september 19, 2012
DESCRIPTION
Electronic Submission of Medical Documentation (esMD) Digital Identity and Author of Record Sub-Workgroups. September 19, 2012. Meeting Etiquette. Please announce your name each time prior to making comments or suggestions during the call - PowerPoint PPT PresentationTRANSCRIPT
Electronic Submission of Medical Documentation (esMD)
Digital Identity and Author of Record
Sub-WorkgroupsSeptember 19, 2012
Meeting Etiquette• Please announce your name each time prior to making comments or
suggestions during the call• Remember: If you are not speaking keep your phone on mute• Do not put your phone on hold – if you need to take a call, hang up
and dial in again when finished with your other call – Hold = Elevator Music = very frustrated speakers and participants
• This meeting, like all of our meetings, is being recorded– Another reason to keep your phone on mute when not speaking!
• Feel free to use the “Chat” or “Q&A” feature for questions or comments
NOTE: This meeting is being recorded and will be posted on the esMD Wiki page after the
meeting
From S&I Framework to Participants:Hi everyone: remember to keep your phone on mute
2
Agenda
3
Topic Presenter
Announcements and Administrative items Sweta
AoR L1 UC Consensus Results Sweta/Bob
Overview and Introduction of Digital Credentials Sub-Workgroup
Bob/Debbie
Announcements• Schedule this week:
4
Day/Time Meeting
Wednesday, September 19 at 10 AM ET
AoR Digital Identity Management SWG
Wednesday, September 19 at 1:00 PM ET
(2 hour session)
• AoR Identity Proofing SWG (1-2 PM)• AoR Signature Artifact/Delegation of Rights SWG (2-3 PM)
Friday, September 21 at 2 PM ET
• AoR SWG Recap (10 Minutes)• Harmonization of UC 1&2
September 2012 Proposed Schedule
5
Sun Mon Tue Wed Thu Fri Sat
September 2012* 1
2 3 4 5 6 72 PM AoR WG
8
9 10 11 12
10 AM - AoR SWG: Digital Identity Management
1 PM - AoR SWG: Identity Proofing
2 PM - AoR SWG: Signature Artifact/Delegation of Rights
13 Leads will
review consensus votes and provide
dispositions
14 2 PM – Joint AoR
and Harmonization
of UC 1&2
15
16 17 18 19
10 AM - AoR SWG: Digital Identity Management
---1 PM - AoR SWG: Identity
Proofing2 PM - AoR SWG: Signature
Artifact/Delegation of Rights
20 21 2 PM – Joint AoR
and Harmonization
of UC 1&2
22
23 24 25 2610 AM - AoR SWG: Digital
Identity Management---
1 PM - AoR SWG: Identity Proofing
2 PM - AoR SWG: Signature Artifact/Delegation of Rights
27 28 2 PM – Joint AoR
and Harmonization
of UC 1&2
29
30 *This is a tentative schedule and subject to change
AoR L1 UC E2E Review
AoR L1 UC E2E Review AoR L1 UC Consensus
AoR L1 UC Consensus
AoR L1 UC Consensus Voting Results• 9 Yes Votes• 2 Abstain Votes
6
Consensus Voting Round Robin for Committed Members• Yes
– A Yes vote does not necessarily mean that the deliverable is the ideal one from the perspective of the Initiative Member, but that it is better to move forward than to block the deliverable
• Yes with comments– If a Consensus Process attracts significant comments (through Yes with comment votes), it
is expected that the comments be addressed in a future revision of the deliverable.• Formal Objection- with comments
– Indicating a path to address the objection in a way that meets the known concerns of other members of the Community of Interest. "Formal Objection" vote without such comments will be considered Abstain votes.
• Formal Objection – Should a Consensus Process attract even one "Formal Objection" vote with comments from
an Initiative Member, the deliverable must be revised to address the "Formal Objection" vote (unless an exceptional process is declared).
• Abstain (decline to vote)
7
Provider EntityPayer Entity
esMD Initiative Overview
PayerProvider
(Individual or Organization)
Contractors / Intermediaries Agent
Payer Internal System
Gat
eway
esMD UC 2: Secure eMDR Transmission
esMD UC 1: Provider Registration
esMD AoR Level 1Digital Identities Bundle Signatures
Certificate Authority
Registration Authority
Provider Directories
AoR -- Phased Scope of Work
9
Level 1 – Current Focus
Level 2 - TBD
Level 3 - TBD
Digital signature on aggregated documents
(bundle)
Digital signature to allow traceability of individual
contributions to a document
Digital signature on an individual document
• Focus is on signing a bundle of documents prior to transmission to satisfy an eMDR
• Define requirements for esMD UC 1 and UC 2 Signature Artifacts• May assist with EHR Certification criteria in the future
• Focus is on signing an individual document prior to sending or at the point of creation by providers
• Will inform EHR Certification criteria for signatures on patient documentation
• Focus is on signing documents and individual contributions at the point of creation by providers
• Will inform EHR Certification criteria for one or multiple signatures on patient documentation
Topics for Digital Identities and AoR Workgroup Effort
1. Identity proofing2. Digital identity management 3. Encryption4. Digital signatures and artifacts5. Delegation of Rights6. Author of Record
10
DefinitionsIdentity (NIST)
A set of attributes that uniquely describe a person within a given context.
Identity (Proposed)A set of attributes that uniquely describe a person or legal entity within a given context.
Identity Proofing (NIST)The process by which a CSP and a Registration Authority (RA) collect and verify information about a person for the purpose of issuing credentials to that person.
Identity Proofing (Proposed)The process by which a CSP and a Registration Authority (RA) collect and verify information about a person or legal entity for the purpose of issuing credentials to that person or legal entity.
11
DefinitionsDigital Signature (NIST)
The result of a cryptographic transformation of data that, when properly implemented, provides a mechanism for verifying origin authentication, data integrity and signatory non-repudiation.
Data Integrity (NIST)Data integrity is a property whereby data has not been altered in an unauthorized manner since it was created, transmitted or stored. Alteration includes the insertion, deletion and substitution of data.
Non-repudiation (NIST)Non-repudiation is a service that is used to provide assurance of the integrity and origin of data in such a way that the integrity and origin can be verified by a third party. This service prevents an entity from successfully denying involvement in a previous action.
Delegation of Rights The ability to delegate rights or authority to another to act in a specific capacity on behalf of the grantor of the right. Must include the digital identity of the grantor, the digital identity of the grantee, the rights granted, duration of grant in a format that is usable in transaction and AoR signature events and is verifiable by a third party for non-repudiation purposes.
Initiative Requirement Summary
Initiative Identify Proofing Digital Identity Management
Signing(Exchange Artifact) Encryption Delegation
of RightsAuthor
of Record
DS4P Org/Individual Yes Yes Yes Yes YesDirect Project Address/Server Yes Yes Yes No No
esMD Org/Individual Yes Yes Yes Yes YesHealthcare Directories Org/Individual Yes Yes Yes Yes No
LCC Org/Individual Yes Yes Yes Yes YesQuery Health Org/Individual Yes Yes Yes No NoTransitions of
Care Org/Individual Yes Yes Yes Yes Yes
13
Mandatory
Optional with consequences
Optional
Future Uses
esMD RequirementsTopics UC1: Registration UC2: eMDR AoR L1 Bundle
Identity Proofing Required Required Required
Digital Credential Management
Required Required Required
Digital Signatures & Signature Artifacts
Required Required Required
Delegation of Rights* Required Required Required
Other
Characteristics of solutionNon-Repudiation
Required Required Required
Characteristics of solutionData Integrity
Required Required Required
* Required if the action of the responsible party is being represented by a third party
Scope for AoR (L1)In Scope
• Identify Proofing as part of Non-Repudiation of Actor Identity
• Digital Credential Management required for Non-Repudiation Actions (Signing and Delegation), Data Integrity and Encryption
• Digital Signatures and Signature Artifacts for Identity and Non-Repudiation
• Digital Credentials and Artifacts for Non-Repudiation of Delegation as required by UC1 and AoR L1
• Data Integrity requirement actions and artifacts• Encryption of PHI requirements• Interactions with External Provider Directories
Out of Scope• Interactions between:
• Payer and Payer Contractors• Provider and Agent• Payer or Payer Contractor and Gateway
• Transaction level encryption• Document level signatures and individual
contribution signatures• Defining delegation of rights within and between
Providers and other authors
User Story / Workflow Overall User Story Components
1) All Actors obtain and maintain a non-repudiation digital identity2) Provider registers for esMD (see UC1)*3) Payer requests documentation (see UC2)*4) Provider submits digitally signed document (bundle) to address
request by payer5) Payer validates the digital credentials, signature artifacts and,
where appropriate, delegation of rights
*User Stories for UC 1 and 2 have already been defined. Workgroup will help define bullets 1) and 4)
Sub-Workgroups
1. Identity Proofing
• Wednesday 1-2 pm• Robert Dieterle (Lead)• Proof of identity
requirements• Allowed proofing
processes
2. Digital Credentials
• Wednesday 10-11 am• Debbie Bucci (Lead)• Credential Life Cycle
(issuance, maintenance and revocation)
• Credential uses (Identity, Signing, Proxy, Encryption, Data Integrity)
• Specific use credentials (e.g. Direct)
3. Signing and Delegation
• Wednesday 2-3 pm• Robert Dieterle (Lead)• Signature and
Delegation artifacts• Workflow issues• Delegation process
General Requirements Solution must
be implementable for pilot in Q1/Q2 2013 scale to all providers and payers minimize the operational impact required to establish , maintain
or use a digital identity provide for non-repudiation without resorting to audit logs or
validation of system configuration Standards -- required
NIST 800-63-1 Level 3 (December 2011) NIST 800-57 Part 1 (Revision 3 July 2012) Federal Bridge Certification Authority Medium Level X.509v3+ Digital Certificates
Sub Workgroup: Digital CredentialsGoal
– Define required process for issuing and managing digital credentials for esMD
Requirements– NIST SP 800-63-1 Level 3 authentication
(December 2011)– NIST SP 800-57 Part 1 (Revision 3 July 2012) – Federal Bridge Certification Authority (FBCA)
certified Medium Level– Digital Certificates must be X.509 V3+ based– Must be from CA cross-certified with FB– Must provide for non-repudiation as part of the
credentials and artifactsIn-Scope
– Digital credential life cycle– Relevant standards– Policy issues regarding Digital Credentials
Out-of-Scope– Identity Proofing– Digital Signatures
Deliverable: “Summary White Paper”– Assumptions– Statement of Problem– Recommended Solution(s)
• Review of standards (e.g. NIST, FBCA, FICAM)
• CA qualifications and list• Issuance process• Credential types and forms• Credential uses (Identity, Signing, Proxy,
Encryption, Data Integrity)• Specific use credentials (e.g. Direct,
DEA)• Maintenance requirements• Revocation process• Trust anchor validation• Non-repudiation assurance
– Identify gaps in current policy impacting Digital Credentials
– References
19
Sub Workgroup: Identity ProofingType: Sub workgroupGoal
– Define required process for identity proofing of healthcare individuals and organizations for esMD
Requirements– NIST SP 800-63-1 Level 3 authentication
(December 2011)In-Scope
– RA qualifications and certification– Combining RA process with other healthcare identity
proofing (e.g. credentialing)– Policy issues regarding identity proofing
Out-of-Scope– Digital Credential Management– Digital Signatures– Proxy or Delegation
Deliverable: “Summary White Paper”– Assumptions– Statement of Problem– Recommended Solution(s)
• Review of Standards (e.g. NIST, FICAM)• Certification requirements for RAs• Proof of identity requirements for
– Entities– Individuals
• Allowed proofing processes (e.g. as part of credentialing?)
• Frequency of Identity review• Appeals process for denial• Variation based on specific
credentials/use?• Revocation (triggers and process)
– Identify gaps in current policy impacting Identity Proofing
– References
20
Sub Workgroup: Digital SignaturesGoal
– Define process, artifacts and standards for transaction and document bundle digital signatures for esMD
Requirements– Must provide for non-repudiation as part of the
credentials and artifacts– Must ensure data integrity
In-Scope– Use Case 1 and 2 transactions– AoR L1 (Signature binding to aggregated
document bundle)– Signature workflow– Signature artifacts– Identification of relevant standards
Out-of-Scope– AoR L2– AoR L3
Deliverable: “Summary White Paper”– Assumptions– Statement of Problem– Recommended Solution(s)
• Review of Standards (e.g. OASIS, IHE, HL7, …)
• Transaction signature process• Transaction artifacts to meet Use Case
1 and 2 requirements• Document Bundle signature process• Artifacts to meet AoR L1 requirements• Data Integrity requirements• Non-repudiation assurance
– Identify gaps in current policy impacting Digital Signatures
– References
21
Sub Workgroup: Delegation and Proxy Goal
– Define credentials, artifacts and process for Delegation of Rights for esMD
Requirements– Must provide for non-repudiation (NIST definition)
as part of the credentials and artifacts– Revocable
In-Scope– Use Case 1 and AoR L1 Delegation of Rights
requirements– Delegation/Proxy workflow– Delegation/Proxy artifacts– Identification of relevant standards
Out-of-Scope– AoR L2– AoR L3
Deliverable: “Summary White Paper”– Assumptions– Statement of Problem– Recommended Solution(s)
• Review of Standards (e.g. OASIS, IHE, HL7, …)
• Proxy/Delegation Credential/Artifact(s) • Operational consideration for
Proxy/Delegation Creation• Scope/Content of Proxy/Delegation• Revocation of Proxy• Credential Transaction proxy
requirements• Transaction artifacts to meet Use Case
1 requirements• Document Bundle proxy signature
process• Artifacts to meet AoR L1 signature
proxy requirements• Data Integrity requirements• Non-repudiation assurance
– Identify gaps in current policy impacting Delegation & Proxy
– References
22