# Presentation: 522401

## NHIN / HISPC / SLHIE Joint Conference

**HISPC Adoption of Standard Policies Collaborative**
***May 1, 2008***
*Dallas, TX*
**Kim Snyder**

## Adoption of Standards Collaborative – Participating States 

- Ten states participating
- Arizona – Kim Snyder, Co-Chair
- Arizona Legal – Kristen Rosati, Legal Chair
- Colorado – Arthur Davidson, Project Manager
- Connecticut – John Lynch, Co-Chair
- Maryland – David Sharp, Project Manager
- Nebraska – David Lawton, Project Manager
- Ohio – Philip Powers, Project Manager
- Oklahoma – Lynn Puckett, Project Manager
- Utah – Francesca Lanier, Project Manager
- Virginia – Chris Doucette, Project Manager
- Washington – Jeff Hummel, Project Manager

**Notes:**
Some omitted

## Adoption of Standards Collaborative – Goals 

**Develop a set of basic security policy requirements for authentication and audit**
- Share information across state lines
- Focus on provider access to the HIE for treatment purposes
**Design an implementation strategy **
- Guide multi-state adoption

**Notes:**
Want to share info across state lines
This is our main focus

## Adoption of Standards Collaborative – Objectives 

**Develop a set of basic policy requirements for authentication and audit referred to as the NATIONAL HEALTH BRIDGE: BASIC POLICY REQUIREMENTS FOR AUTHENTICATION AND AUDIT**
- Authentication
- Registration
- Data sharing
- Identity verification
- Provisioning
- Maintenance
- Audit
- Data fields required
- Audit process
- Legal issues
- Establish legal chair
- Review basic policy requirements with other collaborative states

**Notes:**
What’s included in the registration process – name, role, contact, how is a person registered
Agreement including accountability – link to existing organization – 
Identity Verification – Verify that organization exists – i.e. hospital; verify individual exists
Provisioning ID – Unique identifier; characteristics of passwords 
Maintenance – password resets, revoke privileges
Audit – Using Connecting for Health Common Framework – identify fields to be audited, Categories of Logging and Audit Controls 
Not limited to: 
Audit of VIP records.
Procedures for follow-up on suspicious activity, such as indications of possible
privacy or security breaches.
Review of network intrusion detection system activity logs.
Review of system administrator authorizations and activity.
Review of physical access to data centers.
Other review of technical, physical, and administrative safeguards as established by the policies of the organization.
Follow HIPAA Requirements for Audit 
Legal chair established to coordinate all collaborative states security policies and review enforcement rules. 

## Adoption of Standards Collaborative – Objectives (continued) 

**To define an implementation strategy that guides a state’s adoption and use of the National Health Bridge (NHB)**
- Variation in policy and requirements across collaborative states
- Collaborative states network models
- Detailed set of agreed-upon policy requirements
- Suggested steps for implementation

**Notes:**
Address variations in security policy across the collaborative states with agreement on minimum requirements for sharing across state line 
Document collaborative states network models
Outline steps to implement – to include research already completed, methods for reaching consensus, lesson learned

Also going to be doing an environmental scan.

## Adoption of Standards Collaborative – Challenges 

**Specific challenges to be resolved **
- The multitude of processes currently employed by HIEs to validate authorization of a person requesting patient health information
- Variation across user/entity verification methodologies
- Policy requirements for authenticating users by state
- Enforcement of the basic policy requirements
- Alignment of efforts across the HISPC collaborative is essential as the various policy areas interact and touch upon each other in complex ways

**Notes:**
Many different methods of auditing and authenticating – goal is to reach consensus about what works and what doesn’t 
Enforcement of policies will be the biggest challenge.  Legal working group to address this in detail with the collaborative states 
Working with NHIN – leveraging work already completed – extensive lit review 

## Adoption of Standards Collaborative – Modeling States

**Modeling states will address key elements of authentication and audit within their states for review by the collaborative **
**Six modeling states**
- Arizona – federated
- Colorado – federated
- Connecticut – hybrid
- Nebraska – federated, hybrid and banking
- Oklahoma – federated
- Washington – health record banking

**Notes:**
Eight network models, using a common scenario, many to many relationship so we could explore up to 27 different business model interactions.  

## Adoption of Standards Collaborative – Schedule 

- Define Minimum Requirements for Authentication and Audit for HIE Across State Lines

**Notes:**
Talk through the major tasks for each high level category 
Many deliverables due by June 30th

## Adoption of Standards Collaborative - Task Two 	

**Define baseline models, policies, processes**
- Identify templates and data collection methods
- Literature research (HIMSS, NIST, Connecting for Health Common Framework) GSA
- Survey of existing state RHIOs
- Baseline security policies
- Baseline definitions – authentication and audit

## Adoption of Standards Collaborative – Task Three 

**Develop state-specific HIE network model specifications**
- Stakeholder outreach to define policy
- Document HIE network model, policy, procedure
- Define problematic areas
- Identify legal issues and requirements
- Summary report on modeling states’ requirements

## Adoption of Standards Collaborative – Task Four

**Simultaneous collaborative modeling and development of basic policy requirements**
- Simulate exchange given a patient health scenario
- Identify variations, similarities, trends
- Stakeholder outreach

## Adoption of Standards Collaborative – Task Five 

**Develop implementation plan for adoption of National Health Bridge (NHB)**
- Stakeholder buy-in to test NHB
- Content and layout for NHB implementation plan

## Adoption of Standards Collaborative – Task Six 

**Develop proof of concept demonstration**
- Define proof of concept
- Demo proof of concept
- Prepare NHB plan

## Adoption of Standards Collaborative 		

- Questions
- Kim Snyder at _[ksnyder@azgita.gov](mailto:ksnyder@azgita.gov)_

**Notes:**
NO website as of yet
Go through RTI site