*Funded by the European Commission GDPR Compliance and The - - PowerPoint PPT Presentation

*Funded by the European Commission

GDPR Compliance and The International Patient Summary

An IPS Workshop

Brussels, 13th September 2018

GDPR Compliance and The International Patient Summary

Introduction and Welcome

Stephen Kay Vice Chair of CEN/TC 251 CEN IPS Project Team Leader

“In order to further the care for citizens across the globe, collaborate on a single, common International Patient Summary (IPS) specification that is readily usable by all clinicians for the (cross-border) unscheduled care of a patient.”

The Shared Vision

6

November, 2016. OSLO

Management of expectations…

• Why are you here?
• What do you want to achieve?
• Write a sentence or two…
• Share?
• Evaluate what you have got from this

workshop…

TC 251 The International Patient Summary 7

Objectives of this IPS workshop

• To understand what GDPR Compliance means

for the International Patient Summary (IPS), its Implementation,

– both now and in the future, – in Europe and beyond.

• To inform extended forms of Patient Summary
• To make specific recommendations, to ensure

the best possible implementation guidance for IPS (TS 17288) in Europe

International Patient Summary (IPS) Workshop,

Agenda

1. Introduction and Welcome - Stephen Kay, CEN IPS Project Team Leader 2. Some Context (10-minute presentations)

a.

GDPR: Present State - Matthias Pocs, Convenor of CEN/TC251-WG1 b. Status of the IPS standards - Giorgio Cangioli, HL7 International c. HL7 GDPR on FHIR - Alexander Mense, HL7 (Austria) d. Sharing clinical documents - Stéphane Spahni, HUG & IHE-Europe co-chair e. H2020 SHiELD overview - Ed Conley, AIMES

>> LUNCH 12:00-13:00 << 3. Workshop practical, facilitated group discussion, and review of outputs:

• The IPS Use Case and IPS scenarios
• the application of the SHiELD method Use cases to support GDPR

Compliance

Stakeholder Influences

TC 251 The International Patient Summary 10

Stakeholder Awareness

TC 251 The International Patient Summary 11

Complexity if not Chaos

• Multiple things going on simultaneously

– Some may be divisive; some may be duplicative; some complementary; – Each with their own motivation, pressure, timings – Some totally unaware of what others are doing – Multiple endeavours in different implementations – multiple horizon scans and even current landscapes… – Ignorance is bliss…but not for the real consumer…oblivious and oblivion

TC 251 The International Patient Summary 12

Impossible? Patient Summary

• National initiatives
• Different starting points
• Changing landscape
• Consider multiple EC projects in parallel
• Deployments
• Change in policies
• General exchange formats
• Terminology wars
• …
• Joint Initiative Council (JIC)
• CEN and HL7
• GDPR…
• Research and service needs… PH34.. H2020..

TC 251 The International Patient Summary 13

A Quote from <<…>>

“I don’t envy you… Its like trying to change a tyre on a speeding vehicle!”

TC 251 The International Patient Summary 14

International Patient Summary

TC 251 The International Patient Summary 15

https://www.youtube.com/watch?v=KPJXSGbfNkI

TC 251 The International Patient Summary 17

Context Sessions

GDPR: Present State - Matthias Pocs Status of the IPS standards - Giorgio Cangioli HL7 GDPR on FHIR - Alexander Mense Sharing clinical documents - Stéphane Spahni H2020 SHiELD overview - Ed Conley

3/16/2017 TC 251 The International Patient Summary 18

ReEIF Arrow # Stakeholders Meaning Governance 1 SDO Design and Maintenance Data Protection (DP); Privacy and Security 2 SDO, Citizen Provenance, fairness, transparency 3 Implementers, Healthcare providers Assess risks, accountability, Data Protection by Design and by Default Legal and Regulatory 4 Government, Regulators X-border health data, DP harmonisation and Enforcement Policy 5 Policy makers Selection, formalisation and sharing Care Process 6 SDO Clinical and Citizen drivers; Trustworthy 7 Healthcare providers Use, validation Information 8 SDO, Implementers Models and terminologies 9 SDO, Implementers Models and exchange formats Applications 10 Implementers Implementation considerations Infrastructure N/A

• Standards, Profiles,

and Evaluation 11 SDO Feedback and sustainability 12 Citizens, Healthcare-providers Validation and Value

Implementors SDOs Governments Policy-makers Healthcare-Providers Citizens Regulators SDOs Implementors Healthcare- Providers Citizens Regulators IPS Dataset Specification and IPS Value Sets (Product view) IPS Creation and IPS Exchange (Process view) ReEIF Considerations

Governance Data Protection; Privacy and Security Legal and Regulatory Policy Care Process Information Applications Infrastructure N/A Standards, Profiles, and Evaluation

1 1 2 3 4 4 5 6 7 8 9 10 11 12

TC 251 The International Patient Summary 21

TC 251 The International Patient Summary 22

IPS Scenario Commentary (1)

• An explicit, initial requirement for developing the IPS was

to enable citizens of one country to receive relevant treatment for their unplanned health need in another country.

• Soft-box 1 (SB1) stars ‘adult’, ‘health need’ and ‘foreign

country’ for the reader’s attention. First, ‘adult’ is highlighted because the starting dataset assumes that the ‘subject of care’ in question is an adult staying in a foreign country either for business or leisure; if the citizen is a child, it maybe that additional data might be required in a patient summary (for example, legal guardian details and the person’s date of birth are already in the eHN dataset but data such as Apgar scores are not).

TC 251 The International Patient Summary 23

IPS Scenario Commentary (2)

• Second, the ‘health need’ is, as yet, unspecified; it may or may not

relate to a chronic health condition, but the eHN dataset, the starting requirement for this standard, is intended to be “minimal and non-exhaustive” implying that the data elements are valid as a core set applicable to any health condition, perhaps with the expectation that other data could be added as required.

• The fact that it is a ‘health need’ should not prevent a summary

from expressing social, mental and spiritual conditions (the 1948 WHO definition of health is very inclusive); that having been said, the data elements comprising the current IPS dataset major on the healthcare aspects of well-being and would have to be substantively extended and revised to provide adequate coverage for the core parts of a more inclusive summary.

TC 251 The International Patient Summary 24

IPS Scenario Commentary (3)

• Third, ‘foreign country’ is starred, because although ‘cross-border’

was the impetus for establishing the eHN dataset, the experience of the epSOS project showed that the value of the patient summary is much greater at a national and local level.

• Indeed, a cross-border application is probably non-viable without

the buy-in of more localised benefits (see “Attitudes towards the impact of

digitisation and automation on daily life”, Eurobarometer 460, May 2017).

• The cross-border concept then is best considered as a specialised

case, perhaps a more difficult one, of cross-boundary problems, which include jurisdictional as well as professional and

• rganisational boundaries. The IPS must deliver value to national

and local healthcare parties as well as regional and international

• nes.

TC 251 The International Patient Summary 25

IPS Scenario Commentary (4)

• Soft-box 2 (SB2) ‘demand for care’ is specialized by ‘demand for initial contact’

(not shown), which results in a ‘contact’ (SB3) that is ‘unplanned’ (SB4). The eHN Guidelines indicates that this particular circumstance shows the most value/benefit for having the patient summary available at the point of care.

• Soft-box 4 (SB4) an unexpected health need, does not limit the contact to an
• emergency. Indeed, emergency care is a specialty in its own right, often with its
• wn dataset requirements, and the time-frame and context of an emergency may

actually negate realistic access to the IPS unless it is held by the patient or their legal guardian and is directly available at the point of care. Note too that the IPS dataset is intended to be useful for ‘planned contacts’ too, albeit that the ‘unplanned care’ is the emphasis of the eHN Guideline. ‘Scheduled’ and ‘Unscheduled’ types of care are often used in the eHN Guidelines as synonyms for ‘planned’ and ‘unplanned’ care respectively.

• The 2nd revision of the eHN Guidelines uses the term ‘unscheduled’, rather than

‘unplanned’, which has more of an organisational connotation. Even so, it is the unexpected and urgent nature of the health need event that finds the healthcare provider unprepared, often with no prior record of the person to be treated.

TC 251 The International Patient Summary 26

IPS Scenario Commentary (5)

• Soft-box 5 (SB5): the starred SB5 assumes that

this ‘unplanned contact’ is the first of its kind and so no previous record exists in the local site; it is, however, conceivable that the person is a returning patient and the subsequent request in SB6 is to provide a more recent patient summary. The ‘Healthcare Provider’, either the Healthcare Professional (HCP) or the organisation, require an ‘electronic patient summary’ at the very least to

• ffer the appropriate response.

TC 251 The International Patient Summary 27

IPS Scenario Commentary (6)

• Soft-box 6 (SB6): the person’s summary is the result from a ‘health

information request. Patient summary is starred in SB6 for two reasons.

1. The first reason is the IPS scenario makes no explicit reference to technical implementation matters, such as federation where multiple fragments or entire patient summaries exist on different systems across different organisations brought together as one document in response to the request. The IPS scenario assumes a patient summary will be available without saying how. 2. The second reason highlights the fact that the request made is explicitly for an extract of the EHR rather than the whole record. The implication is that a patient summary is easier to share, manage and assimilate than a more complex and comprehensive EHR, given that (a) time is at a premium, (b) a degree of urgency exists, and (c) a hoped-for possibility that only the most relevant parts of the person’s history comprise the ‘health record extract’; one that is both concise and understandable.

TC 251 The International Patient Summary 28

IPS Scenario Commentary (7)

• Soft-box 7 (SB7) assumes that this could be a first contact. In which

case, the IPS has to be available at the ‘point of care’. The received IPS may form a new, minimal EHR within the local system. Conversely a ‘planned’ contact or a repeated contact may require the new summary to be integrated (possibly updating the previous

• ne if existing and legitimately/legally allowed) rather than just

stored within the local system. The import process of IPS data is not a part of this standard.

• Designation as a child will have significance with respect to usage,

legal and otherwise, depending on jurisdiction; this will be addressed in the accompanying implementation guidance.

• ‘Demand for initial contact’ and ‘initial contact’ concepts are

important but represent only a part of the IPS Scope, which includes the possibilities of ‘further’ contacts.

TC 251 The International Patient Summary 29

The IPS Use Case, 4 Scenarios, and the Subject of Care

• Original UC was scoped to address a single,

primary scenario, i.e., to exchange a Patient Summary cross-border for unscheduled care (of a visitor).

• IPS Scenario 1: Cross-Border, Unscheduled care
• IPS Scenario 2: Local, Unscheduled care
• IPS Scenario 3: Cross-border, Scheduled care
• IPS Scenario 4: Local, Scheduled care
• SoC assumed to be adult, on Business/for

pleasure

TC 251 The International Patient Summary 30

Things to ponder….

– LIST all the GDPR targets…but is the PS a target… it is a communication, remember blockchain … think about anonymity… about deletionless records… about rbac – Is IPS a repository persistent thingy… is it not a conversation privileged, ethemeral, and speicifc instant/snapshot and then what… instant delete…value in keeping it… controllers/processors/links

• Compare SHiELD use case with IPS use case… are there any substantive

differences… if not is there a case for reuse (and application of lessons learnt… is there a need for a watching brief across all the European initiatives and the national ones to ensure productive serendipity…. more bliss!)

• Why now… 17269 is an intentionally abstract document roaming around the

stratosphere… permitting flexibility…independent of a particular implementation…but the current TS is intended to be a way to instantiate the abstracty into a concrete implementation

• Should we list the very minimal mandatory IPS…and see if GDPR has anything to

say on that and then extend it…

TC 251 The International Patient Summary 35

CEN IPS project overview

• Officially started on May 2016
• February 2017 : Launched new Work Items

proposals for EN and TS ballot.

prEN: The International Patient Summary for Unscheduled, Cross-border Care prTS: The International Patient Summary: Guidance for European Implementation

CEN IPS Current State of Deliverables

• February 2018:

– Submitted prEN 17269 for enquiry ballot – Multiple translations before ballot/critique – Ballot initiated end of July, 2018

• June 2018

– Submit prTS 17288 to CEN TC – Gain feedback, edit & submit July – for ballot in December – Ensure consistency between the two – and intention to publish in Q1 of 2019