Wednesday, February 1, 2012

As Massachusetts prepares a Request for Response (RFR)  to procure healthcare information exchange infrastructure and applications,  many stakeholders have been hard at work documenting requirements.

The Provider Directory and Public Key infrastructure are some of the hardest specifications to write since they have not yet been widely deployed for healthcare information exchange anywhere in the country.

The leaders of the Massachusetts HIE effort have held 3 major vendor and user forums over the past month and have been told that no vendor has a standards-based provider directory in production at any customer site.

Here's our best thinking about Provider Directory and Public Key infrastructure services.

Provider Directory
The Directory will have a schema within a relational database that enables lookup of entities, which could include a person (John Halamka),  an organization (BIDMC), a department (The BIDMC Department of Emergency Medicine), a state entity (Massachusetts Department of Public Health),   a payer (Blue Cross Blue Shield of Massachusetts), a vendor (The Massachusetts eHealth Collaborative Quality Data Center), or a PHR infrastructure trusted by the HIE (Microsoft Healthvault).     There will be two ways to query this database - Lightweight Directory Access Protocol (LDAP) for  use within the Massachusetts state government firewall and SOAP-based web service APIs for all users external to the firewall.   The response to a query will include the node name for communication to the entity i.e. John Halamka will not have a node, but the BIDMC Department of Emergency Medicine or BIDMC could.   Digital certificates are not stored in the Provider Directory.

Public Key Infrastructure
Certificates will be issued by a single Certificate Authority and will be stored in one of many Domain Naming System (DNS) services capable of supporting certificate queries such as BIND or Microsoft's special implementation of DNS created for the Direct Project (http://directproject.org/).    For example, BIDMC could offer a DNS service called Direct.bidmc.org which hosts the public keys for all our nodes.

Here's how it would be used.  An EHR would look up an entity in the Provider Directory and then use DNS services to retrieve the certificate for the entity's node.

We're also considering an alternative approach using the open source tools available in the Direct Project's Reference Implementation.   These tools include administrative tools to store and manage certificates and an adapter that links the directory store to a DNS responder.    Participants could upload their certificates to this centralized data store.  For example:

DNS Responder <--DNS Web Services--> Direct Reference Implementation Web Services <--BIDMC adaptor--> BIDMC datastore

The vendor community has told us that they want a single simple directory and public key infrastructure specification they can implement one time for an entire state.   We'll give that to them and I'll write about their responses in future posts.

Related Posts:

  • What is Compassionate Comfort Care?Over the past 24 hours, my family and the hospital care team have been guided by my father's healthcare proxy to avoid painful, invasive, or aggressive care at time when his multiple medical issues have combined to make his h… Read More
  • Building Unity Farm - Planting the Orchard As Spring approaches, Kathy and I are diligently planning the fruits and vegetables of Unity farm. Our first year on the farm was about creating infrastructure and building the animal herds. Our second year will be about expa… Read More
  • Celebrating my Father's LifeAs I sit at my father's bedside, managing the increasing heaviness of his breathing, I'm doing my best to keep his lips moist, his extremities warm, and the dosing of his comfort care medications appropriate so there is no ai… Read More
  • Serving as Healthcare Navigator for my Father On Friday at noon, I received a call from my father's cardiologist that I should fly to Los Angeles urgently - "your father has had his third heart attack, his heart is pumping at half its usual volume, and the combination of… Read More
  • Use of HIE Fully Integrated into the EHRNote - while I was flying to Los Angeles to be with my father, I wrote the Tuesday-Thursday blog posts which will be automatically published this week.    I'm focused on his care now and will return to writing in re… Read More

0 comments:

Post a Comment

Powered by Blogger.

Popular Posts

Blog Archive