An open source software tool for creating and managing patient consents electronically in IHE XDS.b environments

Transcription

1 An open source software tool for creating and managing patient consents electronically in IHE XDS.b environments 20th of April 2012 O. Heinze 1, M. Birkle 1, H. Schmuhl 1, B. Bergh 1 1 Department of Information Technology and Medical Engineering University Hospital Heidelberg, Germany

2 Overview 1. Background / Motivation 2. Objectives 3. Methods 4. Results 5. Discussion

3 Background / Motivation

4 Classic Health Record architecture Personal Health Record (PHR) Patient / Citizen Electronic Health Record (EHR) Hospitals GPs Pharmacies Homecare Devices

5 Personal Electronic Health Record (PEHR) in the Metropolitan Region Rhine-Neckar Patient / Citizen Personal Electronic Health Record (PEHR) 1. Fully controlled by the patient 2. Based on IHE Profiles 3. Open Source for connectivity Hospitals GPs Pharmacies Homecare Devices

6 Metropolitan Region Rhine-Neckar (MRN) 3 states (Baden-Wuerttemberg, Hessen, Rhineland-Palatinate) area of 5637 km² with 2.4 million inhabitants seventh largest economy in Germany more Information:

7 Integrating the Healthcare Enterprise (IHE) Initative Initiative by healthcare professionals and industry to improve electronic data exchange and interoperability in health care using standards (e.g. HL7, DICOM, ) Definition of Integration Profiles which describes Actors and Transactions Actor 1 Transaction e.g. ITI-08: HL7 Version ADT A01 i.e. XDS-I: Cross-enterprise Document Sharing for Imaging Integration Profile 5 Actors (e.g. Image Document Source and Consumer) 2 Transactions (e.g. Provide and register Image Document Set) Actor 2

8 PEHR architecture overview Data Warehouse Primary Systems PEHR Personal Electronic Health Record Central Registrys XDS compliant software OSEP Proxy not XDS compliant software OSEP Open Service Platform Document Registry (XDS) Document Repository (XDS) Patient Registry (PIX, PDQ) Provider and Organization Registry (PORS) Audit Repository (ATNA) Central Repositorys Medication Services Forms Service Professional Portal (InPROV) Care and Disease Mangement (CDM) Patient Portal Central Applications optional interface anonymized Private EHRs

9 Objectives To develop a concept and a prototype for the PEHR consent management which Strengthens patients rights patient empowerment Taking the main legal requirement in Germany into account: opt-in approach informed consent high transparency fine grained access rights

10 Methods

11 Methods Based on Literature review Analysis of IHE Basic Patient Privacy (BPPC) Profile Analysis of OASIS XACML the functionalities and components to meet the requirements of a centralized opt-in consent management solution compliant with German legislation have been analysed Two JAVA based services have been developed and integrated into the Heidelberg PEHR.

12 Results

13 IHE Basic Patient Privacy Consent (BPPC) Profile very basic profile to manage patient privacy in XDS environments three problems of BPPC have been identified: usage of OIDs in the field confidentiality code return of all privacy policies to the decentralized policy decision points no workflow described how to manage consent documents

14 extensible Access Control Markup Language (XACML) Powerful standard to build structured access control policies based on XML Syntax Definition of PAP - Policy Administration Point which manages policies PDP - Policy Decision Point which evaluates and issues authorization decisions PEP - Policy Enforcement Point which intercepts user's access request to a resource and enforces PDP's decision. PIP - Policy Information Point which can provide external information to a PDP (e.g. LDAP attribute information)

15 PEHR architecture with consent management Data Warehouse Primary Systems PEHR Personal Electronic Health Record XDS compliant software OSEP Proxy not XDS compliant software PEP OSEP Open Service Platform Document Registry (XDS) Document Repository (XDS) Central Registrys Patient Registry (PIX, PDQ) Provider and Organization Registry (PORS) PEP PAP PDP Audit Repository (ATNA) Central Repositorys PIP Medication Services Forms Service Professional Portal (InPROV) Care and Disease Mangement (CDM) Patient Portal Central Applications optional interface anonymized Private EHRs

16 Consent Management Suite (COMS) Consists out of two different services Consent Management Service (CMS) store, process and enforce consent documents Consent Creator Service (CCS) create, alter and manage consent documents Definition of a CDA based consent document PAP PDP

17 Consent Management Service (CMS)

18 Consent Creator Service (CCS)

19 Workflows supported with COMS create consent document (left top) provide document (left bottom) retrieve document (right top)

20 Discussion

21 Discussion Our approach solves the consent issue when using IHE profiles for the PEHR. It is highly interoperable due to the use of international standards and can hence be used in any other setting to leverage consent issues and substantially promote the use of IHE for regional health information networks in general. COMS is open source software released at the Open ehealth Foundation (OeHF)

22 Thank you! University Hospital Heidelberg Department of Information Technology and Medical Engineering (ZIM) Speyerer Str Heidelberg Germany Oliver Heinze Mail [email protected] Fon Markus Birkle Mail [email protected] Fon