FHA AHCA Harris Meeting FHA – AHCA – Harris Meeting August 23, 2012. Harris Capabilities Briefing ... IOS HISP Secure Internet (SMTP w/SMIME) Lab, HIE or EHR System . Harris Capabilities

Harris Capabilities Briefing

Slide 1 of 14 HARRIS PROPRIETARY INFORMATION

9/20/10 1

Florida Health Information Exchange Status

FHA – AHCA – Harris Meeting

August 23, 2012



9/20/10 2

Agenda

Florida HIE Overview

Technical Implementation

Security Implementation

HIE Policy

Adoption

Sustainability



9/20/10 3


Janet Hofmeister



9/20/10 4

• Florida wins Florida Health Information Network Grant

•Health Information Exchange Coordinating Committee convened 2004

• Florida applies for ONC State Health Information Exchange Grant

•Concept of governance by Not-for-Profit

•No organizations identified 2009

•AHCA awarded HIE Cooperative Agreement Program Award in March

• Legislature directs issuance of Invitation to Negotiate (ITN) by July

•Harris awarded four-year, $19 million contract in November 2010

•Contract signed in February

•Direct Secure Messaging Deployed in July

•Patient Lookup Group 1 testing completed in December 2011

• Strategic Health Intelligence goes live!

• PLU Groups 2 & 3 selected; Group 4 applications received (Aug)

• Outreach Contracts selected 2012

History of the Florida HIE



9/20/10 5

Contractual Requirements and Status

Major Contractual

Requirements Status

Develop Direct Secure

Messaging

Complete – last enhancements to be deployed in

September

Develop Patient Lookup

Services

Complete – final gateway of gateways upgrade ready in

September

Create and implement DSM

adoption program

Complete – Plan in place and adoption efforts ongoing,

including DoH, Lab, Pharmacies, Payer & EHR vendor

outreach

Deploy up to 20 PLU nodes Ongoing – 12 adopters selected; 1 site is live and other

11 are working towards complete deployment;

Group 4 applications received; Group 5 deadline is 12/1

Connect to NwHIN In progress – Evaluating partners

Create Sustainment Plan Complete – Plan developed

Distribute Outreach Funding In progress – Awardees selected and contracts being

executed



9/20/10 6

Exchanging health information from the Florida Panhandle to the Keys

• Connects provider networks including:

• Physicians

• Hospitals

• Regional Health Information Organizations

• State Government Agencies

• Others as Healthcare evolves (i.e., ACOs., etc)

• Provides timely, secure, authorized exchange of

patient health information for treatment

• A network of networks:

• Open-source, standards-based

• Leverages existing local HIE networks to connect Florida’s

healthcare providers

• Consists of two major services:

• Direct Secure Messaging (DSM)

• Patient Lookup (PLU)




9/20/10 7

• Patients, Caregivers, Consumers

• Providers - Doctors, Nurses, Physician Assistants,

Nurse Practitioners and others

• Regional Extension Centers (RECs)

• Hospitals, Clinics, Physicians’ Groups

(Public and Private)

• Regional Health Information Organizations (RHIOs)

• Health Information Exchanges (HIEs)

• Integrated Delivery Networks (IDNs)

• Independent Practice Associations (IPAs)

• Long-Term Care and Mental Health Facilities

• Department of Health & County Health Departments

• State Immunization Records (Florida SHOTS)

• Federally Qualified Health Centers (FQHCs)

• National, independent, state labs

• E-Prescription Networks

Florida Stakeholders



9/20/10 8

Florida HIE Technical

Implementation

Chris Phillips



9/20/10 9

Direct Secure Messaging (DSM) is a secure e-mail system that allows participants to push encrypted health information to other participants and to respond to requests for information • Conforms to DIRECT Standards

• For Treatment, Payment and Healthcare Operations

• Content agnostic

Patient Look-Up (PLU) allows clinicians to query for and pull patient records from other participating nodes on the statewide network • Conforms to CONNECT Standards

• For TREATMENT purposes only

• Patient authorization is required

• Exchange is via the CCD

Florida HIE Services



9/20/10 10

Florida HIE Federated Data Services

Patient Look-Up (Query/Pull) • Completely federated

• No central Clinical Data Repository (CDR) exists at the Florida HIE Level • All data resides locally

• The Florida HIE is a conduit to share information between end-points who retain control of the data

Direct Secure Messaging (Push) • Has centralized exchange server

• Supports HISP to HISP connectivity



9/20/10 11

Patient Look-Up Use Cases

Providers can perform targeted queries and retrieve a patient’s health records in CCD/C32 format

• Enables reduction of duplicative tests and adverse drug interactions

• Improves the timeliness and quality of care

In Emergency Room – make a broadcast query to access an unresponsive patient’s health records in seconds

• Providers can make more informed and timely decisions about patient care and treatment – which is imperative during an emergency

Back at the PCP, patient records from the ER visit can be retrieved

• Primary care physician can provide better follow-up care after the emergency is over potentially reducing unnecessary ER visits



9/20/10 12

Patient Look-up Functional Architecture

Hospital HIE

Health Choice

Networks

INFRASTRUCTURE

Nationwide Health Information Network (NwHIN)

INTERNET

Others

FQHC Local Lab

FQHC

Community HIE

DSM

FQHC

Hospital HIE

Free Standing Hospital



9/20/10 13

HIE

Patient Look-up Technical Architecture

EXPRESS EXPRESS LITE

INFRASTRUCTURE

Service

Registry Certificates

Terminology

Translation

P2PDirect Provider

Directory

Integration

Engine

DOCUMENT

GENERATION

Integration Engine

DOCUMENT GENERATION

Registry &

Terminology Registry &

Terminology MPI/RLS

EHR

CONNECT

Gateway CONNECT

Gateway

Published Messaging and

Authorization Specification

PATIENT LOOKUP

DOC SUBMISSION

LARGE FILE TRANSFER

NwHIN

Connection Privacy

Reports

Audit Log

PACS EHR

Clinical Data

Repository

MPI/RLS Clinical

Data Repository



9/20/10 14

Use Cases for DSM

Primary care provider refers patient to specialist including summary care record

Primary care provider refers patient to hospital including summary care record

Specialist sends summary care information back to referring provider

Hospital sends discharge information to referring provider

Laboratory sends lab results to ordering provider

Transaction sender receives delivery receipt



9/20/10 15

DSM Functional Architecture

DSM Web Based

(HISP)

INDEPENDENT

PHYSICIANS

Secure Internet Web-Client Access

PHYSICIANS

GROUP HOSPITALS

Quest Diagnostics

HISP

Alabama HISP

IOS HISP

Secure Internet (SMTP w/SMIME)

Lab, HIE or EHR System



9/20/10 16

DSM Technical Architecture

LDAP

Exchange Server (Apache James)

E-mail Web Client (Squirrel Mail)

Mail

Provider Directory

DOH Provider License Status

File

Florida HIE Web Page

(Account Mgmt System)

CMS NPPES Licensed Providers Direct

Address Book

Mail • Open source

• Security Certificate

• Thorough vetting uses multiple data

sources



9/20/10 17

Integration between Systems and DSM

Automatic interfaces to healthcare systems, EHRs (Inbox or clinical content)

Reliable delivery notifications

Interface & specifications available October 2012

Using SMTP/POP3 or XD*

Systems or EHRs must develop their own interface to meet specifications



9/20/10 18

Florida HIE Security

Implementation

Andre Hebert



9/20/10 19

Florida HIE Security and Privacy Principles

Secure, encrypted transmission, centralized audit reports, alerts, and HIPAA compliance

Protect patient privacy and consent through Subscription Agreement policies

Support various policy frameworks that might be implemented within the Edge Systems

PLU participant organizations are vetted based on the thoroughness of their privacy and security policies (among other criteria)

DSM registrants undergo one of the most comprehensive identity validation process currently in production, compared to similar systems nationwide



9/20/10 20

Security Controls:

Florida HIE Data Center Overview

Layered Security Architecture

DSM

CONNECT Gateway



9/20/10 21

DSM

CONNECT Gateway

Security Controls:

Data Center Physical Security Layer

• Warning signs

• Security guards

• Locked gates and doors

• Locked cabinets and racks

• Electronic badges

• Closed circuit television

cameras

• Alarm systems

• Raised flooring (water

damage protection)



9/20/10 22

DSM

CONNECT Gateway

Security Controls:

Network/Infrastructure Security Layer

• TLS – Data Encryption

(RSA- 2048-bit)

• Firewalls - DMZ

• IDS/IPS

• HTTPS Reverse Proxy

• Anti Virus Protection

• Access Control Procedures

• System Monitoring

• Limited Remote Access

• Data Backups



9/20/10 23

DSM

CONNECT Gateway

Security Controls:

Application Security Layer

• Account Registration

• User Authentication

• Role Based Access Control

• Data Segregation

• Data Encryption (at rest)

• Vulnerability Mgmt

• Audit Logging

• Account Locking

• Inactivity Timeouts



9/20/10 24

Security Controls:

Supporting Network Security Processes

Security across entire system development lifecycle • Design • Development • Test

• Staging • Deployment

Change control and configuration management • Configuration Control Board (CCB)

• Comprehensive CM approach with integrated Microsoft TFS IDE

Security and program risk management • Security risk plan and assessment

• HIPAA Compliant

Personnel training • Operational system and architecture

• HIPAA/HITECH and legal

Operational procedures • Account management • Remote access process • System maintenance

• Disaster recovery • Security incident process • Help Desk processes



9/20/10 25

Vetting for DSM Participation

On-line self registration: • Only certain types of organizations allowed to register

• Based on taxonomy code listed in NPPES database

• Registrant is authenticated to validate that they are who they say they are • Access to FAX machine listed in NPPES database

• Valid and active Florida license verified for individuals and organizations • License number listed in NPPES database

• Validated against the Florida Department of Health (DOH) database (on-line) and AHCA facility license database (off-line)

• Individuals are authenticated by the organization they are affiliated with • Organization Point of Contact (POC) must approve individual accounts

Group registration: • Manual vetting of organization and organization POC by AHCA

• AHCA or Florida DOH licensed facility – clear and active

• Provider, State Agency, Plans/Payers POCs are validated via personal inspection of credentials and third party database

• Plans/Payers are also validated that they are licensed in Florida or participating in Florida Medicaid

• Organization POC responsible for vetting individuals within their organization per NIST Level 3 guidelines



9/20/10 26

Florida HIE Policy

Carolyn Turner



9/20/10 27

Consent Models

DSM is Delegated Model

• Responsibility of Exchanging Parties

• DSM Content Anonymous to System

• Use Determined by Exchanging Parties

• Limited Authorization Form may be used

PLU is Consent to Access Model

• Patient Authorization Required • Must use Florida Form or legal equivalent

• Provider retains document

• Authorization is universal for named provider

• Break the Glass Permitted

• PLU Organizations Must Audit Patient Authorization

• PLU Organizations Must Share Audit Plans

• Patients May Restrict Access per HIPAA (not available for PLU)

• Re-Disclosure Notice (42 CFR Part 2) Required at each Access of PLU



9/20/10 28

Permitted Uses of Service

Patient Look-Up

• Treatment

• Health Care Operations as Authorized by Patient

• Public Health

• Disability Determinations

Direct Secure Messaging

• Treatment

• Payment

• Health Care Operations

• Public Health

• Meaningful Use Reporting

• HIPAA Authorization Required Purposes - Research



9/20/10 29

Who Can Join Each Service

Patient Look-Up: Providers

• Hospitals and Hospital Systems

• Regional Health Information Organizations

• Health Information Exchanges

• Health Care Clinic Systems

Direct Secure Messaging: Providers, Payers and State Agencies

• Providers include hospitals, physicians, ambulatory facilities, pharmacies, home

health agencies, community mental health, nursing homes, hospices, clinical labs

• Payers include commercial insurers, Medicaid health plans, Medicare Advantage,

Healthy Kids, third-party administrators

• State Agencies include AHCA, DCF, DOEA, APD, and DOH and others authorizing

employees who exchange Protected Health Information (PHI) with health care

providers and health plans



9/20/10 30

Florida HIE Adoption

Evan Carter



9/20/10 31

PLU Adoption/Current Participants

Current PLU nodes

Organization Members Region

Atlantic Coast HIE Memorial Healthcare System Miami-Dade/Broward

Big Bend RHIO TMH, CRMC Leon & surrounding counties

Community Health Centers Alliance FQHCs Statewide

Florida Department of Health County Health Departments Statewide

Florida Hospital - Adventist Florida Hospital Facilities Central Florida

Health Management Associates HMA Facilities Statewide

IOS Health Systems Ambulatory EHR providers Statewide/South Florida

Kindred Healthcare Long-term care facilities Statewide

Orlando Health Orlando Health Facilities Central Florida

UF&Shands Shands Gainesville & Jacksonville North Florida

South Florida HIE FQHCs Statewide/South Florida

Strategic Health Intelligence Baptist, Sacred Heart Hospitals Escambia & surrounding counties



9/20/10 32

PLU Adoption/Current Participants



9/20/10 33

PLU Application/Onboarding Process

PLU Readiness Questionnaire and/or Self-Onboarder Checklist

available online or from Florida HIE adoption staff

Questionnaires can be submitted at any time

Onboarders are selected quarterly from available applicant pool

• Selections based on quantitative scoring for organization’s technical readiness,

size, privacy & security policies, and location

12 current onboarders have been selected in 3 different groups

Group 4 selection process underway

• 5 new applications received

Group 5 selection process will occur in December, 2012

• 3 to 4 applicants to be selected

• Group 5 will likely be the last group of onboarders selected that will receive free

technical assistance from Harris Corp.



9/20/10 34

PLU Application Types

Technical Assistance

Facilitated Registration (3 to 4 spots left)

Self-Onboarder (unlimited)

Software Package

Full Express Organization requires: • New MPI & RLS • Harris technical assistance for onboarding

Organization requires: • New MPI & RLS Organization will receive software package from Harris Corp. and follow instructional documentation to complete onboarding

Express Lite Organization requires: • Harris technical assistance for onboarding

Organization already has an internal MPI & RLS to be integrated with the Florida HIE

Organization already has an internal MPI & RLS to be integrated with the Florida HIE Organization will receive software package from Harris Corp. and follow instructional documentation to complete onboarding



9/20/10 35

DSM Registration Process



9/20/10 36

DSM Current Statistics

• All statistics through July, 2012

• Goal for end of 2012 is 1,000 registered accounts



9/20/10 37

Outreach Sub-Contracts

Total funding: $1.9M

Awarded to participating entities to develop the software interfaces or

other software necessary to develop downstream connections to

underserved entities and expand health care provider access to the state-

level HIE network for Patient Look-Up (PLU); and/or to assist participating

entities in deploying HIE, including Direct Secure Messaging (DSM)

services to underserved entities through outreach, technical assistance,

and provider training.

• Strategic Health Intelligence (SHI): $900,000

• Community Health Centers Alliance (CHCA): $500,000

• Health Management Association (HMA): $250,000

• South Florida Regional Extension Center (SFREC): $250,000



9/20/10 38

Florida HIE Sustainability

Janet Hofmeister



9/20/10 39

Value Proposition and ROI Tools

• Paper developed jointly by AHCA and Harris, also incorporating research done by the Center for

Information Technology Leadership (CITL) and tools first developed by the Iowa Office of Health

Information Technology (eHealth)

• Covers topics of:

• Services of the FL HIE

• Flexibility offered by the two services

• Methods of connection

• Retention of control of data by the providers

• Proposed costs for both PLU and DSM

• Methods employed to mitigate risk

• Strategy for outreach and adoption

• CITL basis for determining network value

• Return on Investment (ROI) model published by Iowa eHealth

• ROI Worksheets

• The following slides show the ROI calculation worksheets and put the value of the HIE into practical

terms



9/20/10 40

Calculation of Return on Investment

• Included in the paper is a set of calculations around different costs that are

incurred by facilities from a sole practice to a large hospital system

• While it is easy to view ROI in terms of dollars and cents, we must always

remember that the true return is in improved care to the patient. Some of

these may include:

• Avoidance of drug interactions or allergies

• Convenience for the patient to have their records available when

needed

• Ease to an ill person of not having to do duplicative tests

• More timely care, less delay in diagnosis and onset of treatment

• Possible life saving treatment for an unresponsive patient

• We encourage both current and potential DSM and PLU to use these charts

to determine the costs to their organizations and what could be saved

should the FL HIE be implemented



9/20/10 41

EHR Interface Savings Calculator

• We provide an HIE for connecting

disparate systems

• By establishing one connection to

the FL HIE, providers can be

connected to many of their

partners at once

• This would eliminate the fee ($5K -

$40K) that is generally charged by the

EHR vendors to establish an interface

with each data trading partner

• PLU can connect to treating

partners such as hospitals,

physicians, & county health depts.

• DSM offers a means to obtain

structured data from labs and

others

Number of hospitals communicate

with:

Number of physician offices or

clinics communicate with: +

Number of laboratories

communicate with: +

Number of pharmacies

communicate with: +

Number of home health agencies

communicate with: +

Number of long-term care settings

communicate with: +

Total number of connections:

Average annual interface cost from

EHR vendor: X $

Cost without HIE: $

Annual cost of HIE: - $

Cost saving: $



9/20/10 42

Savings from Reduced Use of Paper Records

• Reduced expenditures required to

support a paper-based system,

including:

• paper supplies

• filing systems

• dedicated office space required to

store paper charts or reports

• HealthBridge, based in Cincinnati,

estimated a savings of $0.41 per

report with the elimination of

paper delivery of reports

• HealthBridge,

http://www.healthbridge.org

Square footage for record storage:

Rent per square foot: X $

Annual rent for record storage: $

Percent reduction in volume of paper

records after implementation: X

Annual storage cost savings: $

Number of reports per year:

Savings per report (costs of postage,

paper, printers and personnel, based

on detailed time and material

studies):

X $0.41

Annual delivery cost savings: $



9/20/10 43

Savings from using Electronic Patient Charts

Number of chart pulls each day:

Minutes spent per chart: X

Minutes spent pulling charts

each day:

Number of work days per year

(e.g. 250): X

Minutes pulling charts each

year:

Reduction in chart pulls or based

on post implementation study of

practice/facility:

X 35%

Time savings due to HIE

implementation (minutes):

Divide by 60 to determine time

savings in hours: ÷ 60

Time savings due to HIE

(hours):

Average hourly administrative rate: X $

Annual cost saving potential: $

• An alternative way to request and view

patient charts

• For example, providers can query the HIE to

view a patient’s Continuity of Care Document

(CCD) or send the CCD using DSM rather

than having to make a phone call to another

provider and request the patient chart be

pulled and sent via fax

• Journal of Healthcare Information Technology

estimates a 35% reduction in chart pulls in the

first year after EHR implementation (2006

article)

• George Washington University Medical

Faculty Associates estimated a first year

savings of $81,551 after factoring in staff time

for each chart pull

• Reference: Stephen Badger, Journal of

Healthcare Information Technology, Vol

19, No 2, 2006



9/20/10 44

Savings from using HIE instead of FAX

• Enables an alternative form of secure

communication between providers

using DSM or PLU

• Early results of University of Iowa

– Broadlawns Hospital HIE pilot

show the potential for a 40%

reduction in the amount of time

needed to process faxed health

information (e.g., average

handling time was reduced from

10 minutes to 6 minutes).

• Reference: University of Iowa

Hospitals and Clinics, email message

to Iowa e-Health, March 3, 2011

Items faxed per day, pre-

implementation:

Work days per year (e.g. 250): X

Items faxed annually:

Time to process each fax (in

minutes): X

Divide by 60 to determine time

spent processing faxes in hours: ÷ 60

Hours spent processing faxes

each year:

Reduction in time spent processing

faxes or based on post-

implementation study at facility,

health plan or practice:

X 40%

Hours saved from DSM and/or

PLU:

Average hourly administrative rate: X $

Annual cost saving: $



9/20/10 45

Savings from Reduced Readmissions

• We provide access to continuity of

care documents (CCD) and

hospital discharge summaries to

primary care providers through

PLU or DSM

• Recent study in Connecticut

estimates a 25% reduction in

potentially preventable

readmissions due to the

availability and use of an HIE

Number of admissions annually:

Percent of admissions that are

Potentially Preventable Readmissions

(PPRs):

X

Number of annual PPRs:

Percent reduction of PPRs due to HIE:

*Adjust for local DSM/PLU uptake:

Low, use 0-10%

Medium, use 10-20%

High, use 20-25%

X 25%*

Cost of an admission: X $

Cost savings potential $

Percent uncompensated care: X

Uncompensated cost saving: $



9/20/10 46

Savings from Reduced Emergency Room

Visits

• Access to continuity of care documents (CCD)

through use of PLU or DSM for referrals to

medical homes

• Boston Consulting Group estimated that

13% of repeat ED visits were potentially

avoidable

• The Wisconsin-Institutes for Discovery

reported a benefit to providers as well as

payers due to reduced expenditures on

Medicare and Medicaid patients that are

not fully compensated

• References:

• Boston Consulting Group, Rhode Island

Quality Institute: Business case for Health

Information Exchange, 2008.

• Srikrishna Sridhar, et. al., Optimizing

financial effects of HIE: a multi-party linear

programming approach, American Medical

Informatics Association, 2012.

Number of ED visits annually:

Percent of ED visits that are repeated: X

Number of repeat ED visits:

Percent reduction of repeat ED visits due to HIE: *Adjust for local DSM/PLU uptake:

Low, use 0-5% Medium, use 5-10% High, use 10-13%

X 13%*

Cost of an ED visit X $

Cost saving potential: $

Percent uncompensated care: X

Uncompensated cost saving: $



9/20/10 47

Expected Sustainment Costs

Total Estimated Sustainment Costs: $2,321,660

• Personnel - Technical (Tier 2 & 3), Management, Administration, Legal, Website

support, documentation updates

• Overhead - Office space, utilities, etc.

• Hardware - Computing, networks, security

• Software - License, maintenance, and certificate fees

• Training/Helpdesk - Tier 1 support, document and knowledge base updates

• Accreditation/Certification - Personnel HIPAA certifications

• Outreach and Technical Development - New capability implementation;

business outreach



9/20/10 48

How much will it cost and who will pay



9/20/10 49

Allocation of the costs



9/20/10 50

Questions?

For additional information please visit:

www.florida-hie.net

FHA AHCA Harris Meeting FHA – AHCA – Harris Meeting August 23, 2012. Harris Capabilities Briefing ... IOS HISP Secure Internet (SMTP w/SMIME) Lab, HIE or EHR System . Harris Capabilities

Documents