Identity Conference: modernization of health processes in Belgium

1. Identity Conference: modernization of health processes in Belgium Frank Robben General manager of the eHealth platform Quai de Willebroeck 38 B-1000 Brussels E-mail: Frank.Robben@ehealth.fgov.be Website eHealth platform https://www.ehealth.fgov.be Personal website: www.frankrobben.be

2. Some evolutions in health care • more chronic care instead of merely acute care • remote care (monitoring, assistance, consultation, diagnosis, operation, ...), and home care • multidisciplinary, transmural and integrated care • patient-oriented care and patient empowerment • rapidly evolving knowledge => need for reliable and coordinated management and access to knowledge • threat of excessively time-consuming administrative processes • thorough support of health care policy and research requires thorough, integrated and anonymised information • cross-border mobility • need for cost control

3. These evolutions require... • collaboration between all actors in health care • efficient and safe electronic communication between all actors in health care • high-quality electronic patient files, across specialties • care pathways • optimised administrative processes • technical and semantic interoperability • guarantees concerning • information security • privacy protection • respect for the professional secrecy of health care providers

4. Overall objectives of the eHealth platform • how? • through a well-organised, mutual electronic service and information exchange between all actors in health care • by providing the necessary guarantees with regard to information security, privacy protection and professional secrecy • what? • optimisation of health care quality and continuity • optimisation of patient safety • reduction of administrative burden for all actors in health care • thorough support of health care policy and research

5. eHealth platform In practice Administrative advantages The patient consults his doctor Possibility to register therapeutic relationships and informed consent

6. eHealth platform In practice Online advice and guidelines Look up medical history through the SumEHR Medical advantages Electronic prescriptions Medication schedule Laboratory results Electronic medical referral form

7. eHealth platform In practice Registrations Tarification, billing Adminis-trative advantages Create and send certificates Update SumEHR, medication schedule, ... Send a report to the GMF owner

8. Health portal AVS AVS AVS AVS Basic architecture Patients, health care providers and health care institutions Software health care provider Software health care institution AVS AVS Site NIHDI AVS AVS Overall objectives of the eHealth platform MyCareNet AVS AVS AVS AVS AVS AVS AVS AVS AVS AVS AVS AVS Users Basic services eHealth platform Network VAS VAS VAS VAS VAS VAS Suppliers

9. 10 basic services • integrated user and access management • orchestration of electronic subprocesses • portal environment (https://www.ehealth.fgov.be) • logging management • system for end-to-end encryption • personal electronic mailbox for each health care provider (eHealthBox) • timestamping • coding and anonymisation • consultation of the National Register and of the Crossroads Bank Registers • reference directory (metahub)

10. 10 basic services 6.1. integrated user and access management: makes it possible to guarantee that only authorised health care providers/ health care institutions have access to personal data to which they are authorised to have access • access rules are defined by, among other things, the law and authorisations issued by the Health Section of the Sectoral Committee (established within the Privacy Commission) • each application defines its own access rules • when a user authenticates his identity (using the electronic identity card or token), the generic verification model of the tool is set in motion: it consults the rules established for the application, verifies if the user does indeed meet these rules and accordingly grants or restricts access to the application

11. identification and authentication of physical and legal persons management & verification of characteristics (e.a. a capacity, a function, professional qualification) of persons management & verification of mandates between physical or legal persons management & verification of authorisations Integrated user and access management

12. Integrated user and access management Electronic identity card (eID): statutory electronic identity card for Belgians over the age of twelve Kids-ID: on demand for children below the age of twelve Foreigners card: for both EU and non-EU citizens with residence in Belgium

13. Electronic identity card (eID) read data + authenticateidentity digital signatures

14. Electronic identity card (eID) 1. Install eID software 2. Connect the card reader with the computer 3. Consult your data

15. Integrated user and access management

16. 10 basic services 6.2. orchestration of electronic subprocesses: allows for the flexible and harmonious integration of the different processes that are linked to the implementation of several basic services into one, single application 6.3. portal environment: a web window offering a variety of online services to health care actors in order to help them provide the best possible health care; the portal environment provides all useful information on the services that are offered by the eHealth platform, its tasks, its standards, etc. It contains, among other things, the documents users need to configure the right settings in order for them to have access to the available online services

17. 10 basic services 6.4. logging management: management of a register of access to the information management system: all read, write and delete accesses are registered and have probative value in case of a complaint 6.5. system for end-to-end encryption: transfer of complete and unmodified data from one point to another by making them indecipherable (encryption), provided that these data have not been decrypted with a key Two methods: • In the case of a known recipient: use of an asymmetric encryption system (2 keys) • In the case of an unknown recipient: use of symmetric encryption (the information is encrypted and stored outside the eHealth platform; the decryption key can only be obtained through the eHealth platform)

18. 10 basic services 6.6. timestamping:makes it possible to assign a time and date, accurate to the second, to a health care document and thereby makes it possible to permanently ensure the validity of its content by appending an eHealth signature 6.7. coding and anonymisation: makes it possible to hide the identity of individuals behind a code, so that the useful data of these individuals can be used without infringing on their privacy + makes data anonymisation possible by replacing patients’ detailed characteristics with generalised characteristics. These encoded or anonymised data preserve their usefulness, but without allowing the direct or indirect identification of the person

19. 10 basic services 6.8. consultation of the National Register and Crossroads Bank Registers: authorised health care actors access the National Register and the Crossroads Bank Registers under strict conditions 6.9. eHealthBox: a secured electronic mailbox for the exchange of medical data 6.10. reference directory: indicates which types of data are stored, by which health care actors and for which patients, with the consent of said patients

20. Value-added services 65 value-added services in production • 40 value-added services under study Some examples of value-addedservices: • registration in and consultation of the Cancer registry, the registry of hip and knee prostheses (Orthopride), the registries of care provided for heart implants (Qermid), the shared electronic arthritis file, including electronic processes for the reimbursement of anti-TNF medication (Safe) • PROCARE RX allows radiologists to upload and send anonymous X-rays and information to experts for review or a second opinion • reports on MUG interventions • Resident Assessment Instrument (BelRAI) • electronic medical card for people without documents (eCarmed) • consultation of living wills regarding euthanasia • electronic registration and consultation of the medical evaluation of disabled people • electronic birth registration – eBirth

21. Cornerstone: Multidisciplinary data sharing • data transmission • snapshot of the data • sender chooses recipient • sender is responsible for sending the data only to recipients who are entitled to have access to these data • data sharing • evolutive data • the source does not know in advance who will consult the data (e.g. on-call GP) • necessity of clarifying which people are entitled to have access to the data

22. Data transfer:eHealthBox: • sending of messages to "actors in health care" • based on • national Register number • NIHDI number • CBE number • through web application or integrated into the medical file • with (or without) encryption based on eHealth certificates/ eHealth keys • other functionalities • receipt, publication and reading confirmation • reply & forward • check multiple mailboxes • priority level • auto delete • an average of 1.6 million messages sent per month to the eHealthBox (multiple recipients) • an average of 2.4 million messages downloaded per month through the eHealthBox

23. Multidisciplinary data sharing • data from hospitals • sharing of documents between hospitals and doctors • “hubs and metahub system” • extramural data • sharing of structured data between first-line health care providers and other extramural health care providers • “extramural vaults” • coupled and interoperable • standards • informed consent • therapeutic relationship/ health care relationship

24. Hubs & Metahub system: Creation of the "hubs" 5 hubs 3 technical implementations 98 % of Belgian hospitals (have signed the 2012 protocol)

25. Hub-metahub: currently

26. Hub-metahub: in future 3. Retrieve data from hub A A 1: Where can we find data? 2: In hub A and C 4:All data available 3: Retrieve data from hub C C B

27. Extramural data 1/2 • supporting the development of data exchange platforms for all sorts of extramural health care providers (GPs, dentists, pharmacists, physiotherapists, home nurses, dietitians, psychologists, ...) • in cooperation with Communities (first-line health care conference in Flanders, the Intermed initiative in Wallonia) • for the disclosure of data via the hub/metahub system between local information systems of extramural health care providers and between these systems and the information systems of health care/welfare organizations • for the interaction with extramural vaults awaiting development • by reusing the basic services of the eHealth platform and by making use of several achievements of the developed data sharing platform between hospitals and GPs/doctors

28. Extramural data 2/2 A Inter-Med C B

29. Data sharing • Each actor keeps their own file up to date • However, they can decide to share parts of the file with other actors • Examples: • medication schedule • SUMEHR • parameters • journal • …

30. Vault Governance Archiving Management Vault core • Access for health care providers • having a "health care relationship" • depending on their role • No access for • IT administrators, hoster,.. • eHealth platform • authorities • without the active cooperation of the owner of the 2nd key Vault data Authentication ... Authorisation 1. 2 Treshold decryptie Trusted 3rd party Vault connector Data quality Encryption Decryption Authentication

31. Informed consent & therapeutic relationship • content of informed consent • for registration in the reference directory (as required by the eHealth law) • for the electronic exchange of health data between health care providers within the framework of patient health care, as long as the following conditions are met: • approval by the Sectoral Committee • therapeutic relationship required • only relevant data • the patient decides, in consultation with the health care provider, which data will be shared • health care providers may be excluded by name • possibility of a posteriori verification of the granted access • consent may be revoked at any given time

32. Informed consent & therapeutic relationship • registration of informed consent • patient is informed about the system • specific procedure approved by the Board of Directors and the Sectoral Committee • consent can be registered through eHealth consent • either by the concerned person themselves • or by a doctor, a pharmacist, a hospital or a health insurance fund • https://www.ehealth.fgov.be/fr/prestataires-de-soins/services-en-ligne/ehealthconsent • therapeutic relationship • only health care providers who have a therapeutic relationship with the patient (1) can access the information they need to perform their task (2) • (1) proof of therapeutic relationship determines which patient the health care provider has access to • (2) role determines which type of data the health care provider has access to

33. Health care computerizationPlan 2013-2018 / Overview • at the end of 2012, organization of a Round table regarding the development of health care computerisation • participation of about 300 people from the sector • tangible, 5-year action plan for eHealth established – Roadmap • the action plan is based on 5 pillars: • to develop data exchange by health care providers on the basis of a joint architecture • to increase patient awareness of eHealth • to develop a reference terminology • to achieve administrative simplification and efficiency • to implement a flexible and transparent governance structure in which all competent authorities and stakeholders are involved • this action plan constitutes a clear framework for 20 concrete and measurable objectives for the next five years

34. THANK YOU!Questions? Frank.Robben@ehealth.fgov.be @FrRobben https://www.ehealth.fgov.be http://www.ksz.fgov.be/ http://www.frankrobben.be