1

 

March 4, 2011 

The Department of Veterans Affairs appreciates the opportunity to respond to the request for 

information published in the Federal Register, Volume 75, No. 235 on Wednesday December 8, 

2010. This request for information (RFI) asks interested parties to provide information on the 

effectiveness of federal agencies participation in the development and implementation of 

standards and conformity assessment activities and programs. 

The United States (U.S.) Department of Veterans Affairs (VA) honors our Nation’s Veterans by 

providing quality health care to Veterans and their families. The Veterans Health Administration 

(VHA) is the largest provider of health care in the U.S. and has been recognized as a leader in its 

use of health care information technology (IT). Within VHA, the Office of Health Information 

(OHI) supports Veterans, doctors, nurses, and other health care providers by defining the 

requirements and direction of VA’s electronic health care system known as Veterans Health 

Information Systems and Technology Architecture (VistA). A critical component of the health 

IT standards work performed by VHA OHI resources are under the auspices of the Chief Health 

Informatics Office (CHIO). 

CHIO represents VA in voluntary consensus standards bodies and implements the standards 

developed by those organizations within VA systems in accordance with Office of Management 

and Budget (OMB) Circular A-119, and the National Technology Transfer and Advancement 

Act of 1995 (NTTAA). Additional federal mandates, such as Title XIII of the American 

Recovery and Reinvestment Act (ARRA), subtitle Health Information Technology for Economic 

and Clinical Health Act (HITECH), which establishes target dates for health care providers to 

meet requirements for the “Meaningful Use” of electronic health records (EHR), further drive 

VA’s engagement with Standards Developing Organizations (SDOs). There presently exist over 

two dozen health IT SDOs with which CHIO resources engage, actively participate, or provide a 

leadership role as appropriate to support VA’s mission. 

In addition to participating in SDOs to meet the requirements of federal mandates and initiatives 

as referenced above, VA participates to provide Veterans and their families with increased safety 

to improve patient experience and to realize cost savings for VA. Health care standards allow 

consistency of the medical record so that providers can exchange health information and also use 

the data for clinical decision support. This consistency of the medical record between providers 

significantly reduces medication errors, duplicate testing, and other dangerous errors by ensuring 

that all VA clinicians have accurate and up-to-date records. Messaging standards define how 

this health data is sent from one provider to another so that the data is understood by the EHR 

system. Standardized messaging saves money by eliminating the custom interfaces and code 

translations required if each provider or medical device vendor develops idiosyncratic methods 

of exchange. Additionally, information security standards protect patients’ personally 

identifiable information and medical history as information is stored electronically and shared 

DEPARTMENT OF VETERANS AFFAIRS
2

between providers. These advantages ultimately improve the support and services VA provides 

to our Nation’s Veterans. 

SDO participation also decreases the expense to VA of implementing required or beneficial 

standards. VA standards resources ensure that SDOs consider VA needs as they develop new or 

improve existing standards. It is more efficient for VA to engage in standards development than 

to accept the risk of having to implement standards that do not fully meet, or possibly contradict, 

VA’s needs, which would then require VA to expend resources developing workarounds or 

redundant systems. Similarly, VA’s role in SDOs facilitates the improvement of standards 

required for Meaningful Use certification. 

Additionally, VA’s effort to promote Unified Modeling Language (UML)-based standards 

development results in standards that are easier and less costly for developers to implement in 

solutions. VA has successfully introduced model based standards development in the National 

Council for Prescription Drug Programs (NCPDP) (see Appendix A) and intends to leverage this 

success to influence practices within Health Level Seven (HL7) and the Accredited Standards 

Committee (ASC) X12. VA is also promoting Model Driven Health Tools (MDHT) developed 

by VA in collaboration with Open Health Tools (OHT), to help SDOs and other federal agencies, 

such as the Department of Health and Human Services (HHS) Office of the National Coordinator 

for Health Information Technology (ONC), adopt a model driven approach to standards. 

One of VA’s earliest and most prominent successes in the standards arena was the creation of the 

HL7 Electronic Health Record System Functional Model (EHR-S FM) (see Appendix B - C). 

The model includes a description of EHR functionality that can be used to facilitate 

communication between clinicians and technology providers to ensure the right information is 

being made available for the right reason. VA standards resources took internal business 

owners’ requirements to HL7 and led the creation of the EHR-S FM that lists the set of all 

functions and the conformance criteria that should be present in EHR systems. 

Within HL7, VA has also played a significant role in helping to define policy, governance and 

processes. VA and others identified the need for formalization of processes at HL7 and drove 

this change through the Process Improvement Committee (PIC). HL7 created this ongoing 

committee in response to VA’s petition to the HL7 Board to transform the SDO into a project 

focused organization and with improved openness and flexibility. VA resources led the PIC and 

worked with other HL7 members to define and institute process and governance documents, 

including the Decision Making Processes (DMP) and the HL7 Roadmap. More recently, VA 

resources have improved HL7 processes by significantly supporting approaches such as the HL7 

Development Framework (HDF) and the HL7’s “Service Aware Interoperability Framework 

(SAIF) and Sound” approach to standards development, which demonstrates how SAIF allows 

standards to be created and ready for implementation in a single year. 

The security of information contained in the EHR and shared with trading partners is an 

important concern to VA. To this end, VA partners with the Organization for the Advancement 

of Structured Information Standards (OASIS) to specify health care profiles of existing OASIS 

standards to achieve the goal of international security and privacy interoperability (see 

Appendices D - K). VA helped lead the development of critical health profiles, including: 
3

Cross-Enterprise Security and Privacy Authorization (XSPA), Profile of the Security Assertion 

Markup Language (SAML) for Healthcare, XSPA Profile of the eXtensible Access Control 

Markup Language (XACML) for Healthcare, and the XSPA Profile of Web Services Trust (WSTrust) for Healthcare. These profiles ensured that SAML, XACML, and WS-Trust and all 

existing OASIS standards met access control needs as defined by the U.S. Healthcare 

Information Technology Standards Panel (HITSP). 

VA also participates in Global Standards One (GS1) Healthcare to develop standards to improve 

patient safety and supply chain efficiencies (see Appendix L). VA is active in Location 

Identification, Product Identification, and Traceability Adoption workgroups in GS1. Within 

these workgroups, VA promoted the use of the GS1 Global Location Number (GLN) and GS1 

Global Trade Item Number® (GTIN®) to standardize location and product identification 

throughout the health care supply chain. Adoption of these standards provides traceability of 

medical supplies that contributes to patient safety as products move from manufacturer to end 

user. 

VA, through its Chief Health Informatics Office (CHIO), has successfully partnered with many 

private SDOs and collaborated with other federal agencies promoting effective and efficient 

standards development processes. This resulted in standards that meet VA’s and other federal 

agencies needs, and also benefited the private sector and public good. The above discussion of 

standards activities along with the attached letters of commendation and press releases citing 

VA’s contribution to the standards community provide a snapshot of VA’s involvement and 

speak to the positive relationships that VA has built with the private standards community. 

The Department of Veterans Affairs, Veterans Health Administration, Office of Health 

Information, Chief Health Informatics Office officials are the points of contact and subject 

matter experts on health IT standards and we look forward to working with NIST officials in 

implementing standards and assessments to assure conformity. 
4

Appendix A 

March 24, 2010 

Linda Fischetti 

Chief Health Informatics Officer 

Veterans Health Administration 

1335 East-West Highway Suite 3100 

Silver Spring, MD 20910 

Re: Technical Support for Modeling 

I would like to commend the Veterans Health Administration and the VHA Chief Health Informatics Office 

for ongoing participation with the nation’s healthcare standards development organizations and 

commitment to modeled, interoperable standards. The support and leadership of Dr Nelson Hsing and 

Frieda Hall of the VHA Chief Health Informatics Office have afforded NCPDP with the technical expertise 

necessary to move toward model based standards development. 

Of special importance is the sharing of the talents and expertise of Galen Mulrooney and Sean Muir. They 

have been invaluable in assisting NCPDP in planning and building an implementable model framework 

and migrating to a model driven standards development environment. While the overarching model is still 

under development, it is anticipated that the first model-based NCPDP standard and implementation 

guide will move into our ballot process in August of this year. This would not have been a possibility 

without their assistance. 

On behalf of the members, in particular the Maintenance and Control Work Group’s Modeling and 

Methodology Task Group, and staff of NCPDP, thank you for your commitment to and support of the 

NCPDP modeling effort. 

Sincerely, 

Lee Ann C. Stember 

President 

National Council for Prescription Drug Programs 

(NCPDP) 

9240 E. Raintree Drive 

Scottsdale, AZ 85260 

(480) 477-1000 x 108

Lynne Gilbertson 

VP, Standards Development 

National Council for Prescription Drug 

Programs (NCPDP) 

cc: 

Tim Cromwell 

Veterans Health Administration 

Director Standards and Interoperability 

Salt Lake City VA Regional Office

550 Foothill Drive Suite 400 

Salt Lake City, UT 84113

Galen Mulrooney 

Sean Muir 

NCPDP Standardization Co-Chairs 

NCPDP Board of Trustees 
5

Appendix B (double right click below to view pages 1 – 4 of PDF) 
6

Appendix C (double right click below to view pages 1 - 4 of PDF) 
7

Appendix D (double right click below to view pages 1 and 2 of PDF) 
8

Appendix E (double right click below to view pages 1-3 of PDF) 
9

Appendix F 

This is a printer friendly version 

To print this article open the file menu and choose Print. 

Back

Article published April 10, 2008 

Demo shows promise for using XACML with EMRs

By: Joseph Conn / HITS staff writer

A consortium of information technology vendors and the Veterans Health Administration 

of the Veterans Affairs Department demonstrated this week at a San Francisco trade 

show the use of extensible access-control markup language, known as XACML, to 

provide granular levels of control over access to a patient’s personal healthcare 

information in an electronic medical-record system. 

The demonstration was part of the annual RSA Conference, a meeting of computer 

security experts. The conference, which opened Monday and closes Friday, draws its 

name from the initials of the last names of three developers of an algorithm widely used 

in encryption. 

In addition to the VA, participants in the XACML demonstration were Axiomatics, BEA 

Systems, IBM Corp., Oracle Corp., Red Hat, Securent and Sun Microsystems. All seven 

firms are members of the Organization for the Advancement of Structured Information 

Standards, or OASIS, a not-for-profit consortium that drives the development and 

adoption of open standards for computerized communication. 

The vendors were demonstrating the use of XACML to implement an access-control 

transaction package known as TP20 developed by the Healthcare Information 

Technology Standards Panel. 

Participants in the demonstration who could speak on the record were unavailable at 

deadline. 

According to a member of the demonstration team who asked not to be identified, the 

demonstration proved that XACML could be used for role-based constraints—allowing 

certain physicians to see a patient record, but not others—as well as providing patients 

with a high degree of “granular” control over access to their records—allowing some 

parts of their records to be shared, but not others. The exhibit also demonstrated the 

use of XACML to convey requests and provide access authorizations in the event of an 

emergency when patient permission is unattainable, the source said. 

“In healthcare, patient safety trumps security, so in the HITSP use case, we have to be 

able to demonstrate a ‘break the glass’ mechanism,” the source said. 

In a news release, James Clark, director of standards development at OASIS said 

XACML is widely regarded as the standard for solving complex access-control 
10

problems. The demonstration at the RSA conference “shows that XACML can play a 

key role in healthcare. By successfully enforcing fine-grained, access-control decisions 

to protected health information, XACML meets HITSP’s requirements for security and 

privacy.” 

John Davis, standards architect with the VHA’s Office of Information and a member of 

the HITSP technical committee on security, privacy and infrastructure, said in the same 

release that XACML “helps ensure that patients, physicians, hospitals, public health 

agencies and other authorized users share critical information appropriately and 

securely.” 

What do you think? Write us with your comments at hitsdaily@crain.com. Please 

include your name, title and hometown.
11

Appendix G 

From: Michelle Maas Deane [mailto:mmaasdeane@ANSI.ORG] 

Sent: Friday, April 11, 2008 3:33 PM 

To: HITSP@MAILLIST.ANSI.ORG 

Subject: 04/11/08 - HITSP Update from John D. Halamka, MD

Folks: 

1. The following documents that were recently Panel approved have been published and are now 

available on hitsp.org: 

• HITSP/IS02 - Biosurveillance Interoperability Specification and associated constructs 

(updated to reference Security and Privacy constructs) 

• HITSP/IS07 - Medication Management Interoperability Specification and associated 

constructs 

• HITSP/T31 - Document Reliable Interchange 

They will be submitted to AHIC at the June meeting. 

2. The OASIS-HITSP Interoperability demonstration took place during the RSA Conference this week. 

The InterOp demonstrated the use of the OASIS eXtensible Access Control Markup Language 

(XACML) standard to make and enforce fine-grained access control decisions to protected health 

information. The RSA Conference attracts around 17000 people and this is the first time it 

has highlighted in an InterOp demo the healthcare scenario, the Electronic Health Records (EHR) 

and associated interoperable terminologies of clinical roles, patient consent directives, obligations, 

and business logic. Congratulations to Mike Davis and the Security, Privacy and Infrastructure TC for 

a job well done. 
12

Appendix H (double right click below to view pages 1-3 of PDF)
13

Appendix I (double right click below to view pages 1 and 2 of PDF) 
14

Appendix J (double right click below to view pages 1-3 of PDF)
15

Appendix K (double right click below to view pages 1-3 of PDF) 
1

Appendix L (double right click below to view page 1of PDF)