web-based public health reporting in california: a ......report objectives this report addresses the...

Web-based Public Health Reporting in California: A Feasibility Study

REPORT

December 2001

Web-based Public Health Reporting in California: A Feasibility Study

Prepared for the

CALIFORNIA HEALTHCARE FOUNDATION

by

Donna M. Nowell and Fred E. Warren

Lawrence Livermore National Laboratory

UCRL-CR-146420

December 2001

Acknowledgments We wish to thank all those interviewed for their gracious assistance, cooperation, and interest in Web-based public health reporting and in the proposed pilot. The report depended heavily on the information collected from local health departments, hospital staff, primary care providers, DHS departments, and DHS leadership. We wish to especially thank Gwendolyn Doebbert, Dr. Mark Starr, Greg Smith, and Stan Bissell for the guidance and assistance they provided the project and for their reviews of the draft report. This report was sponsored by the California HealthCare Foundation (CHCF), Sam Karp, Chief Information Officer. Authors Technology Information Systems Program, Lawrence Livermore National Laboratory

• Principal Investigator: Fred Warren • Co-Principal Investigator and Primary Author: Donna Nowell

Lawrence Livermore National Laboratory Contact: Sheri Byrd, Senior Public Information Officer, 925-422-2379 California Department of Health Services Co-Sponsors

• California Department of Health Services Health Information and Strategic Planning Division George B. (Peter) Abbott, MD, MPH, Acting Deputy Director

• California Department of Health Services Disease Investigations and Surveillance Branch

Mark Starr, DVM, MPVM, Dipl. ACVPM, Chief, Surveillance and Statistics Section • California Department of Health Services Vital Statistics Branch

Mike Rodrian, Chief of Center for Health Statistics • California Department of Health Services Information Technology Services Division

Gregory L. Smith, Chief, Information Management Architecture Section The California HealthCare Foundation, based in Oakland, is an independent philanthropy committed to improving California’s health care delivery and financing systems. Formed in 1996, our goal is to ensure that all Californians have access to affordable, quality health care. The iHealth Reports series focuses on emerging technology trends and developments and related policy and regulatory issues. Additional copies of this report and other publications in the iHealth Series can be obtained by calling the California HealthCare Foundation’s publications line toll-free at 1-888-430-CHCF (2423) or visiting us online at www.chcf.org. Copyright © 2001 California HealthCare Foundation

Table of Contents Report Objectives Executive Summary 1 I. General Feasibility Analysis 4 Selection of Interviewees 4 General Business Cases 4 CDHS Culture 6 General Requirements 7 Technology Research and Evaluation 9 Doing Business on the Internet 9 A Common Web-based Reporting Architecture 10 Access Control and Computer Security 12 II. Communicable Disease Surveillance Feasibility Analysis 14 Criteria for Selecting Communicable Disease Surveillance as the Proposed Pilot 14 Current Communicable Disease Reporting 15 Communicable Disease Surveillance Business Cases 18 Issue of Physicians Under-Reporting Communicable Disease Cases 21 High Level System Requirements 22 Proposed Architecture for Communicable Disease Surveillance 26 Special Section on Security 28 Security Policy and Procedures 29 Communicable Disease Issues and Risks 30 III. Pilot Project Proposal 32 Pilot Project Objectives 32 Pilot Participants 33 Critical Stakeholders 34 Role of CDHS Leadership and Political Support 34 Limitations on CDHS Information Resources 35 Production Deployment Planning 35 The People Issues of a Pilot 36 Marketing and Sales 36 Appendices 38 Appendix A. Proposed Communicable Disease Surveillance 39 Pilot Computer Environment Appendix B. Proposed Production PH-Net Computer Environment 40 Appendix C. List of Interviewees 41 Appendix D. List of Reportable Communicable Diseases 43 Appendix E. County, State, National View of Reporting Systems and Data Flows for Communicable Diseases 44

Report Objectives This report addresses the feasibility of a statewide Web-based public health reporting system for the

California Department of Health Services (CDHS) and proposes a pilot system to demonstrate the

feasibility of Web-based reporting system.

Feasibility implies the availability of technical solutions, stakeholder buy-in, sufficiently identified

business cases, and specification of high level requirements upon which to base a conceptual design.

Public Release

The California HealthCare Foundation originally issued this report in December 2000, for internal use

by the California Department of Health Services. As Congress is currently considering proposals that

could provide more than $3 billion to improve the nation's preparedness for bioterrorism and

Governor Davis has announced plans to provide county health departments with $5 million for

disease surveillance, the report is being publicly released to help local health officials and state

policymakers explore workable options to improve California’s public health infrastructure.

Disclaimer

This document was prepared as an account of work sponsored by an agency of the United States

Government. Neither the United States Government nor the University of California nor any of their

employees, makes any warranty, express or implied, or assumes any legal liability or responsibility for

the accuracy, completeness, or usefulness of any information, apparatus, product, or process disclosed

or represents that its use would not infringe privately owned rights. Reference herein to any specific

commercial product, process, or service by trade name, trademark, manufacturer, or otherwise, does

not necessarily constitute or imply its endorsement, recommendation, or favoring by the United States

Government or the University of California. The views and opinions of authors expressed herein do

not necessarily state or reflect those of the United States Government or the University of California,

and shall not be used for advertising or product endorsement purposes.

This work was performed under the auspices of the U.S. Department of Energy by Lawrence

Livermore National Laboratory under Contract W-7405-ENG-48.

Web-based Public Health Reporting in California - 1 - CALIFORNIA HEALTHCARE FOUNDATION

Executive Summary

Lawrence Livermore National Laboratory (LLNL) sees no major issues regarding the technical

feasibility of Web-based reporting. In a 1998 study, LLNL concluded that communicable disease

reporting was feasible using Web technologies. Since 1998, Web technology has matured, enhancing

feasibility from a technical perspective. The growth of businesses using e-commerce and the

availability of “off the shelf” products supporting Web technology testifies to the strength and viability

of Internet and Web technology. The recently released California Executive Order (D-17-00) of E-

Government demonstrates state endorsement of Internet technology to increase the efficiency and

effectiveness in state services. New Jersey has had an operational Web-based Death Registration

System since February 2000, illustrating successful application of Web-based technology within a

public health environment.

Regarding stakeholder buy-in for Web-based reporting, interview results indicate that in general there

is good support at all levels for public health Web-based reporting. At the local provider level, support

varied from requesting if they could participate in a pilot, to indifference, to “wouldn’t want to use

it”—with the majority interviewed being willing to try Web-based reporting. At the county level, there

is both enthusiastic interest and cautious support, qualified by what functionality such a system would

provide. At the CDHS level, the CDHS co-sponsors have a vision for introducing Internet and Web

technology, and to the extent that a proposed pilot would strategically support their goals, there is

strong support.

CDHS strategic information planning envisions the development of a one-stop Web portal for public

health reporting. This concept allows physicians and health officials to easily access CDHS Web

applications and services for complying with state regulated reporting and associated CDHS-published

information. Any proposed Web-based system must support this concept. Additionally, CDHS

envisions a common architectural framework for Web-based reporting that can be leveraged across

CDHS programs. The architecture that LLNL is proposing for a Web-based reporting system supports

both these concepts.

Based on interview results, and in mutual agreement with CHCF, Communicable Disease Surveillance

was selected as a proposed pilot system. The primary goals of the proposed pilot are to develop a

production-capable pilot and to create an initial architecture that could be leveraged across other

CDHS reporting systems. Goal objectives include demonstrating the feasibility of an Internet


architecture for communicable disease reporting; evaluating the pilot’s acceptance by local providers,

local health departments and the CDHS Disease Investigations and Surveillance Branch; and gaining

operational experience to assist in production planning.

Among the challenging issues facing the proposed pilot, three stand out. These are getting and

maintaining physician participation, addressing stakeholder concerns regarding the privacy and

confidentiality of personal health data, and developing a plan to transition the pilot into production

mode. Additionally, there are several sets of emerging standards with which the pilot must comply for

full stakeholder support. These standards include the California E-Government Technology

Architecture Requirements, federal HIPAA Administrative Simplification Guidelines, and the Centers

for Disease Control and Prevention (CDC) National Electronic Disease Surveillance System (NEDSS)

Standards.

In discussing communicable disease reporting with those interviewed, it is hypothesized that most

under-reporting of communicable diseases occurs at the physician level. LLNL has identified some

business cases for physicians; however, more incentives are needed in this area. Physician under-

reporting is a local health department issue as well as a pilot issue, and the proposed pilot should

collaborate with local health departments to tap into their experience and efforts in this area.

For security, both the technical aspects and user perceptions need to be addressed. LLNL has a great

deal of experience in designing secure systems. Additionally, LLNL reviewed the CDC guidelines on

security for AIDS data, and the E-Government Architecture Security Component to recommend a

security strategy for the proposed pilot. User education and training on the security strategy and

policies can provide confidence on how the data will be protected.

The dual purpose of the proposed pilot must be kept in mind when considering transition of the pilot

into production. The pilot will address both communicable disease reporting and a common

framework for supporting health surveillance systems across CDHS. Hence, there is the transition

from pilot to production for communicable disease that involves deploying the system to additional

counties and health providers. In addition, there is the transition from pilot to production to leverage

the common framework via duplication, integration, or extension to other surveillance systems.

In summary, LLNL recommends CDHS develop a Communicable Disease Surveillance pilot to

demonstrate the feasibility of Web-based public health reporting for California. Business cases have

been identified, high-level requirements specified, and a conceptual architecture proposed. We perceive


a high level of interest in the project by stakeholders. We propose a production-capable pilot versus a

proof-of-concept pilot to incorporate CDHS’s input regarding the type of pilot CDHS considers

valuable and would be willing to support.

The support of CDHS leadership is essential to the success of the proposed pilot, especially the

common framework aspect of the pilot. CDHS leadership is necessary to provide strategic direction,

build consensus, and to establish priorities enabling staff commitment to project activities. This

support must be sought from the Governor’s office, the Health and Human Services Agency, and/or

the CDHS Director’s office.

It is our view that critical CDHS information planning strategic goals can be furthered by the creation

of a Web site portal that, in turn, has communicable disease reporting as one of its home pages. At the

center of these strategic goals are CDHS plans to continuously improve the quality of public health

delivered to California.

As a note, CDHS information planning uses the term Public Health-Net (PH-Net) for the concept of

statewide Web-based public health reporting. For consistency with CDHS, the remainder of this report

will use PH-Net when referring to statewide Web-based public health reporting.


I. General Feasibility Analysis

LLNL used the following approach to access the feasibility of a statewide Web-based public health

reporting system:

• Reviewed current Web and Internet technology.

• Reviewed the LLNL 1998 study prepared for California Department Health Services.

• Collected information on the business practices of several mandated CDHS public health

systems: Birth Registration, Death Registration, Cancer, and Communicable Diseases.

• Held discussions with various CDHS stakeholders to understand CDHS culture and how best

to plan a pilot project with the highest likelihood of success.

• Conducted interviews with local, county, and CDHS Communicable Disease stakeholders to

assess their willingness to support Web-based reporting, to identify business cases, and to

recommend high-level system requirements for a proposed pilot.

Selection of Interviewees

LLNL interviewed a broad range of public health personnel for this report. LLNL felt it essential that

stakeholders from local providers, local health departments (local public health jurisdictions), and

CDHS-level management and staff be interviewed to provide a comprehensive view. Interviewees

were selected by recommendations from the California Health Information Association, the CDHS

Health Information and Strategic Planning Division, the California Conference of Local Health

Officers, and the CDHS Disease Investigations and Surveillance Branch. Additionally, “cold calls”

were placed to counties to solicit information and additional contacts were generated from these

sources. Personnel from both large and small counties and hospitals were interviewed.

General Business Cases

Business cases provide compelling reasons why change is necessary and/or advantageous and can be

thought of as overall inducements for change such as efficiency, cost benefits, technology changes, etc.

For CDHS, the business cases for developing a statewide Web-based public health reporting system

include the following:


• Strategically positions CDHS to be in alignment with the California E-Government Initiative released September

21, 2000 (Executive Order D-17-00). Governor Davis asserts, “State government should take

every opportunity to use information technology to make state services and programs more

accessible and hassle-free.” Mike Rodrian, CDHS Chief of the Center for Health Statistics and a

member of the Governor’s task force, sees the need for the department to mesh with the state’s

strategy for delivering government services via the Internet and using the Internet to facilitate

improving the department’s business processes.

• Support CDHS, local health departments, and partners to implement federal HIPAA requirements.

The proposed pilot would be designed and developed for compliance with the Administrative

Simplification provisions of the Health Insurance Portability and Accountability Act (HIPAA).

The proposed pilot will rely on CDHS direction and expertise regarding HIPAA compliance

issues. This support could be leveraged across other CDHS areas. The security model developed

for the proposed pilot is an example of how the proposed pilot could function as a model for

other CDHS areas. Although there are strong HIPAA requirements for computer security, the

requirements are broadly specified. The proposed pilot will need to establish very strict security

requirements for compliance with those specified by both CDC NEDSS and the California State

E-Government Initiative.

• Web-based reporting is viewed as sufficiently increasing the efficiency and effectiveness in health reporting.

The report, Shaping a Vision for 21st Century Health Statistics: Interim Report June 2000, states:

“By permitting rapid communication between data providers and health agencies, technology

enables public health workers to promptly address local or national health problems, and to get

information out to the public.” A strategic goal for CDHS information planning is faster delivery

of reporting data to the health departments. Web-based reporting can essentially provide

simultaneous delivery of data to the local public health departments and state levels. Local health

departments commented that if the state could receive the data faster, this would improve the

turnaround time for the state to provide processed data back to the local health departments and

providers.

Another strategic CDHS information planning goal is to reduce redundant data entry, at all levels

of reporting. Across the systems studied for this report, a common theme was that the same data

is often re-entered into different systems (even for the same surveillance area), increasing the

likelihood of data error and consuming staff resources. Development of a new Web-based system


provides the opportunity to re-engineer current processes to improve work flow efficiency,

thereby improving data quality and reducing business costs.

• This is an ideal time to pilot technology, especially Internet technology, in support of public health reporting.

There is a window of opportunity to collaborate with other efforts and to establish a synergy to

improve the current reporting processes. The Los Angles County Department of Health Services

is looking at opportunities to upgrade their communicable disease system to a Web-based model.

Santa Clara county health department has an information integration project for integrating their

40 databases. Small counties are eager to support a common report model for sharing resources.

Projects in bioterrorism are being co-funded with grants from the CDC. Additionally, other states

such as New Jersey and Missouri are considering Web-based reporting models.

• Empower local health providers and local health departments to report electronically. Currently local health

providers either phone in or fax communicable disease data. Some small counties send hard copies

of mandated reports to CDHS where staff is required to manually key-in the data. To report

electronically, a data source only needs a PC with a Web browser interface. Additionally, any

functionality provided by the PH-Net system would be available to all counties. Web-based

reporting becomes a leveler across the counties to provide all counties the same basic, common

functionality independent of a county’s resources.

CDHS Culture

The CDHS culture today is more receptive to change than in 1998. Since 1998, a departmental email

system has been installed which is widely accepted. Recently a pilot for electronically sending

laboratory data to a Communicable Disease database was successfully implemented and deployed.

Some programs are actively pursuing Web-based upgrades. The Office of Vital Records is actively

assessing how to best implement appropriate Web-based technologies for California’s death reporting.

The New Jersey Web-based Death Registration System, which is operating quite successfully, is being

reviewed.

Strategic planning for the Information Services Technology Division is strongly influenced by both

California state and federal level directives, in addition to supporting the CDHS mission. The division

operates under a long term Information Strategic Plan that projects out to four years, with the plan

being updated every 1 ½ years. Past planning has positioned the division to provide Internet


capabilities for public access, intranet capabilities for restricted access by CDHS staffs only, and

extranet capabilities for limited access by external users via virtual private networks (VPNs). The

division is currently assessing HIPAA’s impact, taking into account that some requirements are final,

others are in draft, and that CDHS may defer compliance on some issues. The division is participating

in a CDHS working group to identify common compliance issues across the agency. The division has

charted a technical group to specifically address HIPAA’s requirement on Digital Certificates. The

division is anticipating that specific direction and priorities for supporting the E-Government Initiative

will be provided after the Governor’s January 2001 State Message.

General Requirements

While each CDHS reporting system will have its own specific system requirements unique to its user

community, LLNL perceives there are general requirements for a Web-based reporting system that can

apply across CDHS surveillance and report systems.

• The privacy of an individual’s medical record must be protected. Privacy involves technical, physical, and

administrative controls. From a technical perspective, data must be protected from unauthorized

users when in transmission, when in use, and when in storage. The protection level can vary

depending on the policies and legal requirements for a program. For example, regulations do not

mandate that death registration data be protected while AIDS data is given the highest level of

protection.

• A statewide, PH-Net system to support public health reporting to CDHS should be based on a common

architecture framework that can be leveraged across CDHS programs. A common architecture supports the

sharing of hardware and software resources, and increases the staff efficiency in managing these

resources.

• The architecture supporting PH-Net should be reliable. The architecture should define the necessary

network infrastructure to allow reliable connections between all entities involved in the reporting

and use of reported data, and should define the necessary working components to allow reliable

access to the data. For public health reporting, reliability is key to user acceptance both from the

perspective of those who report the data and those who analyze the data.


• The architecture supporting PH-Net should be scalable. The architecture should scale to support adding

new reporting systems as they convert to the Web-based methodology, and to provide acceptable

performance.

• The architecture supporting the PH-Net should be flexible. Flexibility is needed to allow the system to

easily incorporate changing business needs and expanding functionality, changes in technology,

and changes in law or policy.

• The PH-Net architecture must be compliant with California E-Government technology architecture requirements.

The E-Government requirements are in progress. The requirements listed within this section have

been reviewed and are in compliance with the E-government requirements as they are currently

stated.

• The PH-Net reporting system must be HIPAA compliant. HIPAA requirements are in progress. CDHS is

currently analyzing the impact of HIPAA requirements on their business practices to determine to

what extent and how best to comply with the HIPAA requirements. Development of the Web-

based system must factor in both HIPAA requirements and CDHS’s compliance position.

• The PH-Net reporting system should support a one portal concept for reporting sources that provide data to CDHS.

Several CDHS leaders, such as Dr. George B. (Peter) Abbott, Acting Deputy Director of Health

Information and Strategic Planning, perceive the need within CDHS to provide a single point of

access for reporting sources. This single point of access would be limited to reporting sources and

would not be a public portal.

• The PH-Net reporting system should be user friendly. Ease of use is critical for user acceptance. The Santa

Barbara local public health jurisdiction is piloting an electronic death registration system where

remote terminals have been placed in funeral homes. Initially, there were five funeral homes

participating and today there are only two funeral homes participating. A major user compliant was

that the pilot system did not have a GUI interface.

• The PH-Net reporting system must be able to co-exist with other reporting methods currently in use.

Switching from existing reporting methods to a Web solution will be evolutionary versus

revolutionary. The Web solution must be able to integrate into the current reporting structures.


• PH-Net should rely on mainstream technology and use open standards products. This requirement supports

California E-Government technology architecture requirements, as well as CDC NEDSS and

stakeholder requirements.

Technology Research and Evaluation

In producing this document we draw heavily on our experience in developing Internet-based

information systems for the LLNL and the Department of Energy (DOE). LLNL has active programs

implementing Web-based information processing solutions using Java, Oracle Web Developer,

PowerBuilder, and Web-based transaction processing systems. We have also constructed electronic

commerce applications that use Electronic Data Interchange (EDI) ANSI X.12 formats for the secure

transfer of multi-million dollar transactions over the Internet. LLNL has implemented a distributed,

secure, access-controlled, Web-based, information-sharing network for a large U.S. industry. We have

implemented a supply chain management solution that transfers engineering technical data to our small

to medium manufacturing vendors, many of whom are quite small and have very little computer

experience. We use the Internet to transfer highly classified nuclear weapon data between DOE

facilities and have web-servers that provide access to this type of data. LLNL has evaluated most

implementation alternatives available for the development of Web-based systems and we have direct

experience in implementing many of these solutions. This experience has been applied to the feasibility

analysis and proposed PH-Net architecture.

Doing Business on the Internet

The concept of an Internet computing solution is based on the use of distributed computers to solve a

central information-processing task. In the case of public health reporting, there are three entities that

are involved and have computing resources. These entities are the care providers or their

organizations, the local public health departments, and the State of California Department of Health

Services. With an Internet solution, all of these entities share the Internet as their common

communications method and the computers at these entities’ locations can interact with each other

and share data. This organization is represented in the diagram that follows.


County

County

PractitionersGroup

State

Provider

Provider

ProviderProvider

Provider

Internet

HMO

The Internet imposes fixed communications architecture on the entities that will interact in the PH-

Net process, but the logical information flow between the participants is defined by business process

choices. This logical, or workflow, organization has a much greater impact on the participating entities

than does the physical, Internet organization. It is therefore most critical to the success of the system

to get this workflow organization defined and accepted by the participants. For communicable disease

reporting, this report addresses workflow in subsequent sections.

A Common Web-based Reporting Architecture

In the 1998 study, LLNL proposed intelligent hub architecture as a solution for an Internet-based

communicable disease reporting system. After re-evaluation, reviewing interview results, and reviewing

requirements, LLNL continues to recommend an intelligent hub architecture approach for a common

PH-Net architecture to be leveraged across CDHS programs. In this approach, a central web server, or

group of servers, acts as the clearinghouse for the data with the various entities adding to and taking

from this central database. When implemented via Internet technology, access to the server and its

data is easy from any location. Implementation of this type of system is relatively low cost and rapid.

Modifications to the system are localized and can be done easily.


Below is a diagram showing elements of the common architecture and information flows.

Local Health

Central Server

Provider

State Surveillance

HMO

A principle concept of intelligent hub architecture is the fact that the data is stored and accessed from

a central location. This data can be organized to provide separate “views” to specific user groups and

sequences of processing can be established to control who accesses the data and when data is available

to a specific user for a specific task. It is through this approach that procedural control is maintained

by participants and allows for effective data ownership. A key advantage to an intelligent hub is that

expensive computer resources are shared by participating users and these users do not have to carry

the burden of cost or operation of the computer equipment. They simply derive the benefit of its use.

If the hub is organized using “tiers” or layers of functionality, development of new or expanded

capability is relatively easy and the system is quite flexible to changing business needs. Disadvantages

of this approach include a central point of failure and the loss of physical control of the data by the

counties. Designing the system with redundancy for the central system can mitigate the central point of

failure. A critical success factor will be the development of an effective education program for county

and state program managers that clearly differentiates the concepts of data ownership as separated

from physical computer system ownership.

The feasibility of the architecture can be demonstrated through a pilot implementation of

Communicable Disease Surveillance. The proposed pilot would develop a CDHS Web site portal to

have Communicable Disease Surveillance as one of its home page options. This first step creates the

initial Web architecture and allows the exploration of Web technology for CDHS services in a very

low-risk way. Should the pilot demonstrate an acceptable and well-received Internet approach for

providing CDHS services, the architecture is designed to easily extend to additional applications and to

scale smoothly to accommodate increased numbers of users. Greg Smith, CDHS Chief of Information


Architecture, reviewed the Web computer architecture proposed for this report. He found the

proposed architecture compatible with CDHS’s existing computing infrastructure. Additionally, the

proposed architecture fits in with CDHS’s longer-term Internet strategies, including compliance with

California E-Government and HIPPA.

Access Control and Computer Security

Data to be stored in a public health reporting system include highly sensitive medical data that must be

protected appropriately. In addition to protection from unauthorized access, the data must be provided

only to those that have a “need to know” the data and this group changes over time as the data is

processed from the primary care provider to the county public health office and to the state.

A useful concept we use at LLNL is the “information protection triangle.” This concept is derived

from the information security orders developed by the DOE and is used in the design of computer

systems that protect classified data. A diagram of this concept is:

InformationProtectionTriangle

Authorization

Authentication Access

There are three basic areas in the protection of information. The first of these is the authentication, or

identity verification, of individuals who have access to the data. The second is the control of physical

or electronic access to the data. The third is the authorization to see the data based on the individual’s

need for the information. The control of access to the data is done by such means as keeping the

computer system in a physically controlled room where only appropriate people can gain access to it

and the implementation of software and hardware protections within the computer system. A critical

requirement for a system such as the one being discussed here is that strong encryption be used on all

transmissions of data over the Internet. This is usually implemented via “SSL” (secure socket layer)


encryption. Issuing login names and passwords to users often controls authentication, but this can be

improved by the use of public key certificates. The final aspect of this concept is the implementation

of a policy that defines who can see the data and under what circumstances. Within the DOE this is

called “need-to-know” (NTK) and maintaining NTK controls can be difficult within a large population

over time. In the context of the surveillance reporting systems, there could be multiple control

groups—at the local provider level, at the local public health department level, and at the state level.

Each reporting system would have its own set of groups. At the local public health department level,

each department would have full access to only their data and departmental reporting groups would be

isolated from each other. State level groups could have access to the data depending on data status.

One important point needs to be discussed regarding the Information Protection Triangle concept.

Only two of the required three areas can be implemented via technology and these are the “base” of

the triangle. A computer system can enforce authentication checking and control the access to data,

but only people can make the decision about who is authorized to see the data. Once the policy

regarding authorization has been defined, however, it can be implemented in the computer system,

often via a method know as “access control lists.” These are the lists of who is allowed to see what

data and the computer will authenticate the user to see if they are on the list. If the user is on the list,

they can access the data, if not, then access is denied. Management of these lists can be complex for

large user groups. Often the decision is made that membership in a group grants access to the data and

thus access to the data is by group rather than by individual.

One practical issue of employing user authentication is the requirement to manage a large user

population. In California there are in excess of 50,000 providers who have a communicable disease-

reporting requirement. Issuing login names and passwords or even digital certificates to such a large

population represents a significant administrative task. It can be done, as witnessed by large online

systems such as America OnLine, but such an administrative infrastructure would be fairly expensive

to implement and operate. It may be possible to leverage other efforts in this area, and this should be

investigated.


II. Communicable Disease Surveillance Feasibility Analysis

Criteria for Selecting Communicable Disease Surveillance as the Proposed Pilot

In the 1998 CDHS study LLNL conducted, CDHS had considered other surveillance systems before

determining that the study would focus on Communicable Disease Surveillance. For this contract,

LLNL had initially investigated other surveillance systems as candidates for a proposed pilot before it

was mutually agreed with CHCF to focus on Communicable Disease Surveillance.

Selection of Communicable Disease Surveillance as a proposed pilot included the following criteria:

• Reporting area was state mandated.

• Required information could be reported using a form.

• Reporting area involved clinical diagnoses and findings and included laboratory results.

• Reporting area was receptive to new Web technology and use of open standards.

• There were clear business cases to support transition to Web-based reporting.

• Reporting area was not financial and or administrative.

LLNL perceived that the Communicable Disease Investigations and Surveillance Branch was very

enthusiastic to be considered as a proposed pilot. The branch is regarded as being an early technology

enabler. The branch was recently awarded a CDC grant to support electronic laboratory reporting to

the state’s Surveillance Repository database. Additionally, the branch has recently successfully

completed a demonstration project for electronic reporting of lab results using HL7 to enhance

microbial disease laboratory reporting. These efforts in laboratory reporting will integrate well and

support the proposed Web-based reporting pilot.

LLNL perceives that there is stronger support now from local health departments for a centralized

communicable disease database than two years ago, and counties are more willing for the state to

receive data simultaneously with the counties. Most importantly, public health can be effectively

impacted by improvements to communicable disease reporting as envisioned by the pilot proposal.


Current Communicable Disease Reporting

By California law (17 CCR 2500), it is the responsibility of every health care provider to report cases,

confirmed or suspect, of specified communicable diseases to the local public health department where

the patient resides. There are currently 83 communicable diseases that must be reported. The

information to be reported is specified on a paper form, the Confidential Morbidity Report (CMR).

Local providers usually either fax the CMR form or phone in the CMR information to the local health

department. The local public health department investigates and confirms the case, and reports

confirmed cases to the CDHS Disease Investigations and Surveillance Branch. The Los Angles local

health department is an exception in that just recently this department began sending unconfirmed

cases to the Disease Investigations and Surveillance Branch. On a weekly basis, the Disease

Investigations and Surveillance Branch transmits communicable disease data to the national CDC.

With few exceptions, the branch removes identifying information and assigns case report numbers

before the data is forwarded to CDC.

Additionally, laboratories are regulated by law to report their results on 18 communicable diseases.

Laboratory results are faxed or mailed to the local public health department where the attending local

provider practices. Local departments use the laboratory results to assist them in investigation and

confirmation of cases. Currently laboratory results are not forwarded on to the state.

Health care providers are responsible for reporting CMR data. California state regulation (17 CCR

2500) defines health care provider as a physician and surgeon, a veterinarian, a podiatrist, a nurse

practitioner, a physician assistant, registered nurse, a nurse midwife, a school nurse, an infection

control practitioner, a medical examiner, a coroner, or a dentist. The primary sources of CMR reports

are the individual private practice physician, hospitals, and HMOs. The individual physician usually

delegates CMR reporting to their staff. Within hospitals and HMOs there are Infectious Control staff

who take on responsibility for CMR reporting. Although hospitals and HMOs may have computer

information systems where much of the CMR data resides, these resources have not been tapped to

assist in any automation effort to electronically transmit data to support rapid communication between

data providers and health agencies. Laboratories are moving toward electronic submission. The Kaiser

Northern Region central laboratory has a computerized system that automatically faxes laboratory

results to the appropriate local health department each night.

Local health departments have the responsibility to address communicable disease control within their

jurisdiction. For some diseases there is a critical short period of time for a local department to take


action and it is thus extremely important for the CMR information to be timely and accurate. Reports

of notifiable disease may trigger epidemiological and laboratory investigations to identify sources of

disease, as well as the implementation of control and prevention measures. The public health

community has long recognized that reporting of communicable diseases is incomplete, which greatly

hampers successful public health interventions. Current estimates are that in some California counties

only about 20% of the reportable diseases are actually reported. The current paper-based reporting

system is also slow and the information often reaches the local health department and the State

Disease Investigations and Surveillance Branch after its point of optimal use, thus significantly

reducing its value. The current reporting system is very labor intensive and often requires multiple

steps of data entry.

Processing of the CMR and laboratory reports varies from local health department to another. In

addition to the CMRs and lab reports, local health departments receive phone calls from private

citizens that must be addressed. Local health departments will either have a manual system or a

computerized system for initially processing reports and balancing nurse workloads for case

management. The majority of local health departments use the Automatic Vital Statistics System

(AVSS) for electronically transmitting CMR data to the state. AVSS was initially used for birth

registration and a version of the system was created to support communicable disease reporting. If the

local department is using the AVSS system, confirmed reports are manually entered into AVSS for

electronic transfer to the state. At the state level, the state accepts data sent via AVSS, an alternate

bulletin board method, and CMR hard copies.

At both the local health department level and state level, there are reporting constraints for AIDS,

tuberculosis (TB), and the sexually transmitted diseases (STDs) syphilis and chancroid. For privacy

protection, AIDS data is sent via registered mail. There is a very proactive effort to collect AIDS data

from care providers. AIDS data is entered into a stand-alone computer system and is kept separate

from other communicable diseases. CDC developed a system for AIDS surveillance, HARS, and

mandates that both the counties and CDHS use the HARS system.

Confirmed TB cases also have reporting constraints. In addition to reporting TB with the general

communicable diseases, confirmed TB cases must be reported to the CDHS TB Control Branch, using

a four-page form. CDC developed a system for confirmed TB, called TIMS, and mandates that

counties and CDHS use this system. For counties that report the highest volume of TB cases, CDC

supplies a TIMS system to electronically report to the state. The remaining local health departments


send hard copies to the state. Typically a local health department might report 10 to 15 cases of TB

annually.

For syphilis and chancroid there are eight regional field offices established to support handling these

cases. Syphilis and chancroid cases should be reported to the appropriate office, which forwards

reports to the state’s STD Control Branch. The STD Control Branch provides data to the Disease

Investigations and Surveillance Branch’s master database.

As mentioned, most of the CMR data from the local health departments is entered into the AVSS

computer system, which is a distributed network operated and maintained by the AVSS project at the

University of California Santa Barbara (UCSB). The CMR data at each local AVSS site is uploaded via

modem to the Department of Health Services’ AVSS site. In California there are 61 local health

jurisdictions, more than 40 of which use the AVSS system to report their CMR data to the state. More

than 90% of the CMR data is submitted electronically from the local public health departments to the

Disease Investigations and Surveillance Branch; the balance is received as paper reports and is entered

manually into the database by CDHS.

The CMR data is used by the CDHS to track communicable disease transmission patterns, develop ad

hoc reports, and analyze associated case histories. On a regular basis, the information is summarized

and sent to the Centers for Disease Control as part of a mandated reporting requirement. There are

several sources of information that could supplement the data received by the state, such as laboratory

test results, pharmacy prescriptions, etc., that currently are not being adequately collected or correlated

with CMR data.

Several problems at the county level stem from difficulties in communication between counties and

with the state. It is very difficult to exchange epidemiology data and analyze trends in near real time

and there was concern expressed that the state does not have the communications or database

infrastructure to rapidly respond to a natural disaster or act of terrorism. Although there seems to be

good communication after disease outbreaks are detected, there is much less communication about

disease trends.


Communicable Disease Surveillance Business Cases

The success of the proposed pilot will depend heavily on identifying business cases for each entity

involved with communicable disease surveillance. LLNL believes that the identified business cases

actually have a synergistic relationship across all levels—CDHS Disease Investigations and Surveillance

Branch state level, local public health departments, and local providers. Consequently, the business

cases are not specifically identified with a particular report level, and provide benefit at all levels.

• Rapid delivery of communicable disease data is a strategic goal for CDHS information planning. The current

communicable disease surveillance system has been adequate for reporting health conditions after

the fact. However, the system has become increasingly marginal for identifying new outbreaks of

disease or other conditions and is completely unable to keep up with the growing potential for

sudden and fast moving bioterrorism attacks. Rapid communication would provide the Disease

Investigations and Surveillance Branch with a global view of reported diseases for trend detection,

and would alert local health departments of trends crossing local jurisdictions.

Currently the state receives only confirmed reports of communicable disease cases. It can take

time for local health jurisdictions to confirm cases, especially if the confirmation needs additional

lab testing. This requires that additional appointments with the physician be scheduled and can

lengthen the confirmation period from several extra days to weeks. The state would like access to

both the CMR and the laboratory data while the local health department is confirming a case.

Local health departments also desire faster delivery of communicable disease data to more

effectively implement control and preventive measures. The local departments can experience

considerable lag time in receiving reports from physicians and laboratories.

• Improvement of data accuracy. Data accuracy can be improved by avoiding re-keying of data, and by

applying business rules at the time of data entry. Execution of business rules at the source of entry

is the most efficient, rather than later in the process when incompleteness and inaccuracy are more

difficult to correct.

An important issue for the local health departments is that CMR reports need to provide complete

information, especially demographic data. To conduct their investigations, the local departments

need patient address information. Some laboratories only provide the patient name. Local health


departments must then contact the physician to get patient address information, which adds time

and effort to their investigations.

• Increased number of communicable disease cases reported. It is generally accepted that there is significant

under-reporting of communicable disease cases. Stakeholders are optimistic that a new Web- based

reporting system and the potential improvements it could generate would increase the number of

cases reported.

• Improved data quality. Improved data quality addresses rapid delivery of communicable disease data

to the state and local health departments, improvement in the number of cases reported, and

improvement in the data accuracy of those cases reported. As the quality of the data improves, the

data will become more valuable. It will be more reliable, more useful, more requested, and

consequently enhance its potential to positively impact public health.

Rapid delivery of data makes it more current and more meaningful; such data reported back to

providers could provide incentive to report their communicable disease cases in a timely fashion.

• Provide feedback to the local health department and local providers. Local providers indicated that it would

be useful to know how many of the cases they reported were confirmed. Several hospitals

suspected that they over-report cases. Currently they get counts of confirmed cases, but the counts

are not identified at the hospital level. Several doctors also indicated that having access to

communicable disease case distributions could add value to their practice.

It is envisioned that improvement in data quality will enhance the data’s usefulness and generate

greater demand for reports from local providers to assist them in decision making processes to

improve the quality and planning of delivered health care.

• Avoid re-keying of data to reduce staff effort. A central concept is to enter the data once at the source and

then provide electronic access to the captured data for those who process the data. This supports

improved data quality and reduces duplicate data entry steps. If local providers report data

electronically, this will reduce the need for data entry at the local health departments. This will

reduce, but not entirely eliminate, the need. Allowance must be made for some providers who will

continue to phone in and fax reports. Additionally, local health departments receive phone calls


from private citizens that must be addressed. For these cases, the issue is to develop a system that

requires entry of the data only once at the local health department level.

The majority of the local heath departments use AVSS for reporting. Typically these counties use

two computer systems. One system is used for case management (confirmation) and the second

system, AVSS, is used for reporting data to the state. The CMR data is keyed into the first system

for case management and then must be re-keyed into the AVSS system, since AVSS does not have

a data import capability. The new system should consolidate these functions, so that data is

entered only once. For those local departments that handle confirmations manually, the new

system would optionally provide the local health department with a computerized capability for

case management.

Not all local health departments electronically transmit CMR data to the CDHS Disease

Investigations and Surveillance Branch. Some departments mail hard copies to the branch where

the data is manually keyed in. To report electronically, in those cases where the local department

might still receive faxes and phone calls, a local health department using a Web-based reporting

system would only need a browser interface. This approach provides small local health

departments with limited resources a way to electronically process their CMRs.

• Capability to support computer-to-computer data transfers. Organizations are working to reduce or

eliminate paperwork and seek ways of preventing duplicate data entry steps. HMOs and hospitals

typically have existing computer systems and record most if not all of the information required by

the CMR report as a by-product of their normal business activity. We see an economic advantage

to these organizations if the pilot could support direct computer-to-computer data transfers to

meet the CMR reporting requirements of their doctors. An outstanding issue is that the

information might not be available in time to meet CMR reporting requirements. For example,

encounter codes are entered at patient discharge time, which in most cases is too late to meet

CMR timeliness requirements. The proposed pilot would need to explore possible solutions to

these issues. As health providers are strategizing for compliance with HIPAA, now is an ideal time

to interact with health providers to explore re-definition of business processes that could improve

timeliness in reporting communicable disease in a cost benefit way by computer-to- computer

transfer of CMR data.

Laboratories also have computer systems for recording results. Kaiser, Northern California

Region, has a computer system that nightly executes to automatically fax laboratory results to


appropriate local health departments. This has been a cost saving to Kaiser, and there was

willingness expressed on their part to participate in the proposed pilot where the northern region

would send laboratory data to a centralized system via computer-to-computer transfer.

• Provide a migration path for communicable disease reporting to a new system based on mainstream technology.

The current, primary mechanism used for communicable disease reporting is the AVSS system,

which is based on the MUMPS system. MUMPS is not mainstream technology. Use of mainstream

technology is a requirement of the California’s E-Government Architecture.

The proposed pilot is based on an architectural framework in which the pilot would run in parallel

with AVSS. CMR data collected at the centralized hub would interface directly with the state

Communicable Disease Master Data Set, which currently processes data electronically transmitted

to the state using alternative, non-AVSS, methods. The proposed pilot would represent another

alternative method.

• Ease in releasing new software versions. Using a Web browser approach, distribution of new software

releases to the local health departments and local providers is unnecessary. Only the Web server

needs to be updated. This eliminates the cumbersome need to synchronize release distribution

across users. All users will be updated simultaneous with the assurance that they are all using the

same release.

Issue of Physicians Under-Reporting Communicable Disease Cases

A frequent theme was identified throughout our conversations with individuals cognizant of the

communicable disease reporting process. Participation by the physicians in the reporting of

communicable disease is the critical element in obtaining the basic CMR data; however, there is shared

concern over motivating physicians to participate in any Web-based reporting system. Physicians are

primarily motivated by the desire to heal their patients; they are focused on individual health, not

public health. It is generally acknowledged that given the constraints on their time, physicians delegate

communicable disease reporting to their staff. Local health departments are working with physicians

on this issue of under-reporting. The pilot should collaborate with local departments to identify

motivators that will encourage participation by physicians.


To motivate physicians, these providers must see added value. One suggestion was to provide to

doctors something of value for their participation, such as information about local disease incidents

similar to those identified for a patient. The value of this feedback increases as the feedback becomes

more timely, which is a primary goal of the proposed system. Another suggestion was to allow the

system to accept hand written forms faxed by the physician. It was also suggested that doctors would

be more inclined to use a system if they could verify that a patient’s information was actually accepted

by the system, thus giving them some feedback on their reporting. In those doctors’ offices that use

practice management software, a benefit could be realized by creating a direct computer-to- computer

interface between one or more of these software systems and the pilot system. We view involving and

engaging the doctors as a significant objective for the pilot deployment.

High-Level System Requirements

Interviews were conducted with stakeholders from local providers, local public health departments,

and personnel within the state CDHS Communicable Disease Surveillance Branch, the Health

Information and Strategic Planning Division, and Information Technology Services Division in order

to determine user requirements. Stakeholders among local providers included both inpatient and

outpatient settings. The requirements are listed below. Also, the requirements previously listed in the

general requirement’s section apply. In some cases the general requirements are repeated here with

more specific application to communicable disease reporting.

• To support user friendliness, the system should support various modes of user input. Ease of use should be

viewed as a strong motivator for system use. LLNL recommends that the pilot experiment with 2

to 3 different input modes for user evaluation. We suggest experimentation with the following

input modes. First, providers may want to continue faxing CMRs to the local health department.

The faxed copies could be electronically scanned and a program could then transmit the form data

to the central repository. Optionally, the user could review the scanned form for correctness

before the form data was transmitted. Second, some hospitals find it very convenient to phone in

CMR reports. There is emerging technology that uses voice-recognition software to fill in forms

for electronic transmission. Third, for Web-based forms, the system could supply customized

defaults where possible depending on the logon identity. For example, knowing the identity of the

physician, the system could default physician facility information.


• The system should provide case management functions for local health departments. Local health departments

are required to confirm reported cases and to respond to reported cases from a public health

perspective. In addition to reports from providers, the local departments get calls from private

citizens. Case management refers to tracking the status of a reported case and the ability to balance

nurse caseloads. Several counties estimate that only half of the reports processed are confirmed

and sent on to the state. The local department needs to track the actual workload it handles, which

can be significantly greater than the count of state-reported cases. This requirement has high

priority for the local health departments.

• The system should provide rapid delivery of communicable disease data between data providers and health agencies.

This requirement specifies that the state would see suspect and confirmed reports, and laboratory

results. Additionally, the state must ensure that local health departments have timely access to data,

where the timeliness required could vary depending on the communicable disease reported.

The proposed pilot will need to work with participating laboratories to ensure that data necessary

to allow distribution of laboratory results back to the appropriate local health department is

supplied.

• The system should provide workflow management. This requirement is closely related to the requirement

for case management functionality. Workflow needs to be managed from the time CMR reports

and laboratory reports are received by the centralized facility through confirmation and release of

data. Today, CMR workflow is characterized by distributed physical flow. In the proposed pilot,

the CMR workflow will be characterized by centralized logical flow. As part of workflow, the state

must be able to determine which reports are confirmed. Other status indications may also need to

be provided. As mentioned earlier, local departments get calls from private citizens. These calls

can be bizarre and of no interest to the state. Yet the local department would need to log the call

for workload purposes.

• The system must control access to the data. The goal is to provide controlled mechanisms for accessing

data to support efficient workflow processes. At any point in time, only those authorized and with

a need to know should have access to the data.

• The system must provide security and data protection. As mentioned in the general requirements, it is an

absolute necessity to protect the privacy and confidentiality of personal health data. State and


national organizations are addressing privacy and data security. The proposed pilot should comply

with California E-Government Technical Architecture guidelines and HIPAA guidelines.

Additionally, proposed security measures documented in this report incorporated CDC Guidelines

for AIDS reporting.

• The system should support capture of high quality data. Elimination of duplicate data entry would aid in

improving data quality as well as automatic data validation at the point of data entry. Data

validation would also include checking that all required data has been entered. The proposed pilot

will need to identify the business rules for data validation. The proposed pilot should also

investigate getting laboratories to provide demographic patient identification.

• The system should provide data download capability to local health departments. Local health departments

using AVSS currently rely on their local AVSS system to extract data for analysis. Local staff have

set up their PCs with the programs needed for their analysis. Any new system must support the

capability for data extraction to the local level.

• The system should provide feedback to the local health departments and providers. Feedback should include

defined queries and reports as well as ad hoc query and report capability. The proposed pilot will

need to address specifically what feedback is needed.

• The system should comply with CDC NEDSS and CDC HISSB guidelines for electronic reporting. In addition

to California E-Government and HIPAA standards, the system needs to comply with CDC

NEDSS and CDC HISSB guidelines. This involves use of HL7 for lab reports, use of XML, and

use of standard codes. LLNL believes the proposed architecture complies with CDC guidelines.

Compliance is important because it is an eligibility prerequisite in applying for CDC grants.

• The system should support computer-to-computer transfer. The following capabilities should be supported:

• Electronic transfer of data from laboratories to the central facility.

• Electronic transfer of data from HMO and hospital computer systems to the central

facility.

• Electronic transfer of data from a local health department to the central facility.


This requirement provides the provision for a local health department to electronically

collect communicable disease data for transmittal to the state. The local health department

would need to provide appropriate security for data protection.

• Electronic transfer of data from the central facility to the local health department. (This is

equivalent to the system down load capability.)

• Data collected by the system should be usable by a spatial analysis product. Data collected should be

Geographical Information System (GIS) ready; that is, address information should be verified at

data entry time and even possibly geo-coded.

• The system should assist in identifying duplicated reports. There are several ways that reports might get

duplicated. One way is that the lab is in one jurisdiction and the physician is in another

jurisdiction. Another way is that for the same condition, a patient might go to multiple physicians

and again might cross jurisdiction boundaries.

• The system should support inclusion of patient identification to link to other state reporting systems. This

requirement addresses enterprise integration to easily link information across systems. Such

linkages assist in the correlation of data to enhance the understanding of the causes of ill health

and what to do about the causes; improve the responsiveness of systems to emerging data needs;

and track what public health services are available to an individual. CDHS has developed, tested,

and begun to implement a common core data set as an unique identification scheme for linkage of

client data from two or more CDHS databases. The State Client Index is based on this scheme.

However, at this time, CDHS is waiting for federal HIPAA standards before assertively pursuing

further implementation. The proposed pilot would need to stay alert regarding the status of any

new or existing identification links for inclusion in the pilot.

• The system should assist in identifying lab reports that are missing their associated CMR report. A local health

jurisdiction may receive a lab report before it receives the CMR report. When this happens, some

jurisdictions will then call up the physician to get them to send in the CMR. It would be helpful if

a function was provided that could track which lab reports had missing CMR reports. This

function could also provide an accountability feature to identify providers who neglect to provide

timely reports of CMR data.


• The system should provide county specific communicable disease reporting requirements. The state regulates

which communicable diseases must be reported. Local health departments may temporarily

augment this list. Having the reporting requirements easily accessible online could enhance the

usefulness of the system.

• Consider supporting supplemental communication facilities. A “chat” facility should be available for the

users of the system to exchange information and questions. This would be particularly useful in an

emergency or crisis. Also, an electronic mail notification system needs to be implemented. This

system would be able to report to specific doctors, health care organizations, or health officers

when the CMR record of an individual has been processed through a specific step. It would also

allow counties to report status information to the state on individual cases. The conditions that

generate this reporting would need to be agreed upon by the participating users.

Proposed Architecture for Communicable Disease Surveillance

The proposed architecture for a new communicable disease reporting system is derived from the PH-

Net architecture described earlier. The system would be based on the “intelligent hub” architecture

with a Web-browser interface. LLNL recommends that the hub server be implemented using a

commercially available applications integration broker to provide for adequate flexibility and future

enhancements. The system should include a relational database system for storing and retrieving the

CMR data. The system should also be designed to accommodate case history data and support case

management functions. We further recommend that two central servers and a load leveling router be

implemented to provide a failure resistant and scaleable architecture. Redundant disk arrays should be

incorporated into the servers, and communication lines to the system should also be redundant. All

communications to and from the server should be encrypted with at least 56-bit encryption although

128 bit would be better if the users can support it. The central server should be firewall protected.

VPN software should be used for all computer-to-computer data transfers and each remote computer

system should be provided with a digital certificate to unambiguously identify it for communication

with the central hub. VPN and firewall software must be IPSec protocol compliant and be

International Center for Security Analysis (ICSA) tested. The system must support standard HTML

browser connections. Provision must be made for the use of digital encryption key certificates for

authentication of users when these become widely available, and for each remote host system

connected to the central servers. Privacy of the CMR and case data must be protected throughout each

stage of its processing by the enforcement of access control groups and the use of passwords.


Communicable disease data would flow from the primary care providers (or their organizations) and

laboratories into a central, relational database. This data would enter either via direct entry from a

browser-based form or via a standard computer to computer interface via VPN-encrypted

connections. Once the data was stored, access to the data would be restricted to the local health

department involved and the state, until the local health department released the data for wider

distribution. Data released for wider distribution would have personal identifying information

removed. A workflow process would be established that sequences the individual CMR data records

through this flow and imposes the required review and release steps. As part of the workflow, the

status of the data would transition from suspect to confirmed. Provision would be available for the

local health departments to download their data from the central server in a standard format or

through direct database access for local processing.

Some consideration needs to be given to the issue of individual providers needing to provide the same

data to more than one organization. Ideally, the information should only be entered once, either

directly to the Web-based system or to the provider’s organization, which would then forward the data

on to the central database system.

Regarding computer-to-computer transfer, the only practical way to provide this capability in a new

communicable disease reporting system is to implement standards-based computer-to-computer

communication protocols. It is important to use existing standards, as the cost of implementing these

interfaces is large and it is impractical to expect organizations supplying the CMR data to develop an

interface specifically for this application. The system must, then, leverage already existing efforts within

the health care industry where possible to automate their business functions. HIPAA and CDC

NEDSS should be drivers in this area. An important goal of the proposed pilot would be to keep

abreast of new regulations regarding standards for guidance in their use for reporting CMR data. Four

specific standards have been identified to date. The first is the ANSI X.12 Electronic Data Interchange

837 transaction. This standard is supported by HIPAA for an “encounter/claim.” The second format

is the Health Level Seven (HL7 2.3) Observed Results Unsolicited (ORU) messages currently being

implemented in automated laboratory information systems. This standard is supported by both

HIPAA and CDC NEDSS for laboratory reporting. The third format is XML (the eXtensible Markup

Language) as defined World Wide Web Consortium that is rapidly becoming the “lingua franca” of the

Internet. This standard is supported by CDC NEDSS for program specific reporting. The last format

is the industry standard “DBF” format that can be generated by most desktop applications. Issues have

also been raised as to whether these formats are appropriate both from a technical perspective and


from a legal perspective. Use of these formats would be important in any pilot system created for

communicable disease reporting and an important result of the pilot would be the methods and

legalities of their use in the context of communicable disease reporting, as well as in other public health

surveillance activities.

Special Section on Security

An essential PH-Net requirement is the need to provide computer security to protect personally

identifiable medical data. When thinking about computer security, it is important to realize that there

are costs associated with protecting data and computer systems and that there is always more that can

be done. Within the DOE we have a concept known as the “graded” approach to computer security.

This view is that computer systems and their data need to be protected to the level that is required, but

not simply protected to the greatest degree possible. This concept recognizes that security is the

process of putting up barriers to unauthorized access and that it consists of creating a series of barriers

until the protection level is appropriate for the threat and the risks involved.

Basic to computer security is the creation of a computer security plan for the system and data to be

protected. This process is initiated by doing a risk assessment to determine the likely threats to the

computer system and the risks associated with the compromise of the data. This then forms the basis

for making the judgements as to how much computer security is required for the specific system under

consideration. When the level of computer security has been identified, there are well-established

technical and administrative methods for implementing the level of security needed.

The computer security approach we recommend is known as “defense in depth.” In this approach all

entry paths and exit paths to a system are protected and within this “perimeter defense” an electronic

guard is posted to watch for any illegal accesses that made it through the perimeter.

For the proposed Internet based systems the perimeter of the computers that form the hub system will

be protected by a “firewall” computer that filters all accesses to the protected systems. In addition, we

propose an access limiting “router” be used to protect the “back door” of the systems as they

interconnect to the internal CDHS computer environment. All connections over the Internet to the

hub will either be via strong (e.g., greater than 40 bit) encryption of Web access through the use of

secure socket layer (SSL) encryption or by virtual private network (VPN) encryption of transmissions

from remote hosts to the application server. Within the protected hub system, an “intrusion detection”


system will be implemented to guard against illegal penetration of the protected perimeter of the

system. A regular program of software upgrades must also be implemented to eliminate security

problems in the host server systems. It is important to realize that these technical methods are not

adequate in and of themselves. The policies and procedures used to maintain the computer system and

ensure its security are as important, and perhaps even more important, than the technical methods.

Security Policy and Procedures

Human error or malfeasance can compromise the best computer security implementations. Without

good human assurance policies and procedures, no information is safe. The Centers for Disease

Control and Prevention (CDC) has provided some excellent guidance in formulating these policies. We

suggest that Appendix C of the Guidelines for HIV/AIDS Surveillance (Security Standards for the

Protection of HIV/AIDS Surveillance Information and Data) offers an excellent model for good security

policy and procedures. It is beyond the scope of this report to detail these, but the primary guiding

principles identified might prove illustrative.

1. Surveillance information and data will be maintained in a physically secure environment.

2. Operational security procedures will be implemented and documented to minimize the

number of staff that have access to personal identifiers and to minimize the number of

locations where personal identifiers are stored.

3. Individual surveillance staff members and persons authorized to access case specific

information will be responsible for the protection of confidential surveillance information and

data.

4. Security breaches of surveillance information or data will be investigated thoroughly, and

sanctions imposed as appropriate.

5. Security practices and written policies will be continuously reviewed, assessed, and as

necessary, changed to improve the protection of confidential surveillance information and

data.


Communicable Disease Issues and Risks

This section briefly describes the risks identified to date. Should the proposed pilot be funded, these

risks would be addressed in the pilot’s project plan risk analysis task.

• Getting physicians to use the system. As physicians represent the largest area where under-

reporting occurs, any goal to increase the number of cases reported must address motivating

physicians to use the system. Some incentives have been suggested. Additional physician input is

needed.

• There was almost unanimous feedback from those interviewed that the system must be able to

protect the privacy of personal medical records. The LLNL proposal provides a secure framework

that must be supplemented by computer security policies. Users must be trained regarding their

security responsibilities and policy compliance must be enforced.

• Authentication of users is an important aspect of security. In California there are in excess of

50,000 providers who have a communicable disease-reporting requirement. Issuing login names

and passwords or even digital certificates to such a large population represents a significant

administrative task. It can be done, as witnessed by large online systems such as America OnLine,

but such an administrative infrastructure would be fairly expensive to implement and operate. It

may be possible to leverage other efforts in this area, and this should be investigated. We

recommend that for the proposed pilot, passwords without digital certificates be used for user

authentication.

• Local health departments are concerned regarding the reliability of a centralized system. Although

there is stronger support today for a centralized system than there was two years ago, this concern

must be addressed. Requirements do specify that the proposed system must be reliable and the

proposed architecture provides redundancy.

• Although local health departments are more willing for the state to receive data simultaneously

with the local departments, this issue must continue to be addressed. Local departments are

concerned with how providers might interpret communicable disease data going to the state first.

Their concern is that providers will want to start bypassing the local department and perceive that

it is more important to send data directly to the state. Careful marketing can be instrumental in

addressing this issue.


This issue is closely related to the issue of who owns the communicable disease data and under

what circumstances it should be passed from the local health departments to the CDHS. A critical

success factor will be the development of an effective education program for county and state

program managers that clearly differentiates the concepts of data ownership as separated from

physical computer system ownership.

• Lack of CDHS resources to participate in development of the proposed pilot. Discussions need to

be pursued with CDHS to address staffing for the proposed pilot.

• Currently CDC mandates the use of the HARS system for AIDS reporting and the use of the

TIMS system for confirmed TB. Subsequently, there are political challenges that must be

addressed to include AIDS and confirmed TB reporting in the proposed Web-based

communicable disease reporting system. CDC is moving towards a more integrated approach for

communicable disease reporting. The proposed pilot should investigate possibilities for

collaborative effort with CDC toward this objective. Additionally the security requirements for

handling AIDS data are greater than those for other communicable diseases. The impact on the

local health departments to meet increased security requirements, including physical security and

policy requirements, would need to be investigated and addressed should AIDS data be combined

with other notifiable disease data. Because of these unknowns, AIDS and confirmed TB reporting

were not included in the cost estimate.

• Any system that attempts to alter how an existing business process operates will generate some

resistance to the change. This resistance is often political or administrative as individuals and

groups attempt to slow down or stop the change. This risk must be managed from the very

beginning of the project by winning over the participants and by maintaining a constant effort to

sell and support both the concept and the implementation.

• There are many different groups attempting to introduce automation into the health care system

and each has its own approach. There is a risk of having too many demands placed on the pilot,

driven by too many stakeholder groups. A quick way to cause a failure in a computer system

development is to not manage the requirements the system is trying to meet. In the trade, this is

known as the “attack of the creeping feature creature.” One way to manage this risk is to

incrementally implement capabilities with well-defined operational milestones that can be met

during the project, where a working system can be demonstrated at each step.


III. Pilot Project Proposal

LLNL proposes that CDHS develop a pilot electronic communicable disease reporting system to

explore the feasibility of conducting public health surveillance over the Internet. To build on the

results of LLNL’ s findings, additional analysis for communicable disease reporting would be

conducted to develop detailed requirements and to make any modifications to the proposed

architecture. The pilot system would be implemented and fielded to selected members of the health

care community. We propose operating the pilot system for an evaluation period of four months. Prior

to operational deployment, pilot evaluation criteria would be established. During this operational

period, ongoing enhancements would be made to the pilot based on participant feedback. Also during

the operational period, the PH-Net concept, now with a demonstration system, could be marketed to

determine and build additional buy-in support for Internet-based public health surveillance. At the

conclusion of the operational period, an evaluation would be made regarding transition of the pilot to

production. Production has two meanings, including: (1) transition of the pilot to production for

Communicable Disease Surveillance; and (2) transition of the pilot to production where the pilot

represents a model to be integrated, duplicated, or extended to other CDHS surveillance programs.

Pilot Project Objectives

The primary goals of the pilot will be to develop a production-capable pilot, which if successful could

be rolled out statewide, and to create an initial architecture that could be leveraged across other CDHS

reporting systems.

Supporting objectives include:

• Demonstrate the feasibility of Internet architecture for communicable disease reporting.

• Evaluate the pilot’s acceptance by local providers, local health departments, and the CDHS

Disease Investigations and Surveillance Branch.

• Evaluate production readiness of the pilot.

• Gain operational experience to assist in production planning.

• Evaluate the different modes of data input used. Which input modes were preferred, how well

did they work, should they all be used in a production mode?

• Identify and document any system acceptance issues or recommendations.

• Assess the level of training and support needed for production based on the pilot needs.


• Identify any operational difficulties, especially as they might impact transition to production.

• Collect metrics based on the evaluation criteria.

• Evaluate the results of marketing efforts conducted during the pilot.

Pilot Participants

To provide comprehensive feedback on the proposed system, representatives from local providers,

local public health departments, as well as the CDHS Disease Investigations and Surveillance Branch

should participate in the pilot. LLNL discussed possible pilot participation with the Disease

Investigations and Surveillance Branch and there was agreement that the system should ideally be

piloted to two local health departments, five hospitals, seven to ten physicians, one HMO, and one

laboratory. These participants should be able to provide a reasonable number of disease reports that

would then be evaluated for timeliness, usefulness, and ease of use by the appropriate local health

department disease control program and by the Communicable Disease Control Division of the

CDHS. For laboratory participation, we recommend partnering with the Disease Investigations and

Surveillance Branch’s project that is piloting electronic laboratory data transfer.

Pilot participation would extend beyond those participating in the operational evaluation.

Representatives from key counties should actively participate in the requirements and design phase.

This would include large counties providing the bulk of the reporting volume, and counties currently

upgrading their systems. Although the proposed pilot would focus on communicable disease reporting,

representatives from other CDHS surveillance areas would need to participate in the requirements and

design phase to ensure the pilot provided sufficient flexibility to incorporate their needs when

leveraging the pilot across other CDHS areas.

A pilot such as this one will require considerable ongoing dialog and support. Without buy-in and

strong support from the participants, the pilot will not succeed and will not be able to adequately

determine the viability of using the Internet to report communicable disease events. If possible, it

would be ideal to select the operational pilot participants physically close to the development team for

quick accessibility and reduced travel costs. The New Jersey Electronic Death Registration project lead

stated one their success factors was being on call and their close physical proximity.


Critical Stakeholders

There are two kinds of stakeholders for the proposed pilot system, visible and invisible. The visible

stakeholders are those members of the Communicable Disease Division that would have responsibility

for the pilot data, individuals at each local heath department that would deal with the data, doctors,

HMO personnel, hospital personnel, and CDHS information systems personnel. These individuals can

be identified through their jobs within the department or their responsibility for CMR data. The

invisible stakeholders are people who may not appear on any organization chart and may not even be

within the work areas responsible for communicable disease data, but who, by their nature or political

connections, can strongly influence the acceptance or rejection of any new policy, procedure, or

system. One of the major tasks of a pilot project will be the identification of the critical stakeholders,

both visible and invisible, and the subsequent obtaining of their buy-in to the project. This process

normally proceeds on an individual-by-individual basis and is often quite time consuming. The

consequences for omitting the buy-in of an important stakeholder, whether visible or invisible, can

mean the collapse of the pilot project due to a critical approval being refused or support for an

important activity being withheld.

Role of CDHS Leadership and Political Support

The CDHS is an entity within the State of California political system and it thus derives much of its

direction from political sources. Because the CDHS is a very hierarchical organization and very subject

to political guidance, many individuals within the hierarchy respond strongly to direction from the top.

It is our opinion that a successful pilot computer system within the CDHS will require strong support

from very senior management. This support must be sought from the Governor’s Office and/or the

CDHS Director’s Office.

The proposed pilot will need a CDHS advocate and we see the CDHS Information and Strategic

Planning Division as fulfilling this critical role. Throughout its duration, the proposed pilot will need to

keep abreast of CDHS strategic and tactical planning goals, to have the capability to tap CDHS

expertise (both technical and political), and to have the benefit of an internal CDHS co-sponsor

actively working to build and to maintain project support. This type of support can only be provided

by an internal entity within CDHS, supported by CDHS high-level management.


High-level support is a necessary condition for success, but it is not all that will be required. A strong

sales effort will also be required for key stakeholders up and down the management chain and to the

people “in the trenches” who will make the pilot work, including the local health departments.

Limitations on CDHS Information Resources

Discussions with CDHS Information Technology Services Division (ITSD) managers and staff

defined some constraints on their participation. The rules that govern procurement and hiring within

the department are involved and time consuming. There are many unfilled openings in the ITSD area

that are caused by the extreme shortage of qualified IT candidates applying for the openings, and lag

time in hiring. With recent budget cuts, staff head count is also below the level for sustainable

operations. In addition to a very tight staffing situation, the procurement system introduces very long

lead times into procurements of computer equipment and software. LLNL believes that ITSD

participation is essential based on CDHS’s goal for leveraging the pilot across other CDHS areas, and

CDHS’s valid concern regarding ongoing production operation after the pilot. If the pilot system is to

be successful, a strategy must be developed that allows for ITSD staff involvement. The procurement

issue can be by-passed if CHCF purchased the equipment.

If additional help can be provided to ITSD, perhaps in the form of temporary contract help to

perform routine operational activities, then existing ITSD staff could be freed up to help support the

pilot. Or alternatively, contract people could be brought in during the pilot’s development phase with

the requirement of knowledge transfer to ITSD. Discussions would need to be pursued with the ITSD

management to identify a workable plan. We perceived an interest in the pilot within the division that

could be drawn on to form a solution.

There are similar resource issues in the CDHS application area, which would need to be addressed.

Production Deployment Planning

Prior to accepting a pilot system within the department, ITSD will need to have a clear picture and

resource cost estimates of what an operational system will require from them. This deployment plan is

needed to provide for the long lead-time it takes to obtain budget and staffing within the department.

In addition, strong political and management support will be needed if redirection of resources is

required.


The People Issues of a Pilot

It is people who will make the pilot system successful and it is very important to plan for the needs of

the pilot participants, both those who directly use the pilot system and those who are in the

management chain responsible for it.

• Training. There must be a training program developed for the system users and training must be

provided to them. The training must address security strategy and security policies.

On-site pilot staff available to guide new users through their initial experiences with the system

must also supplement the training. This provides the added benefit of allowing pilot staff to

observe the pilot system in use and access its usability.

• Technical Service/Help Desk. The pilot project must provide a help desk function to provide users

with rapid, timely resolution of questions and concerns as they arise during the pilot.

A pilot such as this one will require considerable ongoing dialog and support. Without buy-in and

strong support from the participants, the pilot will not succeed and will not be able adequately to

determine the viability of using the Internet to report communicable disease events. At several

points during the operational period, pilot staff might spend additional on-site evaluation time.

• IT Staff Involvement. The project must provide for the education of selected members of the CDHS

ITSD in the design and operation of the pilot system. This is required to ensure the ability of the

department to support the system should it be transitioned into a production system. It also

provides a way to encourage ITSD staff to support the project by involving them in an exciting

technical project.

Marketing and Sales

For just this feasibility study, we were asked to provide descriptive materials and to give a presentation

at the Small County Epidemiologists Forum. For the proposed pilot, there will be many situations

during the project where presentations must be made to key stakeholders, line management, and staff.

These presentations may be to groups and they may be to individuals. To successfully influence key

stakeholders, a complete marketing strategy should be developed along with persuasive sales materials.


This would involve the identification of the unique selling proposition(s), target audiences, project

logo, project graphics, and key selling strategies. It would also involve the production of sales materials

such as presentation graphics and slides, brochures, a Web site, and a demonstration system. The

techniques for sales and marketing are well developed in the commercial sector, but it may be novel to

consider their need within the context of a government agency pilot computer system. However,

people are people wherever you find them and the need to influence and convince is an important part

of any project that introduces change into an organization.


Appendices Appendix A. Proposed Communicable Disease Surveillance Pilot Computer Environment Appendix B. Proposed Production PH-Net Computer Environment Appendix C. List of Interviewees Appendix D. List of Reportable Communicable Diseases Appendix E. County, State, National View of Reporting Systems and Data Flows for

Communicable Diseases


Appendix A. Proposed Communicable Disease Surveillance Pilot Computer Environment

HMO Data Center

Laboratory Data Center

County Data Center

Doctor's Office Internet

Dual Redundant Web Servers

Load LevelingRouter

Firewall

Doctor's Desktop

Doctor's Practice Management

System

FormatTranslation

Server

CMR DatabaseServer

HTTPS HTTPS,FTP,VPN

XML (VPN)

XML

EDI(VPN)

HL7 (VPN)

HTTPS FTP

(VPN)

SQL

Proposed Communicable Disease Reporting PilotOperational Computer Environment

FTP,etc

Communicable Disease

Master Dataset

Access Router

IntrusionDetection


Appendix B. Proposed Production PH-Net Computer Environment

HMO Data Center

Laboratory Data Center

Local HealthOffice Data Center

Doctor's OfficeInternet

Redundant WebServers

Load LevelingRouter

Doctor's Desktop

Doctor's PracticeManagement

System

FormatTranslation

Servers

Report DatabaseServers

HTTPS HTTPS,FTP,VPN

XML(VPN)

XML

EDI(VPN)

HL7(VPN)

HTTPSFTP

(VPN)

SQL

Proposed CDHS Internet-based Reporting ModelProduction Computer Environment

FTP,etc

Report InfoMaster Datasets

AccessRouter

IntrusionDetection

Firewalls

ApplicationServers


Appendix C. List of Interviewees California Department of Health Services

• Dr. George B. (Peter) Abbott, Acting Deputy Director, Health Information and Strategic Planning

• Mike Rodrian, Chief of Center for Health Statistics • Frank DeBernardi, Chief, Management Information System/Decision Support, Medical Care

Services • Dr. Mark Starr, Chief, Communicable Diseases Surveillance and Statistics Section • Greg Smith, Chief, Information Management Architecture • Gwendolyn Doebbert, Assistant Chief for Health Information Policy • Marilyn Wensrich, Chief, Planning and Project Management, Information Technology

Services • Debi Jackson, Data Processing Manager I • William Siska, Information Technology Specialist • Sandra V. Hughes, Senior Counsel, Office of Legal Services • Stan Bissell, Information Specialist, Surveillance and Statistics (Communicable Diseases) • Gail Gould, Sexually Transmitted Diseases Control • Jean Montes, Chief, Sexually Transmitted Diseases Control • Janice Westenhouse, TB Surveillance and Epidemiology, Research Scientist II • Jim Creeger, Manager, AIDS Case Registry • Dr. Sandra Huang, Medical Epidemiologist/Bioterrorism, Communicable Disease Control • Jane McKendry, Chief, Vital Statistics • Sandy Ficenec, Vital Statistics • Rod Palmieri, Contact for Electronic Death Registration Planning Group • Dr. Bill Wright, Chief, Cancer Surveillance • Bob Schlag, Cancer Surveillance • Dr. Eugene Takahashi, Chief, Office of Epidemiology, Maternal and Child Health • Doug Mac Donald, Breast Cancer Early Detection Program, Breast and Cervical Cancer

Program • Linda MacFarlene, County Medical Services Program Paid Claims • Jim Sutocky, County Medical Services Program Paid Claims • Dr. Roger Trent, Chief, Epidemiology and Prevention for Injury Control • Alan Oppenheim, Office of County Health Services • Mary Kay Patton, Maternal and Child Health Branch

California Local Health Departments

• Alameda, Gary Oliver, Information Systems • Alameda, John Keltner, Communicable Diseases, STD • Los Angeles, Dr. David Dassey, Communicable Disease Control • Mendocino, Phyllis Webb, Data Analyst • Mendocino, Linda Nagel, Maternal Child Heath • Modesto, Kyle Luman, Chief Epidemiologist • Orange, Kathy Higgins, Disease Control, Data Collection • Orange, Mike Carlson, Communicable Disease Control • Orange, Brandon Page, Communicable Disease Control, AIDS • Orange, Karen, Communicable Disease Control, STD, County Nurse


• Placer, Michelle Fernardez • San Diego, Kim Poggemeyer, Communicable Disease Control • Santa Clara, Karin Coy, Communicable Disease Control • Santa Barbara, Amy Bellomy, Epidemiologist / Director, Disease Control and Prevention • Santa Barbara, Natlee Hapeman, Biostatistician / Epidemiologist • Solano, Helena Hawks, Epidemiologist

Hospitals / HMOs/ Physicians

• Valley Care Hospital, Livermore, Linda Arkinson, Information Systems • Cancer Library, Pleasanton, Janie Eddieman, Librarian • Doctors Medical Center, Modesto, Debbie Fuller, Infectious Control Staff • Doctors Medical Center, Modesto, John Fall, Infectious Control Staff • Memorial Hospital, Modesto, Rebecca Heffner, Infectious Control Staff • Emanuel Medical Center, Modesto, Stephany Lamber, Infectious Control Staff • Physician, Dr. Winter • Physician, Dr. Elaine Ashby • Kaiser, Northern CA Regional Lab, Maureen Bergondy, Computer Systems • Kaiser, Northern CA Regional Lab, Kathy Alzate-Agustin, Computer Systems

Organizations

• Dr. Richard Burton, President, California Conference of Local Health Officers, and Health Officer for Placer County

• LaVonne La Moureaux, Executive Director, California Health Information Association • Kathy McCaffrey, Vice President, Health Care Data and Operations, California Association of

Health Plans Centers for Disease Control

• Joseph Posid, National Center for HIV, STD, and TB Prevention, Centers for Disease Control and Prevention


Appendix D. List of Reportable Communicable Diseases Acquired Immune Deficiency Syndrome (AIDS) Meningitis Amebiasis Meningococcal Infections Anisakiasis Paralytic Shellfish Poisoning Anthrax Pelvic Inflammatory Disease Babesiosis Pertussis (Whooping Cough) Botulism (Infant, Foodborne, Wound) Plague, Human or Animal Brucellosis Poliomyelitis, Paralytic Campylobacteriosis Psittacosis Chancroid Q Fever Chlamydial Infections Rabies, Human or Animal Cholera Relapsing Fever Ciguatera Fish Poisoning Reye’s Syndrome Coccidioidomycosis Rheumatic Fever, Acute Colorado Tick Fever Rocky Mountain Spotted Fever Conjunctivitis, Acute Infectious of the Newborn Rubella (German Measles) Cryptosporidiosis Rubella Syndrome, Congenital Cysticercosis Salmonellosis (Other than Typhoid Fever) Dengue Scombroid Fish Poisoning Diarrhea of the Newborn, Outbreaks Shigellosis Diphtheria Smallpox (Variola) Domoic Acid Poisoning (Amnestic Shellfish Poisoning)

Streptococcal Infections

Echinococcosis (Hydatid Disease) Swimmer’s Itch (Schistosomal Dermatitis) Ehrlichiosis Syphilis Encephalitis Tetanus Escherichia coli Toxic Shock Syndrome Foodborne Disease Toxoplasmosis Giardiasis Trichinosis Gonococcal Infections Tuberculosis Haemophilus Influenzae Invasive Disease Tularemia Hantavirus Infections Typhoid Fever, Cases and Carriers Hemolytic Uremic Syndrome Typhus fever Hepatitis, Viral Varicella (deaths only) Hepatitis, A Vibrio Infections Hepatitis, B Viral Hemorrhagic Fevers Hepatitis, C Water-associated Disease Hepatitis, D Yellow Fever Hepatitis other Yersiniosis Kawasaki Syndrome Occurrence of Any Unusual Disease Legionellosis Outbreaks of Any Disease Leprosy Leptospirosis Listeriosis Lyme Disease Lymphocytic Choriomeningitis Malaria Measles (Rubeola)


Appendix E. County, State, National View of Reporting Systems and Data Flows for Communicable Diseases

County Sys (Typically anetworked PC) to trackverifications of CMRs andto balance nurse caseload.Can be manual sys.

CMRs for Communicable Diseases, STD, TB (Not AIDS)are phoned in, faxed in, mailed in

Confirmed CMRs (For counties using AVSS,must manually key-in data since AVSS doesnot import data

County Sys(most useAVSS) (PC)

State AutomatedVital StatisticsSystem (AVSS)(Mumps)

CommunicableDisease Mgn Sys(Mumps)

No Ids, Weekly

Personal PC:data analysis

Confirmed and Unconfirmed TB Cases

TIMS(PC)

Confirmed CMRs with Ids sent up semiweekly.Hot cases are phoned in.

Lab Reports

State STDControl Branch

CDC TBEliminationBranch

HARSHIV-AIDS(PC)

County sends PH personnel out to reviewmedical records for AIDS cases.

For security, systemis stand alone. It isnot networked.

State TBControl

StateHARS

Sent to state at least monthly. Only counties (11) with highest volume of TBcases have TIMS system. Others send in hardcopy report.

Ids

File created yearly to see ifany TB patients have AIDS.Not networked. With newlegislation, this may not bepossible.

CDCHARS

Monthly via modem(encrypted?)

No Ids

This is a parallel system with the State system. The two dBs may have differentdata, since the state system does not weed out unconfirmed TB reports.4 page form. Form is

completed over abouta 6 month’s time.Portions sent in asthey are completed.

SAS data sets.Local network.No ids. Forepidemiologists.Use EPI/Info foranalysis.

RegionalField Office(PC)

Some counties send hcCMR directly to state

Extended data (e.g.immunization data)

Comm DiseaseMaster Data Set

CDCWeb Publication ofStatic Data for counties

Providers, HMOs, Hospitals, Physicians, ClinicsLabs

TyphoidCarrier

FoodBorneOutbreak

Paper copies reviewed and entered

Counties not using AVSS transmit their CMRs here

Hardcopy TIMS reportsfrom counties

( LA uses a separate dB for pendingconfirmations is available)

Counties don’t report these?

Focus is Syphilisand Chanroid

Syphilis and Chancroid Cases reported here Weekly

Some counties report other STDs here

Syphilis &Chancroid,other STDcounts

Data is encrypted on a disketteand sent via Federal Express ona monthly basis.

SyphilisandChancroidCases

No Ids

Some counties send STD reports to bothAVSS and Regional Field Office.

Data is encrypted on a diskette and sent viaFederal Express to state on a monthly basis.

Ids

web-based public health reporting in california: a ......report objectives this report addresses the...

Documents