Direct Project Update

Direct Project Update Health IT Standards Committee Meeting Arien Malec, Direct Project Coordinator

Agenda • Background • Live Implementations • Technology Providers • Major Findings and Experience • Direct Ecosystem • Brief Update on NwHIN Exchange and CONNECT

Background Background

What is Direct?Secure Directed Exchange via the Internet • Simple.Connects healthcare stakeholders through universal addressing using simple push of information. • Secure. Users can easily verify messages are complete and not tampered with en route. • Scalable. Enables Internet scale with no need for central network authority that must provide sophisticated services such as EMPI, distributed query/retrieve, or data storage. • Standards-based. Built on well-established Internet standards, commonly used for secure e-mail communication; i.e.,. SMTP (or XDR) for transport, S/MIME for encryption, X.509 certificates for identity assurance The Direct Project specifies a simple, secure, scalable, standards-based transportation mechanism that enables participants to send encrypted health information directly to known, trusted recipients over the Internet. h.elthie@direct.ahospital.org b.wells@direct.aclinic.org

Why is Direct needed?To provide an alternative to legacy mechanisms When current methods of health information exchange are inadequate: Communication of health information among providers and patients still mainly relies on mail or fax • Slow, inconvenient, expensive • Health information and history is lost or hard to find in paper charts Current forms of electronic communication may not be secure • Encryption features of off-the-shelf e-mail clients not often used in healthcare communications today Physicians need to transport and share clinical content electronically in order to satisfy Stage 1 Meaningful Use requirements • Need to meet physicians where they are now

How does Direct fit in with other types of exchange? The Direct Project provides HIEs with a low cost way to enable simple push messaging to their healthcare constituents The Direct Project doesn’treplaceother ways information is exchanged electronically today, but it might augmentthem The Direct Project supports simple use casesin order to speed adoption, but other methods of exchange might be suited for other scenarios, e.g., simple provider referrals vs. real-time population health statistics The Direct Project was designed to coexist gracefully with existing protocols for data exchange, e.g., web services, client-server, etc. The Direct Project seeks to replace slow, inconvenient, and expensive methods of exchange (e.g., paper and fax) and provide a future path to advanced interoperability. The Direct Project specifications will be incorporated into the Nationwide Health Information Network Nationwide Health Information Network Exchange Direct Project Nearby HIE EMR to EMR (HIE) Health information exchange: a puzzle with many pieces

Live Implementations Live implementations

Where is Direct implemented today? Direct Project is being demonstrated in real-world pilots across the country HealthVault (US) Rhode Island Quality Institute (RI) VisionShare (MN) MedAllies (NY) SES (MD/DC) Redwood MedNet (CA) Medical Professional Services (CT) Heartland Health(MO) Dominion (VA) VisionShare (OK) CareSpark (TN) • Direct Project is architected for rapid adoption by: • Thousands of hospitals • Hundreds of thousands of physicians • Millions of providers • Tens (or hundreds?) of millions of patients • Many other stakeholders in healthcare

Minnesota • Hennepin County Medical Center (HCMC), Minnesota's premier Level 1 Adult and Pediatric Trauma Center, in conjunction with VisionShare, has been successfully sending immunization records to the Minnesota Department of Health (MDH)utilizing the Direct Project. On average, approximately 1000 immunization records are sent each day, with an estimated 60,000 – 70,000 patients served to date. • Objective: • To demonstrate the feasibility of using the Direct Project communication protocols, security model, and addressing mechanism to securely submit immunization data from providers into a state immunization information system.

New York • MedAllies, a Health Information Service Provider or HISP, has launched a Direct pilot project to demonstrate the delivery of critical clinical information across transition of care settings in a "push" fashion that supports existing clinical workflows in the Hudson Valley of New York. To date, there are 16 providers at eight sites participating, having completed 50 transactions. • Objective: • Provide advanced support to clinicians through enabling of proactive delivery of clinical information to other providers for patient care.

Rhode Island • The Rhode Island Quality Institute (RIQI), the only organization in the nation to be awarded the Health Information Exchange, Regional Extension Center, and Beacon Community grants, has delivered a Direct Project pilot with two primary objectives: • To demonstrate simple, direct provider-to-provider data exchange between primary care providers and specialists as a key component of Stage 1 Meaningful Use. • To leverage Direct Project messaging as a means to seamlessly feed clinical information from practice-based EHRs to the statewide HIE, currentcare, integrating patient data across provider settings and during transitions of care

Maryland & District of Columbia Secure Exchange Solutions, Inc. is conducting a secure messaging proof of concept project with selected primary and specialty care clinics and specialists in Maryland and the District of Columbia. The technology provided is called SES Direct. Approximately 10 transactions are sent/received each day, with 7 provider end points in production. Objective: • This pilot is designed to address several important goals for engaging safety net providers in the automated information exchange being advanced by HITECH, including how secure messaging can optimize the pre-referral, referral and treatment note exchange between primary care clinics and the specialist community.

Virginia Dominion Medical Associates is an independent, minority physician practice located in Richmond, Virginia. Dominion Medical has traditionally been a paper-based practice but is in the process of moving toward use of an EMR. As part of this process, CenVaNet and MedVirginia are working with the practice to help in its achievement of recognition as a Level 3 NCQA Patient Centered Medical Home (PCMH). Objective: • Utilize the Direct Project standards and transactions to facilitate the referral process, improving care management and coordination services for identified chronic disease populations, including diabetes. 13

Missouri Heartland Health is an integrated health delivery system, which has become the leader in health care within a 21-county area of northwest Missouri, northeast Kansas and southeast Nebraska. Partnering with the Lewis and Clark Information Exchange (LACIE), Heartland Health is utilizing the Direct project to replace traditional fax and phone methods to improve care. To date, approximately 600 transactions have occurred. Objective: • Demonstrate the feasibility of leveraging Direct Project protocols for use in simple clinical data exchange to facilitate distribution of data and referral workflows amongst a diverse group of entities involved in the treatment/payment/operations process.

Technology Providers for Pilots Technology providers for pilots

Technology Providers for Pilots - HISPs • CareSpark • Cerner Direct • eClinicalWorks • Emdeon • Impriva • MedAllies • MEDfx/Verizon • Mirth • MobileMD • Quest/MedPlus • Secure Exchange Solutions • VA • VisionShare

Technology Providers for Pilots - EHRs • Allscripts • Amazing Charts • Care360 • eClinicalWorks • e-MDs • Greenway Medical • NextGen Healthcare • Polaris EpiChart • Siemens

Technology Providers for Pilots - Non-EHR Clients • DocSite • Email and web • Email with built-in S/MIME • MEDfx • MirthResults+CONNECT • Outlook/Exchange with S/MIME • RESTful API to HISP • Thunderbird • Web Portal to HISP

Technology Providers for Pilots - PHR & Lab • PHR • Microsoft HealthVault • Lab • LabCorp • LIS @ NorCal Hospitals (HMS, Meditech, McKesson) • Middlesex Hospital • Quest Diagnostics

Major Findings and Experience Major Findings and experience

Overview Comments • Direct is the most exciting standardization effort going on in the healthcare industry today. It would be wonderful if we can get CMS to support using Direct to communicate with the provider community. (DC/Maryland) • We continue to see the value for providers that have marginal connectivity to create a stepping stone to full EHR deployment. Direct allows swift provisioning of Meaningful Use capability requiring practically no end user installation challenges or time investment. (Virginia) • All EHR vendors on this project felt that the XDR approach was ideal for leveraging the current system workflows with minimal development effort and maximum provider benefit. The EHR vendor community has been developing IHE protocols for more than four years. This approach met them at their current capability, resulting in a very short timeline to use Direct in a robust manner…The XDR approach advances [the capability for interoperable SMTP message delivery] further with meta-data in the message, which is utilized by the receiving EHR system to incorporate the message into the practice workflow, minimizing the need for human intervention. Since the messages and documents become part of the provider’s daily workflow, adoption and usage are maximized with little training…We believe the capability will significantly increase care coordination and care management functions. (New York)

Implementation Speed/Difficulty • The process was very efficient and the system was available for testing within a short time frame. (New York) • Has been relatively smooth. Infrastructure was designed so it was very simple for end users and platform vendors to implement Direct Compatibility. The truly generic nature of the protocol has been helpful in easing the implementation, using existing protocols and not requiring anything too custom. (Rhode Island) • Partners publically stated that it was very easy to implement (less than 4 hours on both sides). (Minnesota) • Some challenges with implementation have been: • Inconsistent operation of SMTP servers • Differing characteristics between each version of each OS • Differences in how providers collect and disseminate information. (e.g., one practice uses a single MS Word document to store each patient’s information. They needed to extract single pages needing to be sent to referring provider for the encounter.) (DC/Maryland)

Implementation Speed/Difficulty (cont.) • The implementation took two weeks and was of medium difficulty. (Virginia) • From a technical perspective, there weren’t any significant barriers to standing up an operational HISP beyond the anticipated coordination of working within an existing corporate SMTP infrastructure. (Missouri) • A few observations worth noting from the business/functional perspective: • Overall support from HIEs has been extremely positive, though we have struggled from a contracting/legal perspective between HISP and end users leveraging the network. • The following can potentially slow the upgrade process: a) Organizations must consider the risk/reward of the collective functionality received with each release of any software upgrades (i.e., a new release isn’t likely to include solely Direct-enablement). b) Organizations are likely following a predetermined upgrade schedule for their organization. c) Direct represents a “core” component of the architecture, and hence draws proportionate attention and review when making upgrade decisions. • Regarding Direct-enabled standalone solutions, there is a natural resistance to incorporate solutions requiring separate login and manual extraction/inclusion of data into existing workflows. (Missouri)

Ongoing Utilization Ease/Difficulty • Quite simple by all reports. Greater difficulties in adapting to workflow, but technology is familiar. (Rhode Island) • The introduction of Direct messaging did not alter the current provider end-user roles and responsibilities. There is no difficulty of ongoing utilization anticipated. (New York) • Once installed, using Direct is quite easy. The sends are quite easy; the receives are automatic. This is working well regardless of whether or not the physicians have EMRs. (DC/Maryland) • No maintenance was needed for partners. (Minnesota)

Certificate Management • Used a DNS for certificate distribution and it worked well. Use a single trust anchor. (Minnesota) • Provider certificates were not deployed as CERT records in DNS. Used a single trust anchor created and signed by Verizon’s Certificate Authority. (Virginia) • Certificates are shared within a “social networking” environment. The certificates are exchanged using a defined, trusted API – the Direct software maintains the private and public keys. (DC/Maryland) • Worked well in pilot, but focusing on issue now for statewide rollout – how to operationalize certificate management, and not forcing providers to think too much about it if they have a central entity who can do vetting of a trust community on their behalf. (Rhode Island) • For phase 1, the pilot security model used multiple Certificate Authorities across participating entities…To enable the secured Direct exchange in a timely fashion, the plot leadership selected an approach using a multiple trust anchor, thereby preserving the current production-level security policies of the participating vendors and host data centers…For the pilot, organizational-level certificates were used instead of end-user certificates due to the nature of EHR workflow integrations. (New York)

Overall Speed/Latency • Since the transport protocol used in this pilot is an IHE SOAP-based web service, the speed of transactions is determined only by network latency between the data center and EHR locations. Latency measured was between 5 and 10 seconds. (New York) • Has been virtually instantaneous (a few seconds between send/receive). (Minnesota) • Information is moving at the speed of email. The pilots are limited by the throughput of the various of public SMTP servers. However, this has yet to prove to be an issue. (DC/Maryland) • Limited participant feedback is positive with one user stating this is “much faster than a comparable fax transmission.” (Missouri) • No issues with speed or latency faced. (Rhode Island)

Workflow • Two user stories were selected: hospital discharges to PCP and “closed loop referral” (PCP requests specialist consultation, specialist returns consultation message to PCP)…When we explained to physicians that the information would be available within their EHR systems, Dr. Ferdinand Venditti, the vice dean for clinical affairs at Albany Medical Center, and a practicing cardiologist, said, “this is the holy grail of medicine.” (New York) • [Workflow integration] will become a bigger issue as statewide rollout occurs. Adding training around Direct will be a key service of RI REC. (Rhode Island) • The justifiable and natural resistance to logging into yet another system to conduct daily business is a current reality. As more and more software providers embed Direct standards into their native workflows and/or concrete examples of benefits outweighing changes to workflow, we do believe this resistance will diminish.(Missouri)

Who has committed to implement Direct?(As of March 17, 2011) EHRs HIOs & HIE Tech States • GE Healthcare • Greenway • NextGen • OpenEMR • Polaris • RelayHealth • Siemens • WorldVistA • AAFP • Ability • Akira Technologies • Atlas Development • Axolotl • CareEvolution • Covisint • Garden State Health Systems Inc • GSI Health • Harris • Health Information Network of South Texas (HINSTx) • Ingenix • Inpriva • Kryptiq Corporation • Lifepoint Informatics • max.md • MedAllies • MedCommons • MEDfx • Medicity • MedPlus • Mirth • MobileMD • ProviderDirect • RedwoodMedNet • RelayHealth • Secure Exchange Solutions • Surescripts • Techsant Technologies • 4Medica • Allscripts • Care360 • Cerner Corporation • eClinicalWorks • eMDs • Epic • Alabama • California • Florida • Illinois • Iowa • Kentucky • Minnesota • Missouri • Montana • New Hampshire • New Jersey • North Carolina • Ohio • Oregon • Rhode Island • South Carolina • Texas • Vermont • West Virginia • Wisconsin PHRs Dossia Microsoft HealthVault NoMoreClipboard.com RelayHealth Health Systems BIDMC CHRISTUS Health Department of Veterans Affairs MPS, CT

Direct Ecosystem Direct ecosystem

What is the end state for Direct? Direct standards and specifications are developed by a group of public-private stakeholders, using an open and transparent collaborative process. • Direct Project Output: • Standards and Service Definitions • Implementation Guides • Reference Implementation • Pilot project testing and real-world implementation Vendors incorporate reference implementation into HIT products • Wide-scale adoption of Direct standards by late 2012 • Opportunity for States and HIEs to build on and drive adoption First phase grounded in real-world pilot projects implemented by early 2011 Incorporation of HITPC, HITSC, and ONC policy guidance

Brief Update on NwHIN Exchange and CONNECT Brief Update on NwHIN

NwHIN Exchange Update • 10 Current Exchange Participants DoD Kaiser Permanente VA Regenstrief Institute SSA HealthBridge CDC Inland Northwest Health Services MedVA NCHICA • Active Onboarding applicants • Qualification -- 9 (Beacon Community, State HIEs and CMS and their partners) • Validation -- 13 (7 SSA Awardees, 3 Beacon Community and 3 State HIEs) • Activation -- 5 (5 SSA Awardees) • Inquiries received: 14 (combination of State HIEs, Beacon Community awardees and others

Nationwide Health Information Network Governance Efforts • HITECH obligates ONC to establish a governance mechanism for the nationwide health information network. • ONC will do so through rulemaking. • ONC received recommendations from a Governance Workgroup of the HIT Policy Committee regarding the scope and focus of governance. • ONC is initiating rulemaking process, with notice of proposed rulemaking expected in fourth quarter of 2011.

Why address governance now? • HITECH requires it, and governance is essential to make decisions needed to accomplish national HIT agenda and HITECH goals. • Necessary for the Exchange to expand and grow beyond those entities under federal contract, grant or cooperative agreement. • Necessary in order to validate and assure that conditions for trust and nationwide interoperability exist. • States are establishing governance roles (e.g. HIE certification) in the absence of national governance. • Necessary for transparent oversight, enforcement and accountability.

Governance Workgroup Recommendations • Nine principles for governance • The federal government should support and provide strong incentives to vigorously promote adoption. • There should be shared governance responsibilities • There should be conditions for trust and interoperability and a mechanism to verify that these conditions are satisfied. • ONC should oversee NW-HIN governance and assure accountability

CONNECT Update • Expanded CONNECT developers • Mitre developing shared development environment • Aegis supporting VLER activities, with an emphasis on short-term priorities and longer-term testing strategy • Hired new technical leads for the CONNECT program management office (Tom Borja and VladiReznikov) • Ongoing Release cycles and development • CONNECT 2.5 released February 2011 • CONNECT 3.2 to be released in June 2011 • Additional Updates • Building an automated test environment for organizations to better test their CONNECT installations to be able to share data securely with other organizations using Nationwide Health Information Network standards • Expecting to award new development contract within next month

Open Source Developments • Alembic Foundation • a nonprofit built by David Riley and Vanessa Manchester, (both formerly on the CONNECT team) is using CONNECT 3.1 as their baseline for future development • CONNECT 3.1 = Aurion 3.1. Their next release will be Aurion 4.0 and may diverge from the CONNECT 3.2 code base • Auriondoes not replace CONNECT. CONNECT development will continue as we support VLER and develop a distributed development environment that includes the open source communities. • ONC remains committed to establishing modular implementation specifications and robust testing to assure interoperability • If CONNECT and Aurion both properly implement the Nationwide Health Information Network standards and specifications, they should be interoperable

Discussion Discussion

Direct Project Update