Appendix F: HISPC ASP Use Case Policy Requirements Templates Table of Contents HISPC ASP EHR Laboratory Results Use Case Policy Requirements Template for Participant Model States F-7 Part 1. Introduction ....................................................................................... F-7 Purpose .................................................................................................. F-7 Organization ........................................................................................... F-7 Instrument Navigation .............................................................................. F-8 Part 2. Scenarios for Documenting Authentication and Audit Requirements ........... F-8 EHR Laboratory Test Results Use Case Summary ......................................... F-8 Part 3. Policy and Information Exchange Requirements Worksheets for the Health Information Organization—EHR Laboratory Results Use Case .......... F-9 Part 4. User Guide to Instrument Completion .................................................. F-28 Part 5. Local HIO Business Actors .................................................................. F-49 Part 6. Supplemental Material ....................................................................... F-51 HISPC ASP Medication Management Use Case Policy Requirements Template for Participant Model States F-60 Part 1. Introduction ..................................................................................... F-60 Purpose ................................................................................................ F-60 Organization ......................................................................................... F-60 Instrument Navigation ............................................................................ F-61 Part 2. Scenarios for Documenting Authentication and Audit Requirements ......... F-61 Medication Management Use Case Summary ............................................. F-61 Part 3. Policy and Information Exchange Requirements Worksheets for the Health Information Organization—Medication Management Use Case ....... F-62 Part 4. User Guide to Instrument Completion .................................................. F-83 Part 5. Local HIO Business Actors ................................................................ F-111 Part 6. Supplemental Material ..................................................................... F-115 HISPC Phase III ASPC Final Report F-1 Appendix F — HISPC ASP Use Case Policy Requirements Templates List of Tables F-1. AUT-1a: User Authentication Requirement: Method(s) of User Identity Vetting at Time or Registration of HIO Members.................................... F-10 F-2. AUT-1b: User Authentication Requirement: Assurance Level Used (Individual User) .............................................................................. F-10 F-3. AUT-1c: User Authentication Requirement: Lab Results Context Restrictions Apply (see HITSP/C37) ..................................................... F-10 F-4. AUT-1d: User Authentication Requirement: Sensitivity Restrictions to Lab Results Apply ............................................................................. F-11 F-5. AUT-2: Subject of Care Identity .......................................................... F-11 F-6. AUT-3a: System Authentication: System Identity Vetting ....................... F-11 F-7. AUT-3b: System Authentication: Assurance Levels (System to System) ... F-12 F-8. AUT-3c: System Authentication: Lab Results Context Restrictions Apply (see HITSP C37) ...................................................................... F-12 F-9. AUT-3d: System Authentication: Sensitivity Restrictions to Lab Results Apply .............................................................................................. F-12 F-10. AUT-4: Data Authentication: Data Authentication Requirements Vary by Jurisdiction and Information Use ..................................................... F-13 F-11. AUT-5a: Organization Authentication: Organization Identity Vetting ........ F-13 F-12. AUT-5b: Organization Authentication: Assurance Levels (Organization to Organization) ............................................................................... F-13 F-13. AUT-5c: Organization Authentication: Lab Results Context Restrictions Apply .............................................................................................. F-14 F-14. AUT-5d: Organization Authentication: Sensitivity Restrictions to Lab Results Apply ................................................................................... F-14 F-15. AUT-6: Authenticate Recipient Identity (User, Organization, System): Authenticate the Identity of Recipients of Communications by Any of the Following Means .......................................................................... F-14 F-16. AUD-1: Information Request—Requires Written Policy: Components Required in the Written Policy ............................................................. F-15 F-17. AUD-2: Information Disclosure—Requires Written Policy: Components Required in the Written Policy ............................................................. F-16 F-18. DAT-1: Role: Establish a Defined Role Associated with the HIO Registered User Under Which the User Is Authenticated ......................... F-16 F-19. DAT-2: Data Source .......................................................................... F-17 F-20. DAT-3: Assurance Levels: Assurance Levels Communicated ................... F-17 F-21. DAT-4: Requestor Type ..................................................................... F-17 F-22. DAT-6: Data Elements/Identifiers the HIO Uses for Record Matching (Required Elements for Matching [Optional]) ........................................ F-18 F-23. DAT-7: Matching Criteria: Defined Required Minimum Number of Data Elements Required to Query Another System ........................................ F-18 HISPC Phase III ASPC Final Report F-2 Appendix F — HISPC ASP Use Case Policy Requirements Templates F-24. DAT-8a: Persistence: Persistence of Source Signature ........................... F-19 F-25. DAT-8b: Persistence: Nonrepudiation of Origin ..................................... F-19 F-26. DAT-9: Demographics That May be Logged .......................................... F-19 F-27. DAT-10: Provider Identity Attributes: User Attributes Included in Directory Entry ................................................................................. F-20 F-28. DAT-11a: Organization Identity Attributes: Organization Attributes Required by HIO to Allow for Member Organization to Connect to HIO ..... F-20 F-29. DAT-11b: Organization Identity Attributes: Regulated Health Care Organization .................................................................................... F-21 F-30. DAT-12a: System Identity Attributes: System Attributes Required by HIO for HIO Member Organization Systems to Connect .......................... F-21 F-31. DAT-12b: System Identity Attributes: System Types (Check all Applicable Types Participating in the HIO) ............................................ F-21 F-32. SYS-1: Preparing a Query Message: Specified by HITSP ......................... F-22 F-33. SYS-2: Audit Log (HIPAA) .................................................................. F-22 F-34. SYS-3: Audit Log Content: Shared Specifics Include: ............................. F-22 F-35. SYS-4: System Review ...................................................................... F-23 F-36. SYS-5: Threshold Calculation ............................................................. F-23 F-37. SYS-6: Audit Trail and Node Authentication (ATNA) ............................... F-23 F-38. SYS-8: Security Audit Practices .......................................................... F-23 F-39. SYS-9: Digital Signature .................................................................... F-24 F-40. POL-1: Interim Reports ..................................................................... F-24 F-41. POL-2: Restricted Data Sharing .......................................................... F-24 F-42. POL-8: Returning More Demographics ................................................. F-24 F-43. POL-9: Audit Log Process ................................................................... F-24 F-44. POL-10: Data Authentication .............................................................. F-25 F-45. POL-11: Digital Signature .................................................................. F-25 F-46. POL-12: Relationship to Patient .......................................................... F-25 F-47. POL-13: Risk Assessment .................................................................. F-25 F-48. POL-15: Information System Activity Review (45 C.F.R. 164.308(a)(1): Administrative Safeguard; Policy, Data, and System Requirements ................................................................................... F-26 F-49. POL-16: Log-in Monitoring (45 C.F.R. 164.308(a)(5): Administrative Safeguard; Policy, Data, and System Requirements ............................... F-26 F-50. POL-17: Evaluation (45 C.F.R. 164.308(a)(8): Administrative Safeguard; Policy Requirements ......................................................... F-27 F-51. POL-18: Audit Controls (45 C.F.R. 164.312(b): Technical Safeguard; Policy, Data, System Requirements ..................................................... F-27 F-52. Local HIO Business Actors .................................................................. F-50 F-53. Structural Roles ................................................................................ F-51 F-54. Health Care Functional Roles: In this Role, is the User Expected to be Able to Access Data? ......................................................................... F-55 HISPC Phase III ASPC Final Report F-3 Appendix F — HISPC ASP Use Case Policy Requirements Templates F-55. Organization Roles: In this Role, is the User Expected to be Able to Access Data? .................................................................................... F-56 F-56. Crosswalk: Lab Authentication and Audit Requirements to HITSP Standards ........................................................................................ F-57 F-57. AUT-1a: User Authentication Requirement: Method(s) of User Identity Vetting at Time or Registration of HIO Members.................................... F-63 F-58. AUT-1b: User Authentication Requirement: Assurance Level Used (Individual User) .............................................................................. F-63 F-59. AUT-1c: User Authentication Requirement: Medication Processing Context Restrictions Apply ................................................................. F-64 F-60. AUT-1d: User Authentication Requirement: Sensitivity Restrictions for Medication Reconciliation Apply .......................................................... F-64 F-61. AUT-2: Subject of Care Identity .......................................................... F-64 F-62. AUT-3a: System Authentication: System Identity Vetting ....................... F-65 F-63. AUT-3b: System Authentication: Assurance Levels (System to System) ... F-65 F-64. AUT-3c: System Authentication: Medication Processing Context Restrictions Apply (see HITSP C37) ..................................................... F-66 F-65. AUT-3d: System Authentication: Sensitivity Restrictions for Medication Reconciliation Apply .......................................................................... F-66 F-66. AUT-4: Data Authentication: Data Authentication Requirements Vary by Jurisdiction and Information Use ..................................................... F-66 F-67. AUT-5a: Organization Authentication: Organization Identity Vetting ........ F-67 F-68. AUT-5b: Organization Authentication: Assurance Levels (Organization to Organization) ............................................................................... F-67 F-69. AUT-5c: Organization Authentication: Medication Processing Context Restrictions Apply ............................................................................. F-67 F-70. AUT-5d: Organization Authentication: Sensitivity Restrictions for Medication Reconciliation Apply .......................................................... F-68 F-71. AUT-6: Authenticate Recipient Identity (User, Organization, System): Authenticate the Identity of Recipients of Communications by Any of the Following Means .......................................................................... F-68 F-72. AUT-7: Data Validation ...................................................................... F-68 F-73. AUD-1: Information Request—Requires Written Policy: Components Required in the Written Policy ............................................................. F-69 F-74. AUD-2: Information Disclosure—Requires Written Policy: Components Required in the Written Policy ............................................................. F-69 F-75. DAT-1: Role: Establish a Defined Role Associated with the HIO Registered User Under Which the User is Authenticated ......................... F-70 F-76. DAT-2: Data Source .......................................................................... F-70 F-77. DAT-3: Assurance Levels: Assurance Levels Communicated ................... F-70 F-78. DAT-4: Requestor Type ..................................................................... F-70 F-79. DAT-6: Required Elements for Matching (Optional): Data Elements/Identifiers the HIO Uses for Record Matching .......................... F-71 F-80. DAT-7: Matching Criteria: Defined Required Minimum Number of Data Elements Required to Query Another System ........................................ F-72 HISPC Phase III ASPC Final Report F-4 Appendix F — HISPC ASP Use Case Policy Requirements Templates F-81. DAT-8a: Persistence: Persistence of Source Signature ........................... F-72 F-82. DAT-8b: Persistence: Nonrepudiation of Origin ..................................... F-72 F-83. DAT-9: Demographics That May Be Logged .......................................... F-72 F-84. DAT-10: Provider Identity Attributes: User Attributes Included in Directory Entry ................................................................................. F-73 F-85. DAT-11a: Organization Identity Attributes: Organization Attributes Required by HIO to Allow for Member Organization to Connect to HIO ..... F-73 F-86. DAT-11b: Organization Identity Attributes: Regulated Health Care Organization .................................................................................... F-74 F-87. DAT-12a: System Identity Attributes: System Attributes Required by HIO for HIO Member Organization Systems to Connect .......................... F-74 F-88. DAT-12b: System Identity Attributes: System Types: Check all Applicable Types Participating in the HIO ............................................. F-74 F-89. DAT-13: Signature Purpose: Applicability and Captured Elements of Signature ........................................................................................ F-75 F-90. SYS-1: Preparing a Query Message: Specified by HITSP ......................... F-75 F-91. SYS-2: Audit Log (HIPAA) .................................................................. F-76 F-92. SYS-3: Audit Log Content: Shared Specifics Include .............................. F-76 F-93. SYS-4: System Review ...................................................................... F-76 F-94. SYS-5: Threshold Calculation ............................................................. F-77 F-95. SYS-6: Audit Trail and Node Authentication (ATNA) ............................... F-77 F-96. SYS-8: Security Audit Practices .......................................................... F-77 F-97. SYS-9: Digital Signature .................................................................... F-77 F-98. SYS-10: Electronic Signature .............................................................. F-77 F-99. SYS-11: Signature Verification: Verification of Signer Credentials ............ F-78 F-100. SYS-12: Information Integrity ............................................................ F-78 F-101. SYS-13: User Identity Verification ....................................................... F-78 F-102. POL-1: Interim Reports ..................................................................... F-78 F-103. POL-2: Restricted Data Sharing .......................................................... F-79 F-104. POL-8: Returning More Demographics ................................................. F-79 F-105. POL-9: Audit Log Process ................................................................... F-79 F-106. POL-10: Data Authentication .............................................................. F-79 F-107. POL-11: Digital Signature .................................................................. F-79 F-108. POL-12: Relationship to Patient .......................................................... F-80 F-109. POL-13: Risk Assessment .................................................................. F-80 F-110. POL-14: Signature/Data Validation Checking: Signature and Data Integrity Conducted Prior to Allowing the Following Procedures ............... F-80 F-111. POL-15: Information System Activity Review (45 C.F.R. 164.308(a)(1): Administrative Safeguard; Policy, Data, and System Requirements ................................................................................... F-81 F-112. POL-16: Log-in Monitoring (45 C.F.R. 164.308(a)(5): Administrative Safeguard; Policy, Data, and System Requirements ............................... F-81 HISPC Phase III ASPC Final Report F-5 Appendix F — HISPC ASP Use Case Policy Requirements Templates F-113. POL-17: Evaluation (45 C.F.R. 164.308(a)(8): Administrative Safeguard; Policy Requirements ......................................................... F-82 F-114. POL-18: Audit Controls (45 C.F.R. 164.312(b): Technical Safeguard; Policy, Data, System Requirements ..................................................... F-82 F-115. Local HIO Business Actors ................................................................ F-113 F-116. Structural Roles .............................................................................. F-115 F-117. Health Care Functional Roles: In this Role is the User Expected to be Able to Access Data? ....................................................................... F-119 F-118. Organization Roles: In this Role is the User Expected to be Able to Access Data? .................................................................................. F-120 F-119. Organization Roles: In this Role is the User Expected to be Able to Access Data? .................................................................................. F-121 F-120. Crosswalk: Medication Management Authentication and Audit Requirements to HITSP Standards .................................................... F-122 HISPC Phase III ASPC Final Report F-6 HISPC ASP EHR Laboratory Results Use Case Policy Requirements Template for Participant Model States Part 1. Introduction Purpose This document is intended for use as a guide to facilitate the systematic collection of information related to a specified range of health information organization business requirements in practice, policy, state regulation, and law for the authentication and audit of physicians and health care providers exchanging protected health information given defined scenarios. Organization The Policy and Information Requirements Use Case Collection Template is organized into six parts to allow responding states the flexibility to adapt the use of the instrument to a range of Health Information Organization (HIO) Models, business requirements, and modes of administration. This template may be administered in a group session, individual respondent mode, or other mode as defined by the user. Information may be captured and submitted in any combination of paper or electronic formats. The complete template includes the following: ▪ Part 2: Scenarios for Health Information Exchange ▪ Part 3: Requirements Worksheets A–E A. Authentication B. Audit C. Data D. System E. Policy The Requirement Worksheets A–E are to be completed by the state HIO model organization with help from the state HISPC staff. These documents are intended to capture the organizational policy and procedural requirements as well as any known statutory rules and/or regulations that may apply to the events and actions in the selected lab result scenario. ▪ Part 4: User Guide to Instrument Completion ▪ Part 5: State Business Actors ▪ Part 6: Supplemental Information. Defining roles; requirements crosswalk to HITSP defined standards. HISPC Phase III ASPC Final Report F-7 Appendix F — HISPC ASP Use Case Policy Requirements Templates Instrument Navigation Please review these instructions and all parts of the complete instrument package prior to administration. Follow the steps as described to complete the instrument package. 1. Select an appropriate mode of administration based on the characteristics of the state environment in which the instrument is to be completed. This may include completing the instrument in a facilitated group discussion session, an individual respondent mode, or a combination of the two. 2. Go To Part 2: Scenarios for Health Information Exchange. Review the selected scenarios for your state. The selected scenarios will be noted by the State HISPC Project Manager. 3. Go To Part 3: Requirements Worksheets A–E. Complete Worksheets A through E as per the instructions. Responses on Worksheets A–E will be used to identify business requirements in the subsequent Part 4. One set of Requirements Worksheets for the HIO across scenarios is assumed unless otherwise noted by the state or HIO. 4. Go To Part 4: User Guide to Instrument Completion. Part 4 is to be completed with responses from Requirements Worksheets A–E. Select the state’s first scenario for examination. Repeat Part 4 for each additional scenario selected by your state for review. If necessary complete additional Requirements Worksheets to note the change in requirements by scenario. 5. Go To Part 5: Local HIO Business Actors. Complete per instructions. Part 2. Scenarios for Documenting Authentication and Audit Requirements EHR Laboratory Test Results Use Case Summary The Use Case includes two scenarios that cover typical interfaces involving an EHR system (or equivalent) and laboratory results. The HITSP EHR specifications describe both a laboratory message transaction and a document sharing paradigm. Ordering providers of care receive results as a laboratory message, nonordering providers of care access historical laboratory results as documents, and “copy-to” providers of care may receive document availability notifications to retrieve such lab report documents. A summary of the scenarios is provided. Teams should be familiar with the contents of the scenario and supporting technical documents. This summary is not intended to provide the detail necessary to complete this template. Scenario 1 Laboratory test results are transmitted as a result of the order. The specifics of the ordering process are outside the scope of this use case. The test results are sent directly to the clinician’s EHR system (local or remote) and/or another clinical data system to provide laboratory results to ordering and non-ordering authorized recipients. Consideration is given to both message and document transactions: alternative scenario (1a), HL7 V2.5.1 HISPC Phase III ASPC Final Report F-8 Appendix F — HISPC ASP Use Case Policy Requirements Templates messages are used and in the second alternative (1b), HL7 V3.0 CDA R2 documents are used. Scenario 2 A provider of care accesses historical test results related to a specific patient by first querying for the laboratory report document and then retrieving or receiving the data. The provider may request the test results, possibly from separate data repositories, and after selection, they are sent to the provider’s EHR. This scenario extends the capabilities of Scenarios #1a and #1b by providing HL7 CDA laboratory reports to an authorized provider of care upon request. The provider queries a locator service for the location of a document and receives a pointer that is then used to retrieve the document. This allows for laboratory results to be stored in multiple repositories, but still requested from a single locator service. Part 3. Policy and Information Exchange Requirements Worksheets for the Health Information Organization—EHR Laboratory Results Use Case The following Requirements Worksheets A–E include tables that contain baseline identified business requirements in five areas: authentication, audit, data, systems, and policy (Tables F-1 through F-51). These requirements crosswalk to several selected specifications developed by the ONC Standards Harmonization initiative (HITSP) for the Electronic Health Record Laboratory Results Use Case (see Table F-56). Each area of requirements is contained in a separate table. Each requirement has a unique text-numeric identifier and description. These requirements are not intended to capture all requirements that exist. The Requirements Worksheets are to be completed for the HIO model that is demonstrating the use case. These worksheets must be completed prior to work on Part 4 of this packet. Instructions: Use the key concepts to indicate which of the following practices, policies, and/or procedures are either required, optional, under consideration, or the HIO considers not implementable at this time. If the HIO is not considering the practice, leave the item blank. Key R Required means the use of the indicated process, policy, or procedure is required by the HIO O Optional means the use is in practice by some participants but not required by the HIO U Under consideration for implementation by the HIO N Not implementable at this time across all participants for multiple reasons (i.e., cost, technology, political) HISPC Phase III ASPC Final Report F-9