Advanced and secure architectural EHR approaches

Transcription

1 International Journal of Medical Informatics (2006) 75, Advanced and secure architectural EHR approaches Bernd Blobel Chair of the EFMI WG Electronic Health Records, University Hospital Magdeburg, Germany KEYWORDS EHR; ISO Reference Model Open Distributing Processing (RM-ODP); HL7; CEN ENV Electronic Health Record communication Summary Objectives: Electronic Health Records (EHRs) provided as a lifelong patient record advance towards core applications of distributed and co-operating health information systems and health networks. For meeting the challenge of scalable, flexible, portable, secure EHR systems, the underlying EHR architecture must be based on the component paradigm and model driven, separating platform-independent and platform-specific models. Methods: Allowing manageable models, real systems must be decomposed and simplified. The resulting modelling approach has to follow the ISO Reference Model Open Distributing Processing (RM-ODP). The ISO RM-ODP describes any system component from different perspectives. Platform-independent perspectives contain the enterprise view (business process, policies, scenarios, use cases), the information view (classes and associations) and the computational view (composition and decomposition), whereas platform-specific perspectives concern the engineering view (physical distribution and realisation) and the technology view (implementation details from protocols up to education and training) on system components. Those views have to be established for components reflecting aspects of all domains involved in healthcare environments including administrative, legal, medical, technical, etc. Thus, security-related component models reflecting all view mentioned have to be established for enabling both application and communication security services as integral part of the system s architecture. Beside decomposition and simplification of system regarding the different viewpoint on their components, different levels of systems granularity can be defined hiding internals or focusing on properties of basic components to form a more complex structure. The resulting models describe both structure and behaviour of component-based systems. Results: The described approach has been deployed in different projects defining EHR systems and their underlying architectural principles. In that context, the Australian GEHR project, the openehr initiative, the revision of CEN ENV Electronic Health Record communication, all based on Archetypes, but also the HL7 version 3 activities are discussed in some detail. The latter include the HL7 RIM, the HL7 Development Framework, the HL7 s clinical document architecture (CDA) Present address: Fraunhofer Institut Integrierte Schaltungen, Head of the Health Telematics Group, Am Wolfsmantel 33, Erlangen, Germany. Tel.: ; fax: address: bernd.blobel@iis.fraunhofer.de /$ see front matter 2005 Elsevier Ireland Ltd. All rights reserved. doi: /j.ijmedinf

2 186 B. Blobel as well as the set of models from use cases, activity diagrams, sequence diagrams up to Domain Information Models (DMIMs) and their building blocks Common Message Element Types (CMET) Constraining Models to their underlying concepts. Conclusion: The future-proof EHR architecture as open, user-centric, user-friendly, flexible, scalable, portable core application in health information systems and health networks has to follow advanced architectural paradigms Elsevier Ireland Ltd. All rights reserved. 1. Introduction Healthcare systems these days tend to form loosely or even rather closely coupled regional networks, health maintenance organisations or international trusts. Modern information systems supporting the paradigms of regionalisation, internationalisation, or even globalisation with their characteristics of distribution, communication and cooperation have to be highly interoperable and independent of complexity, localisation constraints, platforms, etc. Therefore, such systems have to meet system requirements of openness, scalability, flexibility, portability, distribution at Internet level and must be generally based on international standards. Furthermore, such information systems have to provide appropriate security and privacy services. Due to their comprehensiveness, complexity, job-sharing design and implementation as well as integration into production environments, modern information systems must be based on formal models for specifying them properly. The interoperability has to be provided at knowledge level meeting legal, ethical and organisational requirements in a flexible and portable way including multimedia and mobile devices. In that context, methods and tools have to be established to enable the formalisation and structuring of components needed as well as to realise their management. 2. Architectural principles of EHR systems Internationally, three standard concepts have been established for EHCR specifications and implementations: the component-oriented single model approach [1], the component-oriented dual model approach [2] and the multi-model approach of component-oriented services [3,4]. The first two approaches pursue data integration, embed concepts into structures in the case of the single model approach, or specify and implement them using archetypes in the case of the dual model approach as well as make functionalities such as workflow concepts and alert mechanisms that are derived from the available data. The third approach realises functional integration, i.e. interoperability, due to the architectural paradigm that is deployed. This integration level is also called semantic integration. Following, the most important approaches are shortly described The CEN Electronic Healthcare Record communication standard The CEN ENV EHCR communication consists of four parts: part 1 extended architecture, part 2 domain term list, part 3 distribution rules and part 4 messages for the exchange of information [1]. The extended componentbased EHR reference architecture is mandated to meet any requirements through the HER s complete lifecycle. According to CEN ENV 13606, an EHR comprises on the one hand a root architectural component and on the other hand a record component established by original component complexes (OCC), selected component complexes, data items and link items. The OCC consist of four basic components, such as folders, compositions, headed sections and clusters which can be combined in partially recursive ways. Currently, the CEN ENV is under revision for resulting in the five part EN EHR communication. This new standard represents the dual model approach according to the GEHR/openEHR approach The Governmental Computerised Patient Record project The Governmental Computerised Patient Record (G-CPR) is a joint initiative of the US Department of Defense (DoD), the US Department of Veterans Affairs (DVA) and the Indian Health Service (IHS). Within this several years lasting project, a common information model, adequate terminology models as well as tools for implementing and managing a proper business as well as technical environment have been established to share patient s information securely between interoperable disparate systems [5]. The solution is based on advanced

3 Advanced and secure architectural EHR approaches 187 national and international standards. Strictly using object-oriented specifications for interoperability, the approach started as rather service-oriented than architecture-based The HL7 Reference Information Model and its clinical document architecture Within its version 3 Message Development Framework, the well known health industry standard for communication HL7 specified a comprehensive Reference Information Model (RIM) covering any information in the healthcare domain in a generic and comprehensive way [6]. The HL7 RIM deals with the associations between the six core classes entity (physical information object in the healthcare domain), the role the entity can play (competence for action), participation (performance of action), the act as well as role relationship mediating interaction between entities in the appropriate roles and act relationship for chaining different activities. HL7 s RIM and vocabulary provide domain knowledge which is exploitable, e.g., for knowledge representation (representation of concepts and relations) in the GEHR Object Model (GOM) and archetypes discussed before. The specialised model for clinical document architecture (CDA) has been specified for developing appropriate messages to support EHR communications. It is based on the generic RIM and its refinements as Refined Message Information Model (R- MIM) and Common Message Element Types (CMET) for EHR-related scenarios. It establishes a dual model approach analogous to the GEHR approach. The HL7 approach solely reflects the information viewpoint of ISO RM-ODP. Within information models, it describes classes, attributes and their specialisations for developing messages. Therefore, HL7 provides interoperability at data level but not at functional level The GEHR approach Based on its involvement into the European Commission s Third Framework Programme project Good European Health Record (GEHR), the Australian government launched recently a project called Good Electronic Health Record (GEHR) [7]. The basic challenge towards GEHR which reflect also the results and experiences from the other projects discussed in the paper is knowledge level interoperability. Like HL7 s approach, also the GEHR approach deploys several models defined in the unified modelling language (UML) specification framework. In essence, it consists of two parts: the concrete GEHR Object Model delivering the EHCR information container needed at the one side and the GEHR metamodels called Archetypes for expressing the clinical content at the other side. The meta-models are bearing the medical knowledge in the sense of specific views and restrictions related to healthcare specialities, specific structure and condition at organisational level or even person-specific items. Because the archetypes are separately developed, they can be step by step instantiated at the technical model level until the complete medical ontology has been specified. In summary, the GEHR approach consists of small flexible pieces like LEGO bricks which can be combined in a proper, health domainspecific way following construction plans defined in archetypes. 3. A future-proof EHR architecture If traditional administrative solutions are based on the processing of data with restricted automated interpretation and built at a rather static context, medical department systems and also advanced management systems require an orientation on information as well as their flexible, context-related processing and provision. Based on the data in common comprehensive EHCR, repository and data warehouse, it is the task of departmental systems to put the corresponding concepts, contexts and functionalities onto the data. In order to ensure its quality and integrity, the information should be recorded and managed at the place of origin. Redundancies should be avoided. Therefore, EHCRs are virtual solutions that are centralised logically but not physically. Enhancing integration and evolution of core applications are essential for developing information and communication technology (ICT) strategies in healthcare. The different EHCR approaches established have been harmonized combining modern development paradigms and the huge domain knowledge expressed in other models, standards and R&D-projects outcome. This has been done using the generic component approach developed by the Magdeburg Medical Informatics Department at the mid-nineties [8]. Starting point of the approach is the ISO Reference Model Open Distributed Processing (ISO RM-ODP); at the beginning established with three views only [9] Component-based architectures Information systems intend to reflect legal, organisational, functional, technological and content

4 188 B. Blobel constraints. Furthermore, they have to enable interoperability not only at data but also at functional or even at knowledge level. The architecture meeting these challenges should consist of generic, encapsulated, persistent pieces which are accessible via interfaces and inherit or override their properties. These properties are met by objects. Because objects constraints are represented by object object interactions, they cannot be invoked via interfaces. Components containing objects and their associations overcome this problem. Therefore, the EHR architecture has to meet the component paradigm. Components can be composed/decomposed providing different levels of details or granularity. Starting from the granularity level of basic concepts of the corresponding domain, the complexity of aggregated components reflecting the application needed may be increased according to the users needs. By that way, standalone applications, distributed applications or even highly complex networks can be implemented. In that context, structural and functional complexity has to be considered as well. Components and their level of granularity can be selected according to the users needs [4] The ISO Reference Model Open Distributed Processing Information systems have been designed, developed and implemented for the purpose of supporting special business objectives and goals. Therefore, that information must be defined which is needed in the business model s context. This information has to be aggregated and processed in a proper way and must be implemented at a specific platform. To compare the architectural, functional, methodological and technological framework of information systems, the ISO Reference Model Open Distributed Processing can be used. This reference model defines possible views on systems such as enterprise view, information view, computational view, engineering view and technology view. Fig. 1 presents the abstraction matrix of component systems considering different levels of granularity and different viewpoints of the components Model-driven architectures The component paradigm first developed in the context of advanced hospital information system architectures at the Magdeburg University Hospital and refined within European projects such as HANSA has been enhanced by OMG s CORBA 3 approach [10] Fig. 1 Abstraction matrix of components. defining a component-based system design methodology. The essential building blocks of this approach are the concepts of portable object adapter (POA) enabling flexible invocations of services, the CORBA Component Model (CCM) with integrated object persistence, transactionality, multiple interfaces, security, etc., the metaobject facility (MOF) and the model-driven architecture (MDA) methodology. To reflect every aspect of any application including all ISO RM-ODP views and both the static and dynamic behaviour, the meta-models must span not only the range of platforms, but also the range of domains and businesses. For that reasons, MOF has to be based on a comprehensive dictionary regarding the applications. For data the same is played by the Common Warehouse Metamodel (CWM). In the first phase of modelling, the platformindependent specification of the components properties is performed describing the business, the information and the computational viewpoint of every component needed. These models are portable to any environment with specific database models, operating systems requirements, etc. This specification is transferred into the second phase of platform-specific modelling, covering the engineering and the technology viewpoint. The separation of platform-independent and platform-specific models, distinguishing between logic and technologic aspects, is the core idea of the MDA approach for component-oriented information systems [10]. The specification of platformindependent models is supported by appropriate tools. The tool-supported transfer into a platformspecific model is performed automatically. Both phases describe system components at meta-level using, e.g., the unified modelling language still abstracting from the implementation details. The resulting graphical vocabulary has to be transferred

5 Advanced and secure architectural EHR approaches 189 Fig. 2 MDA development and expression means. into verbal constraint models using the extensible markup language (XML). All models are developed starting from a coarse description and end up with a fine-grained specialisation. Thereby, the models follow the approach of the Generic Component Model based on the ISO RM- ODP. For the model management and the automatic development of a running application at runtime, corresponding tools will be deployed. In a modeldriven architecture, the implementation is automatically performed using tools as demonstrated in the HARP project running at the Magdeburg Medical Informatics Department [11]. In the next section, this project will be introduced shortly, also including security-related components and their services. As different views can be independently described by domain respective experts, available knowledge can be exploited and specific terminologies can be applied correctly. For example, the concept knowledge of medical doctors or procedural experience of administrators will be expressed in domain models referring to an information reference model established by IT experts. Beside agreed methodologies and tooling, accepted terminology maintained in a repository is a basic requirement. This terminology and ontology will be reused from SNOMED with its extensions SNOMED RT and SNOMED CT as well as from the UMLS created by the US NLM and meanwhile internationally maintained with important contributions by the English NHS. The outcome must be transferred considering engineering aspects related to, e.g., the specific database model, which can be managed by DB experts. All different development phases from general requirements analysis over domain-specific views up to implementation and maintenance of any HIS can be described by MDA. Therefore, MDA also allows dealing with legacy systems to define interfaces and levels of interoperability. Fig. 2 presents the MDA scheme including the expression means used as meta-language, UML and XML have been introduced as mentioned already. Because of some weaknesses of the approved version UML 1.4, tools supporting the emerging UML version have been used. 4. Future-proof EHR systems The proposed EHR architectural approach supports the whole life cycle of future-proof EHR

6 190 B. Blobel systems including requirements analysis, specification, implementation and maintenance. Allowing any reduction of complexity on one hand or any refinement on the other hand, the approach enables scalable and flexible information systems. By separating platform-independent and platformspecific models, portability into any environment is provided. Because all views are modelled separately, domain experts can be involved using their specific tools and languages. The deployment of meta-languages allows the aggregation of models and resulting components. Because different views of a component are supported which can be combined properly, the approach allows for the separate specification of different properties and functions of a component. For example, a components business function and its security behaviour can be modelled separately and implemented in a comprehensive way. By that way, security services can be bound to an EHR component ruling its behaviour in relation to the application context and the principals roles. Details can be found in ref. [12]. As the result, an architecture for secure, scalable, flexible, distributed, semantically interoperable, portable EHR systems has been provided. Following a unified process, the specification of models can be distributed globally for creating the critical number of services for realising the complex functionality of a comprehensive EHR system. The approach supports change management by replacing the service of an implemented component solely, keeping the other ones running. 5. Conclusions The establishment of shared care must be supported by distributed, interoperable information systems. In that context, the future-proof EHR architecture as open, user-centric, user-friendly, flexible, scalable, portable core application in health information systems and health networks has to follow advanced architectural paradigms. For meeting the aforementioned challenges, a component-oriented, model-driven approach must be established. Several EHR projects in the USA, Australia, Denmark, the author is involved in, but also European Research and Development projects such as HARP realised as regional project in the author s environment have been demonstrating the feasibility of the approach. Such advanced EHR architecture must also provide appropriate security services. Definition, design, implementation and maintenance of those services have to follow the same paradigm of model-driven architecture using the ISO RM-ODP. Starting small and thinking big such approach will become real rather soon. A reviewing description of advanced EHR approaches will be available in ref. [13]. Acknowledgements The author is especially in debt to the members of the HARP Consortium, but also to the colleagues from CORBA, HL7, ISO TC 215 as well as CEN TC 251 for their kind cooperation. References [1] CEN ENV Electronic Healthcare Record Communication. [2] T. Beale, A Model Universe for Health Information Standards (2003) [3] B. Blobel, Application of the component paradigm for analysis and design of advanced health system architectures, Int. J. Med. Inf. 60 (3) (2000) [4] B. Blobel, Analysis, design and implementation of secure and interoperable distributed health information systems, in: Series Studies in Health Technology and Informatics, vol. 89, IOS Press, Amsterdam, [5] G-CPR project: [6] Health Level Seven Inc.: [7] GEHR project: [8] B. Blobel, M. Holena, Comparison evaluation, and possible harmonization of the HL7, DHE, and CORBA middleware, in: J. Dudeck, B. Blobel, W. Lordieck, T. Bürkle (Eds.), New Technologies in Hospital Information Systems. Series Studies in Health Technology and Informatics, vol. 89, IOS Press, Amsterdam, 1997, pp [9] ISO/IEC Information technology Open Distributed Processing Reference Model. [10] J. Siegel, Quick CORBA3., Wiley Computer Publishing, John Wiley & Sons, New York, Chichester, Weinheim, Brisbane, Singapore, Toronto, [11] M. Vlachos, G. Stassinopoulos, Open, flexible and portable secure web based health applications, in: B. Blobel, P. Pharow (Eds.), Advanced Health Telematics and Telemedicine, Studies in Health Technology and Informatics, vol. 96, IOS Press, Amsterdam, 2003, pp [12] B. Blobel, R. Nordberg, J.M. Davis, P. Pharow, Modelling privilege management and access control, Int. J. Med. Inf., in press. [13] B. Blobel, A. Hasman, Harmonising advanced architectural approaches for distributed Electronic Healthcare Records towards a model driven EHR architecture, Int. J. Med. Inf., submitted for publication.