Breaking Down the Interoperability and Information Blocking Final

Breaking Down the Interoperability and Information Blocking Final Rules March 19, 2020

Agenda Welcome and Introductions • Jennifer Covich Bordenick, CEO, e. Health Initiative and Foundation Presenters • Crystal Yednak, Senior Manager, Health Research Institute, Pw. C • Lisa Gallagher, Managing Director, Pw. C • Leigh C. Burchell, Vice President, Government Relations, Allscripts • Colby Tiner, Digital Health and Cardiovascular Systems of Care, Policy Analyst, American Heart Association • Danielle Lloyd, Senior Vice President, AHIP • Alice Leiter, Vice President and Senior Counsel, e. Health Initiative and Foundation

Today’s Speakers Crystal Yednak Lisa Gallagher Senior Manager, PWC’s Health Research Institute Managing Director, Pw. C Colby Tiner Danielle Lloyd Digital Health and Cardiovascular Systems of Care Policy Analyst, AHA Senior Vice President, AHIP Leigh C. Burchell Vice President, Government Relations, Allscripts Alice Leiter Vice President and Senior Counsel, e. Health Initiative

Housekeeping • All participants are muted • Use the Q&A box to ask a question related to the presentation • Use the chat box is for technical difficulties and other questions / comments Presentation slides are in the e. HI resource Center https: //www. ehidc. org/resources

e. HI Leadership Council

e. HI’s Mission To serve as the industry leader in convening executives and multi-stakeholder groups to identify best practices that transform healthcare through the use of technology and innovation

Current Areas of Focus Value Based Care it l i b a r pe o r e t In y Privacy & Security Analytics & SDOH Cost Transparency Understanding FHIR / APIs / Da Vinci Protection vs. Access Non-traditional data sources Prior Authorization Policy HIPAA Part 2 SDOH & PGHD Workflow Cybersecurity EHR Data for Clinical trials Info Blocking Medical Device Security

• March 26 - Coronavirus: Can Artificial Intelligence Make A Difference? • March 31 - Rapidly Deployed Remote Monitoring for COVID-19 • April 7 - Telehealth During COVID-19: New Strategies on How Clinicians Are Addressing the Outbreak • Date TBD- COVID-10 - Six Things Organizations Should Be Considering

e. HI Resource Page • Pw. C Report • Beyond IT: Why the regulatory push toward interoperability requires whole organizational responses from providers, payers (https: //www. ehidc. org/resources/pwc-report-beyond-it-why-regulatorypush-toward-interoperability-requires-whole)

This educational program would not be possible without the generous support of:

Crystal Yednak Senior Manager, Health Research Institute Pw. C

Lisa Gallagher Managing Director Pw. C

Breaking Down the HHS Interoperability and Information Blocking Final Rules March 19, 2020 Lisa Gallagher, Managing Director Pw. C Cybersecurity, Privacy and Forensics Practice

Agenda 1. History of the push for Health Data Interoperability 2. HHS goals for Interoperability 3. Key takeaways from the Final Rules - ONC - 21 st Century Cures Act: Interoperability, Information Blocking and the ONC Health IT Certification Program Final Rule - CMS - The Interoperability and Patient Access final rule (CMS-9115 -F) Pw. C March 2020 15

A quick historical timeline We’ve been working on interoperability for years… 2004 ONC Established by Executive Order 2009 ARRA and HITECH Enacted by Congress 2015 MACRA Enacted by Congress Nationwide Interoperability Roadmap Released by ONC Pw. C 2016 21 st Century Cures Act Enacted by Congress 2019 Draft Interoperability Rules Released by ONC and CMS 2020 FINAL Interoperability Rules Released by ONC and CMS March 2020 16

What are the overall goals of the rules? This is a regulatory push by CMS and ONC that aims to shift the way the healthcare system shares data, moving from a system where healthcare organizations may share data under HIPAA to one where they must share data • Data moves with patient from provider to provider, and from health plan to health plan • Patient data is made available through mobile and web-based apps • Freer flow of data empowers patients and helps improve value-based care efforts Pw. C March 2020 17

The ONC and CMS rules apply to…. Providers • Make Patient health information (EHI) available through Application Programming Interfaces (APIs) • Provide electronic notification to other providers when a patient is admitted, discharged or transferred (ADT) • Information blocking prohibited Provider Vendors Third-Party Apps Insurers Payers • Patient claim /health data (EHI) made available through APIs • Patient data shared with other payers as they move from health plan to health plan HIT Developers • Use APIs • New Certification requirements Third-Party Apps • Use APIs • Transition from use of CCDA to the new USCDI *EHI – (final rule) is defined as e. PHI to the extent that it would be included in a designated record set. Pw. C March 2020 18

The ONC Rule: 21 st Century Cures Act: Interoperability, Information Blocking, and the ONC Health IT Certification Program Final Rule

Scope of ONC Rule The ONC Rule covers two main areas, HIT Certification and Information Blocking Certification UPDATES: 2015 EHR Certification Criteria - > “ 2015 Edition Cures Update” - Time Limited and Removed Some Criteria Updated/Revised Some Criteria Added new Criteria: Electronic Health Information (EHI) export, standardized API, P&S Attestation: New - Encrypt Authentication Credentials and Multi-Factor Authentication NEW: API Certification: Pw. C - Health IT Developers must support standardized APIs for Patient Access (single patient) and Population Health (multiple patients) - Must implement “Read” services for HL 7 FHIR Release 4 March 2020 20

Scope of ONC Rule covers two main areas: Information Blocking and HIT Certification Criteria Information. Blocking Information Blocking Exceptions • Preventing Harm A practice by a healthcare provider, HIT developer, or HIE/HIN that, except as required by law or specified by the Secretary as a reasonable and necessary activity, is likely to interfere with, prevent, or materially discourage access, exchange or use of EHI. • Privacy Exception • Security Exception • Infeasibility Exception • HIT Performance Exception • Content and Manner Exception • Fees Exception • Licensing Exception Pw. C March 2020 21

ONC Rule Standards Criteria Data Standard Migration - Industry must transition from the CCDA to the USCDI within 24 months of enactment of the Rule - Includes new fields for: Provenance, Clinical Field Notes, Pediatric Vital Signs, Demographic Info (Name, Email, Phone) e. Prescribing - NCPDP SCRIPT Standard Version 2017071 Clinical Quality Measures* - Removed HL 7 QRDA and added support for CMS QRDA Implementation Guides (IGs) *https: //ecqi. healthit. gov/qrda-quality-reporting-document-architecture Pw. C March 2020 22

ONC Rule Conditions and Maintenance of Certification Requirements • Information Blocking (developers only) • Assurances • Communications • APIs - Conditions and Maintenance of Certification Pw. C • Real-World Testing • Standards Version Enhancement Process • Attestations March 2020 23

Pw. C March 2020 24

The CMS Rule: The Interoperability and Patient Access final rule (CMS-9115 -F)

CMS: The Interoperability and Patient Access final rule (CMS-9115 -F) This rule finalizes new policies that give patients access to their health information and moves the healthcare system toward greater interoperability These new policies include: • Patient Access API (applicable January 1, 2021) • Provider Directory API (applicable January 1, 2021) • Payer-to-Payer Data Exchange (applicable January 1, 2022) • Improving the Dually Eligible Experience by Increasing the Frequency of Federal-State Data Exchanges (applicable April 1, 2022) • Public Reporting and Information Blocking (applicable late 2020) • Digital Contact Information (applicable late 2020) • Admission, Discharge, and Transfer Event Notifications (applicable fall 2020) Pw. C March 2020 26

CMS Rule Requirement CMS intends to liberate health information and move the healthcare system toward greater interoperability Patient Access API (applicable January 1, 2021) - CMS-regulated payers are required to implement and maintain a secure, standards-based (HL 7 FHIR Release 4. 0. 1) API that allows patients to easily access their claims and encounter information, including cost, as well as a defined sub-set of their clinical information through third-party applications of their choice. Provider Directory API (applicable January 1, 2021) - CMS-regulated payers are required make provider directory information publicly available via a standardsbased API. Pw. C March 2020 27

CMS Rule Requirements (continued) CMS aims to facilitate patient mobility, access to services and appropriate billing Payer-to-Payer Data Exchange (applicable January 1, 2022) - Exchange certain clinical data (specifically the US Core Data for Interoperability (USCDI), at the patients request, allowing the patient to “take their data with them” as they change plans - This will include clinical encounter data as well as claims and other EHI - Must implement a process for this exchange by regulatory deadline Dual Eligible Federal-State Information Exchanges (applicable April 1, 2022) - “MMA Files” must now be exchanged daily (previously monthly) - Goal is to ensure enrollees get access to appropriate services and services billed appropriately Pw. C March 2020 28

CMS Rule Requirements (continued) CMS joins ONC in addressing “Information Blocking” Information Blocking (late 2020) - Within its purview, CMS will report eligible clinicians, hospitals and CAHs that appear to be information blocking - Based on attestations to the Promoting Interoperability Program Digital Contact Information (late 2020) - Providers must list/update their digital contact information in the National Plan and Provider Enumeration System (NPPES). - This includes digital contact information such as secure digital endpoints like a “Direct” Address and/or a FHIR API endpoint. ADT Event Notifications (+ 6 months) - Conditions of Participation (Co. Ps) to require hospitals, including psychiatric hospitals and CAHs, to send electronic patient event notifications of a patient’s admission, discharge, and/or transfer to another healthcare facility or to another community provider or practitioner. Pw. C March 2020 29

Implications Laying the right foundation: Key questions for organizations Has your team identified a leader? Is your data in order? Healthcare organizations must recognize that interoperability is not just an issue for IT or compliance departments. A leader is needed to advocate at the top levels and coordinate involvement of multidisciplinary teams. Payers and providers should classify their data, understand where the data flows downstream, review patient matching processes and communicate with vendors about their planned updates. Has your organization reviewed business partnerships and agreements? Digital health companies and new entrants may help healthcare organizations take advantage of opportunities, but policies should be reviewed around consent, privacy and security to reduce legal risks. Pw. C Have you identified the required new processes? Healthcare organizations should prepare for new functions that may be required and consider the workforce impact to ensure compliance as well as an effective digital strategy. March 2020 30

Resources For more information about the ONC Rule and CMS Rule, please see below sites: ONC Rule - For more information on the ONC final rule, please visit: https: //healthit. gov/curesrule - To view the ONC final rule, please visit: https: //healthit. gov/curesrule CMS Rule - For more information on the CMS final rule, please visit: https: //www. cms. gov/newsroom/factsheets/interoperability-and-patient-access-fact-sheet - To view the CMS final rule, please visit: https: //www. cms. gov/Regulations-and. Guidance/Interoperability/index Pw. C March 2020 31

Thank you pwc. com © 2020 Pw. C. All rights reserved. Pw. C refers to the US member firm or one of its subsidiaries or affiliates, and may sometimes refer to the Pw. C network. Each member firm is a separate legal entity. Please see www. pwc. com/structure for further details. This content is for general information purposes only, and should not be used as a substitute for consultation with professional advisors.

Leigh C. Burschell Vice President, Government Relations Allscripts

ONC rule from the Developer’s Perspective • Welcome changes from the proposed rule – Proposed rule went well beyond Congressional intent in some areas… final rule pulled it back to a more reasonable landing spot for the most part • Very real concerns about inhibitions to innovation have largely been addressed • Patients are at the center of the rule, appropriately – ONC did what they could to address concerns about patient data privacy – The job of modernizing patient data protection really rests with Congress • APIs are the star – May be overestimating their potential in the short-term © 2020 Allscripts Healthcare, LLC and/or its affiliates. 34

ONC rule from the Developer’s Perspective • Exceptions to Information Blocking – Largely well-reasoned • Respect for privacy and security factors • Preventing Harm exception will require subjective discretion • Will the Infeasibility exception become a loop hole for provider organizations not committed to data exchange? – Likely to be difficult for providers to stay on top of the differences and interdependencies between the exceptions – will require support resources on our end • Certification changes in the final rule are a big lift – Some minor easing of deadlines by which we need to finish, but it’s still a significant change in a short period time • Adoption vs. deployment of the new Cures Edition • Appreciate the six month deferral in enforcement from ONC – OIG rule will be critical – Affects many areas of our company not usually affected by ONC rules © 2020 Allscripts Healthcare, LLC and/or its affiliates. 35

Colby Tiner Digital Health and Cardiovascular Systems of Care, Policy Analyst American Heart Association

Danielle Lloyd Senior Vice President AHIP

Alice Leiter Vice President and Senior Counsel e. Health Initiative and Foundation

Q&A Crystal Yednak Lisa Gallagher Senior Manager, PWC’s Health Research Institute Managing Director, Pw. C Colby Tiner Danielle Lloyd Digital Health and Cardiovascular Systems of Care Policy Analyst, AHA Senior Vice President, AHIP Leigh C. Burchell Vice President, Government Relations, Allscripts Alice Leiter Vice President and Senior Counsel, e. Health Initiative

This educational program would not be possible without the generous support of: