Electronic Submission of Medical Documentation (esMD)
This presentation is the property of its rightful owner.
Sponsored Links
1 / 29

September 19, 2012 PowerPoint PPT Presentation


  • 58 Views
  • Uploaded on
  • Presentation posted in: General

Electronic Submission of Medical Documentation (esMD) Digital Identity and Author of Record Sub-Workgroups. September 19, 2012. Meeting Etiquette. Please announce your name each time prior to making comments or suggestions during the call

Download Presentation

September 19, 2012

An Image/Link below is provided (as is) to download presentation

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.


- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -

Presentation Transcript


September 19 2012

Electronic Submission of Medical Documentation (esMD)Digital Identity and Author of Record Sub-Workgroups

September 19, 2012


Meeting etiquette

Meeting Etiquette

  • Please announce your name each time prior to making comments or suggestions during the call

  • Remember: If you are not speaking keep your phone on mute

  • Do not put your phone on hold – if you need to take a call, hang up and dial in again when finished with your other call

    • Hold = Elevator Music = very frustrated speakers and participants

  • This meeting, like all of our meetings, is being recorded

    • Another reason to keep your phone on mute when not speaking!

  • Feel free to use the “Chat” or “Q&A” feature for questions or comments

From S&I Framework to Participants:

Hi everyone: remember to keep your phone on mute 

NOTE: This meeting is being recorded and will be posted on the esMD Wiki page after the meeting


Agenda

Agenda


Announcements

Announcements

  • Schedule this week:


September 2012 proposed schedule

September 2012 Proposed Schedule

AoR L1 UC E2E Review

AoR L1 UC E2E Review

AoR L1 UC Consensus

AoR L1 UC Consensus


Aor l1 uc consensus voting results

AoR L1 UC Consensus Voting Results

  • 9 Yes Votes

  • 2 Abstain Votes


Consensus voting round robin for committed members

Consensus Voting Round Robin for Committed Members

  • Yes

    • A Yes vote does not necessarily mean that the deliverable is the ideal one from the perspective of the Initiative Member, but that it is better to move forward than to block the deliverable

  • Yes with comments

    • If a Consensus Process attracts significant comments (through Yes with comment votes), it is expected that the comments be addressed in a future revision of the deliverable.

  • Formal Objection- with comments

    • Indicating a path to address the objection in a way that meets the known concerns of other members of the Community of Interest. "Formal Objection" vote without such comments will be considered Abstain votes.

    • Formal Objection

    • Should a Consensus Process attract even one "Formal Objection" vote with comments from an Initiative Member, the deliverable must be revised to address the "Formal Objection" vote (unless an exceptional process is declared).

  • Abstain (decline to vote)

7


Esmd initiative overview

esMD Initiative Overview

Registration Authority

Certificate Authority

Provider Directories

Gateway

Provider Entity

Payer Entity

esMD UC 1: Provider Registration

Contractors / Intermediaries

Agent

esMD UC 2: Secure eMDR Transmission

Provider

(Individual or Organization)

Payer

Payer Internal System

esMD AoR Level 1

Digital Identities Bundle Signatures


Aor phased scope of work

AoR -- Phased Scope of Work

Level 1 – Current Focus

  • Focus is on signing a bundle of documents prior to transmission to satisfy an eMDR

  • Define requirements for esMD UC 1 and UC 2 Signature Artifacts

  • May assist with EHR Certification criteria in the future

  • Digital signature on aggregated documents (bundle)

Level 2 - TBD

Digital signature on an individual document

  • Focus is on signing an individual document prior to sending or at the point of creation by providers

  • Will inform EHR Certification criteria for signatures on patient documentation

Level 3 - TBD

  • Digital signature to allow traceability of individual contributions to a document

  • Focus is on signing documents and individual contributions at the point of creation by providers

  • Will inform EHR Certification criteria for one or multiple signatures on patient documentation


Topics for digital identities and aor workgroup e ffort

Topics for Digital Identities and AoR Workgroup Effort

  • Identity proofing

  • Digital identity management

  • Encryption

  • Digital signatures and artifacts

  • Delegation of Rights

  • Author of Record


Definitions

Definitions

  • Identity (NIST)

    A set of attributes that uniquely describe a person within a given context.

    Identity (Proposed)

    A set of attributes that uniquely describe a person or legal entity within a given context.

  • Identity Proofing (NIST)

    The process by which a CSP and a Registration Authority (RA) collect and verify information about a person for the purpose of issuing credentials to that person.

    Identity Proofing (Proposed)

    The process by which a CSP and a Registration Authority (RA) collect and verify information about a person or legal entity for the purpose of issuing credentials to that person or legal entity.


Definitions1

Definitions

  • Digital Signature (NIST)

  • The result of a cryptographic transformation of data that, when properly implemented, provides a mechanism for verifying origin authentication, data integrity and signatory non-repudiation.

  • Data Integrity (NIST)

  • Data integrity is a property whereby data has not been altered in an unauthorized manner since it was created, transmitted or stored. Alteration includes the insertion, deletion and substitution of data.

  • Non-repudiation (NIST)

  • Non-repudiation is a service that is used to provide assurance of the integrity and origin of data in such a way that the integrity and origin can be verified by a third party. This service prevents an entity from successfully denying involvement in a previous action.

  • Delegation of Rights

  • The ability to delegate rights or authority to another to act in a specific capacity on behalf of the grantor of the right. Must include the digital identity of the grantor, the digital identity of the grantee, the rights granted, duration of grant in a format that is usable in transaction and AoR signature events and is verifiable by a third party for non-repudiation purposes.


Initiative requirement summary

Initiative Requirement Summary


Esmd requirements

esMD Requirements

* Required if the action of the responsible party is being represented by a third party


Scope for aor l1

Scope for AoR (L1)

Out of Scope

Interactions between:

  • Payer and Payer Contractors

  • Provider and Agent

  • Payer or Payer Contractor and Gateway

    Transaction level encryption

    Document level signatures and individual contribution signatures

    Defining delegation of rights within and between Providers and other authors

  • In Scope

  • Identify Proofing as part of Non-Repudiation of Actor Identity

  • Digital Credential Management required for Non-Repudiation Actions (Signingand Delegation), Data Integrity and Encryption

  • Digital Signatures and Signature Artifacts for Identity and Non-Repudiation

  • Digital Credentials and Artifacts for Non-Repudiation of Delegation as required by UC1 and AoR L1

  • Data Integrity requirement actions and artifacts

  • Encryption of PHI requirements

  • Interactions with External Provider Directories


User story workflow

User Story / Workflow

  • Overall User Story Components

    • All Actors obtain and maintain a non-repudiation digital identity

    • Provider registers for esMD (see UC1)*

    • Payer requests documentation (see UC2)*

    • Provider submits digitally signed document (bundle) to address request by payer

    • Payer validates the digital credentials, signature artifacts and, where appropriate, delegation of rights

      *User Stories for UC 1 and 2 have already been defined.

      Workgroup will help define bullets 1) and 4)


Sub workgroups

Sub-Workgroups


General requirements

General Requirements

  • Solution must

    • be implementable for pilot in Q1/Q2 2013

    • scale to all providers and payers

    • minimize the operational impact required to establish , maintain or use a digital identity

    • provide for non-repudiation without resorting to audit logs or validation of system configuration

  • Standards -- required

    • NIST 800-63-1 Level 3 (December 2011)

    • NIST 800-57 Part 1 (Revision 3 July 2012)

    • Federal Bridge Certification Authority Medium Level

    • X.509v3+ Digital Certificates


Sub workgroup identity proofing

Sub Workgroup: Identity Proofing

Deliverable: “Summary White Paper”

  • Assumptions

  • Statement of Problem

  • Recommended Solution(s)

    • Review of Standards (e.g. NIST, FICAM)

    • Certification requirements for RAs

    • Proof of identity requirements for

      • Entities

      • Individuals

    • Allowed proofing processes (e.g. as part of credentialing?)

    • Frequency of Identity review

    • Appeals process for denial

    • Variation based on specific credentials/use?

    • Revocation (triggers and process)

  • Identify gaps in current policy impacting Identity Proofing

  • References

  • Type: Sub workgroup

  • Goal

    • Define required process for identity proofing of healthcare individuals and organizations for esMD

  • Requirements

    • NIST SP 800-63-1 Level 3 authentication (December 2011)

    • FBCA Medium Level

  • In-Scope

    • RA qualifications and certification

    • Combining RA process with other healthcare identity proofing (e.g. credentialing)

    • Policy issues regarding identity proofing

  • Out-of-Scope

    • Digital Credential Management

    • Digital Signatures

    • Proxy or Delegation


Identity proofing session 1

Identity Proofing (Session 1)

  • Standards to Review

    • NIST (SP 800-63-1)

    • FBCA Medium Assurance

    • FICAM

    • NSTIC

    • IETF Standards (RFC 3647)

    • FIPS 201

  • Individuals

    • Should identity proofing of Individuals vary by role? (i.e. Physicians, allied health, etc.)

  • Discussion of RA process

    • FBCA Medium Level Assurance

    • Registration Authorities

      • Trusted Agents

      • Notary Public

      • Use of Hospitals credentialing process


Identity proofing session 11

Identity Proofing (Session 1)

  • Reference examples

    • DEA (Electronic Ordering of Controlled Substances)

    • DirectTrust.org

    • FDA (Participation in Drug Trials)

    • State-level efforts for communities in practice (Oregon, Washington, California, Maine)

      • I-9 (Validation for Employment)

    • SAFE-BioPharma

    • GSA

    • E-Prescribing

  • Experts to invite to this session (SMEs)

    • John Hall (Direct)

    • David Kibbe (DirectTrust and NSTIC)

    • DEA Representative

    • Peter Alterman (SAFE-BioPharma)

    • Federal PKI Representative (Wendy Brown)


Sub workgroup digital credentials

Sub Workgroup: Digital Credentials

Deliverable: “Summary White Paper”

  • Assumptions

  • Statement of Problem

  • Recommended Solution(s)

    • Review of standards (e.g. NIST, FBCA, FICAM)

    • CA qualifications and list

    • Issuance process

    • Credential types and forms

    • Credential uses (Identity, Signing, Proxy, Encryption, Data Integrity)

    • Specific use credentials (e.g. Direct, DEA)

    • Maintenance requirements

    • Revocation process

    • Trust anchor validation

    • Non-repudiation assurance

  • Identify gaps in current policy impacting Digital Credentials

  • References

  • Goal

    • Define required process for issuing and managing digital credentials for esMD

  • Requirements

    • NIST SP 800-63-1 Level 3 authentication (December 2011)

    • NIST SP 800-57 Part 1 (Revision 3 July 2012)

    • Federal Bridge Certification Authority (FBCA) certified Medium Level

    • Digital Certificates must be X.509 V3+ based

    • Must be from CA cross-certified with FB

    • Must provide for non-repudiation as part of the credentials and artifacts

  • In-Scope

    • Digital credential life cycle

    • Relevant standards

    • Policy issues regarding Digital Credentials

  • Out-of-Scope

    • Identity Proofing

    • Digital Signatures


Sub workgroup digital signatures

Sub Workgroup: Digital Signatures

Deliverable: “Summary White Paper”

  • Assumptions

  • Statement of Problem

  • Recommended Solution(s)

    • Review of Standards (e.g. OASIS, IHE, HL7, …)

    • Transaction signature process

    • Transaction artifacts to meet Use Case 1 and 2 requirements

    • Document Bundle signature process

    • Artifacts to meet AoR L1 requirements

    • Data Integrity requirements

    • Non-repudiation assurance

  • Identify gaps in current policy impacting Digital Signatures

  • References

  • Goal

    • Define process, artifacts and standards for transaction and document bundle digital signatures for esMD

  • Requirements

    • Must provide for non-repudiation as part of the credentials and artifacts

    • Must ensure data integrity

  • In-Scope

    • Use Case 1 and 2 transactions

    • AoR L1 (Signature binding to aggregated document bundle)

    • Signature workflow

    • Signature artifacts

    • Identification of relevant standards

  • Out-of-Scope

    • AoR L2

    • AoR L3


Digital signature session 1

Digital Signature (Session 1)

  • Standards

    • IHE

    • OASIS

      • XML DigSig

    • W3C

    • FIPS 186

    • IETF RFCs

    • IGTF (Proxy Certificates)


Digital signatures session 1

Digital Signatures (Session 1)

  • Industry Experts (SMEs)

    • Verisign/Symantec

      • GeoTrust

    • DigiCert (Scott Rea)

    • Adobe

    • Ping Identity


Digital signatures session 11

Digital Signatures(Session 1)

  • Industry Examples

    • DEA (Electronic Ordering of Controlled Substances)

    • Drug Trials (SAFE-BioPharma)

  • Validation of Trust and Non-Repudiation

    • Level 3 Assurance

    • IETF Rfc 5280, 2560, 5019, etc.

    • LTANS (Long-Term Archive and Notary Services)

    • American Bar Association (IDM Task Force)

    • EU Qualified Signatures


Sub workgroup delegation and proxy

Sub Workgroup: Delegation and Proxy

Deliverable: “Summary White Paper”

  • Assumptions

  • Statement of Problem

  • Recommended Solution(s)

    • Review of Standards (e.g. OASIS, IHE, HL7, …)

    • Proxy/Delegation Credential/Artifact(s)

    • Operational consideration for Proxy/Delegation Creation

    • Scope/Content of Proxy/Delegation

    • Revocation of Proxy

    • Credential Transaction proxy requirements

    • Transaction artifacts to meet Use Case 1 requirements

    • Document Bundle proxy signature process

    • Artifacts to meet AoR L1 signature proxy requirements

    • Data Integrity requirements

    • Non-repudiation assurance

  • Identify gaps in current policy impacting Delegation & Proxy

  • References

  • Goal

    • Define credentials, artifacts and process for Delegation of Rights for esMD

  • Requirements

    • Must provide for non-repudiation (NIST definition) as part of the credentials and artifacts

    • Revocable

  • In-Scope

    • Use Case 1 and AoR L1 Delegation of Rights requirements

    • Delegation/Proxy workflow

    • Delegation/Proxy artifacts

    • Identification of relevant standards

  • Out-of-Scope

    • AoR L2

    • AoR L3


Delegation of rights session 1

Delegation of Rights (Session 1)

  • Relevant Standards

    • OASIS

    • SAML Assertions

    • TJC (Record of Care)

    • IGTF

    • Role-Based Access Control (RBAC)

    • HIPAA Business Associate Agreement (BAA)

  • Industry Experts (SMEs)

    • Dr. Alan Sill (Physicist, Standards Coordinator within the Open Grid Forum)


Delegation of rights session 11

Delegation of Rights (Session 1)

  • Industry Examples

    • HIPAA BAA

    • AFIS (Automated Fingerprint Identification System, FBI)

    • Daon, Inc. (Biometrics)

    • Direct HISPs

    • CLIA requirements for agents or authorized individuals

    • FEMA First Responder Program

    • Provider Outpatient and Therapeutics

    • Power of Attorney/Limited Power of Attorney

  • Artifacts for Delegation of Rights

    • Proxy Certificate

    • SAML Assertion (binding two certificates for a particular purpose)


  • Login