eHealth Information: Federal Activities and Implications for State Policy

1. eHealth Information: Federal Activities and Implications for State Policy Susan M. Christensen Senior Advisor CSG Health Policy Forum On Mental Health Care and Wellness May 31, 2006

2. Overview • Terminology – Getting on the Same Page • Federal Landscape • AHRQ • Privacy and Trust • Resources • Legal Issues • Appendix: Case Study – Legal Issues

3. Terminology: HIE v. HIT • No longer just about putting electronic medical records in hospitals • Electric health information systems across all care settings, as well as payers • Linking them together – interoperability for health information exchange (HIE) • For HIE, communities and states (and some regions) are developing networked systems • To do this, it’s not just about investing in the technology (HIT) ; we must research how to do so in a way that • Maximizes the value we hope to realize – clinically, economically, and for population health • Assures that security and privacy protections are “baked into” HIE

4. HIE Policy Issues • In addition, a new market is being created, with all the technical and policy issues that entails, such as • Standards for data exchange • Assuring consumer participation and patient protections • Security concerns • New business arrangements, new relationships • Disconnect between payment systems and new relationships/care delivery models

5. What’s the situation?

6. Federal Leadership President’s Executive Order 13335 (April 2004) – federal leadership for the development of a nationwide interoperable electronic health information system: • Created Office of the National Coordinator for Health Information Technology in HHS (ONC) • ONC is required to develop a national strategic plan to support: • Public-private collaboration to develop, adopt and implement standards • Evaluate benefits of HIT • Address privacy and security issues • ONC serves as principal advisor to Secretary on national HIT policy, coordinates federal activities, and coordinates public-private outreach and consultation

7. ONC Health IT Roadmap To-Date NOW 2006 GOALS Recommendations for: • Biosurveillance • Consumer Empowerment • Chronic Care • Electronic Healthcare Records WORKGROUPS Workgroups Established Make Recommendations to the Community • Recommendations Report to the Secretary of HHS COMMUNITY Community Established Review Workgroup Recommendations Interoperable Electronic Healthcare Records • NHIN Architectures • Standards Implementation Guidance • Ambulatory Care Certification Criteria INFRASTRUCTURE Contracts Awarded • 2006 Strategic Plan ONC Health IT Strategic Framework NHIN RFI Summary Health IT Policy Council Established FHA Strategic Plan JAN MAR . . . DEC MAR SEP OCT JUL FEB 2005 2004 2007 2014

8. Four Major HHS Contracts HHS has entered into four significant contracts: http://www.hhs.gov/healthit/contracts.html • Harmonize industry-wide health IT standards (ONC) • Develop a conformance certification process for health IT (ONC) • Assess and develop plans to address variations business policies and state laws related to privacy and security (AHRQ) • Four contracts to develop nationwide health information network (NHIN) prototypes that can be used to test specialized network functions, security protections and monitoring, and demonstrate feasibility of scalable models (ONC)

9. Agency for Healthcare Researchand Quality (AHRQ) Mission To improve the quality, safety, efficiency, and effectiveness of health care for all Americans

10. Research at HHS:Where Does AHRQ Fit In? • NIH -- basic biomedical bench research and “efficacy” clinical trials • AHRQ -- “effectiveness” of healthcare services and the healthcare delivery system • CDC -- the public health system and community-based interventions Other federal partners – CMS (Medicare and Medicaid), HRSA (capital and resources, workforce), and ONC(collaboration and coordination on health IT)

11. Intersection of Safety, Quality and Health IT • Support diffusion of HIT to • 41 states • 40 million Americans • Improve medication safety • CMS e-prescribing demos • Provide HIT technical support to safety net • Community health centers • Critical access hospitals • Public hospitals • Privacy and Security AHRQ

12. Focus on Adoption of Health IT • AHRQ’s work focuses on the marriage of Health IT systems with the way work is done in health care • Need to prepare for the impact of new Health IT systems • Health IT is “one part technical, and two parts culture and work process change.” • Opportunity to design new and better workflows – and review work patterns that may never really have been examined.

13. State and Regional HIT Demonstrations • Five-year state-based contracts: • Help states develop secure statewide networks • Ensure privacy of health information • Make an individuals’ health information more available to health care providers • FY04: Five states awarded $1M/year • Colorado • Indiana • Rhode Island • Tennessee • Utah • Delaware added in FY05

14. AHRQ National Resource Center for Health Information Technology • Provides technical and expert support to health IT grantees, contractors, and selected other federal grantees (HRSA, CMS, IHS) • Contract award to NORC (up to $18.5M over 5 years), in partnership with: • Vanderbilt University • Center for IT Leadership (Partners) • Indiana University • Foundation for the eHealth Initiative • CSC • Burness Communications healthit.ahrq.gov

15. Approaching the “Trust” Issue • Why is this important to people? What are people thinking? What is the “threat”? • Can we break it down? Is HIPAA compliance enough? Why not? • How to react? • Who should be involved? • What message? • Guidance for leadership?

16. “Trust” v. “Privacy” v. HIPAA Clarify the issues: • HIPAA – legal requirement • Additional legal privacy requirements • Federal • State • Contractual • Privacy – common law, ethics, good business, protections beyond basic HIPAA compliance • Trust – broader public concern about security and reliability

17. Privacy and Security Contract • In September 2005, AHRQ awarded “Privacy and Security Solutions for Interoperable Health Information Exchange” • Overall contract managed by RTI International in partnership with NGA • 18-month period; $11.5 million • RTI will subcontract with up to 40 states to: • Identify within the state business practices that affect electronic health information exchange • Propose solutions and implementation plans • Collaborate on regional and national meetings to develop solutions with broader application • Provide final report on overall project outcomes and recommendations

18. Contract Purposes • Identify variations in organization-level business privacy and security policies and practices that affect electronic clinical health information exchange (HIE) • For those that are “best practices”, document and incorporate into proposed solutions • For those with a negative impact, identify source of the policy or practice and propose alternatives • Preserve privacy and security protections as much as possible in a manner consistent with interoperable electronic health information exchange • Incorporate state and community interests, and promote stakeholder identification of practical solutions and implementation strategies through an open and transparent consensus-building process • Leave behind in states and communities a knowledge base about privacy and security issues in electronic health information exchange that endures to inform future HIE activities

19. Connecting for HealthCommon Framework • A set of free resources: 16 policy guides and technical documents designed to advance HIE in a private and secure manner. • Technology neutral • Includes model contract language for HIE agreements • The Common Framework puts forth a model of HIE that: • Protects patient privacy by allowing health information to remain under local control – avoiding the need for a large, centralized database or creation of a national patient ID • Avoids large-scale disruption and huge up-front capital investments by making use of existing hardware and software • Supports better informed policymaking around HIE • Establishes trust among collaborating organizations by applying well-vetted model contract language to fit their needs • Series of activities to disseminate and provide education for how to use: AHRQ website, teleconferences, workshops • healthit.ahrq.gov and www.connectingforhealth.org

20. Vanderbilt Center for Better Health Model • Developed workshop design to explore trust issues, come to consensus, and make recommendations or develop workplan for moving forward • Goal: state/community controls the process and the outcome • Statewide: used principles in CFH model as kickoff for discussion about privacy and trust among stakeholders in disparate HIEs across state • Another new statewide initiative: used workshop to do concrete planning for both technology and governance in new HIE • http://www.volunteer-ehealth.org/AHRQ/12142005/index.htm • http://www.mc.vanderbilt.edu/vcbh/ds/0606_privacy/ • Working with AHRQ to make the workshop “portable”

21. Differing Approaches – Legal Issues • Recognize that one approach, i.e., legislation, is not appropriate for every issue • Federal legislation and mandates • National or regional consensus • Model state laws • State innovation through demonstrations or regulation • Model contracts • Private agreements • Coordinate among initiatives; use them in combination

22. Summary • Communities can and should make their own choices about HIE • The decision process on policies and implementation is as much a part of the solution as the technology • Call on national initiatives for what they can offer to save money and accelerate the process

23. http://healthit.ahrq.gov For additional information: Susan Christensen susan.christensen@ahrq.hhs.gov

24. Case Study – One State • Workgroup of stakeholders assumed time frame two years hence • Identified potential key legal, regulatory, and policy areas that could still be of concern as regional health information exchange implementation progresses • Stratified issues by national, regional, local or private in nature (i.e., best resolved at what level to be most effective?), and split them into technical and non-technical categories • Identified proposed approach: legislation, rule-making, consensus, private agreement, or some combination • Model legislation would be appropriate for many of the consensus issue areas, except data and communication standards

25. Technical Issues

26. Non-Technical Issues

27. HIE Structure