic design decisions have been made with a goal of enabling the implementation of a good enough iehr solution to meet immediate clinical needs as soon as possible. Although the development of CareConnect pre-dates V2 of the Infoway Blueprint, the intention is to migrate CareConnect towards full Infoway Blueprint compliance as soon as possible. In this migration, certain elements of the existing CareConnect solution will diminish, while other elements are enhanced and expanded The CareConnect design team has maintained an awareness of Infoway principles, and modeled the design as much as possible such that it could satisfy provincial EHR objectives for the region, and provide a re-usable set of components that can be leveraged by other health authorities to realize provincial objectives. Examples of this include the CareConnect Viewer, web services integration, standards-based integration with the provincial Client Registry/EMPI, and the CareConnect privacy model. CareConnect includes: 1. A Clinical Portal to control access and to allow caregivers to search for patients/clients. For a selected patient, the portal displays patient demographics, encounter history and other key clinical data, and acts as a jumping off point to take the clinician to other sources of patient information. 2. Integration with the Provincial HCIM (EMPI) 1 solution to definitively identify patients across multiple sites and systems. 1 BC Healthcare Client Identity Management (HCIM) / Enterprise Master Person Index (EMPI) Page 2

5 3. Single sign on and single search capability, accessed via the CareConnect Clinical Portal, that requires the clinician to logon only once irrespective of the number of systems being accessed, and automatically finds the requested patient in all systems within CareConnect s scope based on a single search. Systems that currently fall under the CareConnect umbrella are: a. Vancouver Acute PCIS-VA (IDX CareCast) b. Vancouver Acute Agfa PACS c. Providence Health Care PCIS-PHC (Eclipsys Sunrise Clinical Manager) d. External to VCH Excelleris / PharmaNet e. The CareConnect Portal and Encounter Index. PCIS-NS (McKesson) and the PARIS community system will be added when technically feasible. 4. Secure Desktop Sharing. Selected caregivers have been provided with fast logon and user switching capability via biometric devices and proximity cards. Current users of this technology work in the Intensive Care Unit (ICU) at Vancouver General Hospital. 5. An access model in accordance with applicable legislation and full auditability and reporting of all activity that occurs via the CareConnect platform. Following a number of proof-of-concept pilots, CareConnect began rolling out in early 2006 for its initial 0.9 Beta release. Release 1.0 will start rolling out Spring The initial rollout of CareConnect will be to approximately 300 users across the Vancouver Coastal Health region, including the health service delivery areas of Vancouver Acute, Vancouver/Richmond Community, Richmond, North Shore/Coast Garibaldi, and Providence Health Care. 2.2 STRATEGIC OBJECTIVES The key strategic objectives for the CareConnect are: Improve the quality of patient care by improving access to clinical data. Improve the speed of care through faster access to information, resulting in quicker decision-making. Improve service to the consumer by reducing time consuming and redundant activities. Support VCH/PHS health services integration initiatives. Reduce the cost and effort to provide care. Enable 24X7 access to clinical information where it is not currently available. Eliminate staff safety hazards in the Emergency Room. Foster health services integration and improve the flexibility of the health care system. Promote the timely sharing of critical clinical information. Page 3

6 Improve security and privacy of patient records. 2.3 CLINICAL INFORMATION IN CARECONNECT Clinical Portal Within the CareConnect clinical portal, various subject areas of clinical information have been developed (or are now being developed) as the core components of CareConnect. These have been developed as Sharepoint web parts, and as such, they can be added, removed and modified as needed. CareConnect Version 1.0 includes components that deliver the following functionality: 1. Present identity information This is information that identifies a patient or provides enough information to allow the clinician to identify the patient if there are similar candidate identities held in the Enterprise Master Person Index (EMPI). 2. Present demographic information Basic demographic data about a patient is provided via the EMPI. The result is a composite view of the patient/client, made up of the best information available collected from all sources. 3. Present demographic detail This component presents demographic data that is over and above what is provided by the EMPI, for example, infection control or next of kin information. 4. Present encounter information This component presents information about all of the encounters a client has had within VCH / PHC facilities. This currently includes those from the following organizations and their systems. Organization System 1. Vancouver Acute IDX CareCast 2. Providence Health Care Sunrise Clinical Manager (SCM) 3. Lion s Gate Hospital McKesson Star 4. Vancouver / Richmond Community PARIS 5. Present encounter detail information This component presents additional detailed information about each encounter. 6. Present a laboratory summary This component presents an integrated view of a patient s VCH and private sector (i.e., Excelleris) lab results Desktop Integration Services Information exposed directly in the CareConnect clinical portal currently provides only a partial view of the patient s longitudinal record. Where a clinician requires more detail, access to some Page 4

7 of the source systems is available via CareConnect. This access is provided via Sentillion Vergence, an integration product that uses the HL7 CCOW visual integration standard. CCOW (Clinical Context Object Workgroup) is a vendor independent standard developed by the HL7 organization that allows clinical applications to share information at the point of care. Using a technique called context management, CCOW allows information in separate healthcare applications to be unified so that each individual application refers to the same patient and user. This is also known as visual integration. Thus, CareConnect allows the clinician to authenticate at the portal and then when required, pass through to the source systems with no further requirement to enter a user ID, password or even to search for the patient again. CareConnect currently provides visually integrated access to the following systems: the CareConnect clinical portal IDX CareCast at Vancouver Acute Eclipsys SCM at Providence Health Care Agfa PCS at Vancouver Acute Excelleris / PharmaNet. Visual integrated access will be implemented for McKesson on the North Shore when the McKesson physician portal is ready, and for the PARIS community system once CCOWenablement is complete. 2.4 ACCESS TO CARECONNECT Access to CareConnect will be provided by three routes kiosk, standard desktops, and Citrix. 1. A Kiosk Desktop is defined as a locked down desktop in which the primary purpose of the system is to provide access to clinical applications. It would be used by more than one person in high activity/traffic areas such as hospital emergency departments. 2. A Standard Desktop is defined as a single user workstation that requires access to both clinical and non clinical applications. This will be used on single user workstations where access is required to non-clinical applications, including the Internet, to support the dayto-day work of the desktop owner. 3. A Citrix Desktop is defined as a desktop that uses the Citrix environment to run visually integrated enabled applications. Users of this environment can access CCOW-enabled applications via either a published Citrix application or via a published Citrix desktop. This configuration will be used in instances where remote access is permitted. 2.5 ENABLING TECHNOLOGIES CareConnect relies on the stack of integrating technologies listed below: Page 5

8 1. Microsoft SharePoint Services to provide a framework for deploying services / clinical information to care providers. 2. Microsoft.Net development tools / web parts to deliver the information. 3. The provincial Enterprise Master Patient Index (EMPI) based upon the Initiate identity solution. 4. Microsoft SQL Server for clinical data repository implementation. 5. SeeBeyond egate and Microsoft BizTalk message broker platforms to deliver data real time. egate is used for internal VCH/PHC messaging, while Biztalk is used to communicate externally (e.g., with the Ministry of Health). 6. Vergence context management software for single signon and patient linking. 7. Citrix for thin client, browser based deployment. The use of these enabling technologies within the context of CareConnect is summarized in the diagram below. Sharepoint Services Initiate EMPI Message Broker CDR SQL Server Encounter Index Context Manager Access Tools Identify Patient Move data Find Patient Go to Info VCH/PHC y CareConnect Clinical Portal CareConnect Version & Enabling Technology Care provider s home System Citrix Wherever it is! Integrating Technology Password Synching software from MTEECH VCH PACS (AGFA) LGH HIS (McKesson PP) PHC HIS (Eclipsys SCM) Excelleris Labs Pharma Net Provincial EMPI Van Acute HIS (IDX Carecast) Page 6

9 3. CARECONNECT, EHR INFOSTRUCTURE & THE INFOWAY BLUEPRINT An EHR Infostructure (EHRi) is a collection of common and reusable components used in the support of a diverse set of health information management applications. It consists of software solutions, data definitions and messaging standards for an interoperable Electronic Health Record (EHR). The EHR Infostructure assembles data stores and provides services required to constitute and operate a patient/person-centric data repository for data declared as clinically relevant for sharing. The following diagram from Canada Health Infoway s EHRS Blueprint, version 2.1, provides Infoway s view of the components of an EHRi. It includes registries, EHR Data & Services, Ancillary Data & Services, Longitudinal Record Services, a Health Information Access Layer (HIAL), an EHR viewer and Point of Service (PoS) applications. JURISDICTIONAL INFOSTRUCTURE Registries Data & Services Ancillary Data & Services EHR Data & Services Data Warehouse Client Registry Provider Registry Outbreak Management PHS Reporting Shared Health Record Drug Information Diagnostic Imaging Laboratory Health Information Location Registry Business Rules EHR Index Message Structures Normalisation Rules Terminology Registry Longitudinal Record Services HIAL Security Management Data Common Services Communication Bus Privacy Data Configuration Public Health Services Pharmacy System Radiology Center PACS/RIS Lab System (LIS) Hospital, LTC, CCC, EPR Physician Office EMR EHR Viewer POINT OF SERVICE Public Health Provider Pharmacist Radiologist Lab Clinician Physician/ Provider Physician/ Provider Physician/ Provider 1 This section begins with an architectural overview of CareConnect, and then discusses CareConnect s current architecture in the context of each of the Infoway Blueprint s key functional areas. Each subsection begins with a brief description of Infoway s model, and then describes if and how CareConnect has implemented this functionality. Page 7

10 3.1 ARCHITECTURAL OVERVIEW The following diagram shows the main components of CareConnect and associated message flows: Provincial Repository EMPI Client Registry EMPI Database BizTalk Encounter Data pushed from Clinical Systems Encounter Query EMPI Query Lab Query CCOW Authentication and patient context map HL7 v3 Care Connect Care Connect Index Index Layer.NET Applications EMPI Web Services Client Web Services Integration Services Mapping Agent EHR Database VCH Integration Services Exposed Services Integration Layer EMPI Proxy Web Services Web Services Communications Bus (MQ) Other External Services EGate HL7 v2.x Clinical Systems PoS / Viewer SOAP CCOW Enabled Applications Sentillion Vault Eclipsys Excelleris IDX McKesson Portal Citrix Clients Sunset EHR Lab PARIS AGFA Care-Cast Etc PARIS CareConnect provides clinical users with the ability to view personal health information contained in an encounter index, and single sign-on access to in-scope clinical systems. CareConnect interfaces with the provincial Client Registry (the Enterprise Master Person Index or EMPI), and Excelleris. The CareConnect application includes an encounter index, an EHR database, a set of CCOW Enabled Applications and Sentillion s Vergence Vault. The latter is an appliance that keeps track Page 8

11 of clinical user and patient context as a user session moves between the CareConnect index and Point of Service (PoS) applications. An integration layer based on SeeBeyond s egate technology provides web services that are exposed outside of VCH/PHC, and integration services to the health authority s clinical systems, including Patient Care Information Systems (Eclipsys SCM, IDX CareCast, McKesson), hospital lab systems (Sunset) and a Community Care information system (PARIS). Additional details on the CareConnect architecture, within the context of the Infoway Blueprint, are provided in the following subsections. 3.2 REGISTRIES DATA & SERVICES Within the EHR Infostructure (EHRi), registries provide data and resolution services for persons or entities needing to be identified uniquely in the context of a transaction to an EHRi. Examples include Patients/Persons, Providers, Service Delivery Locations, Organizations and Terminology. The EHRi includes other repositories relating to the application of security frameworks such as Point of Service (PoS) applications, users and roles Client Registry CareConnect supports an HL7 v3 Web Services interface with the provincial Client Registry the Enterprise Master Person Index (EMPI). The provincial EMPI will provide CareConnect with a composite view of patient demographic information and with lists of patient variations. CareConnect will consume four web services provided by the provincial EMPI to retrieve patient identity information and patient variations: 1. A web service to provide patient demographics based on a passed-in identifier such as MRN or PHN. 2. A web service to provide a list of patient variations (i.e., other MRNs or PHNs that refer to the same patient within VCH) for a passed-in identifier such as MRN or PHN. 3. A web service to provide a list of possible patient matches for a passed-in set of demographic information (e.g., last name, first name, date of birth, gender). 4. A web service to populate a local cache by distribution messages from the EMPI. This is used for failover and performance management at the regional level. These EMPI web services will use HL7 v3 messages to exchange data. Page 9

12 3.2.2 Provider Registry CareConnect does not currently interface with the provincial Provider Registry. A local Provider Information Management System (PIMS) originally developed by the Vancouver Island Health Authority (VIHA) -- will contain a subset of the provincial provider database, and may play a role in registering new providers and defining their roles and access rights Location Registry CareConnect contains a simple database table of VCH sites. It does not interact with an external Location Registry Terminology Registry CareConnect does not include or interact with a Terminology Registry. 3.3 ANCILLARY DATA & SERVICES Ancillary data and services represent a generic class of auxiliary capabilities that rely on, need or complement EHR domain data in order to support health services delivery. Examples of potential services include outbreak management, communicable disease reporting, enterprise scheduling, and wait list monitoring. CareConnect does not offer ancillary data and services at the present time. 3.4 EHR DATA & SERVICES EHRi domain repositories store, maintain and provide subsets of clinical data pertinent to the clinical picture of a patient/person, typically at a jurisdictional level. The key data domains recognized as part of the Electronic Health Record are the Shared Health Record, Drug Information, Diagnostic Imaging, and Laboratory Shared Health Record The Infoway Shared Health Record repository includes encounter history data as well as clinical data not otherwise maintained in specific domain repositories, such as encounter or visit summary documents, referral orders and notes, diagnosis data, observations, care protocols, care plans, etc. CareConnect currently maintains an encounter index, with related EHR data stored in local database records. This Clinical Data Repository (CDR) is populated real-time via HL7 message interfaces from the same source systems that feed the EMPI. There is therefore a high level of integrity between the CareConnect Shared Care CDR and the EMPI. Over time, it is Page 10

13 anticipated that the type of information contained in the CDR will grow to include, for example, discharge summaries Drug Information CareConnect currently allows for Medical Practice Access to PharmaNet (MPAP) to authorized users. PharmaNet is a secure computer network that allows BC health care providers controlled computer access to their patients /clients medication profiles. The use of PharmaNet by clinicians can potentially protect patients/clients from dangerous medication interactions and duplications. Access to PharmaNet also improves time efficiencies when care providers need to determine the prescription history of patients, particularly those with multiple chronic conditions, those with mental health disorders, and addictions. Access to PharmaNet must be through an authorized vendor; in the case of CareConnect, access to PharmaNet is provided via Excelleris, making use of the CCOW visual integration interface between CareConnect and Excelleris (with single signon / automatic patient linking). VCH/PHC is currently working with the Ministry and other health authorities, exploring some of the challenges around PharmaNet access. The aim is to be able to expand the usage of PharmaNet through CareConnect, subject to approvals by the Ministry and required changes to legislation and regulations governing access by provider and location of practice. Some of the areas being investigated are: Identifying clinical areas at which PharmaNet access would be of high value, but is not currently permitted (e.g., Preadmission Clinics, Pre-operative clinics, inpatient psychiatry, mental health and addictions clinics, etc.). 2 Remote access to PharmaNet, from outside a medical practice, and using wireless networks. VCH/PHC is also performing systems and data analysis towards including VCH/PHC medication profile information in the CareConnect clinical portal Diagnostic Imaging CareConnect currently provides access to diagnostic imaging orders and results from Agfa PACS -- Picture Archiving Communication System -- currently deployed at VCH s Vancouver Acute hospitals. This access is via a CCOW visual integration interface. The future intent is to expand access to VCH/PHC diagnostic imaging orders and results via VCH/PHC s new regional viewer, which will be CCOW-enabled. 2 PharmaNet access is currently permitted in hospital emergency departments and pharmacies, and in community primary care practices. Page 11

14 3.4.4 Laboratory Version 1.0 of CareConnect will include access to patient lab results as follows: Access to lab results in the native Patient Care Information Systems for Vancouver Acute and Providence hospitals (via a CCOW patient-linking interface to the hospital systems). Access to Excelleris private sector lab results (via a CCOW patient-linking interface to the hospital systems). A new CareConnect Lab Summary in the CareConnect portal that will allow the user to: o View a consolidated list of the lab tests completed (or pending) for the current patient. o Link to the detailed results of one or more lab tests for the patient. o View historical trending reports for specific types of lab tests (initially egfr, HbA1c and Hemoglobin). As demonstrated in the following diagram, the CareConnect Lab Summary brings together lab results from VCH s Sunset lab repository and from the Excelleris database. VCH lab result details are displayed in the CareConnect portal, while private sector lab result details are presented in the Excelleris Launchpad application. Trending reports merge VCH and Excelleris data, and are displayed in the CareConnect portal. User Single Sign-on via CareConnect CARECONNECT PORTAL IDX CareCast Excelleris (PathNET) CCOW Search for Patient X Demographic & Encounter Information Eclipsys Lab Results Data (Private Labs) Lab Summary Web Part Lab Test Index* McKesson Trending Reports Lab Result Details Collection Date 2-Aug-2005 Test Type CBC Ordering Physician / Phone No. Jones, Mark Order Location t Lab/Phone No. MDS Metro Out-of- Range Status Results Source Excelleris Agfa PACS 4-Jul-2005 INR Smith, Jane VGH Pre-Admit VGH Lab 1 Incomplete VCH etc. ` * Index can be sorted by any field, and can be filtered by date range, test type and/or abnormal. Default view is all tests for the last 3 months. Printer SUNSET Lab Results Data (VGH, UBC, RH, LGH) Lab Result Details Trending Reports (egfr, HbA1c, Hemoglobin) Printer Page 12

15 Initially, the CareConnect Lab Summary will include the following lab tests: All hematology, chemistry and microbiology lab results from VGH, UBC, and Richmond hospitals, as well as all non-stat lab results from Lions Gate Hospital. These lab results will be obtained from Vancouver Coastal Health s (VCH) Sunset data repository. All hematology, chemistry and microbiology results for private labs (MDS Metro, BC Biomedical, and Valley Medical) from Excelleris. The initial version of the CareConnect Lab Summary will not include lab tests from other VCH labs (i.e., Providence and North Shore/Coast Garibaldi hospitals) and the Provincial Health Services Authority (PHSA), i.e., BC Cancer Agency, BC Centre for Disease Control, etc. These tests are not yet available in the Sunset data repository, but are planned for the future. CareConnect is also working with Excelleris on a patient linking solution for the CareConnect Lab Summary, as Excelleris does not yet participate in the provincial Enterprise Master Person Index (EMPI) initiative. 3.5 DATA WAREHOUSE HEALTH INFORMATION The Health Information Data Warehouse represents a separate capability to compile, aggregate and consolidate EHR data for reporting and statistical or research analysis, as well as health prevention initiatives. While this is not within the current scope of CareConnect, the CareConnect Clinical Data Repository (CDR) is by definition an operational data store, and therefore could be used to produce data marts for research in the same manner as envisioned by Infoway. 3.6 LONGITUDINAL RECORD SERVICES Infoway s EHRS Blueprint includes a Longitudinal Record Service (LRS) to coordinate the patient-centric accesses, updates and location of data across multiple domains and registries. It represents a grouping of capabilities that acts as the kernel of the EHR Infostructure and is responsible for the orchestration of services in order to realize transactions. It is also in charge of providing a coordinated and centralized view of what data is in the EHR for any single patient/person. In other words, it is the engine that coordinates and executes any transaction that needs to have a longitudinal perspective of the clinical data of a patient/person. The LRS contains the following key functions and services: An EHR index Business rules Message structures Normalization rules. Page 13

16 3.6.1 EHR Index In Infoway s view, the Longitudinal Record Services maintains an index of all events posted to a patient/person health record. It has the ability to use this index in order to find information about a patient/person and subsequently obtain the address where the detailed clinical data associated to an event is located. It provides for the ability to have a cross-domain longitudinal view of the information available in the EHR of a patient/person. The EHR Index holds metadata about each person s records. As information about a patient is published to any of the EHR infostructure (EHRi) data repositories, the repository sends selected attributes to the EHR Index which will allow faster and easier selection of that EHR data in subsequent queries. All queries for longitudinal view will be applied against the EHR index, allowing for very fast discovery of which EHR data fits the given selection criteria. The CareConnect EHR Index consists of three primary components: 1. EHR Database The EHR (Electronic Health Record) database contains patient encounter and demographic information. The EHR physical database is updated with encounter information by the clinical systems within the scope of the project. 2. EHR Loader (CareConnect.NET applications) The.NET applications that consume the HL7 ver.2 encounter messages pushed to it by the SeyBeyond integrated composite application network (ICAN) broker. 3. EHR Web Services Access to the EHR database will be via web services hosted in a.net framework. A Clinical Information Locator is part of the CareConnect architecture, and is planned as a future enhancement Business Rules The Longitudinal Record Service (LRS) is the kernel of an EHR infostructure. It is the control center where transactions that need to be executed against a view of information that crosses domains and registries can be established and processed. It has the ability to use the index to find information about health records and obtain the addresses where detailed clinical data associated with events is located. The LRS has the ability to process complex transactions that need to combine information from many different domains and EHR Infostructures. For CareConnect, VCH Integration services will provide proxy web services to accept and forward EMPI demographic and patient variation requests from the application. These proxy web services will take SOAP messages from CareConnect, wrap required authentication information about them (org certs), and then forward them to the EMPI web services. The proxy web services will wait for the responses from the EMPI, authenticate them properly, then forward them back to CareConnect. These SOAP messages will utilize HL7 v3 messages. Page 14

17 VCH Integration services will also receive the encounter messages from the clinical systems and push them to listening sockets on the CareConnect.NET application servers. These messages will continue to be in HL7 v2.x format. Remaining business rules are implemented within the CareConnect.NET applications, including client identity resolution, EHR information access controls and a consent model Message Structures Standardized information and message structures are required to support the exchange of information in and out of an EHR infostructure. CareConnect includes.net EMPI web services to interact with the provincial EMPI. The system handles HL7 v2.x input messages from PoS systems and exchanges HL7 v3 messages with the provincial Client Registry Normalization Rules All data sent to the EHRi repositories is stored as it is provided. In order for this data to be uniformly understood and safely used, it must be provided in as standardized a form as possible. It is expected that all data coming in or out of the EHRi will conform to the relevant pan- Canadian EHR standards. This conformance inherently provides a significant degree of normalization as the result of assembling the information using recognized standards (namely HL7 V3) for data structures and vocabularies. Where pan-canadian normalization is not possible, sufficient metadata must be provided to allow for correct interpretation. Essentially this means that in the case where a non-standard terminology is being used, there must either be a clear mapping to the standard terminology, or the full text descriptions of codified terms should be sent along with the source codes, and these will also be stored in the EHRi. Consequently, when this type of data is requested from the EHRi the full text descriptions will also be provided. In CareConnect, messages are mapped to the current HL7 v2.4 messaging standards by the integration layer. Thus the EHR data model is normalized to conform with the HL7 v 2.4 messaging standards. It is not normalized to the HL7 v3 models, as HL7 v3 is not yet supported by any of the source systems. In addition, the HL7 v3 standard has yet to define messaging to support all of CareConnect s requirements. 3.7 EHR VIEWER An EHR viewer is a generic presentation application allowing end-users to access, search and view relevant and authorized clinical data about clients. Page 15

18 CareConnect is in large part a viewer into consolidated EHR data. CareConnect allows for two principal methods of viewing data: via a portal, and by reaching into the systems using the native viewer. In the latter case, CareConnect provides single sign-on functionality, and visual integration provides patient context when moving between clinical systems and/or the portal. The CareConnect viewer is a web application allowing clinicians to search and view patient encounter records in the EHR database. It is CCOW-enabled within Microsoft Sharepoint Services and accesses the EHR Index via.net application server-hosted EHR web services. CareConnect is also configured to retrieve patient demographic information (the composite view) and patient variation identifiers (all the VCH MRNs and PHNs associated with an individual patient) from the provincial Enterprise Master Person Index (EMPI) via web service calls made to the EHR Index. It will use the various identifiers to pull up the related encounters from the EHR Index. No Personal Health Information (PHI) is stored in SharePoint. The viewer provides a longitudinal read-only view of encounter information across the clinical systems with which it interfaces, but not other VCH clinical systems. Read-only summaries are available from lab systems and PARIS. When the clinical system viewer is used for a specific Hospital Information System, all data within that system can be viewed subject to the access controls configured on the particular clinical system. CareConnect will be available from dedicated kiosk workstations in busy clinical areas, and will be using Citrix for other areas and users (i.e., users coming in via SSL VPN remote access). Citrix is being used so that the client software that usually resides on the desktop does not have to be installed on the machines of every CareConnect user. An SSL/VPN connection is used by remote users. 3.8 HIAL COMMON SERVICES The Health Information Access Layer (HIAL) is a gateway that acts as an abstraction layer to separate Point of Service (PoS) applications from the EHR Infostructure. It acts as a centralized entry point or connection point for any PoS application to interact with an EHR Infostructure or for multiple EHR Infostructures to connect to each other. It is made up of service components, service roles, information models and messaging standards required for the exchange of EHR data and the execution of interoperability profiles between EHR Services. The HIAL is broken down into two layers of services: the common services and the communication bus services. The common services layer is an aggregation of services that provides common and reusable functions for the systems that participate in an EHR Infostructure. It is focused on integration, security, privacy, system configuration, management and monitoring functions and makes those common functions available for all services in a given EHRi Security Services As defined in the Infoway Privacy and Security Conceptual Architecture, security services include identity management, user authentication, access control, secure auditing, encryption, Page 16

19 digital signatures, and general security services such as secure backup and restoration of data, data archiving and secure data destruction Identity Management Infoway s user identity management service addresses the need to accurately identify users of the system. This includes those who access personal health information (PHI), and those that need to administer the system. Identity management services include registration of the user and managing identity information, the generation of unique IDs for users, and the rapid suspension and revocation of all access for a given user. It is closely related to the activity of assigning roles to users. Provisioning new CareConnect users requires each user to be provisioned in one of the VCH or PHC Active Directory (AD) Forests, the Vergence vault, and every clinical system to which they will have access for which user authentication is not integrated with AD (currently all VCH/PHC Patient Care Information Systems). For users with existing accounts, every relevant account must be identified and validated. The account mapping is then entered into the vault. For the original CareConnect pilot project, the above processes have been manual. This is errorprone and presents a scalability challenge. To address these issues, VCH is developing a provisioning and password management system. This system will allow CareConnect users to self-register existing accounts on VCH/PHC clinical systems and will validate ownership of the account by confirming that users can provide a valid password. This identity management system will construct a table that will link all of the user s accounts and provision this table to the Vergence vault. Once accounts have been validated and registered, the user will select a complex password, and the ID Management system will synchronize passwords across all known accounts, with the exception of third party systems. The ID Management solution will also be used to maintain synchronization when passwords are changed, and it can support self-service password resets. With regards to suspension and revocation, the centralized table linking user accounts across multiple systems facilitates the removal of access privileges in a timely manner Authentication Authentication establishes the validity of the claimed identity of a user and provides protection against access by unauthorized users. User authentication services provide service components that are needed to validate the user accessing the EHR Infostructure (EHRi). Infoway has defined two authentication models. In an organization trusted user management (OTUM) environment, all user authentications take place within the accessing user s POS system or clinical portal. In an EHRi trusted user management (ETUM) environment, user authentication takes place via direct interaction with the EHRi. Page 17

20 CareConnect employs an OTUM model. CareConnect users may log onto the clinical applications or the CareConnect EHR viewer. In the former case, the application authenticates the user against its internal user repository. In the latter case, the viewer authenticates the user against one of the authority s Active Directory Forests. Once a user has been authenticated, they can move freely between the CareConnect applications and the EHR viewer without having to re-authenticate. Through CCOW, the Vergence vault passes the appropriate user identity to the target application. CCOW-enabled applications trust CareConnect, so the user is not logged into the applications, but their user ID is used for audit purposes. CareConnect also supports remote access. Remote users employ an SSL/VPN to access CareConnect and must first authenticate using an RSA SecurID one-time password generator. If successful, they must subsequently authenticate to one of the internal domains using a Windows Login at the Citrix Web Interface. Thus all CareConnect users must have an active account in one of the PHC or VCH internal AD Forests, and remote users must have an account provisioned in the RSA Authentication Server Access Control Roles-based access controls are the foundation of the Infoway EHRi. Access privileges must be assigned to roles, users must be defined and roles must be assigned to individual users. Not all bona-fide users of the EHRi can access all available EHRi services. Access control aims to manage and apply the permission rule sets that restrict access to Personal Health Information (PHI) and other information to authorized users only. Access control decisions are driven by access control policy. Such policy is among the most important of the many policies that are required for the effective functioning of the architecture. Infoway s Privacy and Security Conceptual Architecture recognizes access control methodologies based on roles, workgroups and discretionary access control. A CareConnect access policy and model is currently being defined (see section 4.2 below). Individual applications that are under the CareConnect umbrella will continue to implement their existing access controls. The CareConnect application will implement roles-based access control for information contained in the EHR Index. The CareConnect EHR application has two primary components, a Sharepoint portal, and a web services provider (the EHR Index Server): 1. The Sharepoint portal houses the EHR web part, which takes care of the presentation layer of the application. The EHR web part is a consumer of web services provided by the web services provider component. Authorization controls may be applied at this layer to determine what parts and pages of the application are available to the user. This layer has no business logic or access to EHR data. Instead, it consumes web services provided by the web services provider component to get data necessary to fill its screens. Page 18

21 2. The web services provider exposes a number of web services intended solely for consumption by the CareConnect portal. As part of the request payload, these web services require the request source (e.g., VCH-SP), the in-context user name and role list to be passed. The web services are a façade for ASP.NET components. Using declarative and imperative permission demands, the services provide the fine grained access controls required by CareConnect to control access to patient data Secure Auditing The ability to audit transactions and events taking place within the EHRi is fundamental to meeting the privacy and security requirements. The ability to report on the systems, users, providers, patients/persons and health data involved in each EHRi transaction serves as a fundamental privacy principle. The auditing service records significant privacy and securityrelated events, including message transmissions involving personal health information (time, origin and destination, but not content). Clinical applications will continue to provide the auditing services that they have in the past. Additional CareConnect auditing of access to the EHR Index is done behind the web services façade only, as all information requests and responses are via these web services. The only exception that needs auditing is print requests that happen at the browser, and are implemented at the Sharepoint server. For this exception, CareConnect has implemented a web service for the application to notify when printing has been requested, to enable print requests to be audited. Since all data access is done via a web service, simply auditing web service calls and the response provides complete auditing coverage. Therefore, the only audit trigger is in the web service response component. VCH is currently investigating the use of audit consolidation tools to extract consolidated reports based upon our portal audit logs, the Sentillion (Context Manager) audit logs, the Citrix logs, and source system logs Encryption Properly applied cryptography is needed to protect the confidentiality of data. Personal Health Information (PHI) protection legislation in multiple jurisdictions (e.g., Alberta, Saskatchewan, Manitoba) encourages the application of encryption technology. This protection can be applied to data in transit, in active storage and at rest. CareConnect messages sent over external interfaces are encrypted at the transport layer. This includes messages exchanged with EMPI and Excelleris, as well as the encryption of all traffic sent over the virtual private network (VPN). Page 19

22 Digital Signatures Digital signatures will very likely be a requirement for any system that electronically delivers prescriptions to pharmacists, via electronic order entry. To the extent that an implementation of the EHRi supports such a capability, it must also support providers digital signatures. There are many other less common situations where the signature of a physician is required upon an e-form. Certain internal processes also benefit from the use of digital signatures, such as passing authentication credentials between systems. CareConnect does not currently support order entry, and does not support providers digital signatures. Digital signature and certificate technology has been implemented on external interfaces at the transport level (SSL) to provide strong mutual authentication between communicating systems. This includes the provincial EMPI, Excelleris and remote access VPN Privacy Services The above security services support information privacy requirements. In addition, the Privacy and Security Conceptual Architecture defines explicit privacy services including identity protection, anonymization, and consent directives management. A further business-level discussion of the CareConnect privacy model is provided in section 4.2 below Identity Protection To ensure the highest level of anonymity of personal health information (PHI) when stored or in transit between EHRi, information that uniquely identifies an individual should be separated to the greatest degree possible from other information about that individual s health status, diagnosis, treatment, etc. Storing the patient/person identifying information in one location and the non-identifying portion of his or her EHR data in another location reduces the potential impact of a privacy breach. Conceptually, this service links an individual s public identifiers to a matching EHRi client identifier (ECID) in order to locate and retrieve PHI. CareConnect implements a "PatientVariation" table, with its own surrogate key, that stores a source system MRN, and the related demographics from that source system (related by MRN) in each record. This "PatientVariation" record also stores a PHN if the source system associated a PHN with its MRN. The encounter table records relate back to the patient variation records via a foreign key relationship based on the surrogate key in the "PatientVariation" table Anonymization & Pseudonymization An anonymization service takes PHI, removes all personal identifiers, and then either aggregates it or performs other statistical transforms. It will always provide data based on multiple patients/persons. Pseudonymization, on the other hand, provides data on a specific patient/person under a pseudonym. Page 20

23 This functionality is not currently implemented in CareConnect, but would not be difficult to add Consent Directives Management The consent directives management service is intended to help EHRi users and their organizations comply with requirements in applicable legislation, as well as requirements for the handling of PHI found in various privacy policies and in specific consent directives. The service works by applying requirements for the handling of PHI prior to providing access to or transmitting PHI via the EHRi. The service determines whether or not patients /persons consent directives allow or restrict the use and/or disclosure of PHI. If no such directives exist then the service will respond to authorized access requests to PHI. The service also allows EHRi users to manage a patient/person s specific consent directives, such as blocking or masking PHI from a certain care provider or disclosing PHI without consent for emergency treatment, as required or permitted by law. For its consent model at the patient/person level, the CareConnect project is implementing an opt out capability with break the glass functionality by creating an "optout" table in its data model which will contain a list of source system/mrns. The access logic will scan this table for MRNs before fulfilling any requests. If one of the identifiers in the requested linkage set is in this table, access will be denied to all that patient's data unless the clinician invokes the break the glass functionality. 3.9 HIAL COMMUNICATION BUS The communication bus services layer is an aggregation of services that pertain specifically to enabling communication capabilities. It is focused on the receiving and sending of messages and the support of valid communication modes primarily between Point of Service (PoS) applications and an EHR infostructure (EHRi), EHRi-to-EHRi and possibly between components within an EHRi (e.g., LRS to Client Registry). SeeBeyond egate and Microsoft Message Queue (MSMQ) provide communication bus services to CareConnect. This technology is used between PoS systems and the EHR Index, and between CareConnect and the Provincial EMPI POINT OF SERVICE APPLICATIONS CareConnect facilitates views of or access to a variety of Point of Service (PoS) applications. These applications cover patient care information systems (PCIS) at VCH and PHC, a radiology system (PACS), and community care (PARIS). These systems feed information into the CareConnect EHR index in real time. VCH anticipates extending CareConnect coverage to additional clinical systems over time. This would include additional PCIS, and integration with EMR systems used in Primary Care. Page 21