Nationwide Health Information Network Exchange and the SSA Patient Authorization

1. Nationwide Health Information Network Exchange and the SSA Patient Authorization June 18, 2012

2. SSA Background • Over 3 million initial disability applications a year • Over 15 million requests for medical evidence each year (3-4 medical records per case) • 500,000 sources: doctors, hospitals, etc • SSA is not a HIPAA covered entity • Require a patient’s authorization to obtain medical records • Initial Federal Agency on the Nationwide Health Information Network (NwHIN) Exchange

3. Authorized Release of Informationto a Trusted Entity Use Case • Use Case Scenario • Social Security Administration requests medical documentation from a healthcare provider with the patient’s authorization Patient Authorization Patient Authorization File Disability Claim Request Evidence Claimant SSA/DDS Providers Claim Determination Medical Evidence

4. SSA – 827 (Patient Authorization) • Requestor • Responder • Purpose • Effective Date • Effective Timeframe • Type of Information Requested • Signed

5. NwHIN Specifications & Standards • Content Structure • HL7 CDA Release 2 CCD • HITSP C32 • HITSP C62 • Unstructured Documents (pdf, txt, doc, tif, jpg, gif, png) • Vocabulary & Code Sets • ICD-9-CM • Systematized Nomenclature of Medicine--Clinical Terms (SNOMED-CT) • Logistical Observation Identifiers names and Codes (LOINC) • Consent Structure • IHE Basic Patient Privacy Consents • Transport and Security • Messaging Platform • Authorization Framework • Patient Discovery • Query for Documents • Retrieve Documents • Access Consent Policy

6. NwHIN Exchange Transaction Flow Patient Authorization Clinical Documents

7. Security Assertion • Subject ID - MEGAHIT • Subject Organization - Social Security Administration • Subject Organization ID - 2.16.840.1.113883.3.184 • Subject Role - SNOMED-CT (106328005) – Social Worker • Purpose of Use - Coverage • Patient Identifier – encoded per the NwHIN Authorization Framework specification

8. Authorization Decision Statement • NwHIN Exchange uses a Authorization Decision Statement to allow an entity to assert the requester should be permitted to execute the transaction based on a specific security policy • Access Consent Policy and Authorization Framework specifications define the format of the policy

9. Access Consent Policy XDS Metadata

10. Questions

11. For Further Information • Contact - Marty Prahl at martin.prahl@ssa.gov - Bob Hastings at bob.hastings@ssa.gov

12. Reference Materials • NwHIN Exchange Technical Specifications (all of the specifications can be found at http://www.nationalehealth.org/technical-specifications • Patient Discovery (requestor only) - http://www.nationalehealth.org/ckfinder/userfiles/files/Technical%20Specs/Patient_Discovery_Production_Specification_v2_0.pdf • Query for Documents (requestor only) - http://www.nationalehealth.org/ckfinder/userfiles/files/Technical%20Specs/QueryforDocumentsProductionSpecification_v3_0.pdf • Retrieve Documents (requestor only) - http://www.nationalehealth.org/ckfinder/userfiles/files/Technical%20Specs/Retrieve_Documents_Production_Specification_v3_0.pdf • Access Consent Policy (responder only) - http://www.nationalehealth.org/ckfinder/userfiles/files/Technical%20Specs/AccessConsentPoliciesProductionSpecification_v1_0.pdf • Core Capabilities that support the above transactions Messaging Platform -http://www.nationalehealth.org/ckfinder/userfiles/files/Technical%20Specs/MessagingPlatformProductionSpecification_v3_0.pdf Authorization Framework - http://www.nationalehealth.org/ckfinder/userfiles/files/Technical%20Specs/AuthorizationFrameworkProductionSpecification_v3_0.pdf