For ONC S&I DS4P. Dennis Giokas Chief Technology Officer Canada Health Infoway Inc. January 25, 2012

Transcription

1 For ONC S&I DS4P Dennis Giokas Chief Technology Officer Canada Health Infoway Inc. January 25,

2 Outline EHR Business Architecture EHR Solution Blueprint EHR Privacy and Security Summary & Conclusion 2

3 EHR Key Clinical & Business Requirements Patient centric, life-long longitudinal record of clinical data Support for accurate, complete, timely delivery of information Allowing private and secured access to data made available in the EHR Focused on clinically relevant data shared across the continuum of care Shared across multiple organizations, jurisdictions Scalable to allow continuous, extensive growth of clinical information with a ROI More POS applications sourcing data to EHR More users accessing and using data from EHR Towards more physician order entry and decision support Interoperable, integrated Standards based 3

4 EHR Definition An electronic health record (EHR) provides each individual in Canada with a secure and private lifetime record of their key health history and care within the healthcare system. The record is available electronically to authorized healthcare providers and the individual anywhere, anytime in support of high quality care. This record is designed to facilitate the sharing of data across the continuum of care, across healthcare delivery organizations and across geographies. 4

5 Common Architecture Common business and technical architecture accepted by jurisdictions and vendors Links local clinical systems with jurisdiction and regional registries and repositories using a data sharing approach Must cost effective approach, limiting the number of integration points Extensible to support new functions, scalable Serves as a reference model for Infoway investments Available on the Infoway website

6 Patient Receives Care Across Care Providers & Settings Community Care Center Clinic Homecare Emergency Pharmacy Specialist Clinic Laboratory Hospital Emergency Diagnostic

7 Patient Clinical Information is Shared Among Care Providers & Settings Community Care Center Clinic Homecare Emergency Pharmacy Specialist Clinic INTEGRATED VIEW Laboratory Hospital Emergency Diagnostic

8 Clinician systems put relevant data for sharing into interoperable EHR Community Care Center Clinic Homecare Emergency Pharmacy Specialist Clinic INTEGRATED VIEW Put Put Laboratory Hospital Emergency Diagnostic

9 Clinician systems list and get desired data from interoperable EHR for display and use Community Care Center Clinic List/Get Homecare Emergency Pharmacy Specialist Clinic INTEGRATED VIEW List/Get Laboratory Hospital Emergency Diagnostic

10 10

11 Clinical Functions Supported Point-of-service systems and Interoperable EHR Interactions Supported by Standards Drug Utilization Review Support Capability Laboratory, medication orders Alert Order Medication contraindications, alerts on conditions, alerts on abnormal test results Document Allergies/intolerances, conditions, drug dispense, client demographics, clinical reports View Lab, Immunization, medications dispensed, provider demographics, DI images and reports, prescription status Functions Privacy and Security interactions with the EHR Infostructure

12 End-User Perspective: EMR Application JURISDICTIONAL INFOSTRUCTURE Registries Data & Ancillary Data & EHR Data & Data Warehouse Client Registry Immunization Management PHS Reporting Shared Health Record Drug Information Diagnostic Imaging Laboratory Health Information Provider Registry Location Registry Business Rules EHR Index Message Structures Normalization Rules Terminology Repository Longitudinal Record Security Mgmt Data Privacy Data Configuration HIAL Common Communication Bus EMR Database EMR APPLICATION Physician Office EMR POINT OF SERVICE Physician/ Provider 12

13 Pan-Canadian EHR Infostructures as Peers Distributed, Federated, Message Based EHRS EHRS EHRS EHRS EHRS EHRS EHRS 13

14 Privacy and Security in the EHRS 2006 Canada Health Infoway Inc. 14

15 Why is Privacy Important? Privacy by Design: Don t Make Privacy An Afterthought Build It In Ann Cavoukian, Ph.D. Information & Privacy Commissioner, Ontario The most effective means to counter technology s erosion of privacy is technology itself. Alan Greenspan, Federal Reserve Chairman

16 Patient Receives Care Across Care Providers & Settings Will you protect the privacy and confidentiality of PHI? Community Care Center Clinic Homecare Can we share information? Emergency Pharmacy Specialist Clinic Is authentication and authorisation reliable? Are you authorised to access PHI? Laboratory Hospital Emergency Diagnostic Who are you? i.e organisation and provider

17 Why a Privacy and Security Architecture? Trust in the interoperable EHR is based on the assumption that it is private and secure Trust is fundamental to acceptance and adoption by governments, health care providers and the public As Personal Health Information (PHI) is shared across disparate systems, privacy and security are no longer local issues therefore must be managed in a uniform manner and support interoperability Stakeholders expect the Infoway Blueprint to provide the vision of a privacy protective and secure interoperable EHR 17

18 CSA model code privacy principles OECD Fair Information Practices 1. Accountability for personal health information 2. Identifying purposes for collection, use and disclosure personal health information 3. Consent 4. Limiting collection of personal health information 5. Limiting use, disclosure and retention of personal health information 6. Accuracy of Personal Health Information 7. Safeguards for the protection of personal health information 8. Openness about practices concerning the management of personal health information 9. Individual access to personal health information 10.Challenging compliance 18

19 EHR Infostructure: Conceptual Architecture JURISDICTIONAL INFOSTRUCTURE Registries Data & Ancillary Data & EHR Data & Data Warehouse Client Registry Provider Registry Location Registry Ensures only Immunization Management authenticated system users can access the EHR Business Rules PHS Patient Reporting determined i.e. consent directives, masking, or lock box EHR Index Shared Health Record Message Structures Normalization Rules Drug Information Patient s privacy rules Longitudinal Record Terminology Repository Privacy enhanced systems Diagnostic Privacy by Laboratory Design Imaging i.e. anonymization of PHI,, encryption of data bases Health Information HIAL Public Health Authenticated providers Ensures only authorised providers can access PHI Pharmacy System Authorized providers Integrity of PHI Common Technical Communication Bus mechanisms to prevent unauthorized Radiology modification Lab System Center (LIS) PACS/RIS Confidentiality Security Mgmt of PHI Privacy Data Data Ensures confidentiality of PHI during storage and transmission Hospital, LTC, CCC, EPR Physician Office EMR Audit trace Configuration Provides audit and logging of all accesses to EHR EHR Viewer POINT OF SERVICE Public Health Provider Pharmacist Radiologist Lab Clinician Physician/ Provider Physician/ Provider Physician/ Provider 19

20 EHR Infostructure: Privacy & Security features JURISDICTIONAL INFOSTRUCTURE Registries Data & Client Registry Provider Registry Location Registry Immunizatio n Management Ancillary Data & Business Rules PHS Reporting EHR Index Shared Health Record Message Structures EHR Data & Identity Protection Drug Diagnostic Information Identity Mgmt Imaging Normalizatio n Rules Longitudinal Record Access Control Terminology Repository PRIVACY AND SECURITY Anonymisation Laboratory User Authentication Secure Auditing General Security Data Warehouse Consent Directives Mgmt Health Encryption Information Digital Signature HIAL Common Communication Bus Security Mgmt Data Privacy Data Configuratio n GENERAL Auditing Log Mgmt Public Health Pharmacy System Radiology Center PACS/RIS Lab System (LIS) Hospital, LTC, CCC, EPR Physician Office EMR Exception / Error Handling EHR Viewer POINT OF SERVICE Public Health Provider Pharmacist Radiologist Lab Clinician Physician/ Provider Physician/ Provider Physician/ Provider 20

21 Consent Management Service Supports consent requirements arising from legislation and policies Establishes an interoperable consent solution through a common consent vocabulary. Activities related to: Recording Managing Applying Logging Overriding consent directives Validates and applies consent directives and, where necessary, allows consent to be overridden. Supports multiple approaches to storage of consent directives Implicit or explicit Supports multiple levels of specificity for the creation and application of consent directives. 21

22 Specificity of Consent Directives Increasingly fine grained All PHI: Consent for use and disclosure revoked for all PHI stored in the EHRi PHI by Domain Repository: Consent for use and disclosure revoked for all PHI stored in one or more domain repositories (e.g. entire drug profile) PHI by Facilities: Consent for use and disclosure revoked / withheld for all PHI by facility ID (e.g. this is a common request of staff within a healthcare facility) PHI by Role: Consent for use and disclosure revoked / withheld for all PHI by EHRi User role (e.g. researcher) PHI by EHRi User: Consent for use and disclosure revoked / withheld for use or disclosure of PHI by EHRi User identity By Data element: Consent for use and disclosure revoked / withheld for a specific record or data field in the EHRi 22

23 Other Considerations for PHI Protection Highly secure data centres Federated databases such that not all of a person s data is within one database or in one data centre Option to encrypt all PHI data Privacy protective backup, encrypted or deidentified Centralized systems and databases have fewer points of system and user connection, thus fewer points of privacy and security risk 23

24 Key Features To Access Personal Health Information 1. PHI is to be only accessed by authorized Healthcare providers Provision for jurisdictional or regional access control rules applied in a consistent manner i.e. Psychiatric information may not be available to the GP i.e. Radiology reports not available to the ADT clerk 2. Patients have the right to determine the purpose, when and who can access their PHI Where applicable by law, PHI is only made available to a Healthcare provider if the appropriate jurisdictional and/or patient derived privacy rules are satisfied i.e. Patient consent or masked data 24

25 Key Features To Access Personal Health Information 3. Prevent unauthorized access to PHI The use of encryption technologies to protect against unauthorized access (confidentiality and Integrity) to PHI whether in storage or during transmission 25

26 Key Features The Right Information to the Right Person 4. Ensure that Healthcare providers are uniquely identified, authenticated and authorized to access PHI in a trustworthy common manner notwithstanding where they access PHI Single sign on with one electronic credential (ID) recognised by all applications or support for Federated Identities Defining and applying standardized predefined roles across disparate healthcare applications Creation and validation for Digital Signature on electronic documents, i.e. eprescribing, proof of authoring of, and acceptance of reports Audit Trace required for consent override and access: a fundamental privacy requirement who, what, when, why has accessed PHI 26

27 Key Features PHI Is Accessed at Right Time, in Right Context 5. Information not typically available can be accessed in emergency situations Support for predefined conditions for overriding privacy and access control rules Support for extensive audit traceability in cases of exception 27

28 Key Features PHI Is Accessed at Right Time, in Right Context 6. Concerns about the privacy risks of consolidated or federated data bases Highly secure data centres Federated data bases such that not all of a person s data is within one database or in one data centre Option to Encrypt all PHI data Privacy protective backup, encrypted or de-identified Use mechanisms to allow for de-identification and reidentification of PHI Centralized systems and databases have fewer points of system and user connection, thus fewer points of privacy and security risk (n-1) 28

29 In Conclusion 2006 Canada Health Infoway Inc. 29

30 Privacy and Security Conclusions The following need to be in place for privacy and confidentiality: Information on purposes and the individual s rights (e.g. collection, use, disclosure, access, correction, challenge) Consent directives Provider/user identification, authentication and authorization Data and information classification (e.g. in support of authorization) Privacy legislation and accompanying policies Processes (e.g. consent, information flow, governance) Assessment mechanisms and programs to determine compliance Training for all responsible in some way to ensure privacy Privacy and security enhancing technologies 30

31 Thank you! Website: Blog: 31