Source: http://docplayer.net/14666828-Enhancing-access-to-prescription-drug-monitoring-programs-using-health-information-technology-work-group-recommendations.html
Timestamp: 2018-12-12 00:01:33
Document Index: 400715867

Matched Legal Cases: ['arts 160', 'arts 160', 'arts 160', 'art 2', 'art 7', 'art 4']

Enhancing Access to Prescription Drug Monitoring Programs Using Health Information Technology: Work Group Recommendations - PDF
Enhancing Access to Prescription Drug Monitoring Programs Using Health Information Technology: Work Group Recommendations
Download "Enhancing Access to Prescription Drug Monitoring Programs Using Health Information Technology: Work Group Recommendations"
1 Prepared for Office of the National Coordinator for Health Information Technology, in partnership with the Substance Abuse and Mental Health Services Administration Enhancing Access to Prescription Drug Monitoring Programs Using Health Information Technology: Work Group Recommendations August 17, 2012 Version 1.1 The views, opinions, and/or findings contained in this report are those of The MITRE Corporation and should not be construed as official government position, policy, or decision unless so designated by other documentation. Approved for Public Release: Distribution Unlimited. 2012, The MITRE Corporation. All Rights Reserved. MITRE 7515 Colshire Drive McLean, VA 22102
2 Record of Changes Version Number Date Author/Owner Description of Change 1.0 May 29, 2012 J. Hammer August 17, 2012 J. Hammer 1.1 Enhancing Access to PDMP Using Health IT i
3 Table of Contents 1 Introduction: Findings and Recommendations How to Use This Document Top 7 Findings and Recommendations Impediments for Clinical Decision-Makers in Accessing PDMP Data Low Usage Limitations on Authorized Users Current Processes Do Not Support Clinical Workflow Low Technical Maturity to Support Interoperability Lack of Effective Business Agreements Summary Introduction to Work Groups Overview of Work Groups Information Usability and Presentation Introduction Relevant Background Summary of Recommendations Recommendations Data Elements for PDMP Data Workflow Integration Patient-at-Risk Filters Electronic Data Correction Training for Using PDMP Data Topics for Further Exploration User Interface Design Usability Testing Data Content and Vocabulary Introduction Relevant Background Summary of Recommendations Recommendations Interoperability Recommendations Identity Recommendations Data Element Usage for PDMP Data Requests Topics for Further Exploration Data and Interface Specifications Enhancing Access to PDMP Using Health IT ii
4 3.3.2 Unsolicited Reports Authorized Users Cross-Reference Guide Expansion Transport and Architecture Introduction Relevant Background Summary of Recommendations Recommendations Leverage the Existing NIEM-Based Information Exchange Specification Common Set of PDMP Request Interfaces Support for Web Service Architectures Common Approach for Unsolicited Reports Security Performance Co-Transmission of Queries Patient Risk Score Unexplored Topics Authorized Users Access and Authorization Risk Evaluation and Mitigation Strategy SCRIPT Integration Law and Policy Introduction Relevant Background Summary of Recommendations Recommendations Access to PDMP Systems and Data Use of Third-Party Intermediaries to Exchange PDMP Data Unexplored Topics Inclusion of Methadone and Veterans Administration Data in PDMP Systems Funding for PDMP Systems Legal Comparison: Work Group Recommendations and Model State Drug Laws Business Agreements for Intermediaries Introduction Relevant Background Summary of Conclusions Overall Agreement Framework Enhancing Access to PDMP Using Health IT iii
5 6.2.2 Specific Details on Agreement Types Roles Using the Agreements and the Framework Assumptions Discussion Future Directions Records Maintenance Access at Individual and System Levels Unification of PDMP with the Risk Evaluation and Mitigation Strategy Unification of ASAP with the SCRIPT Standard Unified Interface Architecture Data Input and Error Correction Conclusions Acronyms Appendix A Mapping of Recommendations and Products to Tasks in the Action Plan.. 99 A.1 Pilot Studies Appendix B Work Group Participant List Appendix C PDMP Data C.1 PDMP Data Elements C.2 Data Element Exchange Standard C.3 Cross-Reference Guide C.4 Data Element Usage Appendix D Transport and Architecture D.1 PDMP Interface Parameter Template D.2 Use of Parameters in PDMP Interfaces D.3 Interface Example for Patient Data Requests D.4 PDMP Query-Enabled Pharmacy Workflow Appendix E Guiding Privacy Principles E.1 OECD Guidelines Governing the Protection of Privacy (1980) E.2 Fair Information Practice Principles Appendix F Model Business Agreements F.1 Public Entity to Public Entity Business Agreement (clean version) F.2 Public Entity to Public Entity Business Agreement (marked version) F.3 Public Entity to Private Entity Business Agreement (clean version) F.4 Public Entity to Private Entity Business Agreement (marked version) F.5 Mapping of Business Agreement Terms Enhancing Access to PDMP Using Health IT iv
6 F.6 West Virginia Business Associate Agreement Addendum F.7 West Virginia State Boilerplate Example Enhancing Access to PDMP Using Health IT v
7 List of Figures Figure 1. Status of State Prescription Drug Monitoring Programs... 2 Figure 2. Adoption of Electronic Health Records in the United States from 2001 to Figure 3. Paper Structure... 4 Figure 4. Top 7 Recommendations... 5 Figure 5. Work Group Composition and Efforts Figure 6. PDMP Data Elements to Be Displayed in User Systems Figure 7. PDMP Data Elements Incorporated in the User System Display Figure 8. Alignment of the Transport Work Group Activities with a Typical EAF Figure 9. States Allowing an Authorized Agent to Access a PDMP Database Figure 10. States Providing PDMP Access to Patients and/or Parents/Guardians Figure 11. States Not Requiring Prescribers/Dispensers to Access PMP Information Figure 12. States Requiring Prescribers/Dispensers to Access PMP Information Figure 13. States Requiring Practitioners to Register for PDMP Database Figure 14. Interstate Sharing of PDMP Data Figure 15. Umbrella Framework Figure 16. Business Landscape Roles and Data Flow Figure 17. Provider A Pilot Overview Figure 18. Provider B Pilot Overview Figure 19. Provider C Pilot Overview Figure 20. Emergency Department A Pilot Overview Figure 21. Emergency Department B Pilot Overview Figure 22. Emergency Department C Pilot Overview Figure 23. Emergency Department D Pilot Overview Figure 24. Pharmacy A Pilot Overview Figure 25. Pharmacy B Pilot Overview Figure 26. PDMP Query-Enabled Pharmacy Workflow Enhancing Access to PDMP Using Health IT vi
8 List of Tables Table 1. Work Group Titles Table 2. Data Elements for PDMP Reports Table 3. Patient Data Request Table 4. Dispenser Data Request Table 5. Prescriber Interface Table 6. Security Recommendations by Data Type (PHI vs. Non-PHI) Table 7. NAMSDL Model Act Sections Aligned with Work Group Recommendations Table 8. NAMSDL Model Act Sections Not Covered by Work Group Recommendations 85 Table 9. Description of Roles Table 10. Task Mapping of PDMP Recommendations and Products Table 11. Pilot Study Table Table 12. Common Recommendations for All Pilot Studies Table 13. Common Products for All Pilot Studies Table 14. Additional Recommendations for Provider Pilot Study B Table 15. Additional Products for Provider Pilot Study B Table 16. Additional Recommendations for Provider Pilot Study C Table 17. Additional Products for Provider Pilot Study C Table 18. Additional Recommendations for ED Pilot Study A Table 19. Additional Recommendations for ED Pilot Study B Table 20. Additional Products for ED Pilot Study B Table 21. Additional Recommendations for ED Pilot Study C Table 22. Additional Products for ED Pilot Study C Table 23. Additional Recommendations for ED Pilot Study D Table 24. Additional Products for ED Pilot Study D Table 25. Additional Recommendations for Pharmacy Pilot Study B Table 26. Additional Products for Pharmacy Pilot Study B Table 27. Mapping of Business Agreement Terms Enhancing Access to PDMP Using Health IT vii
9 1 Introduction: Findings and Recommendations Prescription drug misuse and overdose is one of the fastest growing health epidemics in the United States. In 2010, U.S. pharmacies dispensed enough opioid pain relievers to medicate every adult in America with a 5 mg hydrocodone every 4 hours for an entire month. 1 As of 2010, nearly 5% of people 12 years or older in the United States stated that they used opioids nonmedically. 2 The amount of controlled substances dispensed and used nonmedically is alarming considering that the Centers for Disease Control and Prevention (CDC) reported that in 2009, opioid drugs, including oxycodone and hydrocodone, caused more than 15,500 overdose deaths a number that is increasing. 3 The overdose death rates for all drugs including opioids increased in Louisiana, Mississippi, Kentucky and West Virginia from the years 1999 to In 2008, New Mexico and West Virginia reported the highest drug overdose death rates at 27 and 25.8 deaths per 100,000 population respectively. 5 To address the prescription drug abuse problem, many states have established Prescription Drug Monitoring Programs (PDMPs). These programs collect prescription data on medications that the federal government classifies as controlled substances and other non-controlled substance drugs. Their purpose is to reduce prescription drug abuse and diversion. PDMPs are not federally operated; they are statewide electronic databases that collect, monitor, and analyze electronically transmitted prescribing and dispensing data submitted by pharmacies and dispensing physicians. PDMP information can be useful to improve decision-making when prescribing and dispensing scheduled prescription drugs, but not all states benefit equally from these programs. Although this data is made available to authorized healthcare professionals in the majority of states, access is generally optional. States use of PDMPs also varies because these state programs were created for a variety of reasons, including law enforcement, legal and regulatory compliance, and, more recently, patient care and safety. This led to great variability in the design, process, and functions among PDMP systems. The first PDMPs were created in the 1930s. In 1992, only 10 operational programs existed. 6 As of July 31, 2012, there are 43 operational programs (see Figure 1), yet technology and policy issues and inconsistencies impact their effectiveness. Consequently, there is a movement by organizations such as the National Alliance for Model State Drug Laws (NAMSDL) and the Alliance of States with Prescription Monitoring Programs (Alliance) to make laws and technological processes for PDMPs consistent across the states. Modern 1 CDC, Vital Signs: Overdoses of Prescription Opioid Pain Relievers United States, , Morbidity and Mortality Weekly Report, vol. 60, no. 43, pp , Nov Substance Abuse and Mental Health Services Administration. Results from the 2009 National Survey on Drug Use and Health: Volume 1: Summary of national findings. Rockville, MD: US Department of Health and Human Services, Substance Abuse and Mental Health Services Administration, Office of Applied Studies; CDC. (2012). CDC National Vital Statistics System. Department of Health and Human Services (HHS). /nchs /data _access/vitalstatsonline.htm#downloadable. 4 CDC, Vital Signs: Overdoses of Prescription Opioid Pain Relievers United States, , Morbidity and Mortality Weekly Report, vol. 60, no. 43, pp , Nov Ibid. 6 K. Blumenschein et al., Review of Prescription Drug Monitoring Programs in the United States, Kentucky All Schedule Prescription Electronic Reporting Program (KASPER), June Enhancing Access to PDMP Using Health IT 1
10 technology can improve access to PDMP data, and this increased access will ultimately improve patient care. Figure 1 shows the states that currently have an operational PDMP as well as those with enacted legislation that do not yet have a functioning program. Figure 1. Status of State Prescription Drug Monitoring Programs In recognition of these important issues, the Obama Administration issued an Action Plan in 2011 to address the prescription drug abuse crisis. 7 A subsequent White House Roundtable on Health Information Technology and Prescription Drug Abuse, held on June 3, 2011, concluded that prescription drug abuse is a preventable problem requiring immediate attention. 8 As a result, the Office of the National Coordinator for Health Information Technology (ONC), in collaboration with the Substance Abuse and Mental Health Services Administration, the CDC, and the Office of National Drug Control Policy, contracted with The MITRE Corporation to identify ways to leverage health information technology (IT) to improve access to PDMPs. The current healthcare landscape is changing so that there is an increase in the adoption of health IT. As of 2010, it is estimated that over 50% of providers in the United States adopted and currently use electronic health record (EHR) systems. Figure 2 illustrates this increase in the percentage of office-based physicians with electronic medical records or EHRs in the United 7 Executive Office of the President of the United States. (2011). Epidemic: Responding to America s Prescription Drug Abuse Crisis. 8 Prescription Drug Abuse and Health Information Technology Work Group. (2011). Action Plan for Improving Access to Prescription Drug Monitoring Programs through Health Information Technology. Enhancing Access to PDMP Using Health IT 2
11 States from 2001 to Health IT systems like these can be used to improve the workflow of accessing PDMP information. For example, states such as New York passed legislation that requires healthcare professionals to check the PDMP before prescribing controlled substances. Health IT systems would be useful for automating queries in states where mandatory PDMP checks are required. The use of health IT to increase access to PDMP information is a core component of the Enhancing Access to PDMPs Project. Figure 2. Adoption of Electronic Health Records in the United States from 2001 to 2010 As part of the Enhancing Access to PDMP effort, MITRE convened Work Groups comprising individuals from the healthcare community, industry, trade and advocacy groups, and state and federal government. The project is also conducting pilot studies to demonstrate opportunities to improve access. The project s purpose is to use health IT to increase timely access to PMDP data and thus to reduce prescription drug misuse and overdose. Specifically, the project focuses on enhancing access for three types of medical professionals within a variety of care settings: Ambulatory clinic healthcare providers (e.g., physicians, nurses, nurse practitioners) Emergency department (ED) physicians 9 C. J. Hsiao et al. Electronic Medical Record/Electronic Health Record Systems of Office-based Physicians: United States, 2009 and Preliminary 2010 State Estimates, Health E-Stat, December F%2Fwww.cdc.gov%2Fnchs%2Fdata%2Fhestat%2Femr_ehr_09%2Femr_ehr_09.pdf&ei=yUUZUKr4AsL30gHIoY GgBg&usg=AFQjCNFkSRd9cWku_jZ0zM9QwwDlHDgpsw&sig2=AeAo9SZB6SPzJkTchvz7rg. Enhancing Access to PDMP Using Health IT 3
12 Dispensing pharmacists. In this report, physicians and pharmacists are referred to as prescribers and dispensers, respectively. The following chapters enumerate specific goals that the Work Groups addressed. 1.1 How to Use This Document This report contains multiple levels of information tailored to different audiences, thus there are different ways to approach reading the document, as shown in Figure 3: 1. Read the Top 7 Findings and Recommendations Section 1.2 presents the most impactful recommendations. This serves as a starting point for people in the PDMP and Health IT community who already have a context for understanding PDMPs and their current state. 2. Read the Summary of Impediments for Clinical Decision-Makers in Accessing PDMP Data Section 1.3 presents summaries of key recommendations that are organized by impediments that hinder PDMP effectiveness today. This section is geared for all audiences wanting an overview of the PDMP issues and a high-level description of key recommendations to overcome those obstacles. 3. Read the Details This document provides an in-depth look at five unique topic areas. Sections 2 6 contain a detailed set of recommendations complete with rationales, products, and/or solutions for implementation. The chapters are organized by the Work Groups convened to examine each topic. PDMP administrators, health IT vendors, lawmakers, and others involved in the intricacies of PDMPs or health IT will find this information valuable. Figure 3. Paper Structure 1.2 Top 7 Findings and Recommendations This report summarizes the findings, recommendations, and products of the Work Groups. The views, opinions, and/or findings contained in this report are those of The MITRE Corporation and should not be construed as official government position, policy, or decision unless so designated by other documentation. Enhancing Access to PDMP Using Health IT 4
13 The Work Groups developed over 45 individual recommendations to enhance PDMPs. However, seven stand out as some of the most important to increase the effectiveness of PDMPs for the user community. Figure 4 sorts these seven recommendations into three primary groups: States, PDMP Community, and Vendors. Figure 4. Top 7 Recommendations These three groups bear some of the greatest responsibility for enhancing access to PDMPs for use by prescribers and dispensers. Some of the recommendations require multi-organization coordination, while others can be undertaken by individual entities. In all cases, these seven recommendations are central to enhancing access to PDMPs: Streamline the registration process PDMP registration should improve with automatic or mandatory registration. Expand the pool of authorized healthcare professionals permitted to access PDMP data Authorized users should have the ability to delegate their access to other healthcare professionals under their supervision. Create a common application programming interface (API) for PDMP system-level access PDMPs need technology to allow other systems to query and retrieve data to supplement the standalone web portals that exist today for user-level access. Integrate access to the PDMP data into the clinical workflow PDMP information should be integrated in EHR and pharmacy systems to varying degrees of sophistication depending on resources and expertise available. Define a standard set of data that should be available in PDMP reports Every report should contain a standard set of PDMP information. Adopt the National Information Exchange Model (NIEM) Prescription Monitoring Program (PMP) specification This specification should be formally established as the standard for PDMP data exchange. Implement an agreement framework and model agreements Standard business agreements with third-party intermediaries should be widely used to facilitate PDMP data sharing. Enhancing Access to PDMP Using Health IT 5
14 These seven recommendations serve as a starting point for PDMPs and related stakeholders. They can be implemented to different degrees with great success. While some are more immediate and others require a greater degree of community organization, they are all critical to increasing PDMP usage and moving toward greater integration with other health IT. 1.3 Impediments for Clinical Decision-Makers in Accessing PDMP Data PDMPs collect and store information about prescribing and dispensing controlled substance data. Prescribers and dispensers may use this information to (1) identify patients who are abusing or diverting prescription drugs and (2) make clinical decisions regarding controlled substances at the point of care. While PDMPs contain useful information, several impediments may hinder prescribers and dispensers from accessing or using this information: 1. Low Usage PDMPs are not used as much as desired by the healthcare community and state governments, given their value to clinical decision-making, because of issues with awareness and system registration and because the data is not current or real-time. 2. Limitations on Authorized Users Members of the care team supporting prescribers and dispensers often are not permitted access to PDMP systems. 3. Current Processes Do Not Support Clinical Workflows The use of standalone Web portals and unsolicited reports does not support clinical practices and workflows. 4. Low Technical Maturity to Support Interoperability Prescribers and dispensers have insufficient access to the PDMP data. Existing solutions are inflexible and lack support for automated queries and reporting. 5. Lack of Business Agreements The business and health IT landscape increasingly contains third-party intermediaries that can facilitate the exchange of information; however, strong model business agreements are needed to adequately protect PDMP information Low Usage Considering their value to clinical decision-making, PDMPs are not used frequently. According to the Bureau of Justice Assistance (BJA) performance measures in 2010, many state registration rates are low, ranging from 5 percent to 39 percent of potential authorized users within a state. 10 These low registration rates are concerning because of the pervasive prescription drug abuse problem. A review of outpatient opioid prescription data from 2000 to 2009 shows that opioid prescriptions are on the rise. 11 Results of the study indicated that 257 million prescriptions for opioids were dispensed in Of these prescriptions, 3.8 million individual patients were prescribed extended release or long-acting opioids. PDMP information is especially relevant for prescribers and dispensers considering that, as of 2009, the majority (60%) of opioid 10 J. Eadie, BJA. (June 21, 2012). PDMP Project Question, message to L. Canzone. 11. Risk Evaluation and Mitigation Strategies (REMS) for Extended-Release and Long-Acting Opioid Analgesics, Joint Meeting of the Anesthetic and Life Support Drugs Advisory Committee and the Drug Safety and Risk Management Advisory Committee, Adelphi, MD, ugproductsadvisorycommittee/ucm pdf Enhancing Access to PDMP Using Health IT 6
15 prescriptions were dispensed from retail pharmacies, and most prescriptions were written by primary care physicians (27%). Further, emergency department physicians were one of the top five prescribers for opioids. There is a clear need to increase PDMP usage among dispensers and primary care and emergency department prescribers. Yet, there are several underlying reasons for the low usage rates: The registration process requires time-consuming and cumbersome steps that are an impediment to granting access to the system. For example, in some cases, potential authorized users must notarize their medical license and government identification before they receive access. Prescribers and dispensers are concerned that by using PDMPs, they may be at risk for increased liability. Many prescribers and dispensers are unsure of how PDMP data may support the care they provide. They also lack awareness and education about the value of these data. 12 Patient information in statewide PDMP systems may not be current. As a result, prescribers and dispensers often do not trust PDMP data and therefore do not feel that they can rely upon it when a controlled substance is prescribed or dispensed. The Work Groups identified the following recommendations, which may increase PDMP use: Recommendation 1a: Streamline the registration process States should review previously enacted registration policies and requirements to determine if they can be streamlined to facilitate higher registration rates. Some states require notarized copies of medical licenses to receive access to PDMPs; however, policies or procedures may exist that can simplify this process. Once policies that facilitate the registration process are implemented, corresponding technology can be developed, such as Web portals for electronic registration. Other solutions, such as automatically registering prescribers and dispensers to PDMPs when they are licensed, may require additional time for implementation. Further, states might consider requiring registration to expand the pool of authorized users. Recommendation 1b: Provide increased protection for authorized users to encourage greater use of PDMP systems Legal liability is an important issue, and many state PDMP laws provide protections for prescribers and dispensers. But these protections are neither universal nor consistent from state to state. To address the disparate treatment of liability for authorized users, prescribers and dispensers should not be civilly or criminally liable for complying with state PDMP laws that require them to submit or share data as part of their legitimate professional activities. Recommendation 1c: Increase awareness and education about the value and use of PDMP data at the point of care This can be achieved by creating awareness campaigns to increase the visibility of PDMP systems and their potential value and by educating prescribers and dispensers about the role of PDMP information in the drug 12 T. C. Green, How Does Use of a Prescription Monitoring Program Change Medical Practice? Pain Med, Substance Abuse and Mental Health Services Administration, National All Schedules Prescription Electronic Reporting Act of 2005 Program Grants, Enhancing Access to PDMP Using Health IT 7
16 abuse crisis. In addition, awareness and education programs also should address how to access and safeguard sensitive PDMP data appropriately. All authorized users of PDMP systems, regardless of whether they submit data to the program or query these databases, should receive appropriate education regarding the proper use of these systems. Recommendation 1d: Consider more real-time transmission of dispensed data to PDMPs to build trust in the currency of the information Dispensers report data on filled prescriptions to PDMP systems, but in most states, transmissions can occur weekly or even monthly. The reporting period for PDMP data directly affects the currency of this data; less frequent reporting results in less current data. Within the next year, it is possible to improve data currency with more frequent reporting and, ideally, real-time reporting. Additionally, these reports should be in an electronic format, as opposed to mailing or faxing paper reports. Ultimately, this will improve PDMP data currency, and as a result, prescribers and dispensers will be more likely to rely on this information as their trust in the data increases Limitations on Authorized Users Members of the care team supporting prescribers and dispensers often are not permitted access to PDMP systems. As of July 2012, only 17 of the 43 states with operational PDMPs allow prescribers to access their patients controlled-substance drug histories, but they may not delegate this authority to their staffs. Recommendation 2: Expand the pool of authorized healthcare professionals permitted to access PDMP data and grant these professionals the authority to appoint delegates who can access this data on their behalf. Prescribers and dispensers, also known as authorized healthcare professionals, should be able to delegate PDMP access to others. This delegation should be subject to the supervising professional who is accountable for the delegates actions. Enabling healthcare professionals to appoint authorized delegates would not only bring state laws and policies in line with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and current real-world clinical practices, but it also would increase the number of authorized users. Since some states prohibit authorized users from delegating access, this recommendation would require new legislation. This may be a lengthy process, depending on current state laws, but from 2011 to 2012, the number of states that permit access delegation grew from 10 to 17. States such as Iowa and Minnesota permit authorized healthcare professionals to delegate access to PDMP data, provided the delegates register for their own accounts in the PDMP system and are held accountable as agents of the healthcare professional Current Processes Do Not Support Clinical Workflow It is crucial that prescribers and dispensers have relevant PDMP information when interacting with patients. Prescribers and dispensers have limited time to retrieve and view this information, and they want to obtain it at the right point in the clinical workflow to help inform complex, controlled-substance prescribing decisions. Therefore, the Work Groups recommended creating mechanisms that provide the PDMP data at the ideal point. This could be as simple as a link within an EHR that healthcare professionals use to access the state s PDMP Web portal, to more robust solutions in which EHR systems query and store the data within the patient s record. Enhancing Access to PDMP Using Health IT 8
17 In addition, some PDMPs send unsolicited reports to prescribers and dispensers when patients exceed a predetermined threshold set by state PDMPs. For example, a dispenser may receive an unsolicited report for a patient who exceeds six prescriptions from six prescribers in a one-month period. 13 The Work Groups have noted several concerns regarding unsolicited reports; specifically, unsolicited reports are of less value to clinical decision-making. These reports are unanticipated by the recipients and currently are delivered through a variety of methods, including fax or postal mail; yet, these notifications do not occur frequently enough to support current workflows. Often the information is not available at the right time, such as when the patient is present and decision-making is occurring. Further, attaching a paper report to a patient s record in an EHR can be difficult. Improving access to and the usability of PDMP data may reduce the need for unsolicited reports in the long term; however, the following solutions may quickly improve the value of current processes for accessing PDMP information: Recommendation 3a: Integrate access to the PDMP Web portal into the clinical workflow Reducing the effort required to use PDMP data is critical for increasing use. Since these users already work within EHR and pharmacy systems, if the PDMP data is available in these user interfaces (UIs), there will be minimal disruption to their normal workflow. This single point of access for PDMP and patient health data also would eliminate the time and resources wasted by multiple user accounts, system logons, and multiple UIs. Recommendation 3b: Consider secure electronic communication of unsolicited reports Secure messaging options, such as , efax, and Direct messaging, will help shift away from postal mail and fax reports. Lightweight, standardized, secure messaging technologies such as Direct messaging will provide more timely access to these reports and will provide a more effective means to attribute the report to a particular patient. 14 Recommendation 3c: Prescribers and dispensers should receive an alert or notification when they receive an unsolicited report concerning a patient One of the primary limitations to using unsolicited reports is that they are unanticipated, so they often are overlooked. Prescribers and dispensers would benefit from an electronic alert or notification upon receiving the unsolicited report. Integrating this alert with the patient s records, such as in the EHR, would be ideal. Recommendation 3d: Provide a variety of mechanisms for PDMP access at the point of care PDMP system queries should occur around the time that the patient is seen in the clinical setting. This ensures that patient information is current during clinical decision-making. Short-term solutions include user-initiated querying (via a link or button in the EHR or pharmacy system) as well as longer-term ideas, such as systems generating queries at appointment-making, patient check-in, or point of prescribing. Healthcare organizations such as hospital and ambulatory systems should work with their EHR or pharmacy system vendors to identify the optimal workflows for their organizations. The one type of transaction not favored by the Work Groups was 13 Ibid. 14 Direct provides a standard and universal method for healthcare professionals to send secure messages over the Internet. See for more information. Enhancing Access to PDMP Using Health IT 9
18 co-transmission, or partnering the PDMP data request with other requests such as third-party payer eligibility checks. Co-transmission was not ideal because it placed PDMP information in a suboptimal position in the user s workflow. Recommendation 3e: Define a standard set of data that should be available to support clinical decision-making There currently is no standard for the specific data that must be included in all PDMP reports. The Work Groups identified a recommended standard data set to be included in a PDMP report, including data elements for patient, prescriber, dispenser, and prescription information. This data set was based on the American Society for Automation in Pharmacy (ASAP) 2009 standard, 15 which is used to report dispensing data. In addition, the Work Groups identified a subset of the most relevant controlled-substance history for patients to be displayed in EHR and pharmacy systems. Lengthy or cluttered displays of PDMP information decrease effective use. In an ideal scenario, a prescriber would open a patient s record in the EHR to view a shortened list of the patient s most relevant PDMP information. This shortened list would contain the most valuable 10 items from the PDMP report. At the top of the shortened list, there would be a summary including the total number of prescribers, dispensers, and prescriptions for controlled substances for a patient over the last year. This summary and shortened list would allow prescribers and dispensers to quickly view only the most valuable PDMP information and determine the need to retrieve the entire set of data in a PDMP report Low Technical Maturity to Support Interoperability To provide timely and accurate information at the point of care, it would be helpful to automate the query of patient PDMP reports and the availability of the reports in the workflow at the time of clinical decision-making. However, there is a lack of technical, system-level access and standards among PDMPs and the EHR and pharmacy systems that prescribers and dispensers use to support automated queries and reporting. In addition, no formal standards or specifications exist for sharing a PDMP report electronically with a prescriber or dispenser. Several options are available to PDMPs for sharing reports with other states, some of which include the use of data sharing intermediaries, or hubs. Specifically, two interstate PDMP data-sharing exchanges are in operation today: the Prescription Monitoring Program Interconnect (PMPi) and RxCheck. These solutions are converging on existing common standards that will enable nationwide query and reporting capability. However, despite the progress to date, the standards were created primarily to support sharing among PDMP systems; incorporation of additional user groups such as dispensers and prescribers may require modification or enhancement to the process and specifications. Considering the PDMP landscape, several recommendations can be implemented within a year to improve interoperability. Recommendation 4a Adopt the National Information Exchange Model (NIEM) Prescription Monitoring Program (PMP) specification as the common specification for exchanging PDMP reports with prescriber and dispenser organizations. This specification is already in use for PDMP data exchange, is reusable and extensible, and has become a de facto standard for data exchange. The NIEM PMP information exchange specification American Society for Automation in Pharmacy (ASAP) Prescription Drug Monitoring Program Standard, Version 4.1, Enhancing Access to PDMP Using Health IT 10
19 currently is the basis for PDMP interstate data access and exchange. The Prescription Monitoring Information Exchange (PMIX) architecture has already implemented the foundation for the NIEM PMP data and messaging specifications for interstate data exchange. In addition, PMPi also uses the NIEM PMP specification. Formalizing this specification would establish a single standard so that vendors could confidently move forward and build solutions for interoperable PDMP data exchanges. One option would be to formally add the NIEM with PMP extension data exchange specification to the NIEM Health Domain managed by ONC. This would expand the specification from an ad hoc solution to a formalized specification with a permanent home under a sponsoring organization with full life-cycle management. Because two different interstate exchanges currently use NIEM PMP, the schemas may need to be consolidated before the NIEM Health Domain adopts them. Recommendation 4b Develop system-level access (API, Web services) to support computer-to-computer integration with statewide PDMPs An authoritative body would specify the API that all vendors would need to support; this should be done once (not state by state), but it would take more than a year to finish. States should demand that PDMP vendors provide a data access API as an intrinsic (i.e., not extra cost) product feature. This would be achieved during the acquisition process. Specifically, an API should be a requirement for a vendor s solution. While this effort is in progress, states can use interstate exchanges (such as PMPi and RxCheck) to provide access to PDMP data even to intra-state clients. This approach, while not technically optimal, worked well for several of the PDMP pilot tests. Recommendation 4c Define the requirements for the three common types of PDMP data requests to shorten the implementation time for organizations and to improve interoperability. Workflow analysis revealed that only three basic kinds of requests for PDMP data exist. As such, the full spectrum of current PDMP data access requires building a general purpose interface able to request patient, prescriber, and dispenser data. The Work Groups used this knowledge to enumerate and define the specific data fields that prescribers and dispensers would need. In addition, the Work Groups developed the following products and recommended their use to ensure technical and semantic interoperability for accessing patient, prescriber, and dispenser data: A common set of Data Elements and definitions, including a human-readable view of the data. The Data Elements are needed to: o Configure a query that uniquely identifies prescribers, dispensers, and patients o Specify the kind of data being requested from these systems. A generic and reusable Data Element Exchange Standard that explains how to electronically define and exchange the Data Elements 16 An application programming interface (API) is a specification that allows two or more different software components to communicate. 17 A Web service is communication among different systems over the Internet. Enhancing Access to PDMP Using Health IT 11
20 A Cross-Reference Guide that maps the Data Elements onto other data specifications to eliminate any ambiguity in the correlation of different data definitions used by different systems The NIEM Information Exchange Package Documentation (IEPD) can encapsulate the human-readable data element view and the electronic data exchange standard. These items have been described separately to emphasize their importance. Recommendation 4d: Share and distribute PDMP technical information and products Using a collaborative infrastructure for advertising, sharing, updating, and testing conformance would help PDMP system and EHR and pharmacy system vendors effectively adopt and use the API, Data Elements Table, Data Element Exchange Standard, and Cross-Reference Guide products Lack of Effective Business Agreements The business and health IT landscapes increasingly contain third-party intermediaries that facilitate the exchange of PDMP information. Intermediaries such as Health Information Exchanges (HIEs) and benefit-management switches already facilitate a variety of data transactions among healthcare organizations, including both payers and prescribers. Leveraging these components of the health IT ecosystem provides both opportunities and risks, and these interactions should be managed carefully. There is an increasing need for HIEs and other intermediaries to implement appropriate agreements corresponding to their projected increased participation in PDMP data dissemination activities. Thus, strong and enforceable agreements are needed to govern the collection, use, disclosure, storage, and other aspects of PDMP data exchange. Yet establishing the appropriate set of agreements is a time-consuming process requiring extensive expertise. Recommendation 5: Implement an agreement framework and model agreements to facilitate data-sharing through intermediaries Standardization of legal agreements advances the goal of facilitating better PDMP data-sharing among authorized users in every jurisdiction. The third-party intermediaries that provide services on behalf of the PDMPs should use well-drafted contracts and agreements based on a comprehensive legal framework. The Work Groups developed examples of these agreements, available in the appendices, which can be implemented. These can supplement the existing agreements in place between interstate data hubs and individual state PDMPs. Over time, the Work Groups hoped that the existing agreement infrastructure will continue to build. This should reduce the need for new agreements, and in addition, the individual agreements may converge to create best practices Summary The previous section contained a discussion of the various impediments for accessing PDMP data at the point of care. The recommendations are a compilation of the Work Group findings. The following section describes the Work Groups, the goals they addressed, and how they were composed. Enhancing Access to PDMP Using Health IT 12
21 1.4 Introduction to Work Groups Overview of Work Groups Work Groups convened to address issues impacting the use of and access to PDMP data. The diverse set of members relied on their extensive knowledge and expertise to develop recommendations and products that should be used to increase the usefulness and availability of PDMP information. Ultimately, prescribers and dispensers may use this information to make more knowledgeable decisions regarding the prescribing and dispensing of controlled substances. The Work Groups considered the following goals when making their recommendations: Connect PDMPs with existing health information technologies to rapidly introduce change Provide timely access to PDMP data in the hopes of identifying issues prior to prescribing Establish standards for facilitating information exchange to improve interoperability Increase overall practitioner use of PDMP data to facilitate the appropriate prescribing of controlled substances Ultimately reduce drug overdose and deaths The Work Groups explored the legal, technological, and operational aspects of the PDMP data and user landscapes, and they developed specific recommendations aimed at improving timely access to PDMP information. The Work Groups also addressed a wide variety of complex issues involving laws and policies, access to and use of PDMP information, and enabling technologies, as listed in Table 1. For brevity, Work Groups will be referred to by their abbreviated title in the report. Table 1. Work Group Titles Name Information Usability and Presentation Data Content and Vocabulary Transport and Architecture Law and Policy Business Agreements for Intermediaries Abbreviated Name Usability Work Group Vocabulary Work Group Transport Work Group Law Work Group Business Agreements Work Group Each Work Group developed specific recommendations designed to benefit a variety of entities in the PDMP landscape, including PDMP administrators, state law and policy makers, practitioners, technology vendors supporting these communities, and members of federal agencies, including congressional leaders. The Work Groups developed recommendations and Enhancing Access to PDMP Using Health IT 13
22 products that were guided by questions and issues enumerated in the task list of the action plan. 18 These recommendations and products are mapped to the original tasks and pilot activities in the action plan (see Appendix A). Figure 5. Work Group Composition and Efforts Work Group members represented diverse perspectives and a variety of relevant healthcarerelated business and technology interests (see Appendix B). Federal agencies also were represented. These members were recruited through a voluntary and open process and selected for their expertise in a field related to the project s goals. Great consideration was given to selecting members from relevant backgrounds who would add significant knowledge to the Work Groups. Figure 5 illustrates the breadth and the depth of the Work Group composition. 18 Prescription Drug Abuse and Health Information Technology Work Group. (2011). Action Plan for Improving Access to Prescription Drug Monitoring Programs through Health Information Technology. Enhancing Access to PDMP Using Health IT 14
23 2 Information Usability and Presentation 2.1 Introduction The Information Usability and Presentation Work Group, also known as the Usability Work Group, focused on how PDMP information should be presented in the user interfaces (UIs) of pharmacy management systems and provider and ED EHRs, also known as User Systems. The Work Group s objective was to maximize the value of PDMP data for treatment and drug-dispensing decision purposes. The members addressed the content and structure of data display for the prescribing or dispensing decision maker, focusing on what information is needed to enable appropriate decisions. The Work Group developed specific recommendations about how data sent from PDMPs should be presented to individuals responsible for making treatment decisions. The following individuals are authorized users (the Users) of PDMP data: Physicians, including both ambulatory practices and ED practitioners (referred to as prescribers throughout this document) Pharmacists or dispensing physicians (referred to as dispensers ) Healthcare professionals who are authorized delegates appointed by either dispensers or prescribers (referred to as delegates ) The Work Group set out to achieve the following three goals: 1. Identify the minimum set of PDMP information required for decision-making. 2. Evaluate the usefulness of patient-at-risk filters for prescribers or dispensers. 3. Determine how accessing PDMP reports would alter a User s typical workflow. Provide recommendations for mitigating any changes Relevant Background To accomplish its goals, the Work Group considered how prescribers and dispensers would use PDMP information and would interact with the PDMP and User Systems. The usability of systems and the presentation of information are important factors in realizing the full advantage of these systems. Since a key usability consideration is understanding the Users perspective and how they typically work, the members took time to examine the typical workflow for each type of User. For example, dispensers often are required to fill a prescription no later than an hour after receiving the prescription order. This process includes several tasks such as inputting the prescription information in the system, verifying the prescription with the prescriber, receiving authorization from the patient s insurance, and filling the prescription. In addition, dispensers often log in to multiple terminals, speak with patients, answer phone calls from prescribers, and handle additional interruptions. Therefore, the process of accessing PDMP information for dispensers should be: Easy Efficient Within the User s current workflow Enhancing Access to PDMP Using Health IT 15
24 The members considered these guiding principles when creating their recommendations Summary of Recommendations This section provides several recommendations that enhance how Users access PDMP information. These recommendations are grouped according to the following topic areas: Data elements for PDMP data Workflow integration Patient-at-risk filters Electronic data correction Training for using PDMP data The Work Group identified the following principles to guide these recommendations: PDMP information should be current and timely, meaning that the data should be as up-to-date as possible and available when needed. Information should be presented to Users within their normal workflow. The ideal scenario is for the PDMP data to be integrated in the Users System. 2.2 Recommendations Data Elements for PDMP Data Complete List of Data Elements for PDMP Reports In an ideal scenario, there would be a standard set of information that must be included in all reports across different state PDMPs. However, numerous state law, policy, and technical challenges are barriers to achieving this ideal scenario. Prescribers and dispensers would like to have access to the most relevant PDMP information when caring for a patient. The Work Group reviewed a variety of PDMP reports and agreed upon a standard data set that should be available in all reports, shown in Table 2. Specifically, this recommendation is based on the data elements provided in the following documents: American Society for Automation in Pharmacy (ASAP) 2009 Prescription Drug Monitoring Program Standard, Version 4.1 Prescription Monitoring Program Model Act 2010 Revision, Alliance of States with Prescription Monitoring Programs 19 Prescription Monitoring Information Exchange (PMIX) Service Specification Package (SSP), Version (December 2011) 20 PMIX Information Exchange Package Documentation (IEPD) as provided in the PMIX SSP, Version (December 2011) Alliance of States with Prescription Monitoring Programs, Prescription Monitoring Program Model Act 2010 Revision, Voorheesville, NY, June 28, Alliance of States with Prescription Monitoring Programs, PMIX, Enhancing Access to PDMP Using Health IT 16
25 Table 2. Data Elements for PDMP Reports Patient Information First name Last name Street address City State ZIP code Date of birth Identification (ID) qualifier and/or patient identifier (situational) Gender code (situational) Species code (situational) Phone number (situational) Prescriber Information First name Last name Street address City State ZIP code Phone number (situational) Drug Enforcement Agency (DEA) number (situational) Dispenser Information Pharmacy or dispensing prescriber name Street address City State ZIP code Phone number (situational) DEA number (situational) National Council for Prescription Drug Programs (NCPDP)/ National Association of Boards of Pharmacy (NABP) Provider ID (situational) National Provider Identifier (NPI) (situational) Prescription Information Name of drug Strength Form Quantity dispensed Days supply dispensed Date prescription filled Date written Refills authorized Refill number Refill status to indicate a full or partial refill Prescription number Note: The term situational describes data elements that are available only in some state PDMPs Enhancing Access to PDMP Using Health IT 17
26 Future PDMP Data Elements and Functionality Users search the information in a PDMP report to look for patterns of drug abuse or diversion. Some prescription data is not currently collected by these programs, but in the future, this information would be useful at the point of prescribing or dispensing. The following three data elements suggestions currently are not collected, but they can be useful to determine which patients are at risk for abusing prescription drugs. For example, payment type may be useful because drug-seeking patients often will pay out of pocket for their prescriptions. Further, the inclusion of patient instructions will remove the ambiguity of dispensers deciphering the providers instructions, which they typically do by calculating the days supply and quantity dispensed. However, patient instructions will only be useful when there is greater standardization for how these instructions are written. Recommendations: PDMPS should collect the following data elements in the future: Drug administration instructions: This should be included, but only after there is more standardization of the format and how this information is written. Payment type First and last name of the person picking up the prescription (if different from the patient) Timeliness and Currency of PDMP Data Reports Prescribers and dispensers have a short period of time to interact with a patient and make a decision about whether to prescribe or dispense a controlled substance. The PDMP information is useless after the patient interaction, so the response time of the PDMP system is vital. Further, some PDMP data is not current, meaning that the data may not reflect controlled substance history in real time. This lack of currency occurs because several PDMPs only require dispensers to report prescription information to the PDMP once a week, or even once a month. The reporting requirements directly impact the currency of data so that more frequent reporting leads to more current data. Unfortunately, patients who frequently abuse or divert prescription drugs may collect multiple prescriptions within the course of a few hours or days, so it would be helpful for dispensers and prescribers to see a patient s most recent activity. In the future, it would be ideal for PDMP information to be as timely and current as possible to provide the most useful data to Users. Enhancing Access to PDMP Using Health IT 18
27 Recommendations: Dispensers and prescribers should have timely access to PDMP data, which means that they should receive the data within 30 seconds after a request. The data should be available while the prescriber or dispenser is still interacting with the patient. The PDMP data should be as current as possible. Users should receive a disclaimer stating that the data is current the day it is received, but data currency can change over time because of additions and corrections. In the future, it would be ideal if the PDMP data was updated at the point that the User requests a PDMP report so that the data reflected all prescription activity in real time Default Length of Patient Drug History in PDMP Data Chronic pain and drug addiction are persistent conditions, and the PDMP data should indicate patients who are suffering from these illnesses. Therefore, dispensers and prescribers benefit from seeing a patient s history of controlled substances over several months. This allows them to determine if there is a pattern of potential prescription drug abuse. At a minimum, dispensers and prescribers should see at least six months of a patient s controlled substance history in a report for an initial evaluation with a patient or if they are new Users of a PDMP system. Providing 12 months of data is ideal because it allows the User to view the patient s pattern of controlled substance use. Recommendations: Dispensers and prescribers should receive a minimum of six months of a patient s controlled substance history in the patient s PDMP data. Ideally, they would be able to request one year of information Workflow Integration Integrating PDMP Data in User Systems Currently, prescribers and dispensers must access a separate system to view PDMP data. Accessing a separate system outside a User s System is time-consuming and frustrating because prescribers and dispensers have limited time. Many prescribers and dispensers work under time pressure and often are inundated with interruptions. Most importantly, dispensers and prescribers must deviate from their normal workflow to access this data. Depending on the circumstances, a prescriber or dispenser may spend three minutes or more retrieving a patient s data from a Web-based portal. Enhancing Access to PDMP Using Health IT 19
28 Users will be less likely to access PDMP information if the process requires several actions and takes longer than a few minutes per patient to retrieve the data. Therefore, Users should be able to access data without deviating from their normal workflow. Ideally, they should be able to retrieve this data through their User Systems. The Work Group considered three different options to integrate PDMP data in User Systems. All of these options have value to the Users because they (1) enhance access to PDMP information and (2) reduce the amount of time and number of steps required to view the information. The following recommendations range from low-level integration to full integration. Each recommendation is discussed as a possible option for integrating PDMP data in User Systems: A single sign-on (SSO) to the PDMP and User System A link to the PDMP system that automatically passes query information Full integration of PDMP data in the patient record within a User System Single Sign-On to the PDMP and User System Currently, dispensers and prescribers must leave their normal system and log on to a separate system to view PDMP data. This discourages Users from accessing this data. Most prescribers and dispensers log on to their User System as a normal part of their workflow. Signing on to a separate system, such as the PDMP system, adds tasks to a User s normal workflow and requires more time. At a minimum, Users should be able to automatically sign on to the PDMP system based on their User System credentials. This would be more efficient and less frustrating to dispensers and prescribers. It may be possible that the SSO can occur concurrently with requests to the state HIE or e-prescribing system. Recommendations: Dispensers and prescribers should be granted access to the PDMP system by signing in to their User System. The SSO to the system will depend on the level of trust in the credentialing and authentication processes for the User System. There may be different levels of access depending on the level of trust in the User System. For example, for systems with lower levels of trust, the User could be granted access to the system only when retrieving PDMP data or when electronically prescribing. Authentication should not interfere with the User s workflow. The User should be logged out of the PDMP system after a period of inactivity not to exceed 20 minutes. Users could be logged out of the system as soon as the report is closed for systems that have less rigorous credentialing and authentication. Users should receive a short message concerning their responsibility to protect the patient s protected health information (PHI). Enhancing Access to PDMP Using Health IT 20
29 A Link to the PDMP System that Automatically Passes Query Information Currently, dispensers and prescribers do not have a direct link to PDMP information from their User Systems. At a minimum, Users should have an SSO for the PDMP and their User System. However, dispensers and prescribers would benefit from an additional level of integration: providing a link in the User System would automatically (1) pass the query credentials and (2) populate the query information in the PDMP system. This option would be more efficient than pulling up the PDMP system, even if the User is already signed in due to the SSO capability. A common Applications Programming Interface (API) for accessing PDMP data is recommended in subsection This API should support passing queries along with the required query credentials as part of the PDMP interface. Recommendations: Dispensers and prescribers should have the ability to click a link in their User System that would allow them to more efficiently access a patient s PDMP data. The link should automatically populate the following search fields from information in the patient file within the User System: First name Last name Date of birth Address (situational) Gender (situational) The PDMP system would be populated with the correct patient information because the link would be located within a patient s file. If multiple patients match the query, then the report should not be sent until the correct patient is selected from a list of possible patients. If multiple patients match the query and the User cannot determine the correct patient, then the User should receive an error message that reads Deferred for manual review, and the PDMP system administrators will review the request. Users also should be able to specify the search parameters before searching for a patient s data in the PDMP system. However, the search parameters may not be accessible depending on the system. Enhancing Access to PDMP Using Health IT 21
30 Full Integration of PDMP Data in the Patient Record within a User System Dispensers and prescribers have limited time to retrieve and read PDMP reports in a PDF format from a separate system. Users could provide better patient care if they were able to view this data in the context of the patient s history in the User System. Prescribers and dispensers are more likely to view the PDMP information and use it to make clinical decisions when the information is clearly visible in their normal workflow. Therefore, PDMP data should be integrated in EHR and pharmacy systems. Prescribers and dispensers should not be overwhelmed with a cluttered display of PDMP data. Instead, they want to view only the most relevant information. A large amount of information should be transferred electronically for PDMP reports. Users will want the option to view the full list of information; however, dispensers and prescribers will become overwhelmed if they must visually search all available PDMP information displayed in the UI. They will be less likely to use the PDMP information if the display is not well formatted or is cluttered with too much information. Users can benefit from a small subset of PDMP information because this would greatly reduce the full list to only the most relevant information. When time is of the essence, dispensers and prescribers will be able to scan this subset of information and make a quick judgment without reading the full list. Therefore, a minimum, useful set of information should be readily visible for these Users, and further information should be viewable if more detail is needed. Enhancing Access to PDMP Using Health IT 22
31 Recommendations: The ideal recommendation is to provide the PDMP data in the User System. There should be a shortened list of prescription information from the PDMP system that includes the following information (see Figure 6): Date prescription filled Prescriber first and last name Name of drug Strength Quantity dispensed Days supply dispensed Indicator of new or refill prescription Refills authorized Data prescription written Dispenser This information should be listed in chronological order according to the date a prescription was filled, beginning with the most recent prescription at the top of the list. Users should be able to sort the list. At the top of the list there should be a summary of the total number of prescribers, pharmacies, and number of prescriptions in a 6-month to 1-year period. This summary also could be achieved using a score or statistic of the patient s history of controlled substances. Users should have the ability to retrieve the full list of information sent in a PDMP report. One example of this recommendation is the ability to view more information through an additional action such as scrolling over the following data elements to view additional information: Scroll over Prescriber to view the prescriber s full address and phone number (if available) Scroll over Dispenser to view the dispenser s full address and phone number (if available) Enhancing Access to PDMP Using Health IT 23
32 Figure 6 shows one way of structuring a PDMP report with a minumum set of data. Figure 6. PDMP Data Elements to Be Displayed in User Systems Integration of Unsolicited Reports in User Systems There are two types of PDMP reports: solicited and unsolicited. The difference between these reports depends on the circumstances of the report s generation. A solicited report is any report that is generated because it is requested by the recipient of the report. For example, a prescriber may suspect that a patient is abusing prescription drugs and requests that person s PDMP report. An unsolicited report, or push report, is generated because program personnel query the PDMP database, identify patterns of suspicious behavior, and send a report to authorized Users without their request. In this case, the recipients do not expect the report. Dispensers and prescribers may be unaware of unsolicited reports because there is no consistent mechanism to notify them. Currently, Users are notified of unsolicited reports by efax, , and sometimes fax or postal mail. However, prescribers and dispensers will need to receive a notification, preferably via or another electronic message that can directly take them to the PDMP data. Ideally, this notification would be viewed in the EHR or pharmacy system or as an that provides a link to the PDMP data. Recommendations: Dispensers and prescribers should be able to receive a message or alert (see Figure 7) in the EHR or pharmacy system or as an that contains a link to the unsolicited PDMP report. Figure 7 provides an example of how different data elements could be organized into an EHR or pharmacy system UI. Enhancing Access to PDMP Using Health IT 24
33 Figure 7. PDMP Data Elements Incorporated in the User System Display Patient-at-Risk Filters A patient-at-risk filter is any system or threshold that can be used to identify patients who may be misusing or diverting prescription drugs. The purpose of these filters is to highlight the most likely prescription drug abusers. These filters are considered a useful tool for surveilling the patient population. 22 Because the majority of patients are not considered at risk, these filters enable dispensers and prescribers to prioritize their list of patients and view the PDMP reports for only high-risk patients. Various criteria are used to identify at-risk patients. Some states consider patients high risk if they fill six or more prescriptions for controlled substances from six or more prescribers or six or more dispensers in a single month; this is called the threshold. The Work Groups also discussed the possibility that prescribers and dispensers have the ability to create customizable thresholds and criteria. This customization would provide the freedom to set more stringent thresholds depending on the prescribers and dispensers personal preferences. Other criteria could be used to determine patients-at-risk including attempts for early refills and the number concurrent prescriptions of a controlled substance. Overall, the purpose of these filters is to reduce the time users spend sifting through several PDMP reports so that they may focus on the most valuable information. Dispensers and prescribers do not have time to review every patient s report; therefore, these filters may benefit Users by sending information on only high-priority patients. The Work Group discussed the usefulness of applying a patient-at-risk filter to PDMP data to sort the most at-risk patients. Without data that supports one filter or threshold over another, it is difficult to make a decision about which filter to use. However, there is value in filters that act as 22 N. Katz et al., Usefulness of Prescription Monitoring Programs for Surveillance-Analysis of Schedule II opioid prescription data in Massachusetts: Pharmacoepidemiology and Drug Safety, vol. 19, pp , December Enhancing Access to PDMP Using Health IT 25
34 clinical decision support tools. These tools can be used to support decision-making by supplementing the prescriber or dispenser s clinical judgment. The Work Group believed that more research is needed to better understand how patient-at-risk filters can be implemented in PDMPs and which filters result in fewer detection errors. Further, providing education about these tools to dispensers, prescribers, and other authorized healthcare professionals is useful. The members provided recommendations that should improve patient-at-risk filters Methods to Improve Using Patient-at-Risk Filters The Work Group identified issues with patient-at-risk filters and noted that such filters need further development to improve how they are used. In particular, every threshold and filter is imperfect. For patient-at-risk filters, there is always the potential to incorrectly identify a patient who is not abusing prescription drugs and also to miss or not identify a patient who truly is at risk. Therefore, Users of any filter should be educated about how the filter works as well as the error rate for that filter. Filters also may be made more accurate by including additional criteria for filtering patients. This is consistent with prior research that suggests using additional criteria may improve the detection of patients who are inappropriately receiving prescription opioids. 23 Researchers suggest additional criteria may include the incidence of early refills, the use of brand name prescriptions compared to generic drugs, and an escalation in the dosage. However, the Work Group highly suggests that further research is needed to determine the optimal level for each criteria. 23 Ibid. Enhancing Access to PDMP Using Health IT 26
35 Recommendations: The following are recommended methods to optimize a patient-at-risk filter: Provide online continuing education. Provide access to policies concerning how the filter selects patients. The following are recommended methods to reduce the potential bias that prescribers or dispensers may experience when using a patient-at-risk filter: Provide a disclaimer that the filter may incorrectly identify or not identify some patients. If possible, this should include education about the filter s error rate. Educate dispensers and prescribers about how to use the information to make clinical decisions. Explicitly state that these tools must be used with caution. The following data elements should be used in the future to determine which patients are at risk for abusing or diverting prescription drugs: Number of prescribers Number of dispensers Number of prescriptions Number of concurrent prescriptions Time period Note: It is currently not possible to view a patient s number of concurrent prescriptions, but this would be valuable information Electronic Data Correction To date, no electronic method exists for requesting corrections to PDMP inaccuracies. Users should be able to easily detect and request corrections of errors in this data. For example, the most common error occurs when two prescribers have similar names. Prescribers and dispensers should be able to electronically complete an online form that states the nature of the error and then submit this form electronically to the PDMP system administrator. This request would then be routed to the dispenser. Ideally, the system should automatically send a confirmation to the person submitting the form that provides a confirmation of receipt. The requester involved should be notified when the correction is made. This ability to electronically request corrections to PDMP data would improve the overall accuracy of information in PDMP systems. Enhancing Access to PDMP Using Health IT 27
36 Recommendations: EHR and pharmacy management systems should have the capability to identify and report errors in PDMP data to the appropriate party, and Users should have the ability to correct this error at the source Training for Using PDMP Data Many prescribers and dispensers have little or no training in how to appropriately prescribe controlled substances, let alone in how to detect patients who may be abusing or diverting these drugs. Prescribers and dispensers have minimal knowledge of what behaviors or patterns indicate a problem with prescription drugs or where to seek help if they discover such a problem with a patient. However, by requiring training before granting access to the PDMP system, states may discourage dispensers and prescribers from using PDMP systems. Nevertheless, thorough PDMP training would be well suited during medical or pharmacy school, and brief tutorials would be helpful when dispensers and prescribers register to use their state s PDMP system. Recommendation: PDMP Users should receive training to teach them how to access, synthesize, and understand the data. Medical and pharmacy students should receive this training during their instruction on prescribing/dispensing medications to assist them with making treatment decisions. 2.3 Topics for Further Exploration The Usability Work Group discussed several topics related to the presentation of PDMP data and the usability of the systems that display this data. However, these topics were not addressed in more detail because they were beyond the scope of the Work Group s goals. The topics are important enough to be explored in the future by a different project or Work Group that can address them in greater detail User Interface Design The members decided not to provide specific recommendations for the presentation of PDMP data in User Systems. Specifying the UI design recommendations and criteria could negatively impact system usability and stifle design innovation. To date, usability and user interface design experts do not provide specific recommendations for the design of EHR systems because they recognize that each system must meet unique requirements. Some EHRs are designed for a Enhancing Access to PDMP Using Health IT 28
37 specific medical specialty. Further, these systems are used in a variety of settings such as pharmacies, EDs, and family medical practices. Therefore, the Work Group decided there was no benefit to suggesting UI design recommendations or requirements. Instead, the individual vendors for EHRs and pharmacy management systems should have the flexibility to incorporate PDMP data to satisfy systems and Users needs. The Work Group does encourage the vendor community to employ the principles of user-centered design (UCD) to ensure the usability of these systems. UCD is a design philosophy in which the user s requirements and limitations are considered throughout the design process or product development cycle Usability Testing The Work Group believes that usability testing is an important part of the UCD process. However, the members did not provide specific recommendations regarding usability testing methods. Because there are a variety of methods, vendors should have the freedom to select the usability methods that are most appropriate for their product. Enhancing Access to PDMP Using Health IT 29
38 3 Data Content and Vocabulary 3.1 Introduction The Data Content and Vocabulary Work Group, also known as the Vocabulary Work Group, focused on the data standards and data elements needed to facilitate the exchange and use of PDMP data. The members developed a core set of PDMP Data Elements and the supporting Data Element Exchange Standard. These two products are the foundation for future data exchanges. The members also identified the data elements needed for report request interfaces and the resulting report contents for the data exchanges associated with the most common use cases that the Transport Work Group identified. The Vocabulary Work Group achieved the following goals: Reviewed existing standards and vocabularies for requesting and receiving prescription drug information Identified a core set of standards and data elements to be used by recipient communities Reviewed existing standards for attributes needed to uniquely identify patients Identified core identity attributes needed to resolve patient identity in the PDMP The recipient communities referenced in the second goal are: Pharmacists or dispensing physicians ( dispensers ) Physicians, including both ambulatory practice and ED practitioners ( prescribers ) Healthcare professionals who are authorized delegates appointed by either dispensers or prescribers (referred to as other authorized healthcare professionals throughout this section) Relevant Background The driving force behind the work of both the Vocabulary and Transport Work Groups is interoperability. The Vocabulary Work Group developed recommendations for the purpose of improving data access and interoperability by providing a common data framework for exchanging PDMP data between systems. The healthcare industry has devoted considerable resources to understanding interoperability. In the context of health IT, interoperability is typically defined as the ability of two or more entities or components to exchange information and to effectively use that information for business purposes. Interoperability types are used to further classify and scope the level of information exchange. The book Coming To Terms: Scoping Interoperability for Health Care 24 specifies three main types of interoperability: 24 P. Gibbons et al. Coming to Terms: Scoping Interoperability for Health Care (Final), Health Level Seven, EHR Interoperability Work Group. Feb. 7, Enhancing Access to PDMP Using Health IT 30
39 1. Technical (physical conveyance of a payload ) 2. Semantic (communication of meaning) 3. Process (integration into a work setting) Summary of Recommendations The Vocabulary Work Group developed several products that provide the foundation for improving timely access to a common, well-understood set of PDMP data. The recommendations are organized using the following categories: Interoperability Data content and vocabulary information needed for interoperability: o Common PDMP Data Elements o Data Element Exchange Standard o Cross-Reference Guide Identity Data needed to uniquely identify persons associated with PDMP data: o Patient identity o Dispenser identity o Prescriber identity o Authorized user identity Data Element Usage for Requests and Reports: o Requests for patient data o Requests for dispenser data o Requests for prescriber data o PDMP reports Implementing the recommendations in the Work Group s products will have many benefits, including: Improving data access while limiting the amount of new interface development time and costs by using the common data defined in the PDMP Data Elements and Data Element Exchange Standard. These products re-use the existing data elements defined in a standalone NIEM-based information exchange specification. Improving data accuracy by the specification of a minimum set of data elements needed to uniquely identify the most common report objects (patient, prescriber, or dispenser). Standardizing and simplifying the development of a small, well-defined set of PDMP interfaces. Promoting data accuracy by eliminating ambiguity in the correlation of different data elements used by different systems with the cross-reference between specifications. Enhancing Access to PDMP Using Health IT 31
40 3.2 Recommendations Interoperability Recommendations Interoperability is essential for effective PDMP data flow and use. The interoperability recommendations identify ways of improving the exchange of PDMP information using: PDMP Data Elements Cross-Reference Guide Data Element Exchange Standard The healthcare arena has a wide variety of stakeholders with different business roles and needs (e.g., payers versus physicians). Over time, these organizations have organically developed IT systems and vocabularies to best address their health IT needs, resulting in a set of divergent and poorly interoperating data specifications and semantics. In the absence of a common set of data meanings and interpretations, and owing to a lack of uniform technical guidance for exchanging the data, interoperability is hindered, and interfaces must be developed in an ad hoc manner. By converging to one common baseline set of PDMP Data Elements, the Work Group has provided the semantic standard needed to accurately describe PDMP information. Likewise, legacy data collections exist in native data representation that must be correctly mapped to the common data elements to enable incorporation of legacy data. To enable the best use of prescription drug monitoring data, software developers need clear technical guidance on how to present data to the diverse stakeholders as well as on how to implement systems that can effectively access the desired data. The proposed Data Element Exchange Standard is intended to provide this guidance. Enhancing Access to PDMP Using Health IT 32
41 PDMP Data Elements Recommendation: The Work Group proposed a common set of PDMP Data Elements largely based on the ASAP Implementation Guides that PDMPs use for receiving reports of controlled substances dispensed by pharmacies. Each PDMP Data Element has the following information: Human-readable data element name Human-readable definition Synonyms for other names by which the data element is known (e.g., birth date can be represented as DOB, Date of Birth, Patient Birth Date, etc.) The PDMP Data Elements include the minimum data needed to uniquely identify the common components of the PDMP systems used in report requests. The PDMP Data Elements also cover other prescription information and persons who pick up prescriptions. The Work Group recommends adopting the PDMP Data Elements for interactions with PDMP systems Data Element Exchange Standard Recommendation: Adopt the proposed Data Element Exchange Standard to define the technical implementation guidance required for health IT systems that exchange information with PDMP systems. This standard enables recipient systems to request and receive data from PDMP systems using a common set of data elements and data element types. The Data Element Exchange Standard has the following information: Human-readable data element name Computer definition of data element with Extensible Markup Language (XML) schema type Defined values/rules of use for the data element The Work Group recommends reusing the standalone NIEM-based information exchange specification called NIEM Prescription Monitoring Program. See Appendix C.2 for the PDMP Data Element Exchange Standard. Enhancing Access to PDMP Using Health IT 33
42 Cross-Reference Guide Recommendation: Adopt the Cross-Reference Guide to facilitate data exchange between systems that use different healthcare data representations. This will ensure a consistent, accurate, and unambiguous exchange of PDMP information. This Cross-Reference covers ASAP, 25 Health Information Technology Standards Panel (HITSP) Summary Documents Using HL7 Continuity of Care Document (CCD) Component/C32, 26 and the NIEM PMP implementations used by the PMIX and PMPi interstate exchanges. The Cross Reference could be further extended to cover other specifications to ensure ongoing technical interoperability among the PDMP and recipient systems. See Appendix C.3 for the Cross-Reference Guide that maps the PDMP Data Elements to related specifications Identity Recommendations The identity recommendations improve the exchange of PDMP information by providing unambiguous identity of: 1. Patient 2. Dispenser 3. Prescriber 4. (Other) authorized user The first three define the unambiguous identity needed for well-configured PDMP data queries, while the final recommendation, required to protect privacy by controlling data access, identifies the entity initiating the PDMP data exchange. Establishing unambiguous identity is a key aspect of any well-configured data query. Methods to resolve identity ambiguity for patients, dispensers, and prescribers serve to satisfy the core PDMP data exchange use cases identified in this chapter. This is expected to be more acute as the size of the PDMP data store grows (i.e., worse for larger states than smaller ones), and especially when interstate exchange through interstate data hubs becomes more prevalent. Identity ambiguity may shelter those engaged in diversion as well as implicate those innocent of such misuse. Thus, PDMP data use will significantly improve when queries return unambiguous results. 25 American Society for Automation in Pharmacy (ASAP) Standard for Prescription Monitoring Programs, Implementation Guide, Version 4, Release 2, Healthcare Information Technology Standards Panel. HITSP Summary Documents Using HL7 Continuity of Care Document (CCD) Component, Version 2.5, June 8, Enhancing Access to PDMP Using Health IT 34
43 In a related issue, the identity of those accessing the data likewise must be uniquely determined to ensure that permissions and data access issues are appropriately handled. Protecting the privacy of PHI is a priority for PDMP systems, and health IT must implement data safeguards, including use of individual user identity (and role), to appropriately limit data access. If PDMP systems and interstate data hubs shared a common set of data to uniquely identify a patient, prescriber, and dispenser, the development of interfaces would be enabled, and data queries would be more effective. The set of data elements that the Work Group produced uniquely identifies patients, prescribers, and dispensers, and it should be used to maintain consistency with current systems. The HIPAA Security Rule requires that each employee be assigned a unique username to identify and track the identity of users that are authorized to access PHI information 27. Therefore, the concept of an authorized user is a common data content requirement for all IT systems handling such information, and this concept should be included in required identity data specifications Patient Identity Recommendation: This is the set of minimum information required to uniquely identify a patient: Name (first and last) Address (including ZIP code) Date of birth Identifier (if available) The PDMP Data Elements and Data Element Exchange Standard have other data elements that are considered situational and may be available, but they are not required to uniquely identify a patient. This information is consistent with a 2008 RAND Corporation study 28 that identified the characteristics needed to uniquely identify a patient. The RAND study analyzed a demographic database containing 80 million records to determine that name, date of birth, ZIP code, address, and some unique identifier (driver s license, partial Social Security number, etc.) was sufficient to uniquely identify a patient. 27 Health Insurance Portability and Accountability Act of 1996, Public Law (P.L.) ("HIPAA"), 45 C.F.R. Parts 160 and 164 ("the Privacy Rule"). 28 R. Hillestad et al., Identity Crisis: An Examination of the Costs and Benefits of a Unique Patient Identifier for the U.S. Health Care System. Santa Monica, CA: RAND Corp., Enhancing Access to PDMP Using Health IT 35
44 Dispenser Identity Recommendation: This is the minimum set of information required to uniquely identify a dispenser: Name (first and last) Address (including ZIP code) Identification The PDMP Data Elements and Data Element Exchange Standard have other data elements that are considered situational and may be available, but they are not required to uniquely identify a dispenser Prescriber Identity Recommendation: This is the minimum set of information required to uniquely identify a prescriber: Name (first and last) Address (including ZIP code) Prescriber DEA number The PDMP Data Elements and Data Element Exchange Standard have other data elements that are considered situational and may be available, but they are not required to uniquely identify a prescriber. Enhancing Access to PDMP Using Health IT 36
45 Authorized User Identity Recommendation: The data associated with an authorized user must be included in the Data Content and Vocabulary products. This is the minimum set of information needed to uniquely identify an authorized user: Name (first and last) Role Case number (if applicable) Authentication credentials (e.g., DEA number, account number) This includes information needed for both system access control and the generation of audit trails. This is a precondition of affiliating user credentials for query activities Data Element Usage for PDMP Data Requests The requestor may need to specify additional information to further refine the PDMP data being requested in addition to providing an unambiguous identity for the patient, dispenser, or prescriber for PDMP requests. This information is part of the technical interface for requesting information from a PDMP system. An interface is typically defined as a set of specifications for use by two or more software components for the purposes of communicating with each other. The request/response part of the interface was covered by the activities of the Transport Work Group. The recommendations in this section identify the PDMP Data Element information needed to define the most common query interfaces with PDMP systems: those seeking data for patients, prescribers, and dispensers. The Work Group also specifies Data Element usage for reports. Access to patient prescription information is impaired by the lack of common interface definitions for requesting PDMP data. Of particular note is that a common set of data elements is not currently available for use across all systems engaged in the health IT ecosystem that prescribe and dispense prescription drugs. Additionally, usability of PDMP reports is impaired by the lack of common report contents. A reusable data element specification would assist the data requestors and system implementers involved in this business environment because it would allow the development of generic, reusable interface definitions for queries involving patient, prescriber, and dispenser information in PDMPs. A common interface to PDMP systems improves semantic interoperability by enabling those seeking PDMP data to finely tune their request for the specific data they need. This common interface would greatly improve technical interoperability because it could be reused by many other systems. The specification of a single interface fosters reuse and provides cost savings for IT systems that reuse this interface. Enhancing Access to PDMP Using Health IT 37
46 Likewise, a specification for the content provided by PDMP systems (report Data Elements) will improve technical and semantic interoperability between PDMPs and recipient systems. It will also greatly improve access to PDMP information because all PDMP systems would provide the same minimum set of well-defined information in the reports Data Element Usage for Patient Data Requests Recommendation: The Work Group recommends the interface parameters shown in Table 3 for requesting information about a specific patient. These interface parameters are applicable for a solicited report and for setting up the parameters of an unsolicited report. Table 3. Patient Data Request Data Elements for the Data Request Notes Patient Name (first and last) Address (including ZIP code) DOB Identifier Gender Species Phone number Authorized User (Person Requesting the Report) Optional Optional Optional Authentication information Name (first and last) Role Case Number Required for law enforcement requests Enhancing Access to PDMP Using Health IT 38
47 Data Element Usage for Dispenser Data Requests Recommendation: The Work Group recommends the interface parameters shown in Table 4 for requesting information about a specific dispenser. These parameters work for use cases where the dispenser is checking his/her own history as well as when another party (e.g., licensing board) is checking the dispenser s data. These interface parameters are applicable for a solicited report and for setting up the parameters of an unsolicited report. Table 4. Dispenser Data Request Data Elements for the Data Request Notes Dispenser Name of Dispenser Address Identification Prescription National Drug Code (NDC) Number Name of drug Authorized User (Person Requesting the Report) Authentication information Name (first and last) Role Case Number May be used to review dispensing of specific drugs May be used to review dispensing of specific drugs Required for law enforcement requests Enhancing Access to PDMP Using Health IT 39
48 Data Element Usage for Prescriber Data Requests Recommendation: The Work Group recommends the interface parameters shown in Table 5 for requesting information about a specific prescriber. These parameters work for use cases where the prescriber is checking his/her own history, or for when another party (e.g., licensing board) is checking their prescribing history. These interface parameters are applicable for a solicited report and setting up the parameters of an unsolicited report. Table 5. Prescriber Interface Data Elements for the Data Request Notes Prescriber Name (first and last) Address (including ZIP code) Prescriber DEA number Prescription NDC Number Name of drug Authorized User (Person Requesting the Report) Authentication information Name (first and last) Role Case Number A prescriber may have multiple DEA numbers. May be used to review prescribing of specific drugs May be used to review prescribing of specific drugs Required for law enforcement requests Enhancing Access to PDMP Using Health IT 40
49 Data Element Usage in PDMP-Provided Data Recommendation: A minimum, common set of information should be specified for PDMP reports. Appendix C.4 identifies the data elements associated with the information that should be available in the most common types of reports: 1. Patient PDMP information 2. Prescriber wants to check his/her own history (prescriber report) 3. Dispenser wants to check his/her own history 4. Request for information about a specific prescriber or dispenser See Appendix C.4 for the Data Element Usage Table. 3.3 Topics for Further Exploration The Work Group identified several topics for future exploration during the Data Content and Vocabulary analysis and product development process. These topics are important work needed to augment the Vocabulary Work Group outcomes and products. The Work Group identified the following unexplored topics for future consideration Data and Interface Specifications A complete framework of data and interface service specifications is needed to provide a comprehensive technical solution for accessing PDMP data. The PDMP Data Elements, Data Element Exchange Standard, and Data Element Usage in PDMP requests define the basic data elements needed for the PDMP interfaces. The Transport Work Group used this information to develop the request and response patterns for the actual exchange of messages. This information needs to be developed into formal interface specifications for system implementers Unsolicited Reports Unsolicited reports are triggered by a predefined set of parameters in the PDMP systems to indicate that a patient has exceeded some threshold for obtaining too many prescriptions within a specific time-frame. To maximize the reuse of specifications, it may be helpful to converge on the specific requirements for alerts and other forms of unsolicited reports. This requires further study to define the most appropriate triggers needed by clinical decision-makers. The technical specifications for the triggering parameters then would be added to the interface specifications for accessing PDMP data. Enhancing Access to PDMP Using Health IT 41
50 3.3.3 Authorized Users The concept of an authorized user is a common data content requirement for all IT systems handling prescription information. Authorized users will be part of any messaging infrastructure implemented, and the concept is mentioned here for thoroughness. The Work Group created a preliminary definition of an authorized user during the use case analysis and associated data elements with report requests. More work is needed to completely understand and define the data required for an authorized user in the PDMP interfaces Cross-Reference Guide Expansion The Cross-Reference Guide (Appendix C.3) between the PDMP Data Elements and other specifications with prescription information will improve data accuracy by eliminating any ambiguity in the correlation of different data elements used by different systems. This Cross-Reference Guide covers ASAP, HITSP C32, and the NIEM-based information exchange specification used by the PMIX and the PMPi. Additional healthcare specifications should be added to the Cross-Reference Guide to eliminate potential data ambiguity errors with other systems that interact with PDMP systems to ensure a consistent, accurate, and unambiguous exchange of PDMP information. Enhancing Access to PDMP Using Health IT 42
51 4 Transport and Architecture 4.1 Introduction The Transport and Architecture Work Group, also known as the Transport Work Group, explored and developed architectural guidelines and technical specifications for data transmission between PDMPs and a variety of recipient systems. Members reviewed and addressed the following topics in detail: Domain standards Security Data transport protocols Web service implementations The Work Group crafted transport and architecture specifications with an eye for general applicability, which would enable the recommendations to be relevant to any system exchanging information with a PDMP system. The Work Group also developed technical recommendations to accomplish effective data sharing and interoperability between PDMPs and data recipients. The Transport Work Group s activities and outcomes align with the typical enterprise architecture framework (EAF) shown in Figure 8. Figure 8. Alignment of the Transport Work Group Activities with a Typical EAF Enhancing Access to PDMP Using Health IT 43
52 The Transport Work Group explored the system-to-system workflows and architectures required to support the following scenarios: Notifying PDMPs of events (such as prescription fulfillment) Requesting data from PDMPs Performing the operations needed to support direct interfaces with PDMP systems and interfaces involving third parties Relevant Background Transporting PDMP data is a complicated process that involves several entities. These entities include both end users and consumers like the PDMP databases and EHR pharmacy systems and third-party intermediaries that route transmissions between PDMPs and end users. Examples of intermediaries include benefits management switches and HIEs. Additionally, the Transport Work Group believed that adhering to common standards and specifications will improve interoperability and timely access to information. The members agreed that adhering to serviceoriented architecture (SOA) engineering best practices, reducing technical barriers to entry, and decreasing ongoing maintenance costs were important to the Work Group s success. For each recommendation, the Transport Work Group provided a rationale explaining why the members arrived at the recommendation, a more detailed explanation of the recommendation, and useful background information Summary of Recommendations The Work Group s recommendations, which aimed at improving the transmission of PDMP data, address the following issues: Development of PDMP use cases and the implementation of a patient-at-risk score Development of a common set of PDMP interfaces for three report types: patient, prescriber, and dispenser Use of the NIEM-based PMP information exchange specification Use of XML-based interfaces for messages Improving workflows through a common operational approach for unsolicited reports and the rejection of co-transmission queries to PDMPs Security of PDMP messages Performance or speed of PDMP system response when users request individual patient PDMP reports 4.2 Recommendations Leverage the Existing NIEM-Based Information Exchange Specification Access to patient prescription data is impaired by the lack of the common data exchange specification needed for PDMP interfaces. A common data specification is needed to obtain patient, prescriber, and dispenser information from PDMP systems. Enhancing Access to PDMP Using Health IT 44
53 The PMIX National Architecture is a formal set of technical requirements that existing and planned interstate data hubs use to enable hub-to-hub communication. A critical component of the architecture is the use of open standards (design elements that are in the public domain and available free of charge). Adopting open standards reduces costs and ensures a state s ability to remain flexible. Two interstate data-sharing hubs are currently in operation: the National Association of Boards of Pharmacy s (NABP) PMPi and the Bureau of Justice Assistance s RxCheck. Additional hubs may be developed in the future. Both interstate data hub players use a standalone NIEM-based information exchange specification (called NIEM PMP). The Transport Work Group proposed that NIEM PMP be formally promoted in the new NIEM Health Domain. This requires an update to the existing NIEM PMP to the latest versions of the NIEM core and the ASAP specification data. Appendix D.3 also identifies some recommended updates for the NIEM PMP patient prescription reports. Members also noted that while not all PDMPs (nor the pharmacies that report the data) use the latest ASAP version, using the latest version is recommended to encourage states to adopt and populate PDMPs with the extra data needed for the Data Element Exchange Standard. Finally, aligning stakeholder solutions with the NIEM-based information exchange specification would help ensure interoperability and information exchange in a timely manner. Promoting a common informational model will accelerate interoperability, which in turn improves the effectiveness of data exchange. Members of the PDMP community noted that NIEM already is using data and data definitions (from ASAP) that have become a de facto standard for storing and exchanging healthcare information. The members believed that the adoption of a modified, updated form of the NIEM-based information exchange specification would benefit the community. The benefits of this recommendation will accrue to both PDMP data managers and those involved in numerous transport activities for this data. Recommendation: Leverage existing capabilities and use the NIEM-based information exchange specification to serve as the domain standard for PDMP data exchange. Facilitate the specification s widespread adoption by the community Common Set of PDMP Request Interfaces Access to patient prescription data is impaired by the lack of both a common interface and the data definitions needed for that interface. A common interface specification is needed to obtain patient, prescriber, and dispenser information from PDMP systems. In this case, an interface is defined as a set of specifications for use by two or more software components for the purposes of communicating with each other. The members determined that a more extensive set of interfaces is needed to satisfy the following complete set of use cases: Unsolicited ( push ) patient reports Enhancing Access to PDMP Using Health IT 45
54 Solicited ( pull ) patient reports Solicited self-report Solicited reports, as typical of a medical oversight agency (e.g., licensing board) Solicited reports from an emergency department, triggered by an admission, discharge, or transfer (ADT) event Solicited reports from an emergency department, triggered by an ADT event It is critical that the new interfaces maintain backward compatibility with existing interface designs. The Work Group concluded that the NIEM-based information exchange specification would meet this criterion. The members also identified the need to modify the report request interface schema to reflect the updated data and parameter needs. Several issues must be addressed in detail, including: The expected delivery formats (e.g., XML, PDF, text blob) Delivery methods (e.g., , efax) and addressing parameters (e.g., ) Authorization These options should be defined based on the use cases. The members also preferred a common method for handling system-level access and authorization (likely through an SSO), although the details regarding SSO are beyond the Work Group s scope. The issue of triggers also is important to the PDMP query process design and report request interfaces. The members stipulated that both automatically triggered and manually initiated queries have the same technical requirements and should be treated similarly. Appendix D.1 contains the interface worksheet for use by individual PDMPs in overall system design. Finally, the members assessed the appropriate parameters for interfaces. Both preconfigured and flexible parameters must be supported for a fully optimized interface regimen. This includes specific parameter values from the PDMP Data Elements (patient, prescriber, and dispenser). The members differentiated between Setup Parameters, which are defined in advance and apply to all reports, and Request Parameters, which are defined in each report request and apply only to that request. Parameter details for the examined use cases are provided in Appendix D.2. A common API for accessing PDMP data should be developed to support PDMP interfaces. The members developed a set of recommended interface parameters for each report type to be used as a starting point for the development of an API specification. The existing NIEM-based information exchange specification could be updated to include a comprehensive list of use cases and the additional interface parameters and exchange data identified by the Vocabulary Work Group. These interfaces should be coordinated and submitted as interface standards as part of a technical collaborative sharing environment such as the NIEM Health Domain. Enhancing Access to PDMP Using Health IT 46
55 Recommendation: Develop a common PDMP API that includes interfaces for solicited and unsolicited reports for three report types: patient, prescriber, and dispenser. Interstate exchanges of PDMP data currently use a standalone NIEM-based information exchange specification that should be leveraged to develop the three common report interfaces and updated to include the additional parameters and exchange data identified by the Vocabulary and Transport Work Groups Support for Web Service Architectures Implementing electronic access to PDMP data is impaired by the lack of common technical specifications for interfaces and data exchange. A common standard for data exchange with PDMP systems is needed. The members decided on a simplified set of requirements based on two technology pillars: (1) the use of XML and (2) the use of Web services. For each transaction, the inputs and outputs should be defined, but the protocol should be agnostic as long as the protocol supports XML transport. This conceptual framework is expected to work well with a variety of existing implementations and technologies. This decision also provides considerable flexibility, allowing for wider participation by organizations with a variety of skills and expertise. The flexibility of XML as a transport media for a variety of transactions is a well-known phenomenon, and XML schemas are an appropriate choice for the data packet in PDMP-related transactions (see Section 6.2.1). Conversely, PDF data exchanges were not considered desirable, even though they are currently used in many states. The use of HTML (HyperText Markup Language) rendering of XML may alleviate the difficulty of reading XML by providing easy access to human-readable text for XML-encoded documents. Within the proposed guidance, Simple Object Access Protocol (SOAP) and representational state transfer (REST) were both deemed acceptable Web service implementation options in this framework, thereby avoiding a detailed analysis of which is superior for PDMP data exchange applications. Either Web service implementation option can be used to define a standard; future standards definition efforts can choose to prefer one over the other. This technical recommendation cannot and should not be implied as superseding applicable regulations in jurisdictions where less flexible formats (e.g., PDF) are required by law or convention. Interstate data hub players use XML schemas, but they use different transports. For example, RxCheck uses SOAP, while the PMPi Web services are RESTful. Both are successful at exchanging data; therefore, there are multiple acceptable and usable methods to make these transactions. The Transport Work Group favored an approach that offers a variety of approved solutions and declined to specify transport protocols or other parts of the technology stack beyond requiring that it satisfy the functional requirements listed in the Work Group recommendations (e.g., will support an XML data exchange, can support security Enhancing Access to PDMP Using Health IT 47
56 recommendations). This inclusive decision should broaden the ranks of participants by reducing the barriers to entry. Recommendation: Data transport should be accomplished through the use of XML and the solution(s) adopted should support a variety of Web service technology stacks and implementations. The use of XML embraces a neutral approach to Web service architectures that does not preclude any best-of-breed technologies in the current market or future technologies Common Approach for Unsolicited Reports Currently, there are a variety of methods to define and deliver unsolicited reports. This causes data access and interoperability issues for interstate information exchanges. The use of unsolicited ( push ) reporting is an important part of the PDMP landscape. Unsolicited reporting is an alert message provided to an appropriate party when a predefined threshold is crossed within a PDMP database. Thresholds for unsolicited reporting typically are set by pharmacy boards or other agencies and may vary widely. In some cases, these trigger thresholds correspond to the previously published National All Schedules Prescription Electronic Reporting National Drug Control Policy and Prevention of Prescription Drug Abuse Reauthorization Act of 2010 guidelines, 29 but frequently they represent the judgment of specific state authorities. The many variations in how unsolicited reports are sent reduce interoperability and slow the development of effective interstate data sharing. By moving toward a common operational approach among participants ( operational convergence ), both the effectiveness and ease of implementation of this data-sharing process should be improved. Recommendation: The underlying nature of unsolicited ( push ) requests within the PDMP community should move toward a common operational approach and design to improve interoperability and data access Security PDMP reports contain PHI that must be secured from potential data breaches. Federal agencies that handle PHI are subject to the Federal Information Security Management Act of American Society of Interventional Pain Specialists. (2010). Facts on NASPER: National Drug Control Policy and Prevention of Prescription Drug Abuse Reauthorization Act of 2010 guidelines. Enhancing Access to PDMP Using Health IT 48
57 (FISMA) 30 in addition to being subject to HIPAA Security Rule requirements, [HIPAA (P.L and 45 C.F.R Parts 160, ). FISMA establishes minimum information security requirements, including technical and operational controls, and defines three security objectives for information systems: 1. Availability 2. Integrity 3. Confidentiality 33 The crosswalk analysis of FISMA to HIPAA offers helpful advice to integrate these policies when needed. 34 The Work Group s recommendation in Table 6 is sufficient for complying with HIPAA and the most applicable portions of the FISMA framework. PDMP data is exceptionally sensitive because it contains PHI specifically, scheduled prescription drug history information. As such, data breaches are considered harmful, and system security is recommended. In all cases, HIPAA data security requirements must be met by all PDMPs, data requesters, and intermediaries. Within these guidelines, the members chose to focus on the relevant portions of the FISMA security parameters suggested by the General Services Administration, which are well established and widely regarded as a good basis. If PHI data is not included in a particular response, the security requirements are reduced. As an example, The Direct Project was created to specify a simple, secure, scalable, standardsbased way for participants to send authenticated, encrypted health information directly to known, trusted recipients over the Internet National Institute of Standards and Technology (NIST). (May 17, 2012). Federal Information Security Management Act of 2002, Computer Security Division: Computer Security Resource Center HHS. (August 21, 1996). PUBLIC LAW , AUG. 21, HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996, Office of the Assistant Secretary for Planning HHS. (February 20, 2003). Part II: Department of Health and Human Services, Office of the Secretary, 45 CFR Parts 160, 162, and 162, Health Insurance Reform: Security Standards; Final Rule, Office for Civil Rights NIST. (February 2004). Federal Information Processing Standards Publication (FIPS PUB 199): Standards for Security Categorization of Federal Information and Information Security, Computer Security Division: Computer Security Resource Center HHS. An Introductory Resource Guide for Implementing the HIPAA Security Rule, Indian Health Service, SP HHS. Direct Project, The Office of the National Coordinator for Health Information Technology. direct_project/3338 Enhancing Access to PDMP Using Health IT 49
58 Recommendation: An appropriate framework based on federal guidelines for message security should be applied to ensure compliance with HIPAA and all relevant state privacy laws. Table 6 outlines the specific recommendations for transport security, message security, message integrity, consumer authentication, and nonrepudiation for PHI and non-phi PDMP data. Table 6. Security Recommendations by Data Type (PHI vs. Non-PHI) PHI Included No PHI Included Feature Point-to-Point Intermediary Point-to-Point Intermediary Transport Security SSL, TLS, VPN (IPSEC), other (FIPS 140-2) SSL, TLS, VPN (IPSEC), other (FIPS 140-2) Message Security Not Required FIPS validated encryption Message Integrity Not Required Not Required (due to intrinsic message security) Service Consumer Authentication Certificate, Username Certificate, Username SSL, TLS, VPN (IPSEC), other Not Required Not Required IP Address, Certificated, Username SSL, TLS, VPN (IPSEC) Not Required XML Signature IP Address, Certificated, Username Non-Repudiation Not Required Not Required Not Required Not Required Performance Prescribers and dispensers should receive individual PDMP reports in a timely manner for clinical decision-making. Currently, there is no standard response interval across all the PDMP systems. In many current situations, PDMP report retrieval requires extra steps to access data on other systems, and this is incompatible with the clinical decision-making workflow. NABP indicates that at present, the PMPi data hub and individual PDMPs have typical response times of 7.5 seconds and 5.74 seconds, respectively. 36 This preliminary data shows that the system response interval requirement proposed by the Work Group should be achievable for now, though increased traffic in the future may require rebalancing system resources to maintain this goal. The Transport Work Group also indicated that large batch downloads (e.g., all dispensations from a pharmacy chain) may be legitimately slower than this baseline, and such activities represent a use case not covered by this recommendation. The members resolved that to best promote system-to-system interoperability, it will be necessary to establish a floor for the system response interval that can be used as a baseline for 36 National Association of Boards of Pharmacy (NABP). NABP PMP InterConnect, Enhancing Access to PDMP Using Health IT 50
59 all participants synchronous responses. The members decided that the interval should be (generously) set at 30 seconds. Some participants (e.g., Surescripts) have much lower latency within their own systems. This response requirement is expected to have considerable implications for queries that currently use fuzzy matches in their search, which are expected to have greater time requirements than exact matches. It also sets expectations for the level of hardware support (i.e., numbers, types, and configurations of servers) that underlies the various PDMP and data hub systems. Recommendation: The system response interval should be faster than 30 seconds for individual reports to avoid issues of timeouts and asynchronous response Co-Transmission of Queries Co-transmission, the concept of consolidating new queries and data returns with existing message transmissions along the existing transport pathways, was proposed as part of the White House Action Plan 37 as a method to implement improvements in PDMP data access. This required the Work Group to carefully consider the technical and workflow implications to better understand the full costs and benefits of the proposed approach. Co-transmission offers one possibility for increasing functionality while reducing development costs. However, upon detailed analysis, the Pharmacy Subgroup determined that rather than resulting in operational or technical benefits, co-transmitting a PDMP query on a pharmacy benefits insurance check would be disadvantageous to PDMP data flows. Benefits management switches and other co-transmission candidates may have gaps that can be exploited by patients engaged in drug-seeking behavior. In particular, such patients may choose to forgo prescription drugs (other health benefits) and instead rely on self-pay options. A variety of known techniques and policies can be used to address this deficiency, though with some degree of legal and technical difficulty. Co-transmission offers participants considerable potential benefits. However, adoption will be slow if the specifics of a proposed co-transmission process produce a disruption to the workflow or if the technology cannot be easily and cheaply extended. The rationale for this rejection was based on these two categories of concerns as well as on a third item: potential relationship dynamics between the switch and other participants in the data flow. The benefits check occurs at the wrong place in the workflow. Specifically, these actions happen in the hands of the pharmacy technician or sales clerk, rather than the pharmacist. In all cases, the primary responsibility for the medical decision resides with the pharmacist, and the data should flow to the pharmacist (for both privacy and usability reasons). Appendix D.4 provides a 37 Prescription Drug Abuse and Health Information Technology Work Group. (2011). Action Plan for Improving Access to Prescription Drug Monitoring Programs through Health Information Technology. Enhancing Access to PDMP Using Health IT 51
60 detailed depiction of an ideal PDMP query-enabled pharmacy workflow, as assessed through a careful analysis by the members. From the technical perspective, the members considered best practices in SOA. Specifically, there should be a loose coupling of severable services and objects. However, tight coupling is intrinsic in co-transmission and thus is not aligned with modern architectural best practices. Further, the members viewed bad service definitions as inappropriate engineering decisions. The Work Group had concerns regarding the role of the switch entity and the potential for secondary uses of the highly sensitive PDMP data. This also aligns with the views of the Law and Business Agreements Work Groups. Recommendation: The proposed co-transmission of queries to PDMPs as part of pharmacy benefits check was rejected as unworkable on both technical and workflow grounds Patient Risk Score Dispensers and prescribers may not have time to review every patient s PDMP report, and standard patient drug history reports do not contain any analysis for patterns of behavior or potential abuse. Therefore, to focus their attention, these users would benefit from a method to prioritize those patients who are at the highest risk of abusing prescription drugs. It would be acceptable to have more than one patient risk score if individual practitioners would find this helpful for their triage. A patient risk score for the purposes of this report is a value derived from PDMP data via an algorithm that classifies a patient s likelihood for prescription drug abuse or overdose. Providing the underlying numeric score produced by the automated analysis algorithm(s) may or may not need to be provided to the users; they may derive some additional value from this granular information with appropriate training. The exact treatment of intermediate category patients was not explicitly resolved, but most patients should be placed in the lowest risk category if the boundaries are set appropriately. From a technical implementation standpoint, the use of a triage flag may introduce a small degree of additional technical complexity to system interfaces. Specifically, the transaction for such a flag is likely to differ from a query requesting a full patient prescription history. However, this is balanced by the fact that a transaction that retrieves a triage flag (alone) would be considerably faster than that for a complete PDMP prescription history. From a workflow perspective, a patient risk score should allow quicker service to be rendered at the point of care to individuals in the lowest category of concern. Thus, the practitioner would have more time to devote to patients in the higher risk category, who by definition will require a greater degree of oversight and case review. Even high-risk patients may not be engaged in inappropriate behavior (e.g., doctor shopping) but instead may simply have an extensive but Enhancing Access to PDMP Using Health IT 52
61 legitimate need for heavy pharmaceutical intervention. This recommendation will allow them the extra attention by the practitioner that they deserve. Recommendation: Some form of patient risk score should be implemented for use by both prescribers and pharmacies in each state (or nationally if possible) and should be made available in PDMPs. A generic and highly desirable configuration would consist of a two- (high/low) or three-tier (high/medium/low) scoring system to assist in the triage of patients. 4.3 Unexplored Topics The Transport Work Group discussed the technical implications of the following topics but did not address them sufficiently to create official recommendations Authorized Users Some members lauded the value of using a directory to identify users. The members felt that a directory would provide considerable value for the overall PDMP data-exchange ecosystem, especially if it included specific information about how to interact with users (e.g., delivery of reports via , fax, etc.) and their authorization status. In a survey of the existing landscape, one PDMP software vendor already possessed a directory for users of PDMP systems. Likewise, PMIX has a directory for how to access specific systems, designed for system-to-system interactions. However, the members did not provide a method for achieving this. A common method is still needed for handling system-level access and authorization Access and Authorization While the directory described in Section might be of considerable value for the PDMP ecosystem, a list of authorized users and their credentials is insufficient for future needs. Instead, this could be seen as a precondition of the next logical step: implementing a framework to enable transparent system-to-system communications where the passing of credentials is the key element (not username, but system authorization credentials). This framework would need to be able to support both synchronous and asynchronous requests and the delivery of information to the requesting user or application. There needs to be a way to reduce the overhead some users face for PDMP data access (e.g., multiple passwords for practitioners who work at multiple venues) Risk Evaluation and Mitigation Strategy The risk evaluation and mitigation strategy (REMS) concept was defined in the U.S. Food and Drug Administration (FDA) Amendments of 2007 for use with biologics or drugs that pose a special degree of risk to public safety. It was designed to allow patients continued access to Enhancing Access to PDMP Using Health IT 53
62 medications while striving to lower the potentials for abuse, misuse, addiction, and overdose. 38 The existing REMS infrastructure, including support for strong audit trails and inventory control, operates as a de facto parallel (and more stringent) PDMP infrastructure. This bifurcation may not be desirable from the standpoint of reducing total costs. The Work Group chose not to address this issue because it was out of scope, yet it should be addressed SCRIPT Integration Pharmacies submit data to PDMPs via the ASAP standard, yet parallel data streams are in place for electronic prescription exchanges that are typically well integrated into the standard business processes and workflows in health IT. Some of these systems use standards from the National Council for Prescription Drug Programs (NCPDP). For example, the SCRIPT standard facilitates transferring prescription data among prescribers, pharmacies, payers, and other entities. 39 It supports prescriptions, refill requests, fill status notification, and other related events. This standard has been extended to support alerts for Drug Utilization Review (DUR) and medication allergies as well as standardized medication nomenclature. More effective integration of the multiple standards in use could improve healthcare workflows and provide improved capabilities such as full routing to payers and PDMPs without additional manipulation within the pharmacy system. 38 W. Bell, Jr. (May 31, 2011). Can REM Programs Solve the Healthcare Prescription Drug Abuse Dilemma, The Medicare Compliance Blog National Council for Prescription Drug Programs. (November 2011). Eprescribing Fact Sheet. Enhancing Access to PDMP Using Health IT 54
63 5 Law and Policy 5.1 Introduction The Law and Policy Work Group, also known as the Law Work Group, was charged with developing policy recommendations that (1) encourage broader and more standardized access to PDMP systems and data by healthcare professionals and (2) provide clear guidance for programs that use third-party intermediaries to exchange data. The Work Group had two primary goals: Examine legal and policy issues that affect access to PDMP data within different settings: o Access by prescribers, dispensers, and their delegates o Access by other authorized nonprescribing or nondispensing healthcare professionals and their delegates o Access by patients to their own data o Access by EHR systems, and which PDMP data elements patients can view in their EHR o Voluntary or mandatory access to PDMP data by prescribers and dispensers, and the associated liability issues that are implicated Examine legal and policy issues regarding the use of third-party intermediaries that enable PDMP data exchange between authorized users: o Sharing PDMP data with third-party intermediaries, generally o Sharing PDMP data with intermediaries that use federated, centralized, or other architectures whereby healthcare providers no longer directly control patient data o Patient consent to sharing data electronically via intermediaries o Patient notice Relevant Background Several state PDMPs have existed for decades, but the recent surge in prescription drug abuse and diversion has prompted nearly every U.S. state (along with Guam and Puerto Rico) to enact legislation to record patients controlled substance prescription histories. PDMPs serve two general purposes: 1. To support patient health and safety by enabling prescribers and dispensers to avoid dangerous drug combinations and to identify patients with possible drug dependencies. 2. To create a platform for authorized regulators and law enforcement to identify potential drug diversion or other illicit activity. The Law Work Group approached the legal and policy issues regarding access and intermediaries mainly from the perspective of patient care and safety. The members leveraged their experience in state and federal privacy and confidentiality laws including Health Insurance Portability and Accountability Act (HIPAA), 42 C.F.R. Part 2, and the Health Information Technology for Economic and Clinical Health Act (HITECH) to develop their Enhancing Access to PDMP Using Health IT 55
64 recommendations. Additionally, the Law Work Group s recommendations were informed by the Fair Information Practice Principles (FIPPs) 40 and the Organisation for Economic Co-operation and Development (OECD) Guidelines on the Protection of Privacy and Transborder Flows of Personal Data. 41 Appendix A provides more detailed explanations of these principles. The Law Work Group s policy recommendations are an important contribution to current prescription drug policy discussions throughout the United States. The National Conference of State Legislatures asserts that Interstate Sharing of Information and Prescription Drug Monitoring Programs are key solutions that must be addressed to halt and reverse the trend of prescription drug overdose and abuse. 42 In New York, legislation passed for two actions: expanding access to dispensers (who currently do not have access to reports) and making PDMP checks mandatory for healthcare professionals when they initially prescribe or dispense controlled substances. 43 Concurrently, the New York Civil Liberties Union is raising privacy concerns. 44 State representatives in Oklahoma also are considering mandatory checks, but opponents urge that doctors should not be doing the job of law enforcement and that mandatory checks would harm workflow and drive up costs. 45 Finally, federal lawmakers have introduced bipartisan legislation to regulate nationwide PDMP standards. 46 The Interstate Drug Monitoring Efficiency and Data Sharing Act would direct the US Attorney General to establish uniform standards for the exchange of controlled substance and prescription information for purposes of preventing diversion, fraud, and abuse 47 Mindful of these current events, the Law Work Group s policy recommendations are designed to inform the current discourse at the local, regional, and national levels Summary of Recommendations The Law Work Group members considered the following issues when drafting their recommendations: Whether broadening access to PDMP data will increase the value and demand for use of PDMP systems 40 Fair Information Practice Principles were first provided by the U.S. Department of Health, Education, and Welfare in 1973; they are currently the core of the Federal Trade Commission s policy regarding privacy. Retrieved from 41 OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data, OECD. Organisation for Economic Co-operation and Development Prevention of Prescription Drug Overdose and Abuse, National Conference of State Legislatures, August G. Koleva. Plan to Stem Prescription Drug Crisis in New York Fuels Disagreement, Forbes, March 2, H. Anderson. HIEs: Protecting Civil Liberties: ACLU Chapter Spells Out Privacy Recommendations, HealthcareInfoSecurity, March 21, KJRH, Bill Designed to Curb Drug Abuse Hits House Floor, February 23, U.S. Congressman Hal Rogers Press Release. Congressman Rogers, Wolf and Senators Portman, Whitehouse Introduce Legislation to Combat Prescription Drug Abuse, March 29, S. 2254, H.R.4292: Interstate Drug Monitoring Efficiency and Data Sharing Act of 2012, U.S. Government Printing Office, March 29, Enhancing Access to PDMP Using Health IT 56
65 Whether the data elements in a PDMP report should be accessible in an EHR Whether prescriber and dispenser queries of program databases should be voluntary or mandated by state law Whether PDMP programs can overcome the significant challenges (including state conflicts of law) that arise when transmitting patient data between states, especially if patients do not consent to sharing their personal information electronically Whether states should provide notice of required data collection, use, and disclosure to patients, where most states do not currently provide such notice The following points summarize the Law Work Group s policy recommendations: Prescribers, dispensers, and other authorized healthcare professionals should not only be able to request and receive PDMP data themselves, but they also should be able to appoint authorized delegates to do the same. PDMP data should be easily shared with patient EHR systems. States should not impose a statutory duty on healthcare providers to check PDMP systems; instead, states should explore reasonable methods to encourage greater use of systems, such as through user registration and education. Authorized users should enjoy limited civil and criminal liability for sharing PDMP data in certain circumstances, including mandatory compliance with state laws, good faith exchanges with law enforcement, and sharing data with fellow treating physicians. Patients should receive notice to ensure that they are aware of their practitioners legal obligation to submit patient personal information to PDMP systems. Each recommendation is followed by an explanation of the rationale for how the Work Group arrived at that conclusion. Additionally, where applicable, examples of existing statutory language are provided to show how some states currently address these issues. These examples of statutory language are not intended to be definitive or to represent the entire universe of possible options; they are merely for reference. 5.2 Recommendations Access to PDMP Systems and Data Data Recipients and Delegation Prescribers and Dispensers May Delegate Access In some states, important consumers of PDMP data do not have statutory or regulatory authority to access data; for example, New York State prevents dispensers from accessing the PDMP system. Additionally, some pharmacies prevent their employees from accessing this data. In most states, authorized users cannot lawfully delegate access to their assistants. Enhancing Access to PDMP Using Health IT 57
66 By January 1, 2013, only 16 states will permit practitioners to designate an authorized agent to access the PDMP database. 48 This indicates a positive trend, as only 10 states permitted delegation to authorized agents in The Law Work Group felt that in the future, all prescribers and dispensers should have the ability to appoint delegates who can access data under state laws. Delegates do not need to be licensed professionals, but delegates must be able to be identified in a PDMP system. Delegates should obtain individual sub-accounts that are linked to their supervisor (the primary account holder). The creation of individual sub-accounts ensures that (1) delegates do not use the primary account of a supervisor; (2) delegates do not establish an account wholly independent from a supervisor; and (3) delegates account activity can be tracked for audit purposes. In these recommendations, access means the ability to request and receive data from the PDMP system. The Work Group s definition of access does not include the ability to submit data. Data submission describes the flow of information to the PDMP system; dispensers are usually the only people who submit data. Figure 9 shows the states that allow practitioners to designate an authorized agent to access a PDMP database. Figure 9. States Allowing an Authorized Agent to Access a PDMP Database 48 S. Kelsey. States that Allow Practitioners to Designate an Authorized Agent to Access the PDMP Database, National Alliance for Model State Drug Laws (NAMDL), February abasemapfebruar_000.pdf. Enhancing Access to PDMP Using Health IT 58
67 Recommendation: Both prescribers and dispensers should be able to request and receive PDMP data. Prescribers and dispensers also should be able to appoint delegates as authorized users under state law to request and receive PDMP data, provided that prescribers and dispensers retain supervision and accountability of those delegates. Statutory Examples: The following examples of statutory language are provided to demonstrate that several state PDMP laws currently support the recommendations in this report. These statutory examples are not intended to be definitive or to represent the entire universe of possible options. Policy makers and legislators may reference the language below as a point of reference when considering the best approach for implementation in their own jurisdiction. 1. Indiana ( (d) (4): Except as provided in subsections (e) and (f), the board may release confidential information described in subsection (a) to the following persons:... (4) A practitioner or practitioner s agent certified to receive information from the INSPECT program Iowa (Title IV, Subtitle 1, Chapter 123, Division VI) : The board may provide information from the program to the following:... A pharmacist or a prescribing practitioner may delegate program information access to another authorized individual or agent only if that individual or agent registers for program information access, pursuant to board rules, as an agent of the pharmacist or prescribing practitioner Minnesota (Chapter 152) , Subd. 6 Access to reporting system data: (b)... the following persons shall be considered permissible users and may access the data... in the same or similar manner, and for the same or similar purposes, as those persons who are authorized to access similar private data on individuals under federal and state law: (1) a prescriber or an agent or employee of the prescriber to whom the prescriber has delegated the task of accessing the data, to the extent the information relates specifically to a current patient... and with the provision that the prescriber remains responsible for the use or misuse of data accessed by a delegated agent or employee; (2) a dispenser or agent or employee of the dispenser to whom the dispenser has delegated the task of accessing the data, to the extent the information relates specifically to a current patient... and with the provision that the dispenser remains responsible for the use or misuse of data accessed by a delegated agent or employee Virginia (Chapter 25.2, Title 54.1) : Any prescriber authorized to access the information in the possession of the Prescription Monitoring Program pursuant to this chapter may, pursuant to regulations promulgated by the Director to implement the 49 Ind. Code (d) (2011). 50 Iowa Code (2011). 51 Minn. Stat (2011). Enhancing Access to PDMP Using Health IT 59
68 provisions of this section, delegate such authority to up to two health care professionals who are (i) licensed, registered, or certified by a health regulatory board under the Department of Health Professions, and (ii) employed at the same facility and under the direct supervision of the prescriber Access and Delegation by Other Authorized Healthcare Professionals Other healthcare professionals involved in patient treatment who may not have prescribing or dispensing authority currently do not have the ability to request and receive PDMP data or to appoint delegates. Many of these healthcare professionals work in pain management or mental health and need to know a patient s controlled substance prescription history. The licensed healthcare professionals referenced here may include persons who do not have authority to prescribe or dispense controlled substances, but they should have access to PDMP data because such access directly impacts the quality of patient treatment and care. These licensed healthcare professionals could include practitioners who work in fields such as disease management, behavioral health that involves utilization management review and case management, and practitioners such as substance abuse clinicians and psychologists. The Work Group agreed that extending access to these other licensed healthcare professionals makes sense. The members caution that even in the five states where access is partially expanded, some state statutes remain more restrictive than the Work Group would prefer. The statutes below merely represent the approach that states have currently taken. Although the Work Group agrees that other licensed healthcare professionals should be able to view PDMP data, the members were unable to form a consensus for extending access beyond these licensed healthcare professionals, thus future discussion is required. Recommendation: Licensed healthcare professionals other than prescribers and dispensers should be authorized to request and receive PDMP data when the data are necessary to evaluate or treat a patient. Licensed healthcare professionals include healthcare practitioners certified or registered by a state. The same licensed healthcare professionals should be able to appoint delegates authorized under state law, provided that the licensed or certified healthcare professionals retain supervision and accountability of those delegates. Statutory Examples: 1. Colorado (Title 12, Article 22, Part 7) : (3) The program is available for query only to the following persons or groups of persons:... (c) Practitioners engaged in a legitimate program to monitor a patient s controlled substance abuse VA. Code Ann (2009). 53 Colo. Rev. Stat (2011). Enhancing Access to PDMP Using Health IT 60
69 2. Indiana (Title 35, Article 48, Chapter 7) : (d) Except as provided in subsections (e) and (f), the board may release confidential information described in subsection (a) to the following persons:... (8) A substance abuse assistance program for a licensed health care provider who: (A) has prescriptive authority under IC 25; and (B) is participating in the assistance program Maryland (Title 21, Subtitle 2A) 21-2A-06: (b) The Program shall disclose prescription monitoring data, in accordance with regulations adopted by the Secretary, to:... (5) A rehabilitation program under a health occupations board, on issuance of an administrative subpoena North Dakota (Title 19, Chapter ) : 3. Unless disclosure is prohibited by law, the board may provide data in the central repository to:... j. A licensed addiction counselor for the purpose of providing services for a licensed treatment program in this state Utah (Title 58, Chapter 37F, Part 4) 58-37f-301: (2) The division shall make information in the database available only to the following individuals, in accordance with the requirements of this chapter and division rules:... (i) a mental health therapist, if: (i) the information relates to a patient who is: (A) enrolled in a licensed substance abuse treatment program; and (B) receiving treatment from, or under the direction of, the mental health therapist as part of the patient s participation in the licensed substance abuse treatment program described in Subsection (2)(i)(i)(A); (ii) the information is sought for the purpose of determining whether the patient is using a controlled substance while the patient is enrolled in the licensed substance abuse treatment program described in Subsection (2)(i)(i)(A); and (iii) the licensed substance abuse treatment program described in Subsection (2)(i)(i)(A) is associated with a practitioner who: (A) is a physician, a physician assistant, an advance practice registered nurse, or a pharmacist; and (B) is available to consult with the mental health therapist regarding the information obtained by the mental health therapist, under Subsection (2)(i), from the database; Patients Should Be Able to Access Their Own PDMP Data Patients do not have access to their own PDMP data in every state. In fact, as of July 2012, only 33 states permit patients and/or parents or guardians of minor children to request and receive their own PDMP data. 58 When states deny patients access to the personal information being collected on them, states are in conflict with longstanding privacy principles like the FIPPs, which have been the foundation of open-government best practices since the 1970s. The Law Work Group believes that in the future, all states should permit patients to access their own data. 54 Ind. Code (d) (2011). 55 Md. Code Ann. Health Occ. 21-2A-06 (2011). 56 N.D. CENT. CODE (2011). 57 UTAH CODE ANN f-301(2)(i) (2011). 58 H. Gray. States that Provide PMP Database Information to Patient and/or Parent or Guardian of Minor Child, NAMSDL, March Enhancing Access to PDMP Using Health IT 61
70 Some states provide patients with limited access to their data; certain data elements, such as prescriber or dispenser DEA registration numbers, are restricted in order to mitigate potential fraud. States should retain the ability to restrict sharing certain PDMP data elements with patients. The members agreed that the methods to request and receive personal data from the PDMP should be reasonable. A reasonable method may include submitting a notarized hard copy request to the PDMP. An unreasonable method may be to appear in person with three forms of identification on the first Tuesday of the month. Currently, no PDMP systems offer patients electronic access to their data. Some members raised a concern that such ease of access may lead to potential abuse or compromise of sensitive PDMP data if patients lose their authentication credentials. The Work Group recognized that in the future, many patients will have the ability to access health records securely via a Web portal or other electronic medium. Figure 10 highlights states that provide PDMP database information to patients and/or the parent or guardian of a minor child. Figure 10. States Providing PDMP Access to Patients and/or Parents/Guardians Enhancing Access to PDMP Using Health IT 62
CONNECTING FOR IMPACT: Federal Efforts to Integrate Health IT and PDMPs to Improve Patient Care
CONNECTING FOR IMPACT: Federal Efforts to Integrate Health IT and PDMPs to Improve Patient Care Jinhee Lee, PharmD Substance Abuse and Mental Health Services Administration Jennifer Frazier, MPH Office
Connecting Prescribers and Dispensers to PDMPs through Health IT: Six Pilot Studies and Their Impact
Page 1 Introduction Prescription drug misuse and overdose is one of the fastest growing health epidemics in the United States. To address the prescription drug abuse problem, many states have established
Enhancing Access to Prescription Drug Monitoring Programs
Enhancing Access to Prescription Drug Monitoring Programs Technical Framework for Interoperability Approved for Public Release: 13-1107. Distribution Unlimited. 2013 The MITRE Corporation. All rights reserved.
CAPITOL research. Interstate Information Sharing: Prescription Drug Monitoring Programs
The Council of State governments CAPITOL research APRIL 00 Prescription Drug Monitoring Interstate Information Sharing: Prescription Drug Monitoring Programs The Council of State Governments Misuse of
Evaluating Options for the Integration of Electronic Medical Records With the Vermont Prescription Monitoring System
Report to The Vermont Legislature Evaluating Options for the Integration of Electronic Medical Records With the In Accordance with Act 75, (2013), Section 13a, An Act Relating to Strengthening Vermont
Integrating E-Prescribing with a Prescription Drug Monitoring Program: A Pilot Study
Page 1 Overview The Michigan pilot at the Huron Valley Physicians Association (HVPA) demonstrated the value of health IT connectivity by: Making Prescription Drug Monitoring Program (PDMP) data more readily
Report to the Legislature: Interstate Prescription Data Exchange MN Prescription Monitoring Program
This document is made available electronically by the Minnesota Legislative Reference Library as part of an ongoing digital archiving project. http://www.leg.state.mn.us/lrl/lrl.asp Minnesota Board of
Enhancing Access to Prescription Drug Monitoring Programs Pilot Impact, In Their Own Words Approved for Public Release: 13-1097. Distribution Unlimited. 2013 The MITRE Corporation. All rights reserved.
ACTION PLAN FOR IMPROVING ACCESS TO PRESCRIPTION DRUG MONITORING PROGRAMS THROUGH HEALTH INFORMATION TECHNOLOGY
ACTION PLAN FOR IMPROVING ACCESS TO PRESCRIPTION DRUG MONITORING PROGRAMS THROUGH HEALTH INFORMATION TECHNOLOGY Presented to The Behavioral Health Coordinating Committee, Department of Health and Human
SUPPORTING PRESCRIPTION DRUG MONITORING PROGRAMS
SUPPORTING PRESCRIPTION DRUG MONITORING PROGRAMS Prepared for the Office of the National Coordinator for Health Information Technology by: Genevieve Morris, Senior Associate Scott Afzal, Principal David
Department of Health and Human Services Substance Abuse and Mental Health Services Administration PPHF-2012-Cooperative Agreements for Prescription Drug Monitoring Program (PDMP) Electronic Health Record
Technical Assistance Guide No. 05-13 PDMP Data Management Solutions
Technical Assistance Guide No. 05-13 PDMP Data Management Solutions April 25, 2013 Introduction During this time of a slow and struggling economy, public agencies are asked to do more with less. As state
Bureau of Justice Assistance. Prescription Drug Monitoring Program Performance Measures Report: January 2009 through June 2012
Bureau of Justice Assistance Prescription Drug Monitoring Program Performance Measures Report: January 2009 through Revised October 21, 2013 Grantee Feedback Included April 4, 2014 Prepared by Peter Kreiner,
A New Generation of Prescription Monitoring Programs: Best & Promising Practices
A New Generation of Prescription Monitoring Programs: Best & Promising Practices National PDMP Meeting Washington, DC September 25, 2013 Presented by John L Eadie Why Is a New Generation of PDMPs Being
Technical Assistance Guide No. 04-13 Funding Options for Prescription Drug Monitoring Programs
Technical Assistance Guide No. 04-13 Funding Options for Prescription Drug Monitoring Programs July 3, 2013 Introduction Over the past ten years, prescription drug monitoring programs (PDMPs) have proliferated
Harold Rogers Prescription Drug Monitoring Program
Harold Rogers Prescription Drug Monitoring Program 19 th National Conference on Pharmaceutical and Chemical Diversion June 16-17, 2010 Harold Rogers Prescription Drug Monitoring Program Since fiscal year
Report of the Executive Committee NABP 109 th Annual Meeting May 18-21, 2013 St Louis, MO Presented by: Malcolm J. Broussard, RPh Good afternoon. It is a pleasure to see so many of you here in St Louis
DETAILED COMMENTS ON MEANINGFUL USE STAGE 3 PROPOSED RULE LEARN FROM STAGE 2 OF MEANINGFUL USE BEFORE MOVING TO STAGE 3
DETAILED COMMENTS ON MEANINGFUL USE STAGE 3 PROPOSED RULE LEARN FROM STAGE 2 OF MEANINGFUL USE BEFORE MOVING TO STAGE 3 Learn from the Experience in Stage 2 The majority of hospitals and nearly all physicians
Preliminary Evaluation of the Prescription Drug Monitoring Program
Preliminary Evaluation of the Prescription Drug Monitoring Program Recommendations: Waive from full evaluation Extend termination date by three years to July 1, 2019 Require follow-up report by January
Integrated Nationwide Prescription Drug Monitoring Program
Integrated Nationwide Prescription Drug Monitoring Program Background Paper Prepared for the 2014 2015 APhA Policy Committee Caroline Griggs, PharmD, MBA Director of Clinical Pharmacy Services Medical
PDMP and HIE Integration: The Maryland Experience
PDMP and HIE Integration: The Maryland Experience January 14, 2015 Kate Jackson Maryland PDMP Manager Lindsey Ferris CRISP PDMP Project Manager Background on CRISP What is CRISP? CRISP is a non-profit
ELECTRONIC HEALTH RECORDS PILOT: BREAKING NEW GROUND. Craig Berberet Illinois PMP Administrator 217-558-0943 Craig.Berberet@Illinois.
ELECTRONIC HEALTH RECORDS PILOT: BREAKING NEW GROUND Craig Berberet Illinois PMP Administrator 217-558-0943 Craig.Berberet@Illinois.gov OVERVIEW OF ILLINOIS PMP Current Grant Funding: Two Harold Rogers
PDMPs and Third Party Payers Meeting December 2012
Prescription Drug Monitoring Program Center of Excellence at Brandeis PDMPs and Third Party Payers Meeting December 2012 Report of Proceedings April, 2014 This project was supported by Grant No. 2011-PM-BX-K002
Prescription Monitoring Information Exchange (PMIX)
Prescription Monitoring Information Exchange (PMIX) Prescription Drug Monitoring Program 2010 West Regional Meeting Chris Baumgartner Program Coordinator ASPMP Why PMIX? The BJA/IJIS PMP Committee Prescription
The Brave. New World of Healthcare Correspondence. Harnessing the Power of SaaS to Safeguard Patient Data. White paper
The Brave New World of Healthcare Correspondence Harnessing the Power of SaaS to Safeguard Patient Data Background The passage of HIPAA in 1996 introduced seismic changes to the way healthcare providers