# Presentation: 130987

## Healthcare Data Cards

**Daniel L. Maloney**
**Director, Technology Service**
**Department of Veterans Affairs**
**Silver Spring, MD., U.S.A.**
**maloney.dan@forum.va.gov**
**http://www.va.gov/**

## Healthcare Data Cards

**Issues and Roles**
**Projects**
**EUROCARDS**
**G-7 Healthcare Data Card Project **
**Technical Intreoperability**
**Security**
**Standards**
**Summary**

## The Department of Veterans Affairs

**27 Million Veterans and 43 Million dependents**
**Nearly one-third of the nation’s population are potentially eligible for VA benefits, includes dependents**
**Second largest of the 14 Cabinet departments**
**Facilities in all 50 states, Washington D.C., Puerto Rico and the Philippines**
**Nation’s largest medical system with 159 hospitals, 129 nursing homes, 35 domiciliaries and 362 outpatient clinics**
**58 regional Benefit offices providing monetary, disability, pension, educational and vocational rehabilitation benefits**
**13 million home loans, and the nation’s largest insurance programs**
**114 national cemeteries**

## Functions of VA’s Public Domain Integrated Hospital Information System (DHCP)

**Clinical and Administrative Support**
**Clinical Results Reporting**
**Order Processing**
**Patient’s Medical Record**
**Accounting and National Reporting**
**Medical Care Cost Recovery**
**Integrated Medical Images at 2 sites**
**60 Applications**
**National Electronic Network for inter facility Communication**

## Potential Roles of a Healthcare Data Card

**Patient Medical **_**Identifier**_
**Insurance Identifier and Data**
**Administrative Data, Demographics**
**Emergency Data, Immunization History, Allergies, Primary Physician**
**Locations of Treatment**
**Specialty Medical **_**Data Bases**_**, Medication, Records, Portions of Medical Record**
**Social Services (WIC)**
**Credit/debit Cards for Payments, EBT**
_**Keys to access data **_**on the network**
**Secure Authentication**

## Overview - Healthcare Data Card

_**Possible Functions of Healthcare Data Card**_
**Medical Identifier (Authentication, Digital Signature) - Patient and Provider**
**Portable Data Bases, or Pointers to Data**
**Data Access Control Keys -Local or on Network**
**Social Services (WIC nutrition)**
**Financial - Insurance, Credit/debit, EBT**
_**Issues**_
**Technical interoperability - (standards = market = volume = lower cost = market ...)**
**Building the Infrastructure**
**Data Standards**

## Healthcare Data Card Projects

**Germany has completed a project distributing 80 million cards to all citizens during 1994 and 1995, along with the reader/printer infrastructure.  The German cards are memory chip cards used for insurance identification.**
**Spain announced plans to distribute 36 million cards by 1997**
**France plans to distribute Professional Cards by 1997**
**USA - DoD MARC, MediCard, WGA HPP**
**International Cooperation - EUROCARDS and G-7 Healthcare Data Card Projects**

## EUROCARDS

**EUROCARDS is a European Union (EU) Advanced Informatics in Medicine (AIM) Concerted Action on Data Card Applications in the Healthcare system**
**Created in late 1993**
**Final reports delivered in 1995**
**Developed a technical, social and legal framework for data card applications**
**European Union (EU) -Austria, Belgium, Britain, Denmark, Finland, France, Germany (originally West Germany), Greece, Ireland, Italy, Luxembourg, the Netherlands, Portugal, Spain, and Sweden**

## EUROCARDS

**Healthcare Professional Cards uses**
**Identification in machine readable form**
**Access control to information systems, local and remote**
**Signatures for electronic documents to be stored and transmitted**
**Access to patient data based on the possession of cryptographic class keys indicating certain professional status**

## EUROCARDS

**EUROCARDS priority for implementation**
**Administrative Cards and the creation of the infrastructure (readers, workstations)**
**Healthcare Professional Cards as a means of enhancing Security**
**Emergency Cards for national and international purposes**
**Patient Cards containing medical and pharmaceutical information, or pointers to the data**

## EUROCARDS - Outcomes

**Book - “Healthcare Card Systems, EUROCARDS Concerted Action Results and Recommendations”, A. Pernice, H. Doare and O. Rienhoff, IOS Press, 218 pages**
**Detailed material from EUROCARDS WG1-WG4 From Antonio Pernice DGXIII of EU**
**G7 Healthcare Data Cards - An initiative extended to US, Canada and Japan**

## What is G-7

**Group of Seven (G-7) is an organization of seven major industrial democracies who meet periodically to discuss world economic and other issues. **
**G-7 was established September 22, 1985. **
**Members are Canada, France, Germany, Italy, Japan, United Kingdom, and United States.**

## G-7 Healthcare Data Card Project

**At the Ministerial Conference held in Brussels on February 25-26, 1995, the G-7 and the European Commission established a number of projects where international cooperation could be an asset. **
**These projects would aim at demonstrating the potential of the **_**Global Information Society **_**and stimulate its deployment. **
**The projects will be initially undertaken by the G7 partners but are open.  The participation of other partners, including international organizations, is encouraged.**

## G-7 Healthcare Data Card Project

**11 Theme Areas**
**Global Healthcare Applications is Theme 8**
**Clinton Administration originally suggested the Healthcare Theme**
**Healthcare Data Card is Sub-Project 6 with an official title of "International Harmonization of Use of Data Cards in Healthcare".**
**G-7 Healthcare Data Card WWW page - http://www.va.gov/card/g7card.htm**

## G-7 Healthcare Data Card Project

_**the card is a carrier of data**_**: where the telematic infrastructure is not available, the patient, moving from one point of care to the other, and carrying in a card his/her own data and **_**pointers to remote databases**_**, actually makes a sort of "virtual" flexible infrastructure that can substitute and complement a more “physical” infrastructure (cabled or wireless).**
_**the card is a key to access the network**_**: both the **_**patient's card**_**, containing the pointers to federate remote data bases, and the **_**doctor's professional card**_**, containing the profile of the user and the associated rights to access the system and its services, constitute essential elements for the overall networked system.**

## G-7 Healthcare Data Card Project

**Two pilot areas were initially identified for a global project approach**
**an **_**international emergency card **_**with an international harmonized emergency and administrative data set (Cardlink Project)**
**an **_**international professional card **_**that will allow the **_**secure identification **_**of healthcare professionals when accessing medical data and network services (Trusthealth Project)**
**Other pilot area and projects to be sanctioned in Canada (Rimouski), USA (WGA) and Japan **

## CARDLINK Project

**Portable Emergency Record as well as pointers stored in a chip card**
**User driven, supported by European Commission**
**Interoperable European emergency data set**
**5 pilot sites - Saint-Nazaire, France; Dublin, Ireland; Milan and Rome, Italy; Valencia, Spain**
**Demonstrate standards based card and reader interoperability with multiple manufacturers**
**Measure usefulness in emergency situations**
**Begun in 9/1994, initial pilot will finish in 1996**
**CARDLINK 2 will expand to 8 countries and integrate with TRUSTHEALTH**

## TrustHealth Project

**Demonstrate trustworthy telematic systems using modern security techniques in an open systems connectivity and trans-European interoperability**
**Using smart cards and RSA asymmetric encryption for health care information security**
**User authentication, digital signatures and exchange of session keys for confidentiality protection, proof of professional registration and as access control devices**
**European Commission sponsored and started in 1995 **
**National Trusted Third Parties to issue key cards and maintain link between the user and the public key**
**9 countries and multiple suppliers, **
**Coordinated by Spri in Sweden**

## Security

**User Authentication**
**Role Based Access, Proof of Registration**
**Access Control to sensitive medical data**
**Keys**
**Symmetric keys (Private Keys)**
**Asymmetric keys (Public / Private Keys)**
**Digital signatures - proof of originator and integrity of message**
**Exchange of session keys for confidentiality encryption**
**Trusted Third Parties to issue and maintain records of keys**

## G-7 Healthcare Data Card Project

**Plans for **_**Technical Interoperability **_**- The functional goal is to allow data to be exchanged between different projects in multiple countries using equipment and cards from multiple vendors**
**International Industrial Consortium of card manufacturers and system integrators**
**European Commission  and a Japanese Proposal**
**USA meeting at CardTech on May 13, 1996 **
**Multiple **_**levels of standardization **_**are required - Standard in areas of Nomenclature,  Data Sets for emergency data, data sets for administrative data, and Standards related to various aspects of security**

## Identification Card Standards

**International Standards Organization **
**The International Standards Organization WWW Home Page (search 7810, 7811, 7812, 7813 or 7816)**
**http://www.iso.ch/welcome.html**
**ISO Standard 7810 - Physical characteristics, especially the card dimensions**
**ISO 7811 - Part 1 to 6 Embossing and Magnetic stripe**
**ISO/IEC 7812 - Identification of issuers and Application registration procedures **
**ISO/IEC 7813- Financial transaction cards **

## Smart Card Standards

**ISO 7816-1:1987 - Integrated circuit(s) cards with contacts - Part 1: Physical characteristics **
**ISO 7816-2:1988 - Integrated circuit(s) cards with contacts - Part 2: Dimensions and location of the contacts **
**ISO/IEC DIS 7816-2 Information technology -Integrated circuit(s) cards with contacts -- Part 2: Dimensions and location of the contacts (Revision of ISO 7816-2:1988) **
**ISO/IEC 7816-3:1989 - Integrated circuit(s) cards with contacts - Part 3: Electronic signals and transmission protocols **
**ISO/IEC 7816-4:1995 Information technology -Integrated circuit(s) cards with contacts -- Part 4: Interindustry commands for interchange **
**ISO/IEC 7816-5:1994 - Integrated circuit(s) cards with contacts - Part 5: Numbering system and registration procedure for application identifiers **
**ISO/IEC DIS 7816-6 - Integrated circuit(s) cards with contacts - Part 6: Inter-industry data elements **

## Smart Card Standards

**Basic card technology standards developed within ISO**
**Application specific standards for healthcare cards are developed within CEN and recommended to ISO**
**TC 224 standards related to machine readable cards and related device interface and operations**
**TC 251 determines data sets and structures**
**EMV Specification - minimum set of functions to support international operability at the interface between the card and the terminal**
**electrical characteristics, data elements and commands, and transactions flow**

## G-7 Activities in U.S.A.

**Jan 29 all G-7 projects status meeting at White House**
**February 9 coordination meeting with European Commission representatives , Government and Industry**
**EU representatives  visit U.S.A. projects in June / July**
**Technical Interoperability meeting with Europeans and Japanese representatives here at CardTech SecurTech the day of May 13, 1996. **
**Seeking U.S.A. projects to cooperate with other G-7 partners (WGA HPP, DoD, MediCard, VA, etc.)**
**Desire to form Government - Industry working group for EBT and G-7 coordination**

## Dynamic Growth

**EMV (Europay, MasterCard and Visa) Integrated Circuit Card Specifications for Payment (10/94)**
**Fortezza Card with Netscape SSL (Secure Sockets Layer) for WWW technology (10/95)**
**GEMPLUS, Hewlett Packard, and Informix team for secure access methods to data base (10/95)**
**SET (Secure Electronic Transactions) Protocol with Microsoft , MasterCard, Visa, RSA, IBM, Netscape, GTE, SAIC, Terisa Systems and Verisign  (2/1/96) may support smart cards**
**Atlanta Olympics use of smart cards**

## Summary

**Use of cards for identification, portable data base and network access**
**Internet growth and popularity is driving force to find a technical standard for safeguarding payment-card purchases made over open networks such as the Internet**
**Multiple projects working to solve this problem and we can use the same technology solutions**
**Emphasis on open standards and multiple vendor interoperability on a global scale**
**Standards lead to larger market for vendors, and lower prices for consumers**
**This will be an exciting year with rapid progress**