Oracle SecureCARE – The Road to Meaningful Use

An Oracle White Paper

March 2010

2

NOTE

The following is intended to outline our general product direction. It is intended for information purposes only, and may not be incorporated into any contract. It is not a commitment to deliver any material, code, or functionality, and should not be relied upon in making purchasing decisions. The development, release, and timing of any features or functionality described for Oracle’s products remains at the sole discretion of Oracle.

3

Oracle SecureCARE – The Road to Meaningful Use It is hard to erase certain images from our minds. Some may have seen the picture of a distraught Mother, alone and crying in the Emergency Room, just after she found out that her baby died in the hospital due to a medical error of improper medication. Unfortunately, this is not an isolated incident. It has been reported that 44,000 to perhaps 98,000 patients die in US hospitals yearly due to medical errors. All these errors are preventable. Oracle has made an investment to the healthcare industry to improve Health IT across the country. Working through public/private partnership our joint goal is to impact the quality, safety and efficiency of care. The Oracle SecureCARE solution set has been developed to meet both the challenges of Health IT and the objectives of “meaningful use” for a certified Electronic Health Record (EHR) system, as defined by the American Recovery and Reinvestment Act (ARRA) of 2009.

Challenges We’re Hearing There are many factors contributing to the many challenges within our healthcare system today. Some of the key consequential pains to achieving quality, safety and efficiency of care are summarized below:

4

Fragmented Care and Quality The healthcare industry is in essence a cottage industry. Complicated by medical specialization, there is no one single person, team or entity accountable for a patient’s care. The quality of data at the point of capture is inconsistent and poor. Problems stem from missing, inaccurate, non-standard, unorganized illegible (e.g., physicians’ scripts), unusable, unreadable and indecipherable data. There is semantic confusion with differing medical and lay terms. Several IT systems are immature in their capabilities to manage both unstructured and structured data.

Compromises to Privacy and Security Privacy and security of Personal Health Information (PHI) is at risk. One recent survey reported that 31% of hospitals responding had a security breach in the past year, and many believe this to be a rising tide. The challenge of de-identifying personal information is a key to sharing knowledge among the healthcare community. Challenges will grow as the healthcare industry extends the sharing of confidential information across a wider network. Security of data at rest and data in motion in an encrypted manner are paramount. In complying with HIPAA, many providers are confused as many states have policies that go beyond HIPAA compliance, and this is further complicated for entities which cross state boundaries.

Poor Interoperability and Standardization There is a lack of comprehensive electronic exchange across the continuum of care. One area of common complaint is the lack of interoperability between the physician and the pharmacist. This is typically accomplished through paper and telephone, causing problem with the integrity of the information and a general lack of efficiency of care. There are over 200 vendors with various degrees of robustness in Electronic Medical Record systems (EMRs) and clinical applications. However, few are able to integrate with each other in an open manner. This puts the objective of achieving a nationwide network at risk. The transition to a National Health Information Network (NHIN) is not only desirable for improving care, quality and efficiency, but also required by law. The industry has been slow to adopt standards for interoperability.

Lack of Knowledge for Decision Making Disparate information systems across the continuum of care result in islands of raw data. The challenge is to transform this data into knowledge for better decision-making and improved care. Databases need to store information in a relational manner to provide effective relationships. Effective analytical and ad hoc reporting tools are needed to ensure integrated clinical decision support. These capabilities must be provided at the initial entry point of information entry and throughout the continuum of care. Many IT systems contain clinical data repositories, but cannot transform the data into a clinical data warehouse for providing meaningful intelligence for decision support. True quality reporting will not be achievable until all these challenges are met.

5

Inability to Access and Share Knowledge There are very few cases today where patients can access their Personal Health Information (PHI) electronically. Coordinated care teams cannot effectively collaborate with patients and their families. The challenge is to create a self-service environment for the patient and family, to address many types of collaborative functions, to include messaging, alerts, scheduling, learning, consultation, and many other forms of exchange. Patients’ satisfaction must be improved by giving this the power to access, manage and share their confidential information safety.

Incentives and Standards for Health IT With the American Recovery and Restoration Act (ARRA), the government has taken steps to provide incentives and define standards toward the ultimate implementation of a national healthcare information system and network. The government is focusing on the following “meaningful use” health outcomes as policy priorities:

• Improving quality, safety, efficiency and reducing health disparities

• Engaging patients and their families

• Improving care coordination

• Ensuring adequate privacy and security protections for personal health information

• Improving population and public health For each of these outcomes, the government has defined goals, objectives and measurements to be implemented during three stages, in GFY 2011, 2013 and 2015.

• Stage 1 (2011) – Capture/share data

• Stage 2 (2013) – Advanced care processes with decision support

• Stage 3 (2015) – Improved outcomes Implementation of meaningful use is more than installing an Electronic Medical Record (EMR) system, more than installing an Electronic Health Record (EHR) system; it is migrating to a complete and open system capable of networking across the nation, in a seamless, highly performant and secure manner. Meaningful Use requires the integration of qualified EHR modules with a robust, mature infrastructure to enable interoperability across the continuum of care. Of particular note is the guidance from the Office of the National Coordinator for Health Information Technology (ONCHIT) regarding openness and interoperability. ONCHIT has emphasized that we cannot restrict secure, private exchange across boundaries. This would have the potential to carve the nation up into disconnected silos, and would undermine the vision of Health IT. Interoperability is needed to ensure that different systems and networks share information openly.

6

Oracle SecureCARE Oracle, a leading provider of complete software and hardware systems, has developed Oracle SecureCARE, a healthcare solution set. A complete Health IT solution must address challenges of protecting, accessing, sharing, managing and analyzing information across the continuum of care. Oracle SecureCARE provides the foundation for Health IT – complete, open, interoperable and secure. Our goals are to improve quality, safety and efficiency; and to reduce health disparities.

SecureCARE is comprised of the following pillars:

• Privacy & Security – protection for personal health information

• SecureCARE Collaboration – personalizing healthcare to engage patients and families

• SecureCARE Analysis – enhancing outcomes and quality reporting

• SecureCARE Records – improving availability and quality of health information

• SecureCARE Exchange – interoperability across the continuum of care

Designed to address the challenges facing the patient, the family and the healthcare provider team, Oracle SecureCARE integrates any qualified EHR

7

module with Oracle’s software, hardware and standards of excellence to deliver a total healthcare solution certified for meaningful use. No EMR/EHR will achieve meaningful use on its own, but SecureCARE makes them interoperate in an open, secure manner – we make the EMR/EHR better. We have taken “care” to ensure that SecureCARE maps to not only the meaningful use objectives as defined by the Interim Final Rule of December 30, 2009 for Stage 1, but also those tentatively as defined by the July 2009 matrix for Stages 2 and 3. At a high-level, the graphic, below, summarizes the benefits and features of the SecureCARE, mapped to the Meaningful Use Outcomes.

The following sections present more details of the benefits and features of each of the SecureCARE pillars.

SecureCARE Collaboration SecureCARE Collaboration enables patients and families to engage in a meaningful manner to access personal health records, take action in self-service clinical applications, and provide real-time collaboration with their clinical team. SecureCARE Collaboration helps you get ready for the ARRA/HITECH Act. Meaningful Use – Stage 1 Objectives satisfied by SecureCARE Collaboration

Send reminders to patients per patient preference for preventive/ follow up care

Provide patients with an electronic copy of their health information upon request

Provide patients with an electronic copy of their discharge instructions and procedures at time of discharge, upon request

Provide patients with timely electronic access to their health information (including lab results, problem list, medication lists, allergies) within 96 hours of the information being available to the eligible professional (online capability for eligible professional providers)

Provide clinical summaries for patients for each office visit (paper or electronic)

Provides a self-service environment Oracle SecureCARE Collaboration delivers a comprehensive set of tools, services, and out of the box solutions that empower your organization to create standards-based social applications, enterprise portals, communities and composite applications that your patients, practitioners and partners can use to deliver care beyond the initial patient visit.

8

By leveraging Oracle Fusion Middleware, you are able to integrate with your back office and clinical applications, allowing you to surface a breadth of content to the patient and provider that otherwise would not be available.

Extends the hospital walls to the home Leveraging capabilities such as blogs, wikis, online presence awareness and team micro-sites, allows care teams to better coordinate their care practices, work virtually and interact externally, delivering knowledge to the patient, their family members and other care providers in a more timely fashion, improving the quality of care provided.

Ensures patient privacy, with timely access to personal health information The primary concern in providing access to clinical information has been and continues to be information privacy, thus ensuring the ability to limit access to patient information based on appropriate use. Oracle’s industry leading Identity

9

Management Suite ensures data privacy. Role-based authorization, solutions for fraud detection and data encryption all ensure that information delivered via the web is as secure as information stored inside your organization. Integrating these security capabilities into the portals you develop ensures that patient privacy is maintained. As an example, the Oracle Health Management Platform leverages these same features, through the portal, to secure multi-channel inbound and outbound calls across your enterprise applications.

SecureCARE Analysis Oracle’s SecureCARE Analysis enables an integrated system for managing and optimizing enterprise-wide performance, to leverage the analysis of healthcare data to improve patient care and reduce errors leading to better clinical outcomes. SecureCARE Analysis helps you get ready for the ARRA/HITECH Act. Meaningful Use – Stage 1 Objectives satisfied by SecureCARE Analysis

Generate lists of patients by specific conditions to use for quality improvement, reduction of disparities, and outreach

Report quality measure to CMS or the States

Implement five (5) clinical decision support rules

Check insurance eligibility electronically from public & private payers

Perform medication reconciliation at relevant encounters and each transition of care – reconciliation of 2 or more medication lists into a single list displayable in real-time

Comprehensive decision support functionality built on a unified infrastructure Oracle Business Intelligence Suite Enterprise Edition Plus (Oracle BI EE Plus) is a comprehensive suite of enterprise business intelligence products that provides healthcare organizations with a full range of analysis and reporting capabilities. Featuring a unified, highly scalable, modern architecture, Oracle BI EE Plus provides intelligence and analytics from data spanning a range of provider sources and applications—empowering providers with complete and relevant insight. OBIEE is built on an enterprise information model that unifies metadata across the Oracle business intelligence tools and analytical applications for the lowest cost of care.

Oracle’s Business Intelligence Suite integrates with almost any data source, ETL tool, major business application, application server and databases, as well as security infrastructure and portal technology.

Improved patient care for better clinical outcomes Oracle’s Enterprise Healthcare Analytics helps providers ensure compliance and reporting, optimize organizational performance and, ultimately, transform medical practice by implementing evidence-based medicine. Enterprise Healthcare Analytics creates a detailed, holistic and integrated view of provider data. It delivers a foundation upon which providers can use pre-built business intelligence, analytic, data mining, and performance management applications from Oracle and Oracle’s partner ecosystem. Enterprise Healthcare Analytics includes Oracle’s Healthcare Data Warehouse Foundation, a comprehensive and detailed data model engineered specifically for healthcare warehousing. Spanning clinical, financial, operational and research domains, it delivers holistic and integrated views of all provider data. A key component analytic is Oracle’s Operating Room Analytics, developed specifically for health care providers to drive operating room productivity and enable more informed decision-making.

10

Key insights for enterprise-wide performance management Oracle SecureCARE Analysis delivers a complete and integrated system for managing and optimizing enterprise-wide performance. Providers around the world are using Oracle’s Enterprise Performance Management system to define their strategy and objectives; coordinate planning to meet those objectives; consolidate and analyze enterprise-wide information; monitor performance against plans; and deliver the insights to drive the best decisions, actions, and processes throughout their enterprise. Using the Oracle approach, providers can align decisions with strategic goals, reduce financial reporting and planning cycles, compare operational results to plans in real time, and drive decisions from “insight to action” with lower costs and less complexity than non-integrated solutions. Oracle Enterprise Performance Management for providers allows healthcare organizations to achieve a state of management excellence - being smart, agile and aligned - yielding better business performance and leveraging operational investments. Cost reductions and improved operational efficiency leading to higher margin

With almost 30% of US hospitals in 2007 functioning in negative operating margins1, providers must ensure that the entire organization’s business performance is fully optimized. Oracle unifies business intelligence and performance management solutions to help reduce costs, improve operational efficiency and, ultimately, lead to higher margins for the organization.

SecureCARE Records SecureCARE Records provides the power of Oracle with any vendor’s clinical applications for faster transaction processing. Information is stored in a comprehensive, standards-based database and enables communication of quality health information with public health agencies. SecureCARE Records helps you get ready for the ARRA/HITECH Act.

1 “Trends Affecting Hospitals and Health Systems.” 2009 Chartbook, American Hospital Association.

11

Meaningful Use – Stage 1 Objectives satisfied by SecureCARE Records

Use CPOE

Implement drug-drug, drug-allergy, drug-formulary checks

Generate & transmit permissible prescriptions electronically (eRx)

Record and maintain data and lists, as required by Meaningful Use criteria

Maintain an up-to-date problem list of current & active diagnoses based on ICD-9-CM or SNOMED CT

Incorporate clinical lab-test results into EHR as structured data

Provide summary care record for each transition of care and referral

Assign a unique name and/or number for identifying and tracking user identity and establish controls that permit only authorized users to access electronic health information

Terminate an electronic session after a predetermined time of inactivity

Record action (e.g., deletion) related to electronic health information in accordance with the standard specified in Table 2B row 3 (i.e., audit log), provide alerts based on user-defined events, and electronically display and print all or a specified set of recorded information upon request or at a set period of time

Improved care and safety with complete, quality data Oracle's Healthcare Transaction Base (HTB) allows you to improve patient care, reduce medical error, improve compliance, and reduce costs by consolidating all your clinical, administrative, and financial information into one integrated healthcare data infrastructure.

With Oracle's HTB you can create a comprehensive patient record that can be shared across institutions and geographic regions, so patients can be assured that their medical information follows them wherever they go. The HTB lets you consolidate key information on allergies, blood type, and health plan to provide care more efficiently and reduce error. With this single source of truth, you can integrate new applications; comply with security and auditing requirements; and generate business intelligence for clinical, operational, or regulatory purposes.

Quicker response for critical decision-making Oracle Exadata delivers extreme performance and scalability for all your healthcare applications. Faster medical and business decisions are enabled whether employing a clinical repository (such as online transaction processing (OLTP)), a clinical data warehouse, or a consolidation of mixed workloads. Built using world-class hardware from Sun, and intelligent database and storage software from Oracle, Exadata is a complete optimized package of software, servers, and storage. Simple and fast to implement, Oracle Exadata is ready to tackle your largest and most important healthcare applications — and often run them 10x faster, or more. Oracle Exadata is an easy to deploy out-of-the-box solution for hosting the Oracle Database. Ready on Day One, much of the integration effort, cost and time of database deployment has been eliminated. All this is available with breakthrough performance.

12

Availability of information to support on-going care

Oracle Database 11g delivers industry leading performance, scalability, security and reliability on a choice of clustered or single-servers. It provides comprehensive features to easily manage the most demanding healthcare transactions, business intelligence, and content management applications for the healthcare industry.

• Protects from server failure, site failure, human error, and reduces planned downtime

• Secures data and enables HIPAA compliance with unique row-level security, fine-grained auditing, transparent data encryption and total recall of data

SecureCARE Exchange Oracle SecureCARE Exchange provides a secure, nationwide, interoperable health information exchange infrastructure that will connect providers, patients, and others involved in supporting health and healthcare. SecureCARE Exchange supports Meaningful Use by enabling secure and standards-based electronic health information exchange. SecureCARE Exchange helps you get ready for the ARRA/HITECH Act. Meaningful Use – Stage 1 Objectives satisfied by SecureCARE Exchange

Generate & transmit permissible prescriptions electronically (eRx)

Report quality measure to CMS or the States

Submit claims electronically to public & private payers

Capability to exchange key clinical information among providers of care and patient authorized entities electronically

Patient summary record from other providers, diagnostic test results, problem list, medication list, medication allergy list, immunizations,

Capability to submit electronic data to immunization registries and actual submission where required and accepted

Capability to provide electronic submission of reportable lab results (as required by state or local law) to public health agencies and actual submission where it can be received

Capability to provide electronic syndromic surveillance data to public health agencies and actual transmission according to applicable law and practice

Verify that electronic health information has not been altered in transit and detect the alteration and deletion of electronic health information and audit logs in accordance with the standard in Table 2B row 4

Verify that a person or entity seeking access to electronic health information across a network is the one claimed and is authorized to access such information in accordance with the standard specified in Table 2B row 5

Improved outcomes with complete, quality data Oracle Healthcare Transaction Base allows you to improve patient care, reduce medical error, improve compliance, and reduce costs by consolidating all clinical, administrative, and financial information into one integrated healthcare data infrastructure.

With Oracle's HTB you can create a comprehensive patient record that can be shared across institutions and geographic regions, so patients can be assured that their medical information follows them wherever they go. The HTB lets you consolidate key information on allergies, blood type, and health plan to provide care more efficiently and reduce error. With this single source of truth, you can integrate new applications; comply with security and auditing requirements; and generate business intelligence for clinical, operational, or regulatory purposes.

13

Reduced cost and time to care, establishment of evidence-based practices The Oracle Sun NHIN-CONNECT improves the coordination of healthcare information among various participants, including hospitals, physician’s offices, laboratories, pharmacies and other providers. This helps ensure that the appropriate health information is securely available at the time and place of care. For providers and patients, it lowers the cost and time to care by reducing inefficiencies and incomplete patient information. Collaborating securely ensures the exchange of information critical for compliance and reporting. Most importantly, Meaningful Use is achieved by reducing risks from medical errors and supporting evidence-based medical care.

Enhanced management and assessment of care

The Oracle Healthcare Master Person Index provides healthcare organizations a reliable platform to develop, deploy, and manage single-view applications. It creates a cross reference of information for patients and doctors that are kept current by rules to identify, match, and update data from multiple source applications. A collection of highly configurable components allows healthcare organizations to create custom indexing applications suited to their specific needs.

Users of Oracle Healthcare Master Person Index are able to specify which patient records to manage, the local systems that contain those records, as well as standardization and matching rules to cleanse data.

Health Bank orPHR Support Organization

Health Bank orPHR Support Organization

Community

#1

Community

#1

IntegratedDelivery System

IntegratedDelivery System

Community Health CentersCommunity Health Centers

Community #2Community #2

State and Local GovState and Local Gov

LabsLabs

PharmaciesPharmacies

CDC

VA

IHS

DoD

SSA

CDCCDC

VAVA

IHSIHS

DoDDoD

SSASSA

The Internet

Standards, Specifications, Agreementsfor Secure Connections

The Internet

Standards, Specifications, Agreementsfor Secure Connections

Mobilizing Health Information

Nationwide

14

SecureCARE Privacy and Security Oracle Privacy and Security provides in-depth protection for HIPAA privacy, ensures the identity management of patients and the clinical team, and guards health information in the most secure manner.

Meaningful Use – Stage 1 Objectives satisfied by Oracle Privacy & Security

Provide electronic health information created or maintained by the certified EHR technology through the implementation of appropriate technical capabilities

Assign a unique name and/or number for identifying and tracking user identity and establish controls that permit only authorized users to access electronic health information

Permit authorized users (who are authorized for emergency situations) to access electronic health information during an emergency

Encrypt and decrypt electronic health information according to user-defined preferences (e.g., backups, removable media, at log-on/off) in accordance with the standard specified in Table 2B row 1

Encrypt and decrypt electronic health information when exchanged in accordance with the standard specified in Table 2B row 2

Record action (e.g., deletion) related to electronic health information in accordance with the standard specified in Table 2B row 3 (i.e., audit log), provide alerts based on user-defined events, and electronically display and print all or a specified set of recorded information upon request or at a set period of time

Verify that electronic health information has not been altered in transit and detect the alteration and deletion of electronic health information and audit logs in accordance with the standard in Table 2B row 4

Verify that a person one entity seeking access to electronic health information is the one claimed and is authorized to access such information

Verify that a person or entity seeking access to electronic health information across a network is the one claimed and is authorized to access such information in accordance with the standard specified in Table 2B row 5

Record disclosures made for treatment, payment, and health care operations in accordance with the standard specified in Table 2B row 6

Protection of patient identities and data The healthcare industry has the most regulations concerning the protection of personal information. Yet it’s responsibility to ensure that the right people can access the right information in a timely manner is critical. In fact lives depend upon it. Oracle has been working with several healthcare providers, payers, educational institutions and research projects to determine optimal solutions in varying environments. There is no one easy answer as to how to adequately adhere to the various regulations while ensuring that access is provided in a timely manner to authorized users that require it. Fortunately Oracle has a multitude of best-in-class security solutions that enable an institution to create their own privacy recipe that is applicable to their specific environment and goals. This enables institutions to remediate an adequate level of risk while providing easier access to information for authorized personnel.

Reduced breaches The healthcare industry ranks 3rd in the US for number or identity breaches that occur – Ponemon Report 2009. The average identity breach is approximately 27,000 identities-PatientPrivacyRights.org and averages over $200 per identity to conform to the state and federal requirements concerning a breach. This equates to an unbudgeted expense in excess of $5 million dollars. HIPAA requirements, a pre-cursor to the HITECH Act meaningful use, require that notification for a breach now occur within 60 days of occurrence. This creates a large immediate negative economic and reputational impact for an institution.

Reduced medical fraud and medical identification theft Oracle provides solutions such as identity management that enables authorized users to more easily access systems and information with mechanisms like single sign-on. At the same time this access is monitored and recorded (audited) so that discovery can be performed as to who was accessing particular information, when it was accessed and even why it was accessed. The HITECH Act is also requiring encryption for databases that contain personal health

15

information as well as this information in transit. This is already installed within your Oracle database environment and is just waiting to be utilized so that unauthorized access to information does not have to be reported. This aids institutions in protecting their brand and reputation while potentially avoiding the expense for notification. The HITECH Act is requiring healthcare institutions to determine when personal demographic data is significant enough to determine an individual’s identity. The Oracle Data Privacy Shield solution provides the ability to tokenize “Avatar” personal attributes so that an individual’s identity cannot be deduced. This solution works with any application or database type so that the institution can utilize this where it is most needed. Oracle also provides the ability to audit and monitor information throughout the enterprise so it is possible to conform to HIPAA directives like “meaningful use” to reproduce who accessed what information, when was it accessed and for what purpose.

SecureCARE Architecture The Oracle SecureCARE employs an open, complete, interoperable and secure architecture designed to integrate with any “Qualified EHR Module”, thereby achieving “Certified EHR Technology” for a “Complete EHR”. The Oracle SecureCARE architecture consists of hardware and software for technology and applications.

SecureCARE also provides the architecture for not only meeting meaningful use criteria, but also for implementing Oracle Customer Relationship Management (CRM) and Enterprise Resource Planning (ERP) applications, to increase the efficiency of managing your business. Increasing the efficiency of managing your business increases the efficiency of the safety and care that you provide.

16

The SecureCARE Solution Set is comprised of several proven hardware and software solutions/product suites as listed in the graphic, above. SecureCARE consists of modular, flexible components, which can be tailored to meet each healthcare providers individual needs. We understand each healthcare provider is stepping on the escalator of meaningful use at a unique different step. Each will have different existing EHR modules may include records systems, software interface programs, open source software programs, clinical decision support rules engines, quality measure reporting services, or other services or components which meet at least one certification criterion, but likely not all meaningful use criteria. Thus, SecureCARE is architected to be interoperable in an open manner with any qualified EHR module. SecureCARE may be implemented at different entry points, and can grow over time, to meet each provider’s incremental strategic expansion.

Oracle SecureCARE – open, complete, interoperable and secure for today and the future Oracle SecureCARE is the IT infrastructure for today and the future. Maximize your Return On Investment (ROI) and lower your risk of penalties through early adoption of certified EHR Technology. Implement SecureCARE technology and applications today and you will have the road toward meaningful, not only within your organization, but also across a national network of networks in the future. Improve quality, safety and efficiency of the care you provide, and reduce health disparities.

17

Oracle SecureCARE – The Road to Meaningful Use March 2010 Oracle Corporation World Headquarters 500 Oracle Parkway Redwood Shores, CA 94065 U.S.A. Worldwide Inquiries: Phone: +1.650.506.7000 Fax: +1.650.506.7200 oracle.com Copyright © 2010, Oracle Corporation and/or its affiliates. All rights reserved. This document is provided for information purposes only and the contents hereof are subject to change without notice. This document is not warranted to be error-free, nor subject to any other warranties or conditions, whether expressed orally or implied in law, including implied warranties and conditions of merchantability or fitness for a particular purpose. We specifically disclaim any liability with respect to this document and no contractual obligations are formed either directly or indirectly by this document. This document may not be reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose, without our prior written permission. Oracle is a registered trademark of Oracle Corporation and/or its affiliates. Other names may be trademarks of their respective owners.