My HealtheVet_Secure Messaging Policy Decisions_ VHA eHealth by pptfiles


									My HealtheVet/Secure Messaging
        Policy Decisions
        Christine Erickson, M.D.
          Lois Hooper, RHIT
            August 11, 2010
              Class # 106
         What We’ll Cover
• Who

• What

• Why
What the Personal Health Record Is

• The Personal Health Record is a record of
  patient sourced and authoritative source
• My HealtheVet is the name of the Department
  of Veterans Affairs personal health record.
   – Allows Veterans to enter personal health
     information (blood pressure, blood sugars,
     weights, etc)
   – Offers Veterans the ability to communicate
     with their health care team (limited
     availability at this time)
   – Offers Veterans the ability to view portions
     of their health record (coming soon)

• Those involved in Personal Health
  Record (PHR) policy:
  – Includes business policy for My
    HealtheVet (My HealtheVet)
  – Wide range of representation
  – Clinical and business mix
• Members represent various groups and
  –   Privacy
  –   Security
  –   My HealtheVet
  –   Identity Management
  –   Data Quality
  –   Patient Safety
  –   Clinical Subject Matter Experts
  –   Department of Defense
  –   Health Information Management
• Subgroup of the Clinical Advisory
• PHR policy group recommends policy
  regarding My HealtheVet
• Develops overarching policy
• Identifies accompanying technical
      What (We Have Done to
•   In-Person Authentication
•   System of Records
•   Information Sensitive to the Veteran
•   Delegation
•   Account Deactivation
•   Secure Messaging
   In-Person Authentication
• Identity of Veteran requesting access
  to information must be assured to
  protect privacy
• Access to enhanced benefits of My
  HealtheVet available to authenticated
• Current process requires Veterans to
  present in person
   In-Person Authentication
• Authentication requirements; Veteran
  – View required video
  – Present in-person
  – Show a valid government issued photo
  – Sign VA form 10-5345a-My HealtheVet
   In-Person Authentication
• As more information and applications
  are available more Veterans will
  request In-Person Authentication (IPA)
• IPA should be done in coordination
  with Health Information Management
• Veteran should be able to authenticate
  where he or she receives services
• Legal Guardian or Power of Attorney
  who has medical decision making
  authority may authenticate in lieu of
  the Veteran
    Alternatives to In-Person

• New service request entered for
  virtual identity proofing
• Business requirements documentation
• Awaiting technical feasibility
    In-Person Authentication
• To resolve Master Patient Index (MPI)
  or duplicate record issues
  – Think locally
  – Contact your local MPI coordinator
  – Try to resolve the issue as quickly as
  – If unable to resolve contact the My
    HealtheVet Help Desk
       In-Person Authentication

• Make sure Veteran has selected VA
  patient in their My HealtheVet account
• Veteran must be matched to the MPI
  –   Social Security Number
  –   Name
  –   Date of Birth
  –   Gender
    In-Person Authentication
• Causes of MPI mismatch
  – Social Security Number has typos or
    numbers are transposed
  – Name:
    • Is not spelled correctly
    • Does not contain all name components
    • Name components are located in the wrong
  – Date of birth has typos, is transposed, or
    not complete
  – Gender is entered incorrectly
    In-Person Authentication

• Duplicate records in the MPI
  – If the MPI has more than one record for a
    single patient, the records are considered
  – Duplicate records cause a Duplicate Entry
    in Patient Registry Error and will prevent a
    patient from being authenticated for a My
    HealtheVet account
          System of Records
• The My HealtheVet system of records (SOR)
  130VA19 did not:
  – Meet current needs for routine use
  – Accurately describe all records held within My
• Personal Health Record policy group formed
  subgroup to review and update SOR including
  representatives from:
  –   My HealtheVet
  –   Office of General Counsel
  –   Privacy
  –   Records management
  –   HIM
1. Is the information stored in the
   personal health record considered a
   VA record?

2.    Who does the information belong

3. Is any My HealtheVet information
   considered part of 24VA19?

1. Information contained solely in My HealtheVet is NOT
   considered a Veteran’s administration record.
2. A Veteran’s self-entered information belongs to the
   - It is not entered into the clinical record unless at the Veteran’s
   - It is not considered part of a system of records.
3. Secure Messaging, while generated in the My
   HealtheVet portal, includes clinical information and is
   stored in patient medical records 24VA19.
   - Other applications of My HealtheVet such as eBenefits
       applications, allow communication with other government
   - Information is stored and maintained in the receiving application.
   Information Sensitive to the
• My HealtheVet must have functionality
  to meet statutory regulation contained
  in 38. U.S.C. 5701
• Prior to release to the Veteran via My
  HealtheVet there must be the ability to
  ensure that no health information is
  released that may be considered
  “injurious to the physical or mental
  health of the Veteran”
   Information Sensitive to the
• VHA policy defines all mental health
  information as meeting the minimal
  criteria of information sensitive to the
  Veteran per VHA handbook 1605.1
• Clinician must make final decision
   Information Sensitive to the
• Recommendation: check box contained
  within the signature area
  – Only information that is NOT to be
    downloaded to My HealtheVet would be
  – Provider would be responsible for making
    final determination
• Information from the date of
  implementation forward will be
  released unless otherwise specified
   Information Sensitive to the
• If provider checks information not to
  be downloaded, Veteran receives a
  notice to contact local Release of
  Information office
• Option for provider to check all
  previous information may be released
  via My HealtheVet
• New Service Request entered in May
                  Delegation *
1. Veterans want to share information in
   their PHR with others of their
• Veteran has control over own PHR
• Policies and processes must exist to
  help Veteran safeguard and control
• Delegation offers the Veteran the
  ability to share information without
  compromising his or her own username
  or password

• *Feature not yet widely available
• Delegate accounts offer the ability for
  patients to share their health information
• Delegate has own access to Veteran PHR,
  with own username and password
• Delegates may be health care providers,
  caregivers, relatives, or any person of the
  Veteran’s choosing
• Veteran can revoke delegation at any
• Veteran renews delegation authority
  yearly but may also specify time limits
  on delegation
• Veteran has the ability to delegate
  access to all or portions of information
  contained in My HealtheVet
• One Delegate may enter information,
  communicate with providers via Secure
  Messaging and perform other functions
  on behalf of the Veteran
• Veteran account deactivation
  deactivates associated delegate access
• Delegates will receive notification if
  their account or the link to the Veteran
  account is deactivated
• The Veteran has the right to be fully
  informed of the implications of
  granting access to his/her personal
  health information
• All Veterans and Delegates shall
  receive education on how to use My
  HealtheVet and how to safeguard
  information privacy prior to obtaining
  access to My HealtheVet
• The Veteran has a right to review a
  log of account access
     Account Deactivation
• Ability to deactivate Veteran’s My
  HealtheVet account must exist
• Policy for deactivation must outline
  how and why
• Veteran must be fully informed of
  deactivation policy
• Corresponding technical solutions to
  implement policy
      Account Deactivation
• Policy outlines when and why accounts
  may be deactivated:
  – Breach of Security
  – Misuse of account features (i.e. diversion
    of medications, inappropriate use of
    secure messaging)
  – Death of the Veteran
  – Veteran’s request
  – Account inactivity for 2 or more years
      Account Deactivation
• Breach of Security: In the event of a
  security breach, procedures as defined
  in VHA Handbook 6500.2/1 appendix A
  will be followed
• Death of a user - official notification
  from Health Eligibility Center
• Two years of inactivity from either the
  Veteran or and delegates associated
  with the account
      Account Deactivation
• Veteran request
  – Veteran e-mails My HealtheVet help desk
    request to deactivate account
  – Confirmation e-mail sent to the User’s
    listed e-mail account associated with My
    HealtheVet with instructions on how to
    reactivate the account
  – Medium Term solution includes a drop
    down account deactivation box
        Secure Messaging
• Secure web-based message service
• Only approved method for secure
  patient- provider communication
• Only for non-urgent communication
• Integration with clinical workflow is
  critical to enable effective processes
        Secure Messaging
• Veterans can request appointments,
  prescription renewals, ask health or
  administrative questions, etc.
• Health care team responds within 3
  business days
• Veterans can receive notifications of
  new Secure Messages (SM) via email
• Veterans must be In-Person
  Authenticated (IPA) to participate
           Secure Messaging
User Types
  •   Veteran / Patient
  •   Consumer user
  •   Provider
  •   Physician, Nurse Practitioner, Physician Assistant
  •   Clinical Team Member
  •   Non-Provider clinical staff providing care in one form
      or another, e.g., Nurse, Medical Assistant,
      Pharmacist, etc.
  •   Triage Staff
  •   Administrative person whose responsibility is to
      initially read message, resolve message or triage to
      Clinical Team Member
  •   Administrator
  •   Secure Messaging administrator who manages access
      to the application for the above users
        Secure Messaging
• All messages stored in database
  outside of the Computerized Patient
  Record System (CPRS)
• Messages of clinical significance may
  be stored in CPRS as a Text
  Integration Utility Note
• Messages flow to CPRS as a signed
        Secure Messaging
• Default location is “other” or historical
• Must manually change to a count non-
  billable clinic
• Only 1 clinic set up for all notes
• Primary stop code is specific clinic
  such as primary care
• Secondary stop code is 719 to reflect
  Secure Message
• No ability to prompt for co-signers
        Secure Messaging
• Secure Messages saved in a count
  clinic must meet criteria for on-line
• Online evaluation may include
  – Review of health record and medication
  – Education or training based on review of
    health record and Veteran entered
  – Other care that does not require the
    Veteran to be physically present
        Secure Messaging
• Signed notes DO NOT prompt for entry of
  encounter information
• Provider must manually enter encounter
  form associated with SM clinic
• National Encounter form for SM available
• Many diagnosis codes, two Evaluation
  and Management codes
• High likelihood of incomplete encounters
• Monitoring of incomplete encounters
       Secure Messaging

• Cornerstone of Patient Centered Model
• MAY reduce low complexity office
• Convenient for Veteran and provider
• Veterans desire online access to their
  health care information and health care
• They want flexibility and access to
  care at their convenience
• Personal Health Records allow patients
  to actively participate in their
• Self Management skills are encouraged
  and may be enhanced
• PHR may also improve communication
  between patients and both VA and
  non-VA providers to enhance care
• PHR may improve access to care
  through secure messaging
• Helps form the support structure for
  the Patient Centered Medical Home
                       Patient Centered Medical Home

        Access                Care Management &            Practice Redesign
Offer same day              Focus on high-risk pts:     Redesign team:
appointments                      oIdentify                  oRoles
                                  oManage                    oTasks
Increase shared medical     Improve care for:           Enhance:
appointments                      oPrevention                oCommunication
                                  oChronic disease           oTeamwork
                            Improve transitions
                            between PCMH and:           Improve Processes:
Increase non-
                                  oInpatient                 oVisit work
appointment care
                                  oSpecialty                 oNon-visit work
                                  oBroader Team
                     Patient Centeredness: Mindset and Tools
                   Improvement: Systems Redesign, VA TAMMCS
                 Resources: Technology, Staff, Space, Community
• Policy must be in place to ensure
  patient safety and privacy
  – Provide protection from privacy and
    security breaches
  – Provide guidelines for user education
What (we’re working on now)

• Health Risk Assessment
  – Interface or push and pull of information
    to and from MHV and CPRS
• “Blue Button” project
  – Allows downloads of information in MHV
    to a CD, flash drive, desk top, etc.
          Future Issues

• Social Media and My HealtheVet
• Terms and Conditions
• Evolving Personal Health Record
  issues that have an impact on the
  Health Record, My HealtheVet, or the

To top