Automate Blue Button Initiative Push Workgroup Meeting

1. Automate Blue Button InitiativePush Workgroup Meeting January 7, 2013

2. Meeting Etiquette From S&I Framework to Participants: Hi everyone: remember to keep your phone on mute  All Panelists • Remember: If you are not speaking, please keep your phone on mute • Do not put your phone on hold. If you need to take a call, hang up and dial in again when finished with your other call • Hold = Elevator Music = frustrated speakers and participants • This meeting is being recorded • Another reason to keep your phone on mute when not speaking • Use the “Chat” feature for questions, comments and items you would like the moderator or other participants to know. • Send comments to All Panelists so they can be addressed publically in the chat, or discussed in the meeting (as appropriate). 2

3. Agenda

4. Announcements and Reminders • Meeting Reminders • Push Workgroup Meetings are Mondays from 2:00 – 3:00 pm Eastern. • Next PUSH Workgroup Meeting is Monday, January 14th, 2013 @ 2:00 pm Eastern. • The next Community Meeting will be held as needed. • Meeting information is on the Automate Blue Button Wiki Page: http://wiki.siframework.org/Automate+Blue+Button+Initiative • Community Homework • Provide comments and feedback on the Push Implementation Guides: http://wiki.siframework.org/Push+Implementation+Guidance+Comments+and+Feedback 4

5. ABBI Schedule December Accomplishments • Drafted Implementation Guide Part 1 (Send and Receive via Direct + Clinical content) • The community has set up a pilot for exchanging trust bundles on behalf of patients. Governance TBD. • Participated in Town Hall and Connect-a-Thon • Finalized the first round of privacy and security guidance and cleared it with OCR. • VA completed update to MyHealtheVet, which will allows patients to download a structured document (CCD) in next release. • Design challenge received a record 230 submissions and winners will be announced next week. • Beth Israel and VA will participate in HIMSS showcase, and Beth Israel will act as “reference implementation” for Push. • Drafted first versions of PULL and PAYOR implementation guidance, currently being reviewed by S&I community.

6. ABBI Schedule January • “Go Live” with draft Implementation Guide Part 1 (Send and Receive via Direct + Clinical content), on January 15 • Make proposal for governance of Trust Bundles • Propose second round of privacy and security guidance for OCR / ONC • Secure list of “reference implementers” and demonstrators at HIMSS • Finalize PULL and PAYOR implementation guidance • Complete Developer Toolkit • Others?

7. Updates to Implementation Guide Corrections: Content XML (See changes) Addition: Link to NIST Testing Tool Workflows Added

8. Updates to Implementation Guide 1. Patient logs into portal 2. Patient clicks on “Share with Direct” 4. Patient enters Direct address and selects transmit frequency 3. Patient reads and accepts transmit terms

9. Updates to Implementation Guide

10. Integrating Feedback from Direct • Objective: To ensure consumers can get their personal health data to their third party applications/locations. • Additions: • Pulling Trust Anchors from Bundle • 3rd Party Locations – Participate in Bundle • Bundle Strawman – HTTPS + PKCS7 (.P7B) • Senders signs w. an EV Certificate

11. Integrating Feedback from Direct http://blue-button.github.com/docs/files/patient-transmit.pdf

12. Certificate Discovery • Blue Button Trust Bundle • Pilot – ABBI Workgroup • Model Privacy Notice • Bundle Management Site • http://secure.bluebuttontrust.org • Content update next week • Direct Reference Implementations • Being updated in January • C# RI code to pull bundles has been written.

13. Certificate Discovery

14. Certificate Discovery

15. Certificate Discovery Submit your anchors! https://secure.bluebuttontrust.org

16. Blue Button Privacy and Security • Adrian: Comment on additional guidance piece. How much additional information is available via BB. In the real world, this leaves from a backend provider or BB. Can we get clarity on the scope on the information that the patient has a right to that is also accessible via BB? • Response: HIPPA (designated record set) and MU2 certifications • Corey: Has this been posted or where will it be posted? • This will be part of the IG (when finalized) and wiki (today) • This privacy and security is for Push only, there may be others surfaced by Pull.

17. Next Steps / Reminders • Next Steps • Feedback on Policy & Criteria • Suggestions on Sponsoring Organization • Push using Email Implementation Guide • Reference Implementations / Pilots • Meeting Reminders • Next PUSH Workgroup Meeting is Monday, January 14th, 2013 @ 2:00 pm Eastern. • The next Community Meeting will be held as needed. • http://wiki.siframework.org/Automate+Blue+Button+Initiative • For questions, please contact your support leads • Initiative Coordinator: Pierce Graham-Jones (pierce.graham-jones@hhs.gov) • Presidential Innovation Fellow: Ryan Panchadsaram (ryan.panchadsaram@hhs.gov) • Project Manager: Jennifer Brush (jennifer.brush@esacinc.com) • S&I Admin: ApurvaDharia (apurva.dharia@esacinc.com)

18. Push Using Email • Sending Health Information via Email • How can we articulate a best practice for this? • We heard suggestions in October: • Packaging files in a password-protected ZIP • Using PDF’s encryption feature • While we are putting the final touches on Transmit Using Direct, we should start creating strawmen for this use case.