ONC

Security Branch Chief Mikki Smith said that the office is currently working with the National Institute of Standards and Technology an on identity management framework and other framework projects in tandem to drive interoperability.

The use of use cases

When ONC officials asked what stakeholders wanted to see more of in terms of outreach, some called for more use cases to inform developers how they might apply data findings to their apps.

Some stakeholders called for more guidance from the government on the security features developers should include in their apps.

Acting Chief Privacy Officer Deven McGraw said that certain groups, like the HEART Working Group and HIMSS, were already working toward privacy and security specifications for APIs, and the health IT community would be best served to build on each other’s work.

“There lots of sort of pockets of work going on these same issues that we definitely want to connect to so that we are supporting one another and leveraging one another’s learning and not reinventing the wheel,” she said.

“So it’s early,” she said. “People are still, I think, getting up to speed and learning what the rules of the road are. We are getting a lot of feedback that people are starting to understand what they are supposed to do.”

Providers started submitting QPP data on Jan. 1 to help shape their Medicare payment adjustments in 2019 through two payment models: The Advanced Alternative Payment Model and the Merit-based Incentive Payment System.

The MIPS model requires providers to submit data to Medicare if they bill more than $30,000 a year and provide care for more than 100 Medicare patients a year, but will allow physicians to determine their pace of adoption ahead of a March 31, 2018 deadline.

The more data a provider submits, the bigger the Medicare payment they will receive.

For the Advanced APM model, providers who get 25 percent of Medicare payments or see 20 percent of Medicare patients through an Advanced APM in 2017, they have a chance at a 5 percent incentive in 2019, with a potential for 9 percent in 2022.

Goodrich said though providers have been working their way through the new reporting requirements, most are embracing them as a way to move to the more merit-based platform.

“One thing that’s been nice to hear is that a lot of folks really want to try to do more,” she said. “We definitely expect that we will have some folks that will do the minimum amount and they’re just not ready to go beyond that, but even with folks who haven’t participated previously, we are hearing they want to at least try to do more than the bare minimum.”

Goodrich added that CMS will start notifying providers of the status of their MIPS eligibility in the next four to six weeks.

ONC looks ahead

Acting ONC Director Jon White also talked about the office’s goals for 2017 and how it plans to move interoperability forward under the Trump administration and new Secretary for Health and Human Service Tom Price.

“We are collaborating closely with our colleagues in the new administration to deliver IT priorities in areas of focus,” he said. “There are two very clear priorities for us. The first is to reduce the burden of health IT use on providers and the second is to achieve widespread interoperability within health IT.”

White added that those priorities came from Price, but ONC will also focus on implementing the 21st Century Cures Act — a 2016 law that authorizes research using protected health data — in addition to working on its data standards for the Precision Medicine Initiative.

The ONC director added that while interoperability’s stakeholders — both in the tech sector and in the medical field — are fully invested in moving forward to use health IT to move health care toward outcome-based measures, the journey is far from over.

“Nobody wants to go back to paper,” he said. “They all say ‘Look, we see a lot of benefits to this information system, we’ve got data available to us that we’ve not had before.’ They also vent their frustrations.

“This is not a once-and-done deal. This is an ongoing process.”

Congress appropriated $205 million in research funding in 2016, and ONC interoperability efforts will help fuel the secure sharing of health data.

“So we’ve got a really rich source of people’s health care data in certified technology,” he said.

“So when people agree to participate in this research initiative, there’s one of two ways they can come in right now: Either through health care provider organizations that have received cooperative agreements from the National Institutes of Health or there’s going to be an open door for people who are not going to be a part of these organizations.”

White added that having health IT certified by ONC means the information collected will be able to be disseminated and researched through proven compatible formats to see the full picture of the health data.

“We are going to use these [Fast Healthcare Interoperability Resources]-based [application program interfaces] to both recognize that it’s the right person, get their appropriate consent to have their information shared with the research cohort and then deliver the information from certified technology.”

White said that ONC has been working in partnership with industry to develop APIs that will promote the free flow of health information to help populate the PMI pilots.

The agency’s role is central to the PMI because it will ensure that the data can be shared securely so the initiative can disseminate across the research cohort.

“ONC’s role in this is pretty specific,” White said. “We are working to promote and develop data standards that can be used for the Precision Medicine Initiative. We are working to pilot those standards so the technology can move the initiative forward and finally robustly partner with the Office of Civil Rights to address privacy and security policy around people’s data.”

ONC received $5 million of the 2016 PMI funding for the coordination of data standards for the project.

ONC director of the Office of Standards and Technology Steven Posnack announced the five finalists at the 2017 HIMSS conference in Orlando, Florida, with the winners expected to be unveiled on May 31.

The finalists include:

• CedarBridge Group LLC for its CareApproveTM app, which provides patients the functionality to grant and revoke access to their electronic health records. The app also includes an EHR system plugin for providers to use for cross-platform use.

• EMR Direct’s HealthToGoTM solution helps patients leverage multiple applications to provide easier use and access to their health data.

• Foxhall Wythe LLC’s DocketTM provides secure system storage for health records with end-to-end encryption and Fast Healthcare Interoperability Resources (FHIR) message interoperability.

• Live and Leave WellTM, by Live and Leave Well LLC, provides secure information exchange for end-of-life planning that is compatible with multiple APIs.

• Lush Group, Inc.’s HealthyMePHR system provides functionality for patients to share and provide access to their EHRs to their provider’s records system.

Each of the finalists was awarded $20,000 for reaching Phase 3 of the contest, in addition to a $5,000-prize for winning Phase 1 in November 2016.

Two Phase 3 contestants will earn an additional $50,000 prize on Feb. 23, when the winners are announced.

For more information on the

.

DHA initially planned the rollout to go live at all four installations — including Naval Hospital Bremerton, Naval Hospital Oak Harbor and Tacoma’s Madigan Army Medical Center — in December 2016, but was delayed while DHA officials ensured the cybersecurity interfaces for the Cerner-designed system worked effectively with legacy systems.

Bono said that by testing the rollout at Fairchild first, DHA officials had some flexibility to test the system’s capabilities for expansion to larger sites.

“We could start relatively small, but scale it up pretty rapidly,” she said. “For Fairchild, they are strictly an outpatient facility. So we had no inpatient care that we needed to try to deploy.

“Also, we knew that they had a fair number of pharmacy transactions, as well as laboratory and radiology transactions, so we thought this would be a great place to start and understand how our processes meshed and what we needed to pay attention to.”

With this summer’s planned rollout set for three new facilities, Stacy Cummings, Defense Healthcare Management Systems program executive officer, said MHS Genesis will expand the capabilities modules to match the needs of the installations.

“From an EHR perspective, the workflows in an inpatient environment are different from the workflows in an outpatient [environment],” she said. “Same thing around things like surgery, blood transfusion, natural language processing tools; these are some of the capabilities that we will be adding as we move to the larger facilities that weren’t requirements of the small facility.”

The interoperable health system has been years in making, with the goal of an EHR infrastructure that will facilitate the free flow of patient data across the Department of Defense.

Cummings said DHA was also tracking how users interact with the system with a metrics tool called the Lights On Network, providing the agency with better insights on how Genesis should develop.

“One of the real benefits of this commercial off-the-shelf tool is the alerts,” she said. “The information that’s stored in the electronic health record, partnered with some of the decision support tools that [system] gives us, we’re going to be able to give good advice to the provider and we can track to see if they follow that advice.”

The alert functions in MHS Genesis will notify providers with tools like updated dosage recommendations based on information contained within the EHR, such as elevated lab levels.

MHS Genesis is projected to be fully deployed by 2022.

“We have a lot of guidance that we are going to have to issue,” she said. “There are lots of provisions that deal with accessing and sharing protected health information for research purposes.”

The law will require both offices to examine a number issues of how the Cures Act will comply with HIPAA, including when it comes to addressing security barriers to information sharing and patient access rights.

Another wrinkle of the law that will require additional guidance is a measure that allows family members of patients with mental health issues to access treatment information.

“This is a topic on which we have issued guidance in the past, but we are continuing to get questions from entities about when they can share information about persons within a mental health context,” McGraw said.

OCR is also expected to roll out additional guidance in 2017 related to the Health Information Technology for Economic and Clinical Health, or HITECH, Act.

As part of the 2009 law, McGraw said OCR will be unveiling new regulations establishing civil penalties for those affected by HIPAA violations.

“This has been on our regulatory agenda for quite some time,” she said. “There’s not really a good model that already exists out there for this.

“We need to understand things like how can we administratively execute this. Giving out money to people is not something we are accustomed to doing. What qualifies as harm when there has been a violation of privacy and security rules?”

OCR will also be updating its Frequently Asked Questions on guidance for secure information sharing and clarifying HIPAA compliance through text messaging and social media.

McGraw added that while the regulations are in the works for 2017, their rollouts will be dependent on the completed appointment of HHS leadership.