Project Brief - MEDfx
Overview
- Certificate Authority
- Create two classes of certificates which must be ITU-T X.509v3 conforming: Trust Anchor Certificates and Provider Endpoint certificates.
- Trust Anchors - Trust Anchor certificates identify communities or circles of trust and are held and used to sign subordinate certificates. The collection of certificates signed by a Trust Anchor Certificate and the Trust Anchor Certificate itself define a circle of trust with respect to the Direct Project.
- Provider Certificates - Each provider or provider organization will require a single certificate or pair of certificates which uniquely identifies that provider or provider organization by address. Unique certificates will be required for sending and receiving information. All addresses are composed according to the Direct Addressing Specification. These certificates will be signed by the Trust Anchor Certificate for the circle of trust to which the provider certificate belongs. The trust anchor certificate will be held by the Certificate Authority and used to verify the association between the Trust Anchor and the Provider by means of a digital signature.
- Provider Registry - Create a registry service which allows authorized provider lookup. Possible approaches are:
- The Pilot should demonstrate integration of the Provider Registry with the Lifescape Portal or Non-Lifescape Portal solution to locate exchange end points.
- Create two classes of certificates which must be ITU-T X.509v3 conforming: Trust Anchor Certificates and Provider Endpoint certificates.
User Story
Dominion Medical Associates is an independent, minority physician practice located in Richmond, Virginia. Approaching its 100-year anniversary, thousands of patients have been served by the practice’s physicians. Dominion Medical has traditionally been a paper-based practice but is in the process of moving toward use of an EMR. As part of this process, CenVaNet and MedVirginia are working with the practice to help in its achievement of recognition as a Level 3 NCQA Patient Centered Medical Home (PCMH).
As part of the PCMH initiative, CenVaNet is providing care management services for several identified chronic diseases populations, the first of which is diabetes. The workflow process to identify and refer the appropriate patients to CenVaNet involves the use of a paper Referral Form which is being filled out by the practice. This forms needs to be securely delivered to the CenVaNet care management staff. Currently this process is a manual one achieved either through a physical handoff of the form to one of the care managers at the practice, or it is faxed to CenVaNet.
Dominion’s use of the Direct Project standards and transactions is an ideal methodology to be used to facilitate this referral process. Dominion practice staff will scan the paper referral form and it will be stored in a standard location. Using the MEDfx Direct portal, this file will be an attachment to an email ‘push’ from the practice to the appropriate clinical care manager at CenVaNet.
CenVaNet care managers use a Medical Home Information System (MHIS) provided to them by MedVirginia and powered by MEDfx. Once the referral is received by CenVaNet, the patient is enrolled within the MHIS system and an electronic Initial Assessment form is created. The care manager uses the MEDfx Direct Portal to ‘push’ a copy of this form back to Dominion Medical Associates where it is attached to the front of the patients paper medical record identifying that patient as one of the patients participating in the diabetes care management program.
These two scenarios are ideal examples of the use of the Nationwide Network for Health Information’s Direct Project as a means to fill a gap for a practice that is currently not electronic. Although moving to an EMR quickly, these methods allow for the practice to securely transfer the appropriate patient referral information to CenVaNet. Additionally, although Direct is a ‘push’ model standard only, this process clearly shows the use of Direct as a means to achieve a two-way communicate path demonstrated by the securely transfer the completed Initial Assessment from CenVaNet back to the practice.
Technology Participants
About MEDfx Corporation
MEDfx Corporation is a privately-held company with a long history of embracing emerging technologies in collaboration with other innovative healthcare organizations. Over the course of its 25-year history, MEDfx Corporation has established itself as a leader in professional services, systems integration, and software engineering. MEDfx provided the engineering and architectural resources responsible for evaluation, selection, integration, and the successful deployment of the first production CONNECT gateway (CONNECTfx). MEDfx has successfully established connectivity with Social Security Administration, Centers for Medicare and Medicaid Services (CMS), VA and Department of Defense (VLER), and other NHIEs. MEDfx is participating in, and is a contributor to, the nationally-sponsored Direct Project under the Office of the National Coordinator. MEDfx has sponsored a pilot demonstrating the exchange of clinical Information using the Direct Project-compliant MEDfx Lifescape provider portal to facilitate the secure exchange of referrals from providers to care managers using the MEDfx Patient-Centered Medical Home Information System with a patient summary record to support the fulfillment of Stage 1 Meaningful Use criteria. The Direct Project and CONNECT protocols were used interchangeably to transport each message. Additionally, each message is routed and secured by the Verizon Provider Registry and the Verizon Certificate Authority. For more information on MEDfx Healthcare Solutions, please visit www.medfx.com.
About Verizon
Verizon Communications Inc. (NYSE, NASDAQ:VZ), headquartered in New York, is a global leader in Cloud Computing, Managed Hosting, Managed Network, Managed Security, and Call Center Support. Verizon provides a broad portfolio of solutions and services to mass market, business, government and wholesale customers. VerizonWireless operates America's most reliable wireless network, serving more than 93 million customers nationwide. Verizon also provides converged communications, information and entertainment services over America's most advanced fiber-optic network, and delivers innovative, seamless business solutions to customers around the world. Verizon has leveraged this vast array of award winning capabilities, assets, and resources to form a connected healthcare practice that solves the Secure, Interoperable, Mobility challenges required for the transformation of the Healthcare industry. Verizon announced the Medical Data Exchange in March 2010, a Direct compatible ‘non structured’ PHI exchange platform. Verizon announced the first Nation wide Multi tenant Healthcare Information Exchange (HIE) in July 2010. Verizon then announced the Nation wide Medical Identity solution in November of 2010, where Verizon will be providing 2.3 million US Medical professionals with two factor identities and cloud based digital certificates leveraging our Nation wide provider directory. Together these solutions are the foundation of Verizon’s Healthcare Information Management platform that provides secure nation wide PHI interoperability. Verizon is pleased to announce the expansion of the HIM platform to now include MEDfx Corporation’s Directfx solution. The addition of Directfx provides a harmonization capability that provides additional and residual value to Direct PHI exchange thereby providing a manageable pathway to stage II and III meaningful use. A Dow 30 company, Verizon employs a diverse workforce of more than 195,000 and last year generated consolidated revenues of $106.6 billion. For more information, visit www.verizon.com.
End User Participants
About MedVirginia
MedVirginia LLC, established in 2000, is a provider-owned physician organization based in Richmond, VA. Its organizational purpose is to provide quality, safety and efficiency through the use of health information technology. At its core is MedVirginia Solution, a community-based health information exchange linking clinical data from physicians, hospitals, labs and pharmacies. In January 2006, MedVirginia’s health information exchange became operational, making it among the first operational community-based systems in the U.S. In 2007, MedVirginia was selected as one of the original Nationwide Health Information Network participants. In 2009, MedVirginia became the first HIE to exchange live patient health information across the Nationwide Health Information Network and the first to deploy the open-source CONNECT gateway. For more information, visit www.medvirginia.net.
About Dominion Medical Associates
Dominion Medical Associates is an independent, minority physician practice located in Richmond, Virginia. Approaching its 100-year anniversary, thousands of patients have been served by the practice’s physicians. Dominion Medical has traditionally been a paper-based practice but is in the process of moving toward use of an EMR. As part of this process, CenVaNet (80% owner of MedVirginia) are working with the practice to help in its achievement of recognition as a Level 3 NCQA Patient Centered Medical Home (PCMH).
Pilot Proposal
- Objectives
- The ability to issue and maintain Trust Anchor Certificates
- The ability to issue and maintain Provider Certificates signed by the appropriate Trust Anchor Certificate
- The ability to maintain the association between Trust Anchor Certificates and the subordinate Provider Certificates in order to create a Circle of Trust
- The ability to deploy Trust Anchor Certificates and Provider Certificates to an endpoint implementation of the Lifescape Portal which has been enabled to securely exchange Health Information using the Direct Specifications
- The ability to deploy Trust Anchor Certificates and Provider Certificates to an endpoint implementation of the Non-Lifescape user which has been enabled to securely exchange Health Information using the Direct Specifications
- Demonstrate the secure exchange of Health Information between Lifescape users with anticipated expansion to non-Lifescape user
- Description - Describe each objective in terms of a targeted end-user story
- Participants - List the HISPs and Participating Organizations and describe the roles of each participant.
- Timeline - identify key milestones for the Pilot
- Resources Anticipated Being Available for Pilot - List the resources needed for the Pilot
- Create an Operational Plan
- Success Metrics - Enumerate how success of this pilot will be determined and measured. Be sure to take into consideration the items listed in the Success Metrics section of the Implementation Operational Plan.
- Other Notes
Planning
- Governance
- What is the status of the Pilot Project's work-plan and associated timeline?
- Pilot to be one year
- How will the division of responsibilities be managed for the following:
- Technical requirements?
- MEDfx
- Trouble-shooting?
- MEDfx
- Policy adherence?
- MEDfx
- Participant training?
- MEDfx
- Certificate management?
- Verizon
- Technical requirements?
- How will the division of responsibilities transition if the pilot lead leaves the project?
- MEDfx will provide transition resources
- What is the role of each integration partner?
- MEDfx
- Technical Requirements
- Development of Interfaces
- Development of Lifescape
- Lifescape Integration
- Verizon
- Certificate Management
- Provider Registry
- IDaaS (Identity Management)
- End User Support
- MEDfx
- What is the status of the Pilot Project's work-plan and associated timeline?
- Clincal Design
- Who are the participants in the pilot demonstration?
- MedVirginia Care Managers
- Dominion Medical Associates
- What Direct Project user stories will the pilot demonstrate?
- What information will be exchanged?
- PDF based clincal records
- What medium will transport this data?
- S/MIME over SMTP
- What is the purpose of this exchange?
- Demonstrate Meaningful Use
- Demonstrate Ability to Issue, Manage and Utilize Trust Anchor Certificates
- Demonstrate Ability to Issue, Manage and Utilize Trust Anchor Signed, Provider Endpoint Certificates
- Demonstrate Integration of Direct Transport with Provider Registry and Lifescape
- What information will be exchanged?
- Which Meaningful Use criteria will this pilot achieve?
- Secure exchange of Clinical Data between Providers
- Who are the integration partners?
- HISP?
- MEDfx
- EHRs?
- MEDfx will adapt to end user EHR if applicable
- Certificate Authority?
- Verizon
- HISP?
- Who are the participants in the pilot demonstration?
- Policy
- Certificate management
- How will certificate discovery occur?
- Anticipated lookup in Verizon's Provider Registry
- Who is the trust anchor for the pilot?
- Verizon
- Will the pilot require organizational-level or endpoint-level certificates?
- Endpoint-Level Certificates
- What will be the minimum identity assurance and authority requirements?
- Possession of Authorized Certificates
- Digital Signature
- What is the certificate expiration policy?
- Certificates will be issued for the anticipated Pilot duration + three months
- Renewed if Pilot Continues
- How will Direct addresses be formatted?
- Direct Reference Implementation format
- How will certificate discovery occur?
- Will the pilot require legal agreements to achieve the necessary patient consent?
- Yes, a legal agreement with the provider will be in place to insure compliance with applicable federal and state laws are observed and that the system is used in an appropriate way.
- For example, HIV results being transmitted
- Do the pilot's policies align with all applicable federal and state laws?
- Yes
- We will maintain compliance by establishing policy that adhere to applicable governing laws
- Certificate management
- Technical Design
- Which reference implementations will this project utilize?
- Java Reference Implementation
- Which deployment models apply?
- Portal Model
- What are messaging capabilities of:
- Participating providers
- Dominion
- Internet Connectivity
- MEDVirginia
- HIE Exchange
- NHIN Connectivity
- Dominion
- Participating providers
- Will additional capabilities be necessary for this pilot project?
- Yes
- If so, what are they and how will they be provisioned?
- Develop and Provision a Provider Directory and Repository
- MEDfx to specify
- Verizon to adapt
- Integration with Lifescape
- MEDfx to specify and develop or adapt
- Direct specification enhancement
- Patient context
- Develop and Provision a Provider Directory and Repository
- Which reference implementations will this project utilize?