eHealth : some challenges

1. eHealth: some challenges Frank Robben General manager eHealth-platform Sint-Pieterssteenweg 375 B-1040 Brussels E-mail: Frank.Robben@ehealth.fgov.be Website eHealth-platform: https://www.ehealth.fgov.be Personal website: www.law.kuleuven.be/icri/frobben

2. Some evolutions in healthcare • More chronic care on top of merely acute care • Remote care (monitoring, assistance, consultation, diagnosis, operation, ...) • Mobile care • Multidisciplinary, transmural and integrated care • Patient-oriented care and patient empowerment

3. Some evolutions in healthcare • Rapidly evolving knowledge => need for reliable, coordinated knowledge management and accessibility • Threat of excessively time-consuming administrative processes • Reliable support for healthcare policy and research requires reliable, integrated and anonymous information • Cross-border mobility

4. Those evolutions require ... • Collaboration between all actors in healthcare, not necessarily based on centralized data storage • Efficient and safe electronic communication between all actors in healthcare • High quality electronic patient records, across specialties • Technical and semantic interoperability

5. Those evolutions require ... • Optimized processes • Guarantees for • information security • privacy protection • respect for the professional secrecy of healthcare providers • Trust of all stakeholders in the preservation of the necessary autonomy and the security of the system

6. Electronic communication also stimulates.. • Quality of care and patient safety • prevention of erroneous care and drugs • negative drug interaction • drug contraindications (e.g. allergies, diseases, …) • prevention of errors in administering care and drugs • availability of trustworthy databases containing information about best care practices and decision support tools • Qualitative support of healthcare policy and healthcare research based on reliable, integrated and anonymized information

7. The Belgian approach • At first creation of an adequate governance and consultative structure about eHealth and then further implementation under control of the governance and consultative structure • Stimulation of multidisciplinary and high quality electronic patient records • If the patient wishes so, gradual referencing to places where his/her personal health data are available

8. The Belgian approach • Common patient identifier • Well elaborated legal and ethical framework • patient rights • privacy protection • professional secrecy • Respect for local, regional or national healthcare organisation structures and initiatives • never use ICT to impose change to organisational structures

9. The Belgian approach • 2008: eHealth-platform creation • a new parapublic institution, instituted by law • governed by representatives of the stakeholders (healthcare providers, healthcare institutions, patients, sickness funds, relevant government institutions, …) • based on the experience in the social sector

10. The Belgian approach • eHealth platform: an interoperable technical platform for safe and reliable electronic information exchange • based on a service oriented architecture • with common basic services • using technical and semantic interoperability standards

11. Basic architecture Portal Health VAS VAS VAS VAS Patients, health care providers and health care institutions Software health care provider VAS VAS VAS Software health care institution VAS Site RIZIV PortaleHealth-platform MyCareNet VAS VAS VAS VAS VAS VAS VAS VAS VAS VAS VAS VAS Users Basic services eHealth-platform Network AuthS AuthS AuthS AuthS AuthS AuthS Data providers

12. The Belgian approach • eHealth-platform common basic services (provided for free): • Process orchestration • Integrated portal • User and access management • Logging • Encryption • Timestamping • Coding and anomyzation • eHealthBox • Reference directory • Consultation of the National Register and of the Crossroads Bank Registers

13. eHealth-platform basic services • Process orchestration: allows a flexible and harmoniousintegration of the differentprocesseslinked to the implementation of several basic services into one and the same application • Integrated portal:a web windowoffering a variety of online services to health care actors in order to help themprovide the best possible healthcare. The integrated portal provides all useful information on the services that are offered by the eHealth-platform, itstasks, its standards, etc. It contains, amongothers, the documents usersneed to configure the right settings in order for them to have access to the available online services.

14. eHealth-platform basic services • User and access management: allows to guaranteethatonlyauthorizedhealth care providers/ health care institutions have access to personal data to whichthey are authorized to have access • accessrules are defined by law, by authorizations of the Health Section of the SectoralCommittee (establishedwithin the Privacy Commission) • each application definesitsownaccessibilityrules • when a user authenticates its identity (using the electronicidentitycard or the token), the genericverification model of the toolis set in motion: itconsults the rulesestablished for the application, verifies if the userscomplywiththeserules and providesaccess or not to the application.

15. eHealth-platform basic services • Logging: management of a register of access to the data management system: all read, write and deleteaccesses are registered and have probative value in case of a complaint • Encryption:transport of complete and unmodified data from one point to another by makingthemindecipherable (encryption) providedthatthese data have not been decryptedwith a key. Twomethods: • in the case of a knownrecipient: use of an asymmetricencryption system (2 keys) • in the case of an unknownrecipient: use of symmetricencryption (the information isencrypted and storedoutside the eHealth-platform, the decryptionkeycanonlybeobtainedthrough the eHealth-platform) • Timestamping: makesit possible to assign a date thatisaccurate to the second to a health care document and allows, in thisway, to ensure the validity of its content throughout time by appending an eHealthsignature

16. eHealth-platform basic services • Coding and anonymization: makes it possible to hide the identity of the individuals behind a code so that useful data of these individuals can be used without infringement of their privacy + makes data anonymization possible by replacing detailed data with generalized data. These encoded or anonymized data preserve their usefulness, but don’t allow the direct or indirect identification of the person • Consultation of the National Register and of the Crossroads Bank Registers: gives authorized health care actors access to the National Register and to the Crossroads Bank Registers under strict conditions

17. eHealth-platform basic services • eHealthBox: a securedelectronicmailbox for the exchange of medical data • Reference repertory: indicateswhich types of data are stored by whichhealth care actors for which patients with the consent of the concerned patient

18. Achievements/Projects • More than 40 value-added electronic services for healthcare actors have been implemented within 3 years by several partners, always using the basic services of the eHealth-platform • eHealth-platform core business focused on electronics data's exchanges systems projects such as: • communication system of electronic patient records between care providers • electronic prescription • disease en therapy registries • Evidence Based Medicine • verification and registration of medical record software packages • semantic interoperability • …..

19. The priority: multidisciplinary data sharing Sending snapshot of the data (do not remain up-to-date) sender chooses recipient sender is responsible for sending the data to recipients who are entitled to have access to these data Sharing evolutive data the sender does not know in advance who will consult the data (eg doctor on duty) organizational measures are required to limit access to the data to those who are entitled to have access

20. Informed consent/therapeutic relationship Informed consent inform patient about the system patient may give his authorization and decide “to get into the system” healthcare providers and patient decide together which information can be shared Therapeutic relationship only healthcare providers who have a therapeutic relationship with the patient (1) have access to the information they need in order to fulfil their job (2) (1) proof of the therapeutic relationship determines access to the right patient (2) role determines which data can be accessed

21. eHealthBox Sending of messages to ‘healthcare actors’ based on Social identification number NIHDI-number CBE-number through webapplication or integrated in the medical file with (or without) encryption based on eHealth certificates/ eHealth keys other functionalities: receipt-, publication-, reading confirmation reply & forward consultation of multiple mailboxes priority level auto-delete …

22. Multidisciplinary data sharing Data from hospitals sharing of documents stored by hospitals the “hub and metahub system” extramural data sharing of structured data stored by extramural healthcare providers the “extramural vault” Coupled and interoperable standards informed consent therapeutic relationship …

23. Exchange of patient data: now Remote files unknown

24. Exchange of patient data: future A 3: Fetch data from hub A 1: Where can we find data? Meta-Hub 2: In hub A and C 4:All data available 3: Fetch data from hub C C B

25. 25 25 21/09/2012

26. Extramural health care providers VitaLink A Meta-Hub Intermed C B

27. Reference directory • Developed through a trapped system • reference to the care provider(s) or care institution(s) where one or more electronic documents are available for a patient is, with the informed consent of the patient, stored in a local or regional reference directory (a so-called "hub") • the reference directory managed by the eHealth-platform (the so-called "metahub") only contains references to the hub(s) where references for a patient are stored • Development through a trapped system • respects the organisation of regional and local networks between care providers and/or care institutions • avoids the possibility that health information about the patient can be deduced from the information stored in the reference directory managed by the eHealth-platform

28. Reference directory • Publication of the reference in a hub and the metahub requires the informed consent of the patient concerned • Access to information to which reference is made in a hub requires a therapeutic relationship between the requesting care provider and the patient concerned • A guidance committee has been created within the Consultation Committee of the eHealth-platform

29. Extramural health care vaults Content : synthetic data emanating from local information systems of different (types of) first-line health care providers (Sumehr) health care programs and health care plans journals (reference to) the vaccination status Allows a granular access control by means of software developped in a coordinated way (registered software) Can interact with the information systems of the different types of health care providers by means of open standards and computerized business processes With an operational management by bodies with representatives of the different types of first-line health care providers, hospitals and patient organizations

30. Software As A service Own Software Software As A service Own software Software As A service eHealth kadaster eHealth box Patient Informed consent by the patient Therapeutic relationships Specialist GP Pharmacist … Homecare MetaHUB eHealth basic services Hospital HUB encryption granular access NISS Extra mural vault Cloud computing

32. Without keys X!ilqshnf2@0à In DB : Key 1 Key 2 X!ilqshnf2@0à Result :

33. With key 1 X!ilqshnf2@0à In DB : Key 1 Key 2 B8i!(mà}z1&ajt Result :

34. With key 2 X!ilqshnf2@0à In DB : Key 1 Key 2 K9l#'ç9gnh3lk Result :

35. With both keys X!ilqshnf2@0à In DB : Key 1 Key 2 Clear data Result :

36. Th@nk you !Any questions ?