2.0 EHR-Centric Interoperability Requirements

CAP117

Communicate Ambulatory and Long Term Care Prescription

X

X

X

X

X

X

X

CAP118

Communicate Hospital Prescription

X

X

X

X

X

X

X

CAP119

Communicate Structured Document

X

X

X

X

X

X

X

X

X

X

X

X

X

CAP120

Communicate Unstructured Document

X

X

X

X

X

X

X

X

X

X

X

X

X

CAP121

Communicate Clinical Referral Request

X

X

X

X

X

X

X

X

X

CAP122

Retrieve Medical Knowledge

X

X

X

X

CAP123

Retrieve Existing Data

X

X

X

X

X

X

X

X

X

CAP124

Establish Secure Web Access

X

X

X

X

X

X

X

X

CAP125

Retrieve Genomic Decision Support

X

X

X

X

X

X

X

X

X

CAP126

Communicate Lab Results Message

X

X

X

X

X

X

X

X

X

CAP127

Communicate Lab Results Document

X

X

X

X

X

X

X

X

X

X

CAP128

Communicate Imaging Information

X

X

X

X

X

X

X

X

X

CAP129

Communicate Quality Measure Data

X

X

X

X

X

X

X

CAP130

Communicate Quality Measure Specification

X

X

X

CAP131

Update Immunization Registry

X

X

X

X

X

X

X

X

CAP132

Retrieve Immunization Registry Information

X

X

X

X

X

X

X

X

X

CAP133

Communicate Immunization Summary

X

X

X

X

X

X

X

X

X

X

X

CAP135

Retrieve and Populate Form

X

X

X

X

X

X

X

X

X

CAP136

Communicate Emergency Alert

X

X

X

X

CAP137

Communicate Encounter Information Message

X

X

X

X

X

X

X

CAP138

Retrieve Pseudonym

X

X

X

X

X

X

X

CAP139

Communicate Resource Utilization

X

X

X

X

X

X

CAP140

Communicate Benefits and Eligibility

X

X

X

X

X

X

X

X

X

X

X

CAP141

Communicate Referral Authorization

X

X

X

X

X

X

X

X

X

X

X

CAP142

Retrieve Communications Recipient

X

X

X

X

X

X

CAP143

Manage Consumer Preference and Consents

X

X

X

X

X

X

X

X

X

X

(i) Protect Security & Privacy

3001(b)

Purpose- The National Coordinator shall perform the duties under subsection (c) in a manner consistent with the development of a nationwide health information technology infrastructure that allows for the electronic use and exchange of information and that

Once law is promulgated against this overall scoping section, this list will need to be revisited to identify additional gaps and validate existing gaps.

Defer, pending publication of regulations.

(i) Protect Security & Privacy

Technologies that protect the privacy of health information and promote security in a qualified electronic health record, including for the segmentation and protection from disclosure of specific and sensitive individually identifiable health information with the goal of minimizing the reluctance of patients to seek care (or disclose information about a condition) because of privacy concerns, in accordance with applicable law, and for the use and disclosure of limited data sets of such information.

Of the four data states specified in the NIST 800-66 document the following gaps exist:

Data at Rest

Data in Use

Data Disposed

Data in motion is covered by HITSP/T17 and HITSP/C44, but the other three data states are not currently addressed by HITSP.

The HITSP SPI Tiger Team will forward to the SPI Technical Committee the gaps of data at rest, data in use, and data disposal for consideration in a revised Technical Committee 2009-2010 SOW. This includes identification and selection of appropriate standards and referring any residual gaps to standards development organizations for resolution.

(i) Protect Security & Privacy

3002(b)(2)(C)(viii)

Methods to facilitate secure access by an individual to such individual's protected health information.

Possible gap: Mobile devices are not specifically covered by existing constructs. This may be a gap. Some additional language may need to be added as to which types of devices are supported and to what degree. (E.g.: Inclusion of portable computing devices.)

The HITSP SPI Tiger Team will determine if revisions to the constructs to add clarity and explicitly include portable computing devices can be an integral part of the next maintenance release. If not, the SPI TT will identify the gaps so they can revise the HITSP SPI TC 2009-2010 SOW.

Note: The recommended resolution is to provide additional language as to which types of mobile devices are supported and to what degree, e.g., portable computing devices, and address confidentiality protections when data leaves the secured perimeter.

(ii) Exchange & Integrate Health Information

[Meaningful Use Health Outcomes Priority / Coordination of Care]

A nationwide health information technology infrastructure that allows for the electronic use and accurate exchange of health information.

Standardized terminology for allergies to medication, drug intolerances and other allergies is needed as well as the elements or accompanying information (e.g. nature of reaction, severity or reaction, and source of info)

In addition agreement is needed on distinctions among allergies, intolerances, side-effects, sensitivity responses, adverse effects and other similar reactions, tolerance, adverse events, side effects, sensitivity reaction

ISO TS Adverse events pending

Some SNOMED mapping for some adverse event/side effect terminologies under way

Tolerance definitions not available (for quality typically medication allergen for exclusion)

International Harmonization Committee (MedDRA)

WHO terminology

Recommend harmonization and development of coded terminology

Standards are able to manage the death indicator, but there is a gap in the process to reliably collect and transmit this data element. Hospital outpatient clinics and Emergency Departments may use ADT A^03 to indicate death of outpatients. In the ambulatory setting there is usually no clear standard electronic record of death. The HL7 death indicator exists but is not currently part of workflow in the ambulatory setting

This will be a matter of training. If there is a demographic resource (e.g. IHE PIX - could be an IHE PDQ message); If Vital Health Statistics resource is available; IHE QED might be used against this resource to access the reason(problem) for death. Vital Health Statistics could be instantiated as a Patient Demographic Supplier

(ii) Exchange & Integrate Health Information

[Meaningful Use Health Outcomes Priority / Coordination of Care]

3001(b)

(6) improves the coordination of care and information among hospitals, laboratories, physician offices, and other entities through an effective infrastructure for the secure and authorized exchange of health care information;

Gaps may be identified when the definition of "meaningful use" is available. Revisit to validate when the definition of meaningful use is available

Defer, pending publication definition for "meaningful use"

(ii) Exchange & Integrate Health Information

[Meaningful Use Health Outcomes Priority / Coordination of Care]

3002(b)(2)(C)(vi)

Technologies that facilitate the continuity of care among health settings.

Long term care (LTC) is referenced only as it relates to the inpatient and ambulatory settings. This capability does not define the LTC environment fully with LTC workflow, participants, needs and activities. It is expected that once an LTC medication management scenario is defined, LTC requirements will be fully addressed.

The extension of the Medication Management IS for LTC is currently part of the 2009 HITSP work. This will result in the Long Term Care setting requirements being discussed and documented in greater detail.

A standard enabling law enforcement to securely hand over crash victim ID/ECON information to crash scene EMS providers in an automated and streamlined format

The IHE PCC Technical Committee, in collaboration with various Emergency Responder SME organizations, including the National Association of State EMS Officials, International Association of Chiefs of Police, and International Association of Fire Chiefs, are responsible for resolving the ECON Gap as part of IHE's development of the 2009 'EMS Transfer of Care' Technical Framework Supplement

There is a need for a CDA implementation guide for the exchange of assessment instruments that include functional status.

HITSP has sent a request to SDOs for consideration. HL7 has embraced this requirement and incorporated this into its 2009 work.

Nursing documentation, such as nurses notes are a gap in the current standards

HITSP will send a request to SDOs to create an implementation guide to fill this gap, including:

Nursing Summary Component Document that contains notes and observations from the nursing staff and to make sure that CDA will work for all nursing documentation

(ii) Exchange & Integrate Health Information

[Meaningful Use Health Outcomes Priority / Coordination of Care]

13101; 3000 Def. (13)

QUALIFIED ELECTRONIC HEALTH RECORD.The term qualified electronic health record means an electronic record of health related information on an individual that

(B) has the capacity

(ii) to support physician order entry;

Orders are ill-defined for both lab and procedure ordered. Need a standard model so that each vendor can map to standardized mechanism to capture the procedure ordered data element.

Recommend to LOINC, SNOMED CT, and CPT to develop AND harmonize a suitable coded value set to express order test name and code values

Gap for electronic capture of consult ordered; there are many ways to determine this information, but no good standard identified. For instance Consult result with appropriate components (e.g. an eye exam with appropriate components retinopathy; provides a dx DX ICD can help, but may not be sufficient). Procedures may be an indication of consultation. Need to manage the status of all referrals and orders

The consultation and communication process is too granular to be measurable

Explore incorporation of communication transaction notification

(iii) Certified EHR by 2014

3002(b)(2)(A)

IN GENERAL- The HIT Policy Committee shall recommend the areas in which standards, implementation specifications, and certification criteria are needed for the electronic exchange and use of health information for purposes of adoption under section 3004 and shall recommend an order of priority for the development, harmonization, and recognition of such standards, specifications, and certification criteria among the areas so recommended. Such standards and implementation specifications shall include named standards, architectures, and software schemes for the authentication and security of individually identifiable health information and other information as needed to ensure the reproducible development of common solutions across disparate entities.

Gaps may be identified when the definition of "meaningful use" is available. Revisit to validate when the definition of meaningful use is available

Defer, pending publication definition for "meaningful use"

(iii) Certified EHR by 2014

3002(b)(2)(C)(i)

(i) The appropriate uses of a nationwide health information infrastructure, including for purposes of--

Gaps may be identified as we perform a detailed analysis on the Common Data Transport (CDT) Use Case and identify the requirements listed in CDT.

The HITSP SPI Tiger Team will identify the gaps so they can revise the HITSP SPI TC 2009-2010 SOW accordingly.

This includes identification and selection of appropriate standards and referring any residual gaps to standards development organizations for resolution.

(iv) Disclosure Audit (per HIPAA for covered entities)

Technologies that as a part of a qualified electronic health record allow for an accounting of disclosures made by a covered entity (as defined for purposes of regulations promulgated under section 264(c) of the Health Insurance Portability and Accountability Act of 1996) for purposes of treatment, payment, and health care operations (as such terms are defined for purposes of such regulations).

There is a gap. HITSP/T15 can support accounting of disclosures but is just one component.

HITSP does not have an accounting of disclosures constructs. While HITSP/T15 employs the use of security logs, accounting of disclosures is more akin to event logs.

The purpose of disclosure and other criteria need to be recorded in the Disclosure log.

If needed, HITSP can look to develop an "accounting of disclosures construct, recognizing that there may be a gap in underlying standards. HITSP would need guidance on the level of specificity within the disclosure log (e.g. limited to specific system behavior, or does the system have to capture all disclosures whether generated by the system itself or otherwise (e.g. verbal)).

The HITSP SPI Tiger Team will identify the gaps so HITSP can seek guidance from ONC for what HITSP needs to deliver, and revise HITSP SPI TC 2009-2010 SOW accordingly.

This includes identification and selection of appropriate standards and referring any residual gaps to standards development organizations for resolution.

(iv) Disclosure Audit (per HIPAA for covered entities)

13405(C)

ACCOUNTING OF CERTAIN PROTECTED HEALTH INFORMATION DISCLOSURES REQUIRED IF COVERED ENTITY USES ELECTRONIC HEALTH RECORD

IN GENERAL

There is a gap. HITSP/T15 can support accounting of disclosures but is just one piece of the puzzle.

HITSP does not have an accounting of disclosures constructs. While HITSP/T15 employs the use of security logs, accounting of disclosures is more akin to event logs.

The purpose of disclosure and other criteria need to be recorded in the Disclosure log.

The HITSP SPI Tiger Team will identify the gaps so HITSP can seek guidance from ONC for what HITSP needs to deliver, and revise HITSP SPI TC 2009-2010 SOW accordingly.

This includes identification and selection of appropriate standards and referring any residual gaps to standards development organizations for resolution.

(v) Improve Quality and Population Health

[Meaningful Use Health Outcomes Priority / Quality Safety , Efficiency, Reduce Health Disparities]

3002(b)(2)(C)(x)

Any other technology that the HIT Policy Committee finds to be among the technologies with the greatest potential to improve the quality and efficiency of health care.

The following topics have not yet been covered by HITSP constructs and are not discussed elsewhere in this document:
1. Nonrepudiation of receipt
2. Common vocabulary to represent NIST level of assurance
3. Cross-Enterprise Security and Privacy Authorization (XSPA)
4. Common vocabulary for Patient Consent Directives
5. Gaps in the use of HITSP/TP13 and HITSP/TP30 may exist in terms of managing the consent, or document, in an exchange environment where an IHE XDS registry or repository may not exist. This situation has been identified in the NHIN trial implementations.

Item 1 is not clearly called-for in ARRA, so we need clarification from ONC as to whether a need for nonrepudiation of receipt may be forthcoming (e.g. in a value case).

Items 2, 3 and 4 exist in the current HITSP SPI TC 2009 SOW. A known set of prioritized, business relationship privacy policies and consumer privacy policies would be of great benefit to the TC in closing the identified gaps.

Item 5 will be referred to the SPI Technical Committee to address.

(v) Improve Quality and Population Health

[Meaningful Use Health Outcomes Priority /Engage Patients and Families]

3002(b)(2)(C)(ii)

Self-service technologies that facilitate the use and exchange of patient information and reduce wait times.

HITSP/C44 enables the use of public terminals for secure access of data. There may be other self-service technologies to facilitate the use of exchange of patient information and reduce wait times that HITSP has not yet considered.

Seek guidance from ONC on the types of other self-service technologies that we may need to support.

Note: Since HITSP/C44 supports the use of "uncertified" user browsers, this supports the notion of self serving technologies (no gap).

(vi) PHI Rendered Unusable by Unauthorized Individual

Technologies that allow individually identifiable health information to be rendered unusable, unreadable, or indecipherable to unauthorized individuals when such information is transmitted in the nationwide health information network or physical transport.

HITSP/T17 supports encryption of data during transmission.

For physically transporting IIHI outside of the secured perimeter there is a gap: Encrypting physical media, e.g., encryption for HITSP/T33. There is no construct for encrypting media at rest.

Furthermore, HITSP needs to expand our definition for portable media to include portable computing devices.

The HITSP SPI Tiger Team will identify the gaps of data at rest, data in use, and data disposal for consideration in a revised 2009-2010 SOW. This includes identification and selection of appropriate standards and referring any residual gaps to standards development organizations for resolution.

(vi) PHI Rendered Unusable by Unauthorized Individual

13402(h)

Unsecured Protected Health Information.

(1) DEFINITION.

(A) IN GENERAL.--Subject to subparagraph (B), for purposes of this section, the term ``unsecured protected health information'' means protected health information that is not secured through the use of a technology or methodology specified by the Secretary in the guidance issued under paragraph (2).

Gap in encryption of removable media and portable devices. Encryption of data on removable media and portable devices would provide support for "Safe Harbor" breach notification requirement.
See previous gap statement on this topic.

The HITSP SPI Tiger Team will identify the gaps of data at rest, data in use, and data disposal for consideration in a revised 2009-2010 SOW. This includes identification and selection of appropriate standards and referring any residual gaps to standards development organizations for resolution.

Seek guidance from the HIT Standards Committee on how to proceed.

(viii) Needs of Children and Vulnerable

[Meaningful Use Health Outcomes Priority / Quality Safety , Efficiency, Reduce Health Disparities]

Technologies that address the needs of children and other vulnerable populations.

No way to receive a Risk Analysis report into an EHR.

The HITSP Care Management and Health Records Domain TC will investigate current standards

The resulting Risk Analysis report should use standard Interoperable Clinician/Nursing Terminology with the following local/Interoperable language agreed to by HITSP:

This Interoperability Specification will use the CHI recommended SNOMED CT as a reference terminology to communicate interoperable information among and between systems, with the HITSP Interoperability Specification Pre-condition that the sending and using systems must use formal coded nursing terminologies such as the Clinical Care Classification (CCC) System and the Omaha System that are integrated in SNOMED CT

Manage Consent Directives

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Access Control

Y

Y

Y

Y

Y

Y

O

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Secured Communication Channel

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Security Audit

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Entity Identity Assertion

Y

Y

Y

Y

O

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Y

Document Integrity

O

O

O

O

O

O

O

O

O

O

O

O

Non-Repudiation of Origin

O

O

O

Y

O

O

De-identification

O

O

O

O

O

O

O

O

O

O

Y

O

Y

O

O

O

O

SC108

Access Control

The HITSP Access Control Service Collaboration provides the mechanism for security authorizations which control the enforcement of security policies including: role-based access control, entity based access control, context based access control, and the execution of consent directives.

SC109

Security Audit

The HITSP Security Audit Service Collaboration describes the mechanism to record security relevant events in support of policy, regulation, or risk analysis. It also provides the mechanism to determine the record format to support analytical reports that are needed.

SC110

Patient Identification Management

The HITSP Patient Identification Management Service Collaboration provides the ability to lookup and/or cross-reference patient identities.

SC111

Knowledge and Vocabulary

The HITSP Knowledge and Vocabulary Service Collaboration provides the ability to retrieve medical knowledge and terminology.

SC112

Healthcare Document Management

The HITSP Healthcare Document Management Service Collaboration provides the ability to share healthcare documents using a set of topologies, such as Media, e-Mail, Point-to-Point, Shared within a Health Information Exchange, and Shared within a larger community (made up of potentially diverse Health Information Exchanges).

SC113

Query for Existing Data

TheHITSP Query for Existing Data Service collaboration provides the capability to query and retrieve data from another clinical system, and the capability to respond to same queries. It applies the necessary Security and Privacy constructs and supports all the queries found in HITSP/TP21.

SC114

Administrative Transport to Health Plan

The HITSP Administrative Transport to Health Plan Service Collaboration provides the transport mechanism for conducting administrative transactions with health plans.

SC115

HL7 Messaging

The HITSP HL7 Messaging Service Collaboration provides the capability to send and receive HL7 messages. This Service Collaboration applies the necessary Security and Privacy constructs.

SC116

Emergency Message Distribution

The HITSP Emergency Message Distribution Service Collaboration performs a multicast notification to specifically identified populations, such as emergency departments.