Legal & Policy Advisory Group Meeting
January 21, 2013 2:30-4p

Name	Organization	
Elizabeth Copeland	MeHI   	
Kathleen Snyder	EOHHS Legal 	
Sarah Moore	Tufts Medical Center	
Adam Tapply 	Center for Health Information and Analysis 	
Support Staff	 	
Mark Belanger	Massachusetts eHealth Collaborative	
Micky Tripathi	Massachusetts eHealth Collaborative	
Jennifer Monahan 	Massachusetts eHealth Collaborative	

Review of Materials and Discussion
There is currently work being done with The Executive Office of Health and Human Services (EOHHS) and Orion on Health Information Service Provider (HISP) connectivity, both on the technical and policy sides. Kathleen Snyder has been working with several folks on what an agreement should contain, and what it will look like. Today we will look at the background on HISPs, review the policy guiderails under consideration, and ask for your input. 
Project Updates
•	Phase 1 – Transaction and deployment update (Slide 2)
o	The group reviewed the Phase 1 updates.  There are now 35 organizations in production, 22 live and 57 total organizations on the HIway. 
•	Phase 1 – Transaction and deployment update cont. (Slide 3)
o	Six new participation agreements were executed in November: Beverly Hospital/NHS, Chair City Family Medicine, Christopher House, Dr. Masucci, Orleans Medical Center, Pulmonary and Primary Care Associates. There were 129,045 transactions exchanged in November and 1,764,493 total transactions to date, approximately 700,000 of which were production transactions.  
o	We still have not seen a rapid increase in use. There continues to be steady increase in  breadth, but actual use has been steady. This was the focus of the December HIT Council meeting where Manu Tandon of EOHHS outlined a 2014 plan for continuing to bring new participants onto the HIway while helping those that are already on to optimize use. 
•	HISP to HISP Connectivity (Slide 4)
o	 A list of the HISP vendors currently engaged was provided. There is a dedicated Orion resource working on connecting these HISPs to the HIway. There are another six or seven HISPs on deck which are expected to start testing next month after this first group.
o	Question: Is testing being done to validate security?
•	Answer: The main security concern is making sure that each one of the HISPs that connects to HIway protects its anchor certificate. EOHHS has engaged Symantec, which has a secure data center that can provide all of the physical and technical controls to protect the security certificates; part of this is requiring vendors to do the same thing. A lot of today’s meeting is looking at the contractual framework that will reinforce that. 
•	Phase 2 Overall Timeline (Slide 5)
o	The biggest announcement is that there will be a Phase 2 launch event the morning of January 8th. Similar to a year ago with the Golden Spike, there will be a demonstration of the Phase 2 services; the relationship listing service (RLS) and provider portal. There will be a use case demonstration; an emergency department team will use the new HIway services to locate and retrieve a record, showing how they would treat a patient differently using the HIway than if they did not have access to the patients records. Beth Israel Deaconess Medical Center, Tufts, Holyoke Medical Center, and Atrius will participate in the demonstration. 
o	Question: Is this going to be on Youtube?
•	Answer: We are not sure if people are recording, there will be a lot of press there. 
Mass HIway Phase 2 Policy Input
•	Setting the Table for Today’s Discussion (Slide 7)
o	Originally it was envisioned that the HIway would be the main provider of Health Information Services in the state; since then we have seen a number of vendors decide to become HISPs. The HIway has found that it now needs to take more of a “peer” position relative to the other HISPs and to work together to connect as many providers as possible statewide. A few HISPs  represent a large number of the Commonwealth’s providers, especially the smaller providers. This reinforces the need to work collaboratively with the HISPs. Today we would like to discuss the contract and technical approach to HISPs and to review and react to the policy guiderails for HISP connectivity. 
•	What is a HISP? (Slide 8)
o	This is a layperson definition of a HISP; there is really no widely accepted definition to date. A HISP is a network with its own trust fabric that issues its own Direct Addresses and issues its own Direct-compliant certificates allowing message traffic to be encrypted en route and decrypted on the when received. 
o	Some examples: Surescripts is partnering with a number of vendors to capitalize on its existing e-prescribing network, while eCW is making its own HISP play in the market. Secure Exchange Solutions (SES), working with Winchester, is creating its own community HISP. 
o	Some other organizations may look like HISPS but are not, Pioneer Valley Information Exchange (PVIX) and Holyoke for example. They are doing a lot of HIE services, but they are not issuing Direct addresses or certificates and instead are using the HIway as their HISP. Meditech is doing a lot of work around connectivity but not taking a HISP approach. Partners, a larger system in the State, is also deciding not to become its own HISP. 
•	HISP to HISP Contract Approach (Slide 9)
o	The main idea is that HIway will have a contract with each HISP and will continue to have a Participation Agreement (PA) with HIway participants under another HISP. 
o	Comment: EOHHS wrestled with the idea of how we were going to contract with the HISPs and settled on having the HISP as a subcontractor to the participant. This is evolving quickly, and faster than expected, but this is the way that EOHHS felt comfortable. Since there are no federal regulations, and organizations are not ready for Direct Trust, we have to work with where we are. With the idea of a HISP as a subcontractor, that allows EOHHS to make sure the consent requirements are satisfied, the Business Associate Agreement (BAA) gets at the level of privacy we need and the HISP agreement will talk about protecting the Anchor Certificates. 
o	Question: Who has to get the participation agreement from the HISP? Does the PA need to do it? 
•	Answer: Willingness to get HIway PA signatures may vary by HISP. 
•	HISP to HISP Technical Approach (Slide 10)
o	The technical approach is about the two things we talked about at the beginning: managing addresses, and managing security certificates. When there are multiple HISPs they must be able to trust one another’s anchor certificates. 
•	Provider Directory - Data elements collected and stored (Slide 11) 
o	How do we extend our trust community with other HISPs? To get to Dave’s earlier point around how to maintain security once you have another layer removed from the HIway, the guide rails right now are that the HIway will only connect to a HISP that will agree to a few different things:
1.	The HISPs performs HISP functions in accordance with Direct protocols. 
2.	The HISP needs a Business Associate Agreement (BAA) with its participants. 
3.	The HISP maintains and protects anchor certificates. 
4.	The HISPs limits provider directory use.
5.	The HISP does not delay messages, or change any message content. 
o	Mass HIway and the HISP then exchange anchor certificates so the intent of the agreement can be enforced through the technology.
•	Question: Have you heard so far any HISPs that take the position that they are simply a secure conduit, and therefore do not need BA agreements?
•	Answer: The idea has not really been shopped around yet. In conversations with Surescripts and their clients, they plan to be a BAA with Walgreens for example. It would be a surprise if anyone pushed back, but if it does happen it will need to be addressed. For the time being, if we come up with a HISP that feels that way, we would need to take a step back and evaluate why the HISP does not want to be a BAA.
•	Question: What is the security risk around the certificate is it that the certificates could be cloned?
•	Answer:  The issue is that if someone were to get access to the certificate, they would be seen as a member of the HIway trust fabric and the recipient would have no way of knowing that they are actually not part of the trust fabric. 
•	Comment: EOHHS has had various conversations with others around HISPs being able to access the Phase 2 services, like the Relationship Listing Service. Such a large number of people are coming in through HISPs, we may want some functionality to be there for HISPs. 
•	Question:  So is the answer then to the security question around the security key?  Are you looking for written assessments, or third party assessments?
•	Answer: EOHHS will have requirements that participants must adhere to. Federal Information Process Standards 140-2 for Cryptographic Modules. EOHHS is still working to vet that standard internally. It has been a challenge because there are no widely adopted standards that people feel comfortable with.
•	Question: Are you seeing any standard in the market where HISPs create their own set of standards?
•	 Answer: There are some younger certifications out there that do not have much market traction yet. This will be a parallel exercise of watching the certifications while working with key HISPs to get going on connecting. 
•	HISP to HISP- Privacy and Security (Slide 12)
o	The BAA really holds this together; everyone will be bound by the Health Information Privacy and Portability Act (HIPPA) privacy and security rules. This is the foundation for a lot of the HISP approach.
•	HISP to HISP- Charging (Slide 13)
o	The position right now is that the HIway will not charge other HISPs to participate, nor expect that the HISP will charge the HIway. This is what we are seeing from other HISPs in the market place; the expectation they will not cross charge.
o	Question:  That means that the HISP can charge their participants?
•	Answer: Yes. 
o	Question: It feels like if the HISP gets money, and the HIway is also providing infrastructure, why is the HIway not getting a portion of money?
•	Answer: It can be argued both ways; they are setting up a mechanism for us as well. The other piece here is that there are a lot of costs on the HISPs for connecting various organizations. They are working with smaller organizations, the HIway can take advantage of those relationships, and they are taking that cost burden off of the HIway.
o	Question: Is the HIway considering putting any ceilings on what the HISPs can charge?
•	Answer: It would be hard for the HIway to do that. In many ways the big vendors are more important to us than we are to them. 
•	HISP-to-HISP-to-HISP (Slide 14)
o	Three examples were used to describe transactions with other HISPs. In the first two examples Mass HIway was involved directly in the transaction so the HIway could ensure message delivery. In the third example Mass HIway was not involved directly in the transaction and could not ensure message delivery. 
o	Mass HIway has taken a stance where it will expose a limited Provider Directory to HISPs that only contains addresses where HIway may ensure delivery
•	Provider Directory Will Have HISP- Specific Access (Slide 15)
o	 This slide is another way to show how the Provider Directory will work with HISPs. 
o	Question: Even if Dr. Dave is using Surescripts and Dr. Joe has eCW and they are both in the MA Provider Directory, they cannot use Surscripts to route to eCW because we do not have visibility into whether the message was delivered.
•	Answer: They presumably could, but the issue is that we would not know about it, nor have any control over it. Because of that the decision was made that we should not put them in the provider directory shown to the HISP.
o	Question: What could go wrong that we would not know about? Why is this a problem
•	Answer: That is really the issue of our not being able to mediate between two different networks. We are dealing with the implications of this network phenomena. We have no role in the delivery of messages between eCW HISP and Surescripts HISP in this example. 
o	Question: On the green arrow on Slide 14-this is OK because the recipient is in our network and we can validate the transmission of the message. Does Dr. Example need to be a MA HIway provider in the directory?
•	Answer: Yes. This requirement will be in the HISP agreement. If the person is not part of the HIway, the message will not be sent. 
o	Question:  What if a medical center would really like to receive messages from doctors in New Hampshire, is it a policy reason, is it a funding issue, or security issue? 
•	Answer: Initially we limited it to Massachusetts. Later on the New Hampshire Health Information Organization (NHHIO) would likely broker the trust for us; NH would trust us, and we would trust them. So the NH providers who are part of NHHIO would be able to link in with MA. 
o	Question: Is this a definite position? That an out of state provider cannot participate?
•	Answer: Right now it is limited to MA licensed providers. However, snowbirds for example, need doctor in Florida to communicate with their Massachusetts provider so these use cases will need to be dealt with over time. 
o	Comment: I know the Provider Advisory Group and Massachusetts Medical Society (MMS) feel strongly that we should allow other state involvement.  There are licensing issues to work around as well.
o	Comment: A lot of consent requirements will be hard to enforce state by state. 
o	Question: Are there any issues around the source of funding, one way or the other?
•	Answer: HIway funding is State and Federal and the end goal is to improve quality and reduce cost in Massachusetts. The case for the Medicaid Advance Planning Document (APD) was that there was a MA Medicaid provider on one end or another of a large percentage of HIway transactions. If this swung wildly out of balance then it would need to be addressed. 
o	Looking back to Slide 15, initially we thought we would bring a whole bunch of people on and there would be a big directory. The challenge now will be that providers that join as a HISP will have some holes in their provider directory which will put the pressure on taking a convening role with the HISPs. The value proposition decreases when there are holes in the network.
•	HISP-HISP Provider Directory (Slide 16)
o	The HIway Provider Directory will only be used by HIway participants; the HISP will limit the directory only to those who are HIway members. 
o	The purpose of provider directory can only be used for exchanging information amount participants. 
Next steps
•	Technical testing with HISPS will continue to occur over the next few months
•	We will convene the key Massachusetts HISPs in the next month or two to get feedback around these ideas, including the HISP agreement. Hopefully they can start sharing anchor certificates and a common understanding on how the Provider Directory will work. 
•	We will continue the policy guiderail review process and will internally work on draft language for discussion in future meetings.
•	Meeting notes synthesized and provided back to Advisory Group for final comments
•	Presentation materials and notes to be posted to EOHHS website
•	Next Advisory Group Meeting – January 21, 2:30-4:00
o	Mass Medical Society – Suffolk conference room
o	Conference call (866) 951-1151 x. 8234356
•	HIT Council –January 13, 3:30-5:00 One Ashburton Place, 21st Floor
HIT Council meeting schedule, presentations, and minutes may be found at http://www.mass.gov/eohhs/gov/commissions-and-initiatives/masshiway/hit-council-meetings.html