Open Questions Tracker for Pilots

OPEN QUESTIONS TRACKER (For Pilots)

• Each Pilot team will use the table below to track open questions with community-wide implications.
• Will be discussed on the weekly Implementation Geographies call and referred to individuals and workgroups as appropriate.

#	Date Opened	Initiator	Question	Implication	Priority	Status	Resolution	Date Resolved
1A	2010-09-14	RIQI	How should certificate duplication be handled?	What if senders/receivers have multiple certificates issued by multiple HISPs/CAs? How do you establish identify/trust across HISPs?		Transferred to WG [2010-09-15]	Refer to Best Practice Workgroup for policy decision. Pat Pyette (Inpriva) also working on a proposed process/architecture that will be reviewed by workgroup(s)	2010-09-15
1B	2010-09-30	RIQI	How should certificate expiration be handled?	When sending an NHIN Direct message, if a certificate has expired, how is trust re-established? Can it be done transparently? (split from issue 1A to enable easier tracking)		Transferred to WG [2010-09-15]	Refer to Best Practice Workgroup for policy decision. Refer to Reference Implementation team to determine if this functionality is already planned/implemented. Pat Pyette (Inpriva) also working on a proposed process/architecture that will be reviewed	2010-09-15
2	2010-09-14	RIQI	What do the prototypes for client (EHR) APIs look like?	While the backends are not yet complete, how should EHR vendors involved in the Pilot determine what to code against for their system changes?		Transferred to WG [2010-09-15]	Owned by Reference Implementation team. Have a subteam stub out the API	2010-09-15
3	2010-09-14	RIQI	Is there guaranteed delivery for NHIN Direct messages?	What happens if one link in an NHIN Direct chain is broken? If the HISP is down? If there is an undefined error? How does the sender know that their message was/not received? Likely includes delivery acknowledgement, and notification of delay and/or failure		Transferred to Individual (Arien) [2010-09-15]	Yes. Have a proposal that needs to be documented. Owned by Arien for time being. Pat Pyette (Inpriva) also working on a proposed process/architecture that will be reviewed by workgroup(s)	2010-09-15
4	2010-09-20	Kim Long (MedPlus / Quest Diagnostics)	Is there a specific domain naming convention that should be used for the user's NHIN Direct address?	How will an NHIN Direct address be differentiated from a regular email address? Do we want a consistent standard that is easily recognizable such as [[1]] or [[2]]? Does having "nhin" in the address represent a security risk? It directly implies that PHI is included in any intercepted message
5	2010-09-20	David Tao	Please look at what's been written	Let's not start from scratch just because this is a new group. The Documentation WG started a document on this subject, had a few calls already, and even issued a call for consensus on the document as it currently stands. I suggest reviewing [3] and amending or adding to that.
6	2010-09-22	Paul Tuten	Questions related to HISPs	Need for practice standards and/or certification of HISPs? operating procedures/limitations/requirements placed on HISPs? Must HISPs issue/manage certs? Audit / log requirements? Limit(s) on storing/hosting/forwarding exchanged data; under what conditions
7	2010-09-22	Paul Tuten	Questions related to certificates	Issued at organizational vs. individual level? how is identity verification handled? what about allied health professionals? what about directed exchange to patients? Who should be the issuing authority? What sort of chain of trust must be established (i.e., should there be a uniform signing authority)?
8	2010-09-22	Paul Tuten	Questions related to NHIN Direct addressing conventions/usage	Should there be standard convention (e.g., @nhindirect.provider.com)? should organizations use unique domains or would a shared domain (e.g., @myfreenhindirect.com) be acceptable? Can the same NHIN Direct address be used to receive messages from multiple clients? For example, if a provider has an NHIN DIrect address that they use with with their EHR system could they also use the same address to get their NHIN Direct messages from home using an email client? If they can, should the messages be available to each client or once they are retrieved by one client they are no longer available for other clients?
9	2010-09-22	Paul Tuten	Questions related to provider directories	Should there be a centralized provider directory? distributed at the HISPs? Is this (should it be) required or optional? (Note that there is national discussion and a public call for comment on the ONC FACA Blog: [4] and a hearing on September 30th).
10	2010-09-22	Parag More (MedAllies)	Question regarding XDR vs XDD & timeline implications	For the pilot with expected timelines please confirm whether pure XDR (as-is) considered as compliant especially since the XDD specification is in development and may take time to be formalized (/accepted). What are the next steps on XDD specifications and timelines associated with the same.
11	2010-09-22	Will Ross (Redwood MedNet)	Question about legal participation agreement for NHIN Direct users	How to minimize the proliferation of disparate solutions to participation agreements so there is a harmonized approach to risk mitigation and contractual obligations among HISPs.
12	2010-09-22	Mark Stine (MedPlus/Quest Diagnostics)	Questions related to message content	Should there be any limitations on attachment types (e.g. .exe files) to a message? If so, should the HISP enforce these restrictions or client? Should there be a limit on number of attachments or a maximum message size? If so, should the HISP enforce these restrictions or client? Is there a need for virus scans against messages/attachments? If so, should the HISP perform this function?
13	2010-09-29	RIQI	What information can/should be stored on the HISP for logging or auditing purposes?	What are the limitations on storage of data on the HISP? User mailboxes Transaction log Short term store - to enable "retry" of delivery when initial try fails Longer term store - as a value added service for reporting, record keeping, etc...
14	2010-11-23	Kim Long/Mark Stine (MedPlus/ Quest Diagnostics)	HISP Error Handling	Similar to # 13 above but taking it one step further: We need a best practice for handling Direct addresses that are not valid or for some reason are unable to be delivered and the handling of errors by the HISPs. In other words, the message gets sent but for some reason is never delivered to the Inbox on the other end. How is the user who sent this message supposed to know this and have the opportunity to resend the information? In a referral situation, the receiving person might call. However, in a lab result to ordering provider situation, the only way we will know is if the provider calls us (usually angry/upset at this point) because his result has not arrived.