Florida Health Information Exchange Status FHA AHCA Harris Meeting August 23, 2012

Transcription

1 Florida Health Information Exchange Status FHA AHCA Harris Meeting August 23, Slide 1 of 14

2 Agenda Florida HIE Overview Technical Implementation Security Implementation HIE Policy Adoption Sustainability 2 Slide 2 of 14

3 Florida HIE Overview Janet Hofmeister 3 Slide 3 of 14

4 History of the Florida HIE 2004 Florida wins Florida Health Information Network Grant Health Information Exchange Coordinating Committee convened 2009 Florida applies for ONC State Health Information Exchange Grant Concept of governance by Not-for-Profit No organizations identified 2010 AHCA awarded HIE Cooperative Agreement Program Award in March Legislature directs issuance of Invitation to Negotiate (ITN) by July Harris awarded four-year, $19 million contract in November 2011 Contract signed in February Direct Secure Messaging Deployed in July Patient Lookup Group 1 testing completed in December 2012 Strategic Health Intelligence goes live! PLU Groups 2 & 3 selected; Group 4 applications received (Aug) Outreach Contracts selected 4 Slide 4 of 14

5 Contractual Requirements and Status Major Contractual Requirements Develop Direct Secure Messaging Develop Patient Lookup Services Create and implement DSM adoption program Deploy up to 20 PLU nodes Connect to NwHIN Create Sustainment Plan Distribute Outreach Funding Status Complete last enhancements to be deployed in September Complete final gateway of gateways upgrade ready in September Complete Plan in place and adoption efforts ongoing, including DoH, Lab, Pharmacies, Payer & EHR vendor outreach Ongoing 12 adopters selected; 1 site is live and other 11 are working towards complete deployment; Group 4 applications received; Group 5 deadline is 12/1 In progress Evaluating partners Complete Plan developed In progress Awardees selected and contracts being executed 5 Slide 5 of 14

6 Florida HIE Overview Connects provider networks including: Physicians Hospitals Regional Health Information Organizations State Government Agencies Others as Healthcare evolves (i.e., ACOs., etc) Provides timely, secure, authorized exchange of patient health information for treatment A network of networks: Open-source, standards-based Leverages existing local HIE networks to connect Florida s healthcare providers Consists of two major services: Direct Secure Messaging (DSM) Patient Lookup (PLU) 6 Slide 6 of 14 Exchanging health information from the Florida Panhandle to the Keys

7 Florida Stakeholders Patients, Caregivers, Consumers Providers - Doctors, Nurses, Physician Assistants, Nurse Practitioners and others Regional Extension Centers (RECs) Hospitals, Clinics, Physicians Groups (Public and Private) Regional Health Information Organizations (RHIOs) Health Information Exchanges (HIEs) Integrated Delivery Networks (IDNs) Independent Practice Associations (IPAs) Long-Term Care and Mental Health Facilities Department of Health & County Health Departments State Immunization Records (Florida SHOTS) Federally Qualified Health Centers (FQHCs) National, independent, state labs E-Prescription Networks 7 Slide 7 of 14

8 Florida HIE Technical Implementation Chris Phillips 8 Slide 8 of 14

9 Florida HIE Services Direct Secure Messaging (DSM) is a secure system that allows participants to push encrypted health information to other participants and to respond to requests for information Conforms to DIRECT Standards For Treatment, Payment and Healthcare Operations Content agnostic Patient Look-Up (PLU) allows clinicians to query for and pull patient records from other participating nodes on the statewide network Conforms to CONNECT Standards For TREATMENT purposes only Patient authorization is required Exchange is via the CCD 9 Slide 9 of 14

10 Florida HIE Federated Data Services Patient Look-Up (Query/Pull) Completely federated No central Clinical Data Repository (CDR) exists at the Florida HIE Level All data resides locally The Florida HIE is a conduit to share information between end-points who retain control of the data Direct Secure Messaging (Push) Has centralized exchange server Supports HISP to HISP connectivity 10 Slide 10 of 14

11 Patient Look-Up Use Cases Providers can perform targeted queries and retrieve a patient s health records in CCD/C32 format Enables reduction of duplicative tests and adverse drug interactions Improves the timeliness and quality of care In Emergency Room make a broadcast query to access an unresponsive patient s health records in seconds Providers can make more informed and timely decisions about patient care and treatment which is imperative during an emergency Back at the PCP, patient records from the ER visit can be retrieved Primary care physician can provide better follow-up care after the emergency is over potentially reducing unnecessary ER visits 11 Slide 11 of 14

12 Patient Look-up Functional Architecture Nationwide Health Information Network (NwHIN) DSM INFRASTRUCTURE INTERNET Hospital HIE Health Community Choice HIE Networks Hospital HIE FQHC Others FQHC Free Standing Hospital FQHC Local Lab 12 Slide 12 of 14

13 Patient Look-up Technical Architecture INFRASTRUCTURE Service Registry Certificates Terminology Translation NwHIN Connection Privacy Reports P2PDirect Provider Directory Audit Log EXPRESS EXPRESS LITE Clinical Data Repository CONNECT Gateway PATIENT LOOKUP DOC SUBMISSION LARGE FILE TRANSFER CONNECT Gateway MPI/RLS Registry & Terminology Integration Engine DOCUMENT GENERATION Published Messaging and Authorization Specification Registry & Terminology Integration Engine DOCUMENT GENERATION EHR EHR PACS Clinical Data Repository HIE MPI/RLS 13 Slide 13 of 14

14 Use Cases for DSM Primary care provider refers patient to specialist including summary care record Primary care provider refers patient to hospital including summary care record Specialist sends summary care information back to referring provider Hospital sends discharge information to referring provider Laboratory sends lab results to ordering provider Transaction sender receives delivery receipt 14 Slide 14 of 14

15 DSM Functional Architecture Secure Internet (SMTP w/smime) Quest Diagnostics HISP Lab, HIE or EHR System Secure Internet Web-Client Access DSM Web Based (HISP) Alabama HISP IOS HISP INDEPENDENT PHYSICIANS PHYSICIANS GROUP HOSPITALS 15 Slide 15 of 14

16 DSM Technical Architecture Mail Florida HIE Web Page (Account Mgmt System) Web Client (Squirrel Mail) LDAP Provider Directory Exchange Server (Apache James) Direct Mail Address Book DOH Provider License Status File Open source CMS NPPES Licensed Providers Security Certificate 16 Slide 16 of 14 Thorough vetting uses multiple data sources

17 Integration between Systems and DSM Automatic interfaces to healthcare systems, EHRs (Inbox or clinical content) Reliable delivery notifications Interface & specifications available October 2012 Using SMTP/POP3 or XD* Systems or EHRs must develop their own interface to meet specifications 17 Slide 17 of 14

18 Florida HIE Security Implementation Andre Hebert 18 Slide 18 of 14

19 Florida HIE Security and Privacy Principles Secure, encrypted transmission, centralized audit reports, alerts, and HIPAA compliance Protect patient privacy and consent through Subscription Agreement policies Support various policy frameworks that might be implemented within the Edge Systems PLU participant organizations are vetted based on the thoroughness of their privacy and security policies (among other criteria) DSM registrants undergo one of the most comprehensive identity validation process currently in production, compared to similar systems nationwide 19 Slide 19 of 14

20 Security Controls: Florida HIE Data Center Overview DSM CONNECT Gateway Layered Security Architecture 20 Slide 20 of 14

21 Security Controls: Data Center Physical Security Layer Warning signs Security guards Locked gates and doors Locked cabinets and racks Electronic badges Closed circuit television cameras Alarm systems Raised flooring (water damage protection) DSM CONNECT Gateway 21 Slide 21 of 14

22 Security Controls: Network/Infrastructure Security Layer TLS Data Encryption (RSA bit) Firewalls - DMZ IDS/IPS HTTPS Reverse Proxy Anti Virus Protection Access Control Procedures System Monitoring Limited Remote Access Data Backups DSM CONNECT Gateway 22 Slide 22 of 14

23 Security Controls: Application Security Layer Account Registration User Authentication Role Based Access Control Data Segregation Data Encryption (at rest) Vulnerability Mgmt Audit Logging Account Locking Inactivity Timeouts DSM CONNECT Gateway 23 Slide 23 of 14

24 Security Controls: Supporting Network Security Processes Security across entire system development lifecycle Design Development Test Staging Deployment Change control and configuration management Configuration Control Board (CCB) Comprehensive CM approach with integrated Microsoft TFS IDE Security and program risk management Security risk plan and assessment HIPAA Compliant Personnel training Operational system and architecture HIPAA/HITECH and legal Operational procedures Account management Remote access process System maintenance Disaster recovery Security incident process Help Desk processes 24 Slide 24 of 14

25 Vetting for DSM Participation On-line self registration: Only certain types of organizations allowed to register Based on taxonomy code listed in NPPES database Registrant is authenticated to validate that they are who they say they are Access to FAX machine listed in NPPES database Valid and active Florida license verified for individuals and organizations License number listed in NPPES database Validated against the Florida Department of Health (DOH) database (on-line) and AHCA facility license database (off-line) Individuals are authenticated by the organization they are affiliated with Organization Point of Contact (POC) must approve individual accounts Group registration: Manual vetting of organization and organization POC by AHCA AHCA or Florida DOH licensed facility clear and active Provider, State Agency, Plans/Payers POCs are validated via personal inspection of credentials and third party database Plans/Payers are also validated that they are licensed in Florida or participating in Florida Medicaid Organization POC responsible for vetting individuals within their organization per NIST Level 3 guidelines 25 Slide 25 of 14

26 Florida HIE Policy Carolyn Turner 26 Slide 26 of 14

27 Consent Models DSM is Delegated Model Responsibility of Exchanging Parties DSM Content Anonymous to System Use Determined by Exchanging Parties Limited Authorization Form may be used PLU is Consent to Access Model Patient Authorization Required Must use Florida Form or legal equivalent Provider retains document Authorization is universal for named provider Break the Glass Permitted PLU Organizations Must Audit Patient Authorization PLU Organizations Must Share Audit Plans Patients May Restrict Access per HIPAA (not available for PLU) Re-Disclosure Notice (42 CFR Part 2) Required at each Access of PLU 27 Slide 27 of 14

28 Permitted Uses of Service Patient Look-Up Treatment Health Care Operations as Authorized by Patient Public Health Disability Determinations Direct Secure Messaging Treatment Payment Health Care Operations Public Health Meaningful Use Reporting HIPAA Authorization Required Purposes - Research 28 Slide 28 of 14

29 Who Can Join Each Service Patient Look-Up: Providers Hospitals and Hospital Systems Regional Health Information Organizations Health Information Exchanges Health Care Clinic Systems Direct Secure Messaging: Providers, Payers and State Agencies Providers include hospitals, physicians, ambulatory facilities, pharmacies, home health agencies, community mental health, nursing homes, hospices, clinical labs Payers include commercial insurers, Medicaid health plans, Medicare Advantage, Healthy Kids, third-party administrators State Agencies include AHCA, DCF, DOEA, APD, and DOH and others authorizing employees who exchange Protected Health Information (PHI) with health care providers and health plans 29 Slide 29 of 14

30 Florida HIE Adoption Evan Carter 30 Slide 30 of 14

31 PLU Adoption/Current Participants Current PLU nodes Organization Members Region Atlantic Coast HIE Memorial Healthcare System Miami-Dade/Broward Big Bend RHIO TMH, CRMC Leon & surrounding counties Community Health Centers Alliance FQHCs Statewide Florida Department of Health County Health Departments Statewide Florida Hospital - Adventist Florida Hospital Facilities Central Florida Health Management Associates HMA Facilities Statewide IOS Health Systems Ambulatory EHR providers Statewide/South Florida Kindred Healthcare Long-term care facilities Statewide Orlando Health Orlando Health Facilities Central Florida UF&Shands Shands Gainesville & Jacksonville North Florida South Florida HIE FQHCs Statewide/South Florida Strategic Health Intelligence Baptist, Sacred Heart Hospitals Escambia & surrounding counties 31 Slide 31 of 14

32 PLU Adoption/Current Participants 32 Slide 32 of 14

33 PLU Application/Onboarding Process PLU Readiness Questionnaire and/or Self-Onboarder Checklist available online or from Florida HIE adoption staff Questionnaires can be submitted at any time Onboarders are selected quarterly from available applicant pool Selections based on quantitative scoring for organization s technical readiness, size, privacy & security policies, and location 12 current onboarders have been selected in 3 different groups Group 4 selection process underway 5 new applications received Group 5 selection process will occur in December, to 4 applicants to be selected Group 5 will likely be the last group of onboarders selected that will receive free technical assistance from Harris Corp. 33 Slide 33 of 14

34 PLU Application Types Software Package Full Express Express Lite Facilitated Registration (3 to 4 spots left) Organization requires: New MPI & RLS Harris technical assistance for onboarding Organization requires: Harris technical assistance for onboarding Technical Assistance Self-Onboarder (unlimited) Organization requires: New MPI & RLS Organization will receive software package from Harris Corp. and follow instructional documentation to complete onboarding Organization already has an internal MPI & RLS to be integrated with the Florida HIE Organization already has an internal MPI & RLS to be integrated with the Florida HIE Organization will receive software package from Harris Corp. and follow instructional documentation to complete onboarding 34 Slide 34 of 14

35 DSM Registration Process 35 Slide 35 of 14

36 DSM Current Statistics All statistics through July, 2012 Goal for end of 2012 is 1,000 registered accounts 36 Slide 36 of 14

37 Outreach Sub-Contracts Total funding: $1.9M Awarded to participating entities to develop the software interfaces or other software necessary to develop downstream connections to underserved entities and expand health care provider access to the statelevel HIE network for Patient Look-Up (PLU); and/or to assist participating entities in deploying HIE, including Direct Secure Messaging (DSM) services to underserved entities through outreach, technical assistance, and provider training. Strategic Health Intelligence (SHI): $900,000 Community Health Centers Alliance (CHCA): $500,000 Health Management Association (HMA): $250,000 South Florida Regional Extension Center (SFREC): $250, Slide 37 of 14

38 Florida HIE Sustainability Janet Hofmeister 38 Slide 38 of 14

39 Value Proposition and ROI Tools Paper developed jointly by AHCA and Harris, also incorporating research done by the Center for Information Technology Leadership (CITL) and tools first developed by the Iowa Office of Health Information Technology (ehealth) Covers topics of: Services of the FL HIE Flexibility offered by the two services Methods of connection Retention of control of data by the providers Proposed costs for both PLU and DSM Methods employed to mitigate risk Strategy for outreach and adoption CITL basis for determining network value Return on Investment (ROI) model published by Iowa ehealth ROI Worksheets The following slides show the ROI calculation worksheets and put the value of the HIE into practical terms 39 Slide 39 of 14

40 Calculation of Return on Investment Included in the paper is a set of calculations around different costs that are incurred by facilities from a sole practice to a large hospital system While it is easy to view ROI in terms of dollars and cents, we must always remember that the true return is in improved care to the patient. Some of these may include: Avoidance of drug interactions or allergies Convenience for the patient to have their records available when needed Ease to an ill person of not having to do duplicative tests More timely care, less delay in diagnosis and onset of treatment Possible life saving treatment for an unresponsive patient We encourage both current and potential DSM and PLU to use these charts to determine the costs to their organizations and what could be saved should the FL HIE be implemented 40 Slide 40 of 14

41 EHR Interface Savings Calculator We provide an HIE for connecting disparate systems By establishing one connection to the FL HIE, providers can be connected to many of their partners at once This would eliminate the fee ($5K - $40K) that is generally charged by the EHR vendors to establish an interface with each data trading partner PLU can connect to treating partners such as hospitals, physicians, & county health depts. DSM offers a means to obtain structured data from labs and others Number of hospitals communicate with: Number of physician offices or clinics communicate with: Number of laboratories communicate with: Number of pharmacies communicate with: Number of home health agencies communicate with: Number of long-term care settings communicate with: Total number of connections: Average annual interface cost from EHR vendor: X $ Cost without HIE: $ Annual cost of HIE: - $ Cost saving: $ 41 Slide 41 of 14

42 Savings from Reduced Use of Paper Records Reduced expenditures required to support a paper-based system, including: paper supplies filing systems dedicated office space required to store paper charts or reports HealthBridge, based in Cincinnati, estimated a savings of $0.41 per report with the elimination of paper delivery of reports HealthBridge, Square footage for record storage: Rent per square foot: X $ Annual rent for record storage: $ Percent reduction in volume of paper records after implementation: Annual storage cost savings: $ Number of reports per year: Savings per report (costs of postage, paper, printers and personnel, based on detailed time and material studies): Annual delivery cost savings: $ X X $ Slide 42 of 14

43 Savings from using Electronic Patient Charts An alternative way to request and view patient charts For example, providers can query the HIE to view a patient s Continuity of Care Document (CCD) or send the CCD using DSM rather than having to make a phone call to another provider and request the patient chart be pulled and sent via fax Journal of Healthcare Information Technology estimates a 35% reduction in chart pulls in the first year after EHR implementation (2006 article) George Washington University Medical Faculty Associates estimated a first year savings of $81,551 after factoring in staff time for each chart pull Reference: Stephen Badger, Journal of Healthcare Information Technology, Vol 19, No 2, 2006 Number of chart pulls each day: Minutes spent per chart: Minutes spent pulling charts each day: Number of work days per year (e.g. 250): Minutes pulling charts each year: Reduction in chart pulls or based on post implementation study of practice/facility: Time savings due to HIE implementation (minutes): Divide by 60 to determine time savings in hours: Time savings due to HIE (hours): Average hourly administrative rate: X $ Annual cost saving potential: $ X X X 35% Slide 43 of 14

44 Savings from using HIE instead of FAX Enables an alternative form of secure communication between providers using DSM or PLU Early results of University of Iowa Broadlawns Hospital HIE pilot show the potential for a 40% reduction in the amount of time needed to process faxed health information (e.g., average handling time was reduced from 10 minutes to 6 minutes). Reference: University of Iowa Hospitals and Clinics, message to Iowa e-health, March 3, 2011 Items faxed per day, preimplementation: Work days per year (e.g. 250): Items faxed annually: Time to process each fax (in minutes): Divide by 60 to determine time spent processing faxes in hours: Hours spent processing faxes each year: Reduction in time spent processing faxes or based on postimplementation study at facility, health plan or practice: Hours saved from DSM and/or PLU: Average hourly administrative rate: X $ Annual cost saving: $ X X 60 X 40% 44 Slide 44 of 14

45 Savings from Reduced Readmissions We provide access to continuity of care documents (CCD) and hospital discharge summaries to primary care providers through PLU or DSM Recent study in Connecticut estimates a 25% reduction in potentially preventable readmissions due to the availability and use of an HIE Number of admissions annually: Percent of admissions that are Potentially Preventable Readmissions (PPRs): Number of annual PPRs: Percent reduction of PPRs due to HIE: *Adjust for local DSM/PLU uptake: Low, use 0-10% Medium, use 10-20% High, use 20-25% Cost of an admission: X $ Cost savings potential $ Percent uncompensated care: Uncompensated cost saving: $ X X 25%* X 45 Slide 45 of 14

46 Savings from Reduced Emergency Room Visits Access to continuity of care documents (CCD) through use of PLU or DSM for referrals to medical homes Boston Consulting Group estimated that 13% of repeat ED visits were potentially avoidable The Wisconsin-Institutes for Discovery reported a benefit to providers as well as payers due to reduced expenditures on Medicare and Medicaid patients that are not fully compensated References: Boston Consulting Group, Rhode Island Quality Institute: Business case for Health Information Exchange, Srikrishna Sridhar, et. al., Optimizing financial effects of HIE: a multi-party linear programming approach, American Medical Informatics Association, Number of ED visits annually: Percent of ED visits that are repeated: Number of repeat ED visits: Percent reduction of repeat ED visits due to HIE: *Adjust for local DSM/PLU uptake: Low, use 0-5% Medium, use 5-10% High, use 10-13% Cost of an ED visit X $ Cost saving potential: $ Percent uncompensated care: Uncompensated cost saving: $ X X 13%* X 46 Slide 46 of 14

47 Expected Sustainment Costs Total Estimated Sustainment Costs: $2,321,660 Personnel - Technical (Tier 2 & 3), Management, Administration, Legal, Website support, documentation updates Overhead - Office space, utilities, etc. Hardware - Computing, networks, security Software - License, maintenance, and certificate fees Training/Helpdesk - Tier 1 support, document and knowledge base updates Accreditation/Certification - Personnel HIPAA certifications Outreach and Technical Development - New capability implementation; business outreach 47 Slide 47 of 14

48 How much will it cost and who will pay 48 Slide 48 of 14

49 Allocation of the costs 49 Slide 49 of 14

50 Questions? For additional information please visit: 50 Slide 50 of 14