HCQ PMEDICARE’S HEALTH CARE QUALITY IMPROVEMENT PROGRAMMEDICARE’S HEALTH CARE QUALITY IMPROVEMENT PROGRAM

QualityNet ExchangeQualityNet Exchange

Dennis StrickerDirector, Information Systems GroupOffice of Clinical Standards and QualityCenters for Medicare & Medicaid Services

HCQ PMEDICARE’S HEALTH CARE QUALITY IMPROVEMENT PROGRAMMEDICARE’S HEALTH CARE QUALITY IMPROVEMENT PROGRAM

Quality Improvement OrganizationsQuality Improvement Organizations

• 53 Contractors for quality improvement for Medicare program

• Multiple parties and settings involved

• Privacy data extensively used

HCQ PMEDICARE’S HEALTH CARE QUALITY IMPROVEMENT PROGRAMMEDICARE’S HEALTH CARE QUALITY IMPROVEMENT PROGRAM

End Stage Renal Disease NetworksEnd Stage Renal Disease Networks

• Only disease-specific way to become a Medicare beneficiary

• Three separate (soon consolidated into one) systems determine Medicare eligibility

• Privacy data historically collected via paper forms

HCQ PMEDICARE’S HEALTH CARE QUALITY IMPROVEMENT PROGRAMMEDICARE’S HEALTH CARE QUALITY IMPROVEMENT PROGRAM

QIOs/ESRDs - Business NeedQIOs/ESRDs - Business Need

• Improve service to customers

• Streamline business processes

• Standardize data collection and information sharing across 50 States, DC, PR and VI

• Adhere to Congressional Mandates– GPEA– HIPAA

HCQ PMEDICARE’S HEALTH CARE QUALITY IMPROVEMENT PROGRAMMEDICARE’S HEALTH CARE QUALITY IMPROVEMENT PROGRAM

QIOs/ESRDs - ChallengesQIOs/ESRDs - Challenges

• Implement an “end-to-end” trust model that scales across the country

• Authenticate users in a G to B environment

• Collect and securely transmit and store clinical & privacy data over the internet

• Limit access to data based on “need-to-know”

• Auditing that involves users and administrators

HCQ PMEDICARE’S HEALTH CARE QUALITY IMPROVEMENT PROGRAMMEDICARE’S HEALTH CARE QUALITY IMPROVEMENT PROGRAM

QIOs/ESRDs - Program ObjectivesQIOs/ESRDs - Program Objectives

• Identification – Ensure user is who they say they are

• Authentication – Ensure user is authorized to use system

• Access Control – Limit access to data based on “need-to-know”

HCQ PMEDICARE’S HEALTH CARE QUALITY IMPROVEMENT PROGRAMMEDICARE’S HEALTH CARE QUALITY IMPROVEMENT PROGRAM

QIOs/ESRDs – Technologies UsedQIOs/ESRDs – Technologies Used

• PKI (Public Key Infrastructure) – Identity authentication and digital signatures

• Portals - Personalized for each user based on user role

• CKM® (Constructive Key Management®) – Confidentiality, tokens, credentials, and role-based access control to data using encryption

HCQ PMEDICARE’S HEALTH CARE QUALITY IMPROVEMENT PROGRAMMEDICARE’S HEALTH CARE QUALITY IMPROVEMENT PROGRAM

PKI,CKM, Oracle and Notary PKI,CKM, Oracle and Notary ProofingProofing

• CMS, through contractor support, provides Notary in-person-proofing at the customer level

• CKM has been integrated into the QualityNet web applications for role-based authorization and protection of data in transit and at rest

• Oracle database rules along with CKM credentials (roles) are used to enforce confidentiality and “need-to-know” access

HCQ PMEDICARE’S HEALTH CARE QUALITY IMPROVEMENT PROGRAMMEDICARE’S HEALTH CARE QUALITY IMPROVEMENT PROGRAM

QIOs/ESRDs - BenefitsQIOs/ESRDs - Benefits

• Real Time Reporting

• Faster access to better information

• Eliminate/reduce paper forms

• Facilitate quality improvement at the provider level

• Protection of data in transit and at rest

• Access control to data based on “need-to-know”

• Digital Signatures

HCQ PMEDICARE’S HEALTH CARE QUALITY IMPROVEMENT PROGRAMMEDICARE’S HEALTH CARE QUALITY IMPROVEMENT PROGRAM

Security Features-Security Features- Identifying Users Identifying Users

• Digital Certificate –

• Identity authentication

• Digital signatures

• Bi-directional SSL connection

• User Token

• Tiny, safeguarded file

• Password protected

• User information – Credentials, Roles

• Store the digital certificate

HCQ PMEDICARE’S HEALTH CARE QUALITY IMPROVEMENT PROGRAMMEDICARE’S HEALTH CARE QUALITY IMPROVEMENT PROGRAM

Registration to QualityNet ExchangeRegistration to QualityNet Exchange

• Registration to QualityNet Exchange site where designated administrators use digital certificates to sign-off on users for access and roles

• Users receive a CKM token, digital certificate, CKM encryption access role, and database role

Current process : :

HCQ PMEDICARE’S HEALTH CARE QUALITY IMPROVEMENT PROGRAMMEDICARE’S HEALTH CARE QUALITY IMPROVEMENT PROGRAM

Authentication to QualityNet Authentication to QualityNet Exchange Exchange

• Users must have these components for authentication to QualityNet Exchange– x509 certificate for bi-directional

(verification of user and web server) 128 bit SSL to QualityNet Exchange

– Pass the Certification Revocation List (CRL)– CKM token– QualityNet Exchange Database ID

• Users login into QualityNet Exchange web application that seamlessly verifies all security components through a single sign-on

HCQ PMEDICARE’S HEALTH CARE QUALITY IMPROVEMENT PROGRAMMEDICARE’S HEALTH CARE QUALITY IMPROVEMENT PROGRAM

Auditing QualityNet Exchange Auditing QualityNet Exchange • Logging of all user activities• Everyone is part of auditing the system• Auditing reports filtered by:

– Individuals can track what they have done

– Designated QualityNet security administrators can track activity of their users

– CMS and the CMS contractor can track user activity across QualityNet Exchange

Clinical Warehouse - Data FlowClinical Warehouse - Data Flow

ProvidersProviders CDACsCDACsQIOsQIOs

QIO Clinical QIO Clinical WarehouseWarehouse

VendorsVendors

DataData

Clinical Warehouse - Data FlowClinical Warehouse - Data Flow

ProvidersProviders

QIOsQIOs CMSCMS

QIO Clinical QIO Clinical WarehouseWarehouse

•Clinical indicatorsClinical indicators

•Provider specificProvider specific

•State aggregatesState aggregates

•Quality Quality improvement improvement

reportsreports

•Aggregate reportsAggregate reports

•State & national State & national indicatorsindicators

•Comparisons to Comparisons to state and national state and national

normsnorms

•Immediate Immediate feedback reportsfeedback reports

InformationInformation

InformationInformation InformationInformation

HCQ PMEDICARE’S HEALTH CARE QUALITY IMPROVEMENT PROGRAMMEDICARE’S HEALTH CARE QUALITY IMPROVEMENT PROGRAM

ESRDFacility

CROWN OverviewCROWN OverviewSSA

ESRDNetwork

QualityNeteXchange

Secure WebUpload &Download

(soft tokens withencryption key&

digital certificates)

CMS

HL7XMLHL7XML

Init

ial

Da

tab

as

e S

etu

p

Pa

tie

nt

Tra

ns

fer

Co

rre

cti

on

s /

Up

da

tes

Beneficiary Demographics+ Part A Enrollment

ESRD coverage Periods

Export

Import

Extract

ExportImport

Load

Replicate

Report

FileExchange

Legacy Migration

Fe

ed

ba

ck

/ S

tatu

s

PaperForms

Transplant Event& follow up data

Deaths, transplant failures,

missing transplants

Claims Data

View

File Exchange

Feedback /AccretionsC onsolidated

R enal

O perations

W eb-enabled

N etwork

Internet

HCQ PMEDICARE’S HEALTH CARE QUALITY IMPROVEMENT PROGRAMMEDICARE’S HEALTH CARE QUALITY IMPROVEMENT PROGRAM

Data CollectionData Collection

• Abstraction tools

• File import according to specifications

HCQ PMEDICARE’S HEALTH CARE QUALITY IMPROVEMENT PROGRAMMEDICARE’S HEALTH CARE QUALITY IMPROVEMENT PROGRAM

Functionality - File ExchangeFunctionality - File Exchange

• Secure distribution channel for any file

• Safe transfer of confidential or private data

• Encryption is transparent to users

• Files are encrypted at rest and in transit

• Monitoring activity in real-time by user (who, what, when and how often)

HCQ PMEDICARE’S HEALTH CARE QUALITY IMPROVEMENT PROGRAMMEDICARE’S HEALTH CARE QUALITY IMPROVEMENT PROGRAM

Information Dissemination Information Dissemination

• Immediate feedback reports

• Aggregate data reports

• Aggregate reports posted by QIOs

• Quality improvement progress by providers

HCQ PMEDICARE’S HEALTH CARE QUALITY IMPROVEMENT PROGRAMMEDICARE’S HEALTH CARE QUALITY IMPROVEMENT PROGRAM

Users View Users View

HCQ PMEDICARE’S HEALTH CARE QUALITY IMPROVEMENT PROGRAMMEDICARE’S HEALTH CARE QUALITY IMPROVEMENT PROGRAM

Users View Users View

HCQ PMEDICARE’S HEALTH CARE QUALITY IMPROVEMENT PROGRAMMEDICARE’S HEALTH CARE QUALITY IMPROVEMENT PROGRAM

Users View Users View

HCQ PMEDICARE’S HEALTH CARE QUALITY IMPROVEMENT PROGRAMMEDICARE’S HEALTH CARE QUALITY IMPROVEMENT PROGRAM

Users View Users View

HCQ PMEDICARE’S HEALTH CARE QUALITY IMPROVEMENT PROGRAMMEDICARE’S HEALTH CARE QUALITY IMPROVEMENT PROGRAM

Users View Users View

HCQ PMEDICARE’S HEALTH CARE QUALITY IMPROVEMENT PROGRAMMEDICARE’S HEALTH CARE QUALITY IMPROVEMENT PROGRAM

Users View Users View