Department of Health and Human Services

NATIONAL COMMITTEE ON VITAL AND HEALTH STATISTICS

Subcommittee on Standards and Security

February 1-2, 2005

Hubert H. Humphrey Building, Room 705A
Washington, D.C.

Meeting Minutes

The National Committee on Vital and Health Statistics Subcommittee on Standards and Security was convened on February 1-2, 2005 at the Hubert H. Humphrey Building in Washington, D.C. The meeting was open to the public. Present:

Committee members

  • Simon P. Cohn, M.D., Chair
  • Jeffrey S. Blair, M.B.A., Vice Chair
  • Stan M. Huff, M.D. (via conference call on Day Two)
  • Harry Reynolds
  • Judith Warren, Ph.D., R.N.

Absent

Staff and Liaisons

  • Maria Friedman, D.B.A., CMS, Lead Staff
  • Suzie Burke-Beebe, ASPE
  • Jorge Ferrer, M.D., VA
  • J. Michael Fitzmaurice, Ph.D., AHRQ
  • Marjorie Greenberg, NCHS/CDC, Executive Secretary
  • Donna Pickett, NCHS/CDC
  • Helga Rippen, OS
  • Marietta Squire, NCHS/CDC
  • Steve Steindel, Ph.D., CDC liaison
  • Karen Trudel, CMS
  • Michelle Williamson, NCHS/CDC

Others

  • Margret Amatayakul, independent contractor
  • Eleni Anagnostiadis, NABP
  • Brian Bamberger, Medimedia Information Technologies
  • Michael Beebe, CBT
  • Thomas R. Bizzaro, First DataBank, Inc.
  • Holly Blodgett, Amisys Synertech, Inc.
  • Gary Beatty, EC Integrity, Inc.
  • Richard K. Brook, ProxyMed
  • Mark N. Brueckl, AMCP
  • Michael J. DeCarlo, BlueCross BlueShield Assn.
  • Lori Reed-Forquet, ASTM
  • Karen C. Eckert, Medi-Span of WoltersKluwer
  • Lynne Gilbertson, NCPDP
  • Jill G. Helm, Allscripts
  • Kelly L. Lavin, American Osteopathic Assn.
  • Gary S. Levine, Medco Health Solutions, Inc.
  • Marilyn Zigmund Luke, AHIP
  • Ross D. Martin, Pfizer
  • Mark Millikan, Medi-Span of WoltersKluwer
  • Tom Musco, HHS, ASPE
  • Michael R. Pollard, Medco Health Solutions, Inc.
  • Stuart Nelson, NLM
  • George Robinson, First DataBank
  • Phillip A. Rothermich, Express Scripts
  • Anthony J. Schueth, Point-of-Care Partners
  • Dana Sherwood, PCM
  • Mike Simco, Walgreens
  • Peter C. Sonnenreich, Kikaku America International
  • Laura E. Vartain, Wexler and Walker Public Policy Associates
  • Roger Vloway, RxPC
  • Ken Whittemore, Jr., SureScripts

EXECUTIVE SUMMARY

ACTIONS

No formal actions.

This 1½-day meeting was a working session comprised of presentations and work on a draft letter of recommendation for the Secretary about e-prescribing. Projected completion date of letter is projected for February 21, 2005.

All official NCVHS documents are posted on the NCVHS Website.

Presentation One Proposed E-Prescribing Standards Regulation Overview

Karen Trudel, CMS

The purpose and the context of the proposed e-prescribing standards regulation were presented. The NCVHS process, described in detail, shows a broad base of support for the new rule. The industry has been asked for feedback about an incremental strategy and about foundation standards that would be based upon pilot studies. The goal is to roll everything into a consolidated electronic health record that would be consistent with other initiatives within the Department. (See detailed summary or transcript for information about key components of the proposed standards regulation (such as transportability and interoperability) as well as definitions; the difference between formulary and benefit standards; timetable for a second set of standards; state pre-emption; NPI; use of internal transactions; and pilot testing)

Discussion

The Subcommittee was asked to develop a letter for the full Committee meeting in March 2005. Recommendations from the Subcommittee or full Committee will play into the pilot rather than the regulation process. Pilot participants are expected to have some applicability to the Part D benefit and therefore, in-patient hospitals would not be a target for pilots nor would acute care settings. Within a staff model HMO, the NCVHS has recommended that the internal prescriber, dispenser, and plan continue to use HL7 except when transmitting out of network, in which case the dispenser’s requirements would rule. Clarification was sought about dispensing prescriptions from a local pharmacy with a shift from in-patient to out-patient status or within multi-service organizations with acute, ambulatory, or home care within one organization. Rather than take a position on these matters, the regulation is requesting comment at this time. A suggestion was made for the Subcommittee to communicate their concerns to the Secretary.

Presentation Two Report on Industry E-Rx Work Groups and Best Practices

Lynne Gilbertson, NCPDP

The specifics of NCPDP’s status with regard to NCVHS’s recommendations to HHS about electronic prescribing for the MMA were presented, and in particular for Observation Three (prescription messages); Observation Four (coordination of prescription message standards); Observation Six (eligibility and benefits messages); Observation Seven (prior authorization messages); Observation Eight (medication history messages from payer/PBM to prescriber); Observation Nine (clinical drug terminology); Observation Ten (structured and codified SIG); Observation 13 (pilot test objectives) [see detailed summary or transcript for specifics]

Discussion

“Inferring pick-up” pertains to guidance that ensures that a pharmacy or prescriber does not infer. The point is to present different aspects of what happens when partners are only enabled in certain functions. What, then, are the repercussions of choices that support only some functionality? One big concern centers on an inability to guarantee that a patient takes medication that has been acquired. To complicate matters, some pharmacies might get a fill status back when patients pick up medication (or they might get a negative fill status if medication was not acquired) while other pharmacies aren’t yet able to do so.

NCPDP supports multiple drug identifiers, particularly because drug files contain utilization review information and interactions that RxNorm does not cover (RxNorm would be added for mapping purposes). The cumbersome nature of moving from the pharmacy to the physician was discussed, noting that the pharmacy might be relieved if the physician could deal directly with payers. A strong goal for all would be interoperability rather than interface.

Formulary and medication history standards have not changed significantly but medication history (currently under ballot, to be adjudicated in March 2005) might get modified. Formulary and benefit standards will be discussed in March 2005 and balloted in May 2005. Post balloting, the industry is invited to comment on these foundation standards. The documents may be recirculated to address negative comments; and approval by NCPDP’s board will follow.

An information matrix and roadmap will be developed to help plan for the pilot tests (see transcript for details). It was noted that the Subcommittee’s recommendation letter of September 2004 stated that the group would provide additional guidance on foundation standards and pilot tests.

Ken Whittemore, Jr., SureScripts

Created as an educational effort rather than to create a standard, the challenge of the NCPDP Workgroup 11/12 Joint Task Group working on electronic signature for use in e-prescribing is to clarify best practices in electronic signatures. At present, the Task Group does not have much to offer but an NCPDP diagram has captured much of what is being done in the field. It would be useful to learn what the industry thinks is state-of-the-art as well as about security regulations and what it can or wants to do. Authentication and non-repudiation are key concerns to be evaluated.

Karen Trudel, CMS

Because signing contracts and cooperative agreements involve federal rules, CMS is not able to work proactively with groups to develop these roadmaps. Meeting participants were encouraged convey their thoughts to Ms. Friedman about the content and structure of the pilots; standards to be tested; evaluation; and critical success factors. Ms. Friedman asked that feedback come quickly (by March 1st or sooner) to enable consideration before completion of the RFP, which they hope to distribute soon (due to a January 1, 2006 start date).

Presentation Three State Issues Related to E-Prescribing of Controlled Substances

Eleni Anagnostiadis, NAPB

NAPB and the State Boards of Pharmacy recognize the importance of creating a regulatory environment that facilitates and regulates electronic transmission of prescriptions for controlled and non-controlled substances in the interest of patient safety. Regulations about controlled substances rely significantly on the regulations and policies of the Drug Enforcement Administration (DEA). Focusing on state issues, the primary concern about electronic transmission is the need for assurance that all prescriptions are authenticated, legitimate, and have integrity. The complimentary and sometimes conflicting relationship of state and federal laws highlights the importance of defining federal requirements and DEA policy for electronic transmission and prescribing. The results of a DEA-authorized pilot project at the Hines VA Hospital will evaluate the effectiveness and security of transmitting controlled substances in order to help the DEA develop and release requirements for the electronic transmission of controlled substances. These requirements are critical to state actions and NCVHS recommendations because states defer to the DEA and CSA for guidance. [See detailed summary or transcript for specific NABP recommendations)

Only three of fifteen regulations ([1] where an oral prescription is not permitted [CII]; [2] under Schedule II Substances; and [3] under Schedule III – V Substances) will be impacted by electronic transmission that the DEA must address. Absent from current DEA regulations and requirements, the use of electronic or digital signatures will become a primary focus of DEA regulations. Ultimately, authority for electronic transmission and prescribing for controlled substances will rest with State Boards of Pharmacy or similarly charged agencies. (See detailed summary or transcript for further detail and for information about state-specified Controlled Substance Act]

Discussion

No one in the room was certain about whether DEA approval would be required for the pilot tests. Final standards should incorporate DEA requirements for electronic transmission of controlled substances. From a state law perspective, e-prescribing is in “pretty good shape.” The DEA is an “irritant” but one that should not hold states back from e-prescribing.

Controlled substances are only about fifteen percent of all prescriptions, and of that, two to three percent of overall controlled substances are Schedule II controlled substances. Schedule III – V substances (13% of controlled substances) are not restricted. Eighty-five percent of all medications (non-controlled substances) can be dealt with in pilots. If the DEA stays with only CIIs, the impact will be two to three percent. Pre-emption offers a structure: the DEA would create a federal regulation that all states would follow. With no pre-emption, states could make regulations more stringent but they most likely would not, as most defer to the DEA. Although the DEA’s Mike Mapes had previously clarified that the intent was for digital signatures to be applied to all controlled substances (II, III, IV, V), a suggestion was made to check with the DEA again on these matters.

The need for a common understanding of definitions (i.e., for electronic signature) and written guidance from the DEA was stressed. For example, some think of PKI as digital signatures and others see a distinction between PKI and digital signatures. Three buckets of substances were defined as: [1] non-controlled; [2] Schedule III – V; and [3] Schedule II. These buckets offer opportunities for collaboration between HHS and the DEA that can provide clarification for the pilots or use in Part D. There are also three types of faxes ([1] “traditional” DEA-approved fax; [2] computer-generated fax (not DEA approved); and [3] a third type, in which a prescription goes through the same procedures and validation as an EDI prescription that individual pharmacies can’t receive electronically). Clarification for the Medicare Part D Program could help determine whether waivers related to Schedule III – V would be useful, especially for the pilots. General clarification about the use of electronic prescriptions for the general population would be useful to the development of standards across the board. Additional paper procedures for Schedule II substances pose a significant barrier to some physicians (i.e., dentists, pain medicine specialists, oncologists) who began to but no longer use e-prescribing. Some see different State Board of Pharmacy rules and regulations as barriers. New Jersey’s recently approved state regulations helps states to move forward on e-prescribing (e.g., electronic prescribing is permissible but only with the DEA’s blessing) more effectively than states that proceed independent of the DEA. (See detailed summary or transcript for details)

Presentation Four Use of RxNorm in the E-Prescribing Context

Stuart Nelson, NLM; Lynne Gilbertson, NCPDP; George Robinson, First DataBank

The development of a new maintenance environment for RxNorm outside of the UMLS (first released in November 2004) that resolves the problem of regenerated (as opposed to permanent) codes and its schedule of updates was discussed. Documentation for RxNorm (available on the RxNorm Website) addresses current editorial policy; business rules for comparing strength of medications; and suggestions for implementing RxNorm in systems.

(See detailed summary or transcript for Website details)

The need for compatibility between RxNorm and NCPDP standards was noted along with the need to accommodate exceptions. It will be more important to link NDC codes in the RxNorm to brand names than to the clinical drugs. Current focus is primarily on U.S. prescription drugs. In the future, obsolete drugs will be labeled as such and dated (see detailed summary or transcript for details on obsolete drugs and other issues such as naming devices containing medications and reimbursable supplies). By the end of 2005, NLM will receive structured product labels from the FDA as they are approved for medication and released, thus allowing for greater currency on newly-available drugs and the ability to link RxNorm names to these structured label products. The FDA estimates a seven-year process before every label and package insert is available electronically.

An RxNorm specialist will be added to the NLM staff in April 2005 to serve as a liaison to the standard development organizations, particularly HL7 and NCPDP and provide additional support to users. Another new staff person will track sources used for RxNorm and UMLS to ensure information currency. NLM is approaching a “fairly stable” staff for its systems work.

Product Identification Task Group Update

Lynne Gilbertson, NCPDP

The presentation’s aim was to describe the functional requirements of a drug concept interoperability vocabulary; detail implementation steps of a drug concept interoperability vocabulary within health information systems; assess current acceptability of RxNorm in supporting drug interoperability requirements; and provide recommendations to the Subcommittee about the adoption of RxNorm within applicable messaging standards. The primary purpose of the RxNorm concept is to provide the automated translation of drug concepts between health information systems that use disparate drug vocabularies.

Characteristics of the ideal concept interoperability vocabulary were enumerated (see detailed summary or transcript for specifics).

A list of use cases that could fit RxNorm into a business case and go into a messaging standard includes prior authorization, formulary, drug history, prescription fills, Rx fills, and discharge medications. Steps reinforcing a demonstrable business need for the inclusion of RxNorm within the applicable messaging standard have been recommended. A governing body has deemed interoperability vocabulary to be ready for production use. Vendors and self-programming entities must appreciate the value of interoperable drug vocabulary to ensure successful implementation.

Updated on a regular basis are: RxNorm, using permanent identifiers; RxNorm cross-reference to UMLS contributing vocabularies; messaging standards, to accommodate the inclusion of RxNorm standards (related guides are provided to the industry). Integrated RxNorm files are available to customers after vendors import RxNorm into database files and perform additional cross reference work, as needed, to ensure that RxNorm ingredient, brand name, semantic clinical drug, and semantic brand drug concepts are linked to analogous concepts. Typically, a time lag can range from months to years between the development of updated health information systems and implementation within end-user systems.

George Robinson, First DataBank

A lack of clear ownership of RxNorm was described as well as differences between prescribers from in-patient and out-patient settings and between how a prescriber describes a drug vs. how a pharmacy represents a drug given to a patient, in terms other than NDC. Clear business requirements from a credentialed or empowered entity are needed to establish the parameters of RxNorm and a plan for acceptance testing. In the absence of acceptable interoperability standards in many applications, the NDC, the Universal Product Code, and health-related identifiers are used as “work-around” in billing transactions. Progress in electronic prescribing is being made without an interoperability standard.

Issues associated with concept-unique identifiers (CUIs) and cross-referencing were raised. The RxNorm code will eventually be linked with an identifier that assigns a level of permanence within UMLS such that cross-reference work will not have to be repeated for each release of RxNorm. As a translation vehicle, it is important for RxNorm to ensure that the prescriber’s intent is not lost through translation(see detailed summary or transcript for examples). Resolution of such issues can occur by working with a liaison from RxNorm to add greater specificity to formulation descriptions within RxNorm, as needed.

Recommendations:

  • Semantic brand drug links to the NDC would be welcomed by those publishing cross references (i.e., Prozac). This is important to drug knowledge-based vendors because joining to name-based identifiers enables vendors to bring cross references to market at a much faster pace.
  • A governing body should be established to define RxNorm requirements, certify acceptance testing, production processes, and editorial policy.
  • A submission for appropriate RxNorm concepts should be included with the appropriate NCPDP messaging standards after industry participants have completed analysis.
  • RxNorm should continue to be funded, developed, and tested.

Discussion

The importance of convincing the industry of the convenience of an automated translation system was emphasized. The Subcommittee’s recommendation is to pilot RxNorm in 2006, using some CMS pilots and some AHRQ pilots (although one participant wondered whether the 2006 pilots could proceed with so much work still to be done by NCPDP). A concern was raised that benefits within clinical decision support, patient safety, and cost savings of adverse drug events might fall outside the scope of a business case evaluation of RxNorm’s benefits. It was noted that in 2005, a determination about code qualifiers and placeholders must be made because at present, the SCRIPT standard does not support RxNorm. CMS was established as the governing body although another suggestion was made to use one of the standard bodies as an alternative. One Subcommittee member thought that open competition for interoperability between vendors should be encouraged, citing different motivations for vendors, pharmacists, and provider organizations. Another did not think that a consensus-based approach would be feasible for day-to-day operations although it might be possible to develop a voluntary organization that could contribute to policy formulation and implementation.

The creation of a list of Medicare-reimbursable supplies was suggested. The use of RxNorm codes was recommended because they are current and available on a regular basis. 2004-2005 AHRQ activity on patient safety, health, and information technology was described, as was the definition of a “concept.” RxNorm differentiates clinical from branded drugs while NDC codes represent a much finer level of product granularity. (See detailed summary or transcript for specifics)

Questions posed to help understand RxNorm’s usefulness clinically:

  • What changes are needed for RxNorm and how hard are they to make?
  • Can RxNorm be piloted to determine strengths and actual use?
  • Won’t the pilots need some private sector partners?

Implementation will be the hardest part of the work and analysis must be ongoing. The pilots could create a use case and do the work of how to use it, which would inform the process of putting it into the standard. Drug database companies and e-prescribing vendor systems must ensure consistent information translation. In the absence of brand drug links to NDC, drug knowledge-based vendors or self-programmers will need to build cross-reference links between concepts and RxNorm concepts, which will add to the implementation timeline. Concerns were voiced about a possible unrecoverable financial investment by industry to develop these links for the pilot test. Market-driven for-profit companies are only likely to do the work if the market shows the need.

RxNorm was described as an opportunity to get information out in different ways to multiple people, thus generating healthy competition, although a mixed case for the use of RxNorm in the actual e-prescribing process was described (see detailed summary or transcript). A dual-coding system would exist in the near future. The development of drug terminologies and the maintenance of mapping tables were differentiated. NCVHS’s asserted that NLM should take ownership of the various mappings, develop processes to make them available, and keep them adjudicated for clinical use.

Open Microphone Discussion

Mike Simco, Walgreens: The most affected group of patients covered by the Medicare Act use a higher amount of controlled substances, which becomes a barrier to physicians using electronic prescribing, especially since much of it is given in combination with other medications. If controlled substances have to be dispensed one way (by phone, fax, or in written form), the physician is probably not going to send the others electronically. This barrier becomes stronger in winter with so much cough and cold medicine (codeine is controlled) used with antibiotics (not controlled). He urged the Subcommittee to approach the DEA again about the requirements of Schedule III – V, to request allowance for these substances to be sent electronically. In Walgreen pharmacies, the adult population constitutes about 30% of the total of controlled substance users but he noted that the older the patient, the higher the percentage of usage.

Richard Brook, ProxyMed: There is still no business case for RxFill. Who will pay for the transaction between the physician’s office and the pharmacy – the payer? With a SCRIPT transaction, physicians generally pay subscription fees to use applications and pharmacies pay transaction fees that generally result in fills. ProxyMed has come up with a model that equalizes the cost of subscription and transaction fees (see transcript for specifics).

Subcommittee Discussion

Prior to writing the letter of recommendation to HHS, the e-prescribing package would benefit from development of a matrix related to the business case, the patient, and the process. Introducing a separate standard for Medicare prescriptions into the prescribing process could undermine adoption of RxNorm. A physician’s need to ask about a person’s drug coverage could deter adoption even more than controlled substance issues (where a “work-around” has been found). Because pre-emption could accelerate or decelerate the process, it would be useful for the Subcommittee to discuss this concern, noting legal ramifications as well as confusion.

The NCVHS process includes:

  • A second set of recommendations about e-prescribing from the Subcommittee to include recommendations about e-signature, information from the Subcommittee on Privacy and Confidentiality, and additional advice on issues raised in today’s meeting.
  • A separate letter of recommendations about NPRM from the Subcommittee for review by the full Committee. Information will be published about open conference calls on these matters through the third week of February 2005.
  • Comments about problems with the NPRM should be sent to a certain address in the Federal Register by April 5, 2005. HHS is now in a 60-day comment period, which allows industry to comment directly to HHS. Contributing to the NCVHS comment letter should not substitute for commenting to HHS directly.

DSMO Annual 2004 Report

Gary Beatty

The 2004 DSMO (Designated Standards Maintenance Organizations) Annual Report was described, focusing on process improvements to the timeliness and predictability of the changes that HIPAA has imposed on the standards development process from a short-term emergency perspective and a long-term perspective. The DSMO is working to find a predictable mechanism and timely process to move from one version to the next. Three change requests (795; 1005; and 1008) were highlighted (see detailed summary or transcript for specifics). Implementation was also discussed, including the new DSMO Website and streamlining the HIPAA standards maintenance process (one of the major items to come out of the 2003 report). Another outcome of the HHS-DSMO discussions is the development of a more predictable process for the modification of the HIPAA-adopted transaction standards. A move to the next version of 835 was recommended (unofficially).

Discussion

Applicability of “backward compatibility,” which enables forward movement without going through the entire regulatory process, is something to strive for. Some maintenance changes will not have to go through a full regulatory process but a change from one transaction version to another would. Since every change costs the industry, maintenance and adoption of new versions are a balancing act.

In response to what could be done about differing payer companion guides (which undermine the ability of providers to submit claims in one single format and standard), it was suggested that WEDI determine what clarifications are appropriate and reasonable and what others impair standardization and interoperability. Companion guides define the fields but not the relationships. In some cases, the relationship of data content can not be defined.

The Subcommittee will consider whether HHS would benefit from expanding the MLU beyond HIPAA to use the DSMO process to field IT comments during the NPRM process for e-prescribing.

Subcommittee Discussion of draft Second Set of Recommendation on E-Prescribing Letter

Facilitated by Ms. Amatayakul

Considerable work was done on the Second Set of Recommendations draft letter on e-prescribing, using the same format as the first letter. There is an Observations section; a Recommended Actionssection; two appendices; and possibly, a glossary of terms. An overview will be given of current security and authentication practices in e-prescribing networks; use of PKI in e-prescribing; privacy concerns; and industry experience.

Subcommittee Discussion and Planning for Next Meeting

Simon Cohn, Jeff Blair

To Do List

  • Electronic signature
  • Privacy and security issues that shift to e-prescribing
  • A directory that would identify prescribers, nursing facilities, and pharmacies (some work has been done; this was an NCPDP testimony)
  • Codification of allergens, drug interactions, and other adverse reactions to drugs (no work has been done)
  • Incorporation of indications for drug therapy into e-prescribing messages
  • Units of measure (being addressed to an extent in a codified sig)
  • Methods for patient identification for e-prescribing
  • Confidentiality
  • General MHII issue
  • Use of the national health plan ID for e-prescribing
  • Formulary identifier
  • Exchange of medication history among all participants in the e-prescribing process
  • Exchange of medical history within the e-prescribing process (longer-term “to do”)
  • How to ensure the interoperability among e-prescribing standards (being worked on)
  • Standard codes for orderable items (no work has been done but this is being addressed in a context of RxNorm)
  • Exchange of drug labeling an drug listing (cannot comment but may want to say that SPLs are working and moving forward)
  • Clinical decision support in e-prescribing (Subcommittee has investigated; reference white paper developed on clinical support)

The Subcommittee might want to update on progress relating to HL7 and NCPDP for prescribing in the letter to the Secretary and in the NPRM letter. Regarding the Notice of Proposed Rule, Mr. Reynolds and Mr. Blair will take the lead (conference calls will be set up). Details of what it would take to complete the letter on e-prescribing and the NPRM letter were finalized. The intent is to complete the two letters by President’s Day (February 21, 2005). [See detailed summary or transcript for details]

DETAILED SUMMARY

DAY ONE February 1, 2005

CALL TO ORDER, WELCOME, INTRODUCTIONS, AGENDA REVIEW

Proposed E-Prescribing Standards Regulation Overview

Karen Trudel, CMS

After recognizing Gladys Wheeler for her work as principal author of the recently released proposed rule making for e-prescribing, Ms. Trudel described the purpose of the regulation, which was announced by the President on January 27, 2005. On February 4, 2005, the rule was published in the Federal Register, with a comment period that will end on April 5, 2005.

Context: This NRPM must be considered in the context of other Part D Regulations such as Title I and Title II (Medicare Prescription Drug Benefit Final Rules) which, published on January 28, 2005, require Part D plan sponsors to support and comply with electronic prescribing standards. Ms. Trudel noted a Stark exemption for e-prescribing and a requirement for an anti-kickback safe harbor. A separate proposed rule on the Stark exemption (in process) will clarify how physician self-referral will work within e-prescribing. An anti-kickback regulation is being worked on by the Office of the Inspector General.

What is in the Proposed Rule: The NCVHS process, described in detail, shows a broad base of support for the new rule. The industry has been asked for feedback about an incremental strategy and foundation standards that would be built based upon pilot studies. The goal is to roll everything into a consolidated electronic health record that is consistent with other initiatives within the Department. Proposed foundation standards include the SCRIPT standard, Version 5, Release 0 (except for the Prescription Fill Status Notification Transaction, due to inadequate industry experience). Ancillary messaging and administrative transactions (e.g., receipt notifications, password changes, etc.) have been included as part of the standard. In addition, fill request and response, change request and response, and cancellation request and response are suggested as foundation-standard usage for the SCRIPT. Also included is the X12 270/271, Version 4010 and Addenda for eligibility and benefits inquiries and response between prescribers and Part D sponsors. Although not discussed by the NCPDP, the Telecommunications Standard Version 5 and the associated Batch Standard for eligibility and benefits (as well as inquiries and responses between dispensers and Part B sponsors) were officially adopted under Part D. To summarize, the eligibility and benefit portion of the transactions mentioned would be used as a foundation standard.

Formulary and benefit standards were differentiated because there is not a clear recommendation that these standards are ready for use. Ms. Trudel thought that these standards would be adopted if they could be accepted as accredited SDO standards by NCPDP. Rather than adopt specific formulary standards, criteria were established for appropriate formulary standards, to include: accreditation; an interface with multiple products and point-of-care vendors (rather than a single application standard); and a uniform means for PBM’s to communicate and arrange formulary and benefit information to prescribers. Rather than dictate the formulary makeup and composition, the format accommodates any formulary that could be designed, thus providing, for example, a uniform means for a prescriber, dispenser, or payer to list drugs that have been prescribed or claimed within a certain timeframe.

Key components: Foundation standards must reflect adequate industry experience, defined as ANSI-accredited, and must be recognized by key stakeholders as an industry standard. Transportability and interoperability are key elements.

Regarding a timetable for a second set of standards, Ms. Trudel explained that additional standards will be identified, pilot tested, and proposed through a separate rulemaking. Pilots are scheduled for 2006, a report is due to Congress in early 2007, and regulations are due to be published by 2008.

Definitions include:

  • E-prescribing is a transmission using electronic media of prescription or prescription-related information between a prescriber, dispenser, PBM, health plan directly or through an intermediary, including an e-prescribing network.
  • An electronic prescription drug program is a transmission of covered Medicare Part D drugs prescriptions to eligible individuals.
  • Prescriber is a physician, dentist, or other person licensed, registered or permitted by the US or a jurisdiction to issue drug prescriptions.
  • Dispenser is a person or other legal entity (including pharmacies) licensed, registered, or permitted by the US or a jurisdiction to provide drug products.

State Pre-emption: Two points of view about state pre-emption were mentioned: 1) pre-emption would only apply to transactions and entities that are part of an electronic prescription drug program under Part D of Medicare or 2) pre-emption would apply to a broader set of transactions and entities such that any state law that posed a barrier to e-prescribing could be pre-empted. The proposed rule takes a narrow interpretation and public comment is invited.

On NPI: On the use of the National Provider Identifier (NPI), public comment is invited as information is sought on its use and timeframe as well as its effect on industry of accelerating the use of NPI for e-prescribing ahead of the HIPAA compliance date (in 2007). Alternatives and options for phasing in NPI were also mentioned.

Use for internal transactions: Also at issue (with request for comments prior to the final rule) is whether foundation standards should be required in completely internal transactions or whether the HL7 standards suffice. Under HIPAA, the standards are used within and between entities.

Pilot testing: The MMA requires testing in 2006 for standards not in widespread use.

Applications will be sought through a public procurement process for volunteer organizations to participate in pilot testing. A contractor will evaluate pilot results and new or emerging standards will be sought.

Discussion

Dr. Cohn asked the Subcommittee to consider taking advantage of the invitation to comment on the proposed rule by developing a letter for the full Committee meeting in March 2005.

Ms. Trudel clarified that the regulation only includes issues necessary to bring up a basic e-prescribing program with foundation standards in January 2006. Pilot testing recommendations will be utilized when the request for proposals or rollout materials on the pilot become public. The NPRM that came out will be used throughout the pilot testing. Recommendations from the Subcommittee or full Committee will play into the pilot process rather than the regulation process.

Asked about whether the regulation would preclude the use of HL7, Ms. Trudel said that she expected pilot participants to have some applicability to the Part D benefit (which hospitals do not). In-patient hospitals, therefore, would not be a target for pilot participants. She clarified that acute care settings were not addressed by the regulation, again, because they were out of the scope for Part D. Within a staff model HMO, the NCVHS recommendation was for the internal prescriber, dispenser, and plan to continue to use HL7, except when transmitting out of network, in which case the dispenser’s requirements would rule. She emphasized the request for comments about internal vs. external policies.

Further clarification was sought about dispensing prescriptions from a local pharmacy with a shift from in-patient to out-patient status. Ms. Trudel questioned whether this would be covered under Part D. Within multi-service organizations that have acute, ambulatory and even home care within one organization, Dr. Warren asked at what point the organization would need to shift from using HL7 internally to using the NCPDP standard. Ms. Trudel said that the regulation did not take a position but that rather, it stated the issues and requested comment. She suggested that the Subcommittee communicate their concerns to the Secretary.

Report on Industry E-Rx Work Groups and Best Practices

Lynne Gilbertson, NCPDP

Observation Three (Prescription Messages) Recommendations to HHS:

  • Recognize as a foundation standard the most current version of NCPDP SCRIPT.
  • Include the fill status notification function of the NCPDP SCRIPT Standard in the 2006 pilots.

Status: NCPDP Work Group 11 Prescriber/Pharmacist Interface RxFILL Task Group has created implementation and operational guidance to pharmacy and prescriber system participants for consistent utilization of the Fill Status Notification transactions. The guidance recommendation is up for approval in March 2005. If approved, updates will be made to the next version of the SCRIPT Implementation Guide (Board approval timeframe is April/May 2005). The guidance includes operational challenges (see transcript for examples).

Observation Four (Coordination of Prescription Message Standards)

Recommendations to HHS:

  • Financially support acceleration of coordination activities between HL7 and NCPDP for electronic medication ordering and prescribing; and support maintenance of HL7 and NCPDP SCRIPT coordination.
  • Recognize the exchange of new prescriptions, renewals, cancellations, changes and fill status notification within the same enterprise as outside the scope of MMA e-prescribing standard specifications.
  • Require that prescribers using HL7 messages convert it or utilize a switch to NCPDP SCRIPT if the message is transmitted to a dispenser outside of the enterprise. HHS should require retail pharmacies within an enterprise to receive prescription transmittals via NCPDP SCRIPT from outside the enterprise.

Status: HL7/NCPDP collaborative demonstration is going well; a team is working to map the standards; mapping working documents will be turned into an industry guidance document; other work items include change management, process flow, and education in HL7, version 3.

Observation Five (Formulary Messages) Recommendations to HHS:

  • Actively participate in and support rapid development of an NCPDP standard for formulary and benefit information file transfer, using the RxHub protocol as a basis. I

Status: In March 2005, NCPDP Work Group 11 Prescriber/Pharmacist Interface Formulary and Benefit Task Group will submit a standard for approval that includes lists of formulary status; alternatives; benefit coverage; benefit co-pay; and cross-reference file of user-recognizable health plan product names. Discussion about RxNorm continues. The implementation currently supports multiple drug identifiers. Further analysis is being done to understand how, if, and at what level RxNorm may be used.

Observation Six (Eligibility and Benefits Messages) Recommendations to HHS:

  • Recognize the ASC X12N 270/271 Health Care Eligibility Inquiry and Response Standard Version 004010X092A1 as a foundation standard for conducting eligibility inquiries from prescribers to payers/PBMs.
  • Support NCPDP’s efforts to create a guidance document to map the pharmacy information on the Medicare Part D Pharmacy ID Card to the appropriate fields on the ASC X12 270/271 in support of its use in e-prescribing.

Status: A task group formed by NCPDP’s Work Group Three is collaborating with X12N WG1 Health Care Eligibility, as needed.

  • Work with ASC X12 to determine if thee are requirements under MMA for how situational data elements are used in the ASC X12N 270/271.
  • Ensure that functionality of the ASC X12N 270/27, as adopted under HIPAA, keeps pace with requirements for e-prescribing.

Observation Seven (Prior Authorization Messages) Recommendations to HHS:

  • Support ASC X12 in efforts to incorporate functionality for real time prior authorization messages for drugs in the ASC X12N 278 Health Care Services Review Standard Version 004010X094A1. 278, a HIPAA-mandated transaction, is a communication between physicians and insurance review boards that supports the ability to request additional information from the provider.
  • Support development of prior authorization work flow scenarios for 2006 pilot tests.
  • Evaluate economic and quality of care impacts of automating prior authorization communications between dispensers-prescribers and payers-prescribers in 2006 pilots.
  • Ensure that functionality of ASC X12 278, as adopted under HIPAA, keeps pace with requirements for e-prescribing.

Status: NCPDP Work Group 11 Prescriber/Pharmacist Interface Prior Authorization Workflow-to -Transactions Task Group has created draft flows of medication prior authorization processes and has identified where standards and gaps exist. Its goals are to understand the prior authorization workflow in the physician, pharmacy, and plan environment; to identify current and additional standards to support prescription drug prior authorization; to develop standards with the appropriate SDO; and to make recommendations to the Committee on whether and how to include prior authorization in demonstration projects. Temporary authorization must be included in the workflow and long-term care must also be considered. The formulary and benefit standard is under development with the aim of transmitting information to e-prescribing systems (see transcript for further explanation, examples, and information).

Observation Eight (Medication History Messages from Payer/PBM to Prescriber) Recommendations to HHS:

  • Participate in and support rapid development of an NCPDP standard for a medication history message for communication form a payer/PBM to a prescriber, using the RxHub protocol as a basis.

Status: RxHub submitted a Data Element Request Form (DERF) at the November NCPDP meeting that is being balloted with adjudication of the ballot at the March 2005 Workgroup meetings.

Observation Nine (Clinical Drug Terminology) Recommendations to HHS include:

  • Include the RxNorm terminology in the NCPDP SCRIPT Standard for new prescriptions, renewals, and changes into the 2006 pilot tests.

Status: RxNorm will be included in 2006 pilots. (see transcripts for details leading up to inclusion)

  • Accelerate the promulgation of FDA’s Drug Listing Rule and ability to support correlation of NDC with RxNorm.

Status: NCPDP Structured Product Label (SPL) Task Group was formed with goals of reviewing areas in SPL that benefit from codification and ensures an accurate mapping of Medicare Part D Model Guidelines and NDF-RT.

Observation Ten (Structured and Codified SIG) Recommendations to HHS:

  • Support NCPDP, HL7, and others (especially in the prescriber community) in addressing SIG components in their standards (US activities).

Status: The Task Group hopes to: maximize use of a SIG standard within in-patient and out-patient settings; accept that some SIGs will not lend themselves to the standard (with focus on 80/20 or 90/10) and; optimize technology. The standard is about interoperability transfer. Projected release of proposed standard for coding and testing (without completion of the ANSI standards process) is Summer 2005, with implementation projected for January 2006 (see transcript for details on status, data gathering, scope definition and management, draft operating assumptions, next steps and timeline).

Observation 13 (Pilot Test Objectives) Recommendations to HHS:

  • Support efforts of standard development organizations to incorporate in the foundation standards as many additional functions required for MMA as possible.
  • Include foundations standards with as many additional functions as possible in 2006 pilots.
  • Begin work with vendors to ensure readiness for pilots on January 1, 2006.
  • Identify and publicize specific goals, objectives, timelines, and metrics to guide design and assessment and increase industry awareness of 2006 pilot tests.
  • After the pilot tests, develop and disseminate information about economic and quality of care benefits of e-prescribing; provide education on implementation strategies; describe how e-prescribing can be consistent with privacy protections under HIPAA; and encourage widespread prescriber adoption and patient acceptance.

Status: The development of a matrix was suggested with NCVHS recommendations and standards as a benchmark. Electronic prescribing organizations will join the effort and CMS will actively participate, especially in coordinating and executing pilot tests.

Next Steps: NCVHS will receive testimony and make further recommendations in March 2005 on the following topics: 1) Electronic signature for use in e-prescribing; 2) A directory that identifies prescribers, nursing facilities, and pharmacies that can accept e-prescribing transactions (see transcript for details).

Discussion

Further information is needed on the meaning of “inferring pick-up” described in the status of Observation Three (Prescription Messages) recommendations. Ms. Gilbertson clarified that the challenge of “inferring pick-up” is not about guidance to infer but rather about guidance to be careful that a pharmacy or prescriber does not infer. The point is to present different aspects of what happens when partners are only enabled in certain functions. What, then, are the repercussions of choices that support only some functionality? A big concern centers on an inability to guarantee that a patient takes medication that has been acquired. To complicate matters, some pharmacies might get a fill status back when patients have picked up medication (or they might get a negative fill status if medication was not acquired) while other pharmacies aren’t yet able to do so.

Asked if she would recommend multiple drug identifiers or go to RxNorm in Observation Five (Formulary Messages), Ms. Gilbertson said that NCPDP supports multiple drug identifiers, particularly because the drug files contain utilization review information and interactions that RxNorm does not cover. RxNorm would be added for mapping purposes. Working together, one might ask what level of drug to relay to a prescriber or e-prescriber system when transmitting information about alternative drugs, for example, and what level of concept corresponds to RxNorm to ensure a one-to-one match.

Dr. Fitzmaurice commented on the cumbersome nature of moving from the pharmacy to the physician. The pharmacy might be relieved if the physician could deal directly with payers. He noted that prior authorization questions are not known up front. A strong goal for all would be interoperability rather than interface. Dr. Fitzmaurice supported the development of a standards benchmark and roadmap for pilot testing in collaboration with CMS.

In response to a question about how much formulary and medication history standards have changed during NCPDP’s deliberations, Ms. Gilbertson clarified that the presented material has not changed significantly but that medication history, currently under ballot, might get modified. In response to whether these foundation standards would be supported by the industry, Ms. Gilbertson said that many were willing participants and that some were already using the protocol. She believes that the standards will have a positive impact. Medication history will be adjudicated in March 2005. Formulary and benefit standards will be discussed in March 2005 and balloted in May 2005. Post balloting, the industry is invited to comment on their comfort with these foundation standards. The documents may be recirculated to address negative comments; and approval by NCPDP’s board will follow.

Ms. Helm volunteered to configure an information matrix and a roadmap to plan for the pilot tests. Mr. Blair thought the pilot development process would probably include identifying requirements and metrics as well as a Stage Two and that it would be useful to document where multiple pilot tests are needed. There might also be an opportunity to test certain things that feed into a subsequent set of pilot tests within the year. For example, NCPDP might gather documentation about the breadth of the standards’ usage within its constituency as well as information about widespread marketing (which NCVHS has used in the past to determine comfort levels when recommending a standard). Dr. Cohn concluded the discussion by stating that the Subcommittee’s recommendation letter of September 2004 had stated that the group would provide additional guidance on foundation standards and pilot tests.

Ken Whittemore, Jr., SureScripts

Mr. Whittemore provided background information about the NCPDP Workgroup 11/12 Joint Task Group working on electronic signature for use in e-prescribing. Created as an educational effort rather than to create a standard, the challenge is to clarify best practices in electronic signatures. The Task Group does not have much to offer at present. Acknowledging that the Subcommittee hoped for a solution that could be adopted across the industry, Dr. Fitzmaurice thought it would be useful to learn about what the industry thinks is state of the art as well as about what it can or wants to do. He wondered what the Task Force would recommend to the Secretary.

Mr. Whittemore said that an NCPDP diagram captured much of what is being done in the field. He thought there was a sense among some Task Group members that watchful waiting was indicated due to a variety of different processes and people using electronic signatures. He hoped that over time, the processes would coalesce. Security regulations were mentioned as an additional consideration. Mr. Blair suggested including ways to measure the extent to which e-prescribing over e-prescribing networks is sufficient, adequate, and secure in pilot tests. Dr. Cohn thought that the issue was more that best practices have not been well described than that the networks are not secure. He asked that Mr. Whittemore and others to provide perspective during this Subcommittee meeting, stating that authentication and non-repudiation were key concerns to be evaluated.

Karen Trudel, CMS

Expressing surprise at NCPDP’s offer to set up criteria for the pilots, metrics, and critical success factors, Ms. Trudel explained that CMS has a different set of rules that includes procurements. Because signing contracts and cooperative agreements involve federal rules, CMS is not able to work proactively with groups to develop some of these roadmaps. She encouraged meeting participants to convey their thoughts to Ms. Friedman about the content and structure of the pilots; standards to be tested; evaluation; and critical success factors. Ms. Friedman asked that feedback come quickly (by March 1st or sooner) to enable consideration before completion of the RFP, which they hope to distribute soon (due to a January 1, 2006 start date).

Dr. Cohn pointed out that standards development is a constantly evolving process, in which pilots represent ongoing activity for improvement.

State Issues Related to E-Prescribing of Controlled Substances

Eleni Anagnostiadis, NAPB

Context: NAPB and the State Boards of Pharmacy recognize the importance of creating a regulatory environment that facilitates and regulates electronic transmission of prescriptions for controlled and non-controlled substances in the interest of patient safety. Regulations about controlled substances rely significantly on the regulations and policies of the Drug Enforcement Administration (DEA). Focusing on state issues, the primary concern about electronic transmission was stated as the need for assurance that all prescriptions are authenticated, legitimate, and have integrity.

DEA Regulations for Controlled Substances: State regulations for controlled substances intersect with the federal Controlled Substances Act (CSA), which, enforced by the DEA, focuses on the ordering, handling, distribution, and dispensing of controlled substances. The complimentary and sometimes conflicting relationship of state and federal laws highlights the importance of defining federal requirements and DEA policy for electronic transmission and prescribing. NABP is not aware of any proposed changes in the CSA or regulations from the DEA for electronic transmission of controlled substances. The DEA has authorized a pilot project at the Hines VA Hospital to evaluate the effectiveness and security of transmitting controlled substances. The pilot results are intended to help the DEA develop and release requirements for the electronic transmission of controlled substances, which are critical to state actions and recommendations of NCVHS because states defer to the DEA and federal CSA for guidance.

NABP recommends that:

  • NCVHS exert its influence to foster the release of regulations and requirements from the DEA about electronic transmission and prescribing of controlled substances.
  • Recommendations from NCVHS account for regulations and requirements of existing states as well as the DEA.
  • Electronic transmission and prescribing requirements for controlled and non-controlled substances be consistent and incorporate the necessary security, accountability, and privacy.
  • National standards be developed for patient safety, public protection, and the provision of quality health care.

A comparison of DEA Controlled Substances Regulations and State Regulations exemplified the fact that only three of 15 regulations will be impacted by electronic transmission that the DEA must address:

  1. Where an oral prescription is not permitted (CII), a prescription must be written in ink or indelible pencil, or typewritten and must be manually signed by the practitioner.
  2. Under Schedule II Substances, all Schedule II substances must be handwritten by a physician and signed by a practitioner.
  3. Under Schedule III – V Substances, substances must be communicated orally, in writing, or by fax.

Though absent from current DEA regulations and requirements, the use of electronic or digital signatures will become a primary focus of DEA regulations. Currently, prescriptions for controlled substances cannot be transmitted or electronically prescribed until the DEA updates its regulations.

State-specified Controlled Substance Act: States such as Nevada are hesitant to create regulations about electronic transmission of prescriptions because the more stringent laws (federal or state) take precedence. States will be forced to develop requirements for the electronic transmission and prescribing of controlled substances if the DEA does not. While most states do not specifically address controlled substances in regulations about electronic transmission, New Jersey and Wisconsin do, allowing for electronic transmission of controlled substance prescriptions pursuant to the establishment of federal regulation by the DEA. New Jersey’s language is particularly progressive (see transcript).

A NABP 2005 Survey of Pharmacy Law indicates that all 50 states and the District of Columbia have state-specified controlled substance acts. The CSA in half the states falls under the purview of the Board of Pharmacy while other aspects of controlled substances regulation fall to other state agencies. State regulatory agencies define their authority through state-specific CSAs. Ultimately, authority for electronic transmission and prescribing for controlled substances will rest with State Boards of Pharmacy or similarly charged agencies.

Discussion

DEA Approval for Pilots: Asked whether HHS could move ahead with pilot testing without a waiver from the DEA, Ms. Anagnostiadis said she believed that it is imperative to obtain a waiver, or at least seek clearance from the DEA prior to performing a pilot test whereby controlled substance prescriptions are transmitted electronically.

Controlled substances are only about 15% of all prescriptions, and of that, two to three percent of overall controlled substances are Schedule II controlled substances. Schedule III – V substances (13% of controlled substances) are not restricted. Mr. Brook clarified that electronic prescriptions for CIIs automatically print out while IIIs, IVs, and Vs receive only oral confirmation in certain states. Although the DEA’s Mike Mapes had previously clarified that the intent was for digital signatures to be applied to all controlled substances (II, III, IV, V), Mr. Whittemore and Mr. Brook suggested checking again with the DEA on these matters.

Definition of electronic signature: A question about whether everyone is using the same definition of electronic signature was raised and the need to use the same definitions was stressed. For example, some think of PKI as digital signatures and others see a distinction between PKI and digital signatures. Mr. Brook thought that electronic signatures focus on “computer to computer rather than on facts.” The definition might include a digital signature but PKI would not be included for Schedules III, IV, and V. Dr. Cohn hoped for written guidance from the DEA to ensure common understanding.

Three buckets: Dr. Cohn made a distinction between three buckets: 1) non-controlled, in which electronic prescribing occurs as permitted by state and federal laws; Schedule III – V, a “confusing” process in which a prescription is sent electronically and followed up by a call from a provider or a fax; and Schedule II, in which paper prescriptions are given to patients. In practice, Mr. Whittemore’s networks do not electronically transmit controlled substances. Physicians give printed prescriptions to patients or fax prescriptions to the pharmacy. To add to the confusion, there are three types of faxes, the “traditional” fax, which allows for signature (DEA approved); the computer-generated fax, which does not (not DEA approved); and a third type, in which a prescription goes through the same procedures and validation as an EDI prescription that individual pharmacies can’t receive electronically.

Clarification for the Medicare Part D Program could help determine whether waivers related to Schedule III – V would be useful, especially for the pilots. General clarification about the use of electronic prescriptions for the general population would be useful to the development of standards across the board.

Model language: Mr. Whittemore thought that wording of New Jersey’s recently approved state regulations helps the state move forward on e-prescribing (e.g., electronic prescribing is permissible but only with the DEA’s blessing) more effectively than states that proceed independent of the DEA. Mr. Brooks says SureScripts looks for model language from State Boards of Pharmacies that can be used elsewhere.

Barriers to e-prescribing: Mr. Cohn wondered if uncertainty related to controlled substance prescribing posed a barrier to the adoption of e-prescribing. Mr. Whittemore characterized it more as an “irritant” or “headache” requiring a different procedure. Mr. Schueth thought that the additional paper procedures for Schedule II substances pose a significant barrier to some physicians (i.e., dentists, pain medicine specialists, oncologists) who began to but no longer use e-prescribing.

Further clarification about state laws: Dr. Warren wondered if states were waiting for the DEA to decide about e-prescribing for other than scheduled drugs. Mr. Whittemore replied “not in general.” Mr. Brook added that some states, like Ohio, require approval of each application. Mr. Schueth saw different State Board of Pharmacy rules and regulations as barriers. Despite barriers, Mr. Whittemore said that 37 states are far enough along with e-prescribing to be good for SureScript partners. Dr. Warren thought that from a state law perspective, e-prescribing was in “pretty good shape.” The DEA is an “irritant” but one that should not hold states back from e-prescribing.

85% of all medications (non-controlled substances) can be dealt with in pilots. If the DEA stays with only CIIs, the impact will be two to three percent. Pre-emption offers a structure: the DEA would create a federal regulation that all the states would follow. With no pre-emption, states could make regulations more stringent but they most likely would not, as most defer to the DEA.

Taking the three buckets into consideration (non-controlled, Schedule III – V, and Schedule II), there are opportunities for collaborative work between HHS and the DEA that will yield clarification for the pilots or use in Part D.

Suggestion: Ms. Anagnostiadis suggested that the work would move forward if the DEA would write regulations or proposed regulations from what they have learned from the Hines VA pilot project or from other pilots that are not point-to-point. Mr. Reynolds and Dr. Steindel pointed out the limitations of the Hines pilot relative to the outpatient and commercial pharmacy industries.

Use of RxNorm in the E-Prescribing Context

Stuart Nelson, NLM; Lynne Gilbertson, NCPDP; George Robinson, First DataBank

The development of a new maintenance environment for RxNorm outside of the UMLS that resolves the problem of regenerated (as opposed to permanent) codes was identified by Dr. Nelson. A model that maintains RxNorm outside of the UMLS while holding onto its links to UMLS concepts, issues updates outside of the UMLS (with a first release in November 2004). Each new release of the UMLS is accompanied by a complete release of all RxNorm data including directly linked vocabularies. In the interim, monthly and weekly updates will be issued with a new full release expected at the end of February 2005 that is synchronous with the 2005 AA UMLS release. Documentation for RxNorm (available on the RxNorm Website) addresses current editorial policy; business rules for comparing strength of medications; and suggestions for implementing RxNorm in systems. A Website browser called RxNav allows viewers to see RxNorm names and codes but not proprietary drug codes that are source vocabularies within RxNorm. Currently, RxNorm has 5,000 ingredients, 9,000 brand names, 27,000 clinical drugs, and 14,000 branded drugs represented.

Compatibility between RxNorm and NCPDP standards: A study by Point-of-Care Partners examined compatibility between the RxNorm and NCPDP standards, revealing that current NCPDP standards have a short character limit that requires a short field to express a concept’s meaning (which explains past “peculiar” abbreviations). While terminology and information models can be developed independently within medical subject headings and Pub Med, it is important in modern systems for terminology and messaging standards to work together. In any system, there has to be some ability to handle exceptions, including controlled substances as well other prescriptions with stringent requirements (e.g., lactose-free).

Linking NDC codes: It will be more important to link NDC codes in the RxNorm to brand names than to the clinical drugs, when possible. The FDA must resolve how complete and what information is available within NDC codes. Current focus is on (largely U.S.) prescription drugs. At some point, it will be important to identify which drugs are from the U.S. and which are from other countries.

About withdrawn drugs: What is to be done with a drug that is withdrawn from the market or is no longer listed by a source vocabulary? At present, sources have various ways of dealing with withdrawn drugs. In the future, obsolete drugs will be labeled as such and dated; and RxNorm branded drugs or clinical drugs that no longer have links to anything active on the market will also be labeled obsolete. This information might still be used in epidemiologic investigations.

Issues to be addressed include the development of consistent names for devices containing medications such as oral contraceptive packs. To address this problem, the library will provide coverage for reimbursable supplies.

Structured product labels: By the end of 2005, NLM will receive structured product labels from the FDA as they are approved for medication and released, thus allowing for greater currency on newly-available drugs and the ability to link RxNorm names to these structured label products. The FDA estimates a seven-year process before every label and package insert is available electronically.

NLM staff additions: An RxNorm specialist will be added to the NLM staff in April 2005 to serve as a liaison to the standard development organizations, particularly HL7 and NCPDP and to provide additional support to users. Another new staff person will track sources used for RxNorm and UMLS to ensure information currency. NLM is approaching a “fairly stable” staff for its systems work.

On vocabularies: Donald Lindbergh says, “Vocabularies get better as they are used. The more you use them, the better they get.” The first vocabulary developed for use in a computerized system in medicine was developed in 1960. Dr. Nelson stated that perfection is a long way off but RxNorm will get better with use over time.

Product Identification Task Group Update

Lynne Gilbertson, NCPDP

The aim of the presentation is to describe the functional requirements of a drug concept interoperability vocabulary; detail implementation steps of a drug concept interoperability vocabulary within health information systems; assess current acceptability of RxNorm in supporting drug interoperability requirements; and provide recommendations to the Subcommittee about the adoption of RxNorm within applicable messaging standards.

The primary purpose of the RxNorm concept is to provide the automated translation of drug concepts between health information systems that use disparate drug vocabularies. One assumption is that existing local and proprietary drug vocabularies will continue to be used within healthcare provider and payer systems. As drug concepts are exchanged as part of messaging transactions between providers and/or payers, an RxNorm concept could be added to the drug concept code and text description native to the center’s application.

Characteristics of the ideal concept interoperability vocabulary are:

  • Drug concepts are assigned permanent identifiers.
  • The meaning of a unique drug concept does not change over time.
  • Drug concepts are made publicly available on a timely basis, with publication mirroring the market release date of the related packaged product.
  • Editorial policy for naming of drug ingredients, brand name, dosage form, strength and strength unit of measure is published and consistently applied.
  • Change history (obsolescence or replacements) is published.
  • The comprehensiveness of interoperable vocabulary covers all medications and medical supplies to be prescribed or ordered within the U.S.
  • A liaison is provided to the industry to handle editorial policy questions, provide implementation support, and participate in industry workgroups.
  • The entity responsible for authoring interoperable vocabulary content provides a responsive customer support service.
  • Cross-references between drug concept interoperability vocabulary and external source contributing vocabularies are maintained and published on a timely basis and used within licensing constraints specified by source vocabularies.
  • The meaning of the linked interoperability vocabulary term must be equivalent to the meaning of the external source vocabulary term.
  • A governing body is established to approve editorial policy, establish use cases, review content authoring processes, and review ongoing quality improvement procedures.
  • A governing body deems interoperable vocabulary as ready for production release and use within health information systems.
  • This is a product that the industry will expect to support.
  • Prescriber, pharmacy, prescription drug plan, long-term care systems and other ancillary systems are modified to import RxNorm concepts and to send and interpret RxNorm values within applicable electronic transactions.

Messaging transaction candidates for inclusion of interoperability drug concepts: A list of use cases where RxNorm could be fit into a business case and then go into a messaging standard includes prior authorization, formulary, drug history, prescription fills, Rx fills, and discharge medications.

Industry implementation of RxNorm: Convinced that a demonstrable business need is present for the inclusion of RxNorm within the applicable messaging standard, steps were recommended by a Task Group formed under Work Group II (Product Identification) for industry implementation of RxNorm. A governing body has deemed the interoperability vocabulary as ready for production use. Vendors and self-programming entities must appreciate the value of the interoperable drug vocabulary to ensure successful implementation.

Updated on a regular basis are: RxNorm, using permanent identifiers; RxNorm cross-reference to UMLS contributing vocabularies; messaging standards, to accommodate the inclusion of RxNorm standards (related guides are provided to the industry).

RxNorm ready for use: Integrated RxNorm files are made available to customers after vendors import RxNorm into database files and perform additional cross reference work, as needed, to ensure that RxNorm ingredient, brand name, semantic clinical drug, and semantic brand drug concepts are linked to analogous concepts. Typically, a time lag can range from months to years between the development of updated health information systems and implementation within end-user systems.

George Robinson, First DataBank

Lack of ownership of RxNorm: Mr. Robinson defined a lack of clear ownership of RxNorm relative to business requirements intended for its support. He spoke of subtle differences between prescribers in in-patient and out-patient settings, noting that level of detail (i.e., dosage form) is much clearer in ambulatory settings). He also noted the difference between how a prescriber describes a drug vs. how a pharmacy represents a drug given to a patient in terms other than NDC.

What is needed are clear business requirements from a credentialed or empowered entity that can establish what RxNorm needs to be as well as a plan for acceptance testing. The business need for mandatory inclusion of RxNorm concepts within applicable messaging standards has yet to be established. In the absence of acceptable interoperability standards in many applications, the NDC, the Universal Product Code, and health-related identifiers are used as work-arounds in billing transactions. Progress in electronic prescribing is being made without an interoperability standard. It would be useful to continue this momentum and bring RxNorm in at an appropriate time.

Concept-unique identifiers (CUIs) are assigned to concepts only through the quarterly release of UMLS. Because of the business need to describe drug concepts on a more frequent basis,

the RxNorm code will be cross-referenced as an interim measure, which eventually will be linked with an identifier that assigns a level of permanence within UMLS. It is nice to know that cross-reference work will no longer have to be repeated every time a new release of RxNorm occurs.

Good news: While Mr. Robinson has assumed a “wait and see” attitude for a process in an early implementation phase, he thinks that weekly updates and the appointment of an RxNorm liaison are very good news.

One critical issue he described is the loss of some knowledge about ingredients (such as salt) when going to RxNorm codes and the fact that a single RxNorm concept sometimes spans multiple pharmaceutical equivalence concepts. Physician intent can be lost, for example, when no distinction is made for accurate dosing (e.g., using a dropper for a young child or a teaspoon for an older child); or about levels of potency (see transcript for examples). If RxNorm is viewed as a translation vehicle, it is important to ensure that the prescriber’s intent is not lost through translation. Less is lost when a prescriber writes an order using a brand because brands are expressed with greater specificity. Issues like these could be resolved by working with a liaison from RxNorm with the hope of adding greater specificity to formulation descriptions within RxNorm, as needed.

Recommendations:

(Mr. Robinson) Those with the task of publishing cross references would welcome semantic brand drug links to the NDC. At present, the only links are at a generic clinical drug level. So, Prozac as a semantic brand drug concept in UMLS would have a direct link to indices that are actually labeled Prozac. This is important to drug knowledge-based vendors because joining to name-based identifiers enables vendors to bring cross references to market at a much faster pace.

(Ms. Gilbertson)

  • A governing body should be established to define RxNorm requirements, certify acceptance testing, production processes, and editorial policy.
  • A submission for appropriate RxNorm concepts should be included with the appropriate NCPDP messaging standards after industry participants have completed analysis.
  • RxNorm should continue to be funded, developed, and tested.

Discussion

Mr. Blair expressed concern that some benefits within the clinical decision support and patient safety areas as well as cost savings of adverse drug events might fall outside the scope of a business case evaluation of RxNorm’s benefits. Mr. Robinson stated that timely access to decision support and relevant information related to the drugs is contingent on RxNorm. He emphasized the importance of convincing the industry of the convenience of an automated translation system. CMS was established as the governing body. Mr. Blair said that one could not look at just one narrow application within MMA but rather, that individual messages must be examined to define requirements and establish whether RxNorm is meeting the need. He wondered what the measure of its acceptability would be.

Thinking that an “owner” of RxNorm must be named, Dr. Huff suggested one of the standard bodies as an alternative (he also mentioned a possible conflict of interest, as Vocabulary Co-chair of HL7). As a provider organization representative, Dr. Huff encouraged open competition for interoperability with many different drug vendors and drug knowledge-based vendors, acknowledging that this might work directly against those with a sizable market share. Believing that providers are underrepresented within NCPDP and HL7, he emphasized different motivations for vendors, pharmacists, and provider organizations. He wondered about input from citizen panels or editorial boards. Dr. Cohn mentioned several models for public vocabularies including ICD (maintained by NCHS) and other maintained by CMS in the public sector. Dr. Cohn did not think that a consensus-based approach would be feasible for day-to-day operations but he reminded the group that NIH Advisory Committees require many levels of approval. Rather than constitute an advisory board, it might be possible to develop a voluntary organization that could contribute to policy formulation and implementation. Dr. Cohn announced his intention to talk with the Director or Deputy Director about ways to solicit more input.

Dr. Cohn said that the only way to address the problem of interoperability is to understand the needs. The RxNorm Project emerged in meetings at HL7 from frustration with discrepancies between First DataBank and Medispan vocabularies. Such “low-level” quality assurance concerns such as the difference in salts were present (noting the need to correct the omission of salts in erythromycin but also noting that salts were not significant in, for example, amoxicillin) along with higher level concerns (such as deciding about the need to express every drug according to its associated salt or how to deal with augmented delivery of diprolene vs. diprozone). He talked about the difficulty of achieving pharmaceutical equivalent. Finally, Dr. Cohn does not see a way to incorporate information into the book electronically without a great deal of manual labor.

Asked whether it was within the scope of current work activity to be “pharmacy supplies as opposed to purely drugs,” Dr. Nelson wondered where the line should be drawn. He suggested the creation of a list of Medicare-reimbursable supplies, stating that one might not want band-aides but would want to include prescriptions for such things as insulin syringes and glucose test strips.

Recommendation: Dr. Nelson stated that NLM is sufficiently staffed and funded at present although he looks forward to bringing on the RxNorm specialist (Dr. Fitzmaurice also applauded the liaison position). While the current system avoids the “churning” of codes while maintaining synchronization with the UMLS, he recommends that those using RxNorm use the RxNorm codes because they are current and available on a regular basis.

Dr. Fitzmaurice conveyed that in 2004 (with continuation into 2005), AHRQ spent over $50 million on more than 100 grants and five state contracts on patient safety, health, and information technology, with $10 million allotted for a data standards program. Seventy percent of the money went to the FDA to reduce adverse drug events by supplying structured product labeling and a list of products approved by the FDA; and to NLM for RxNorm and mapping. Adjustments must be made for RxNorm to meet all of the industry’s needs. Agreeing to adjustments and getting a liaison are positive steps.

In order to understand RxNorm’s usefulness clinically (especially to reduce adverse drug effects) as well as for the business case, the following questions were posed:

  • What changes are needed for RxNorm and how hard are they to make?
  • Can RxNorm be piloted to determine strengths and actual use?
  • Won’t the pilots need some private sector partners?

By January 1, 2006, Dr. Nelson thought that there would be a “pretty complete” representation of current source vocabularies although there are no guarantees about fulfilling every need relative to what is dispensed vs. what is represented and prescribed. The pilots are so important because they help to determine where changes need to be made. Other than an editorial board (a policy decision), other concerns mentioned are already being worked on.

Definition of a “concept”: Dr. Nelson defined a “concept” as a representation of when more than one thing means the same thing at a given level of abstraction. In UMLS work, meanings of words change over time. Thus, the meaning resides in the identifier given to a concept, which includes active ingredient, strength, and format (see transcript for example).

Asked whether RxNorm links data from various sources at the concept level, Dr. Nelson said that RxNorm tries to express information at a level of abstraction that differentiates clinical from branded drugs. NDC codes represent a much finer level of product granularity – a manufacturer, a labeler, a packager, and the size of package in that code. There might be hundreds of NDC codes associated with a drug, which makes it hard to interoperate.

Discussion summary and recommendations:

The Subcommittee’s recommendation is to pilot RxNorm in 2006.

Some will be CMS pilots and hopefully, AHRQ will also do some pilots.

Clarification: The SCRIPT standard does not currently support RxNorm. This discussion must take place in 2005 to determine what need to be code qualifiers and placeholders. Guidance about what level of RxNorm concept should be used may be needed for new treatments. Nothing in the pilot says that people must use an approved NCPDP standard.

Ms. Friedman wondered whether the 2006 pilots could proceed with so much work still to be done by NCPDP. Mr. Bizzaro did not think that the crosswalk had to be done within the pilot. While he did not believe that there would be a full-blown cross reference between database companies and RxNorm concepts, he foresaw an ability to fill prescriptions in a dispensing pharmacy with RxNorm. Ms. Eckert said that Medispan would work with partners wanting to participate in pilot tests to learn more about their business needs and which levels of RxNorm to map to. She noted that such coding would add more time to the development process.

Ms. Gilbertson said that the standards analysis is the easier part of the work; harder is the work of actual implementation. Until there is some sense of what the pilot “morphs” into, analysis must be ongoing. Dr. Huff thought that the pilots could create a use case and do the work of how to use it, which would inform the process of how it should be put into the standard. Ms. Gilbertson thought it important for drug database companies and the e-prescribing vendor systems to bear responsibility for ensuring a consistent translation of information. For example, there is no assurance that the Rx data works on both ends if no one is reviewing data names for consistency. It will be important to conduct this kind of review behind the scenes.

Whose role to look at statutory requirements? Mr. Robinson believes that it is CMS’s role (rather than NCPDP) to look at statutory requirements and the needs of interoperability vocabulary as well as to make suggestions that move the process forward. He described a chicken-and-egg dilemma in which the industry is forced to look at text associated with the drug concept selected in a prescriber system and compare it to the concept that has been translated to an RxNorm.

Regarding use of RxNorm within the pilot: In the absence of brand drug links to NDC, Ms. Eckert and Mr. Robinson thought that the drug knowledge-based vendors or self-programmers must build cross-reference links between a concept and an RxNorm concept, which would add to the implementation timeline. There was concern about the possible expectation that the industry would have to make an unrecoverable financial investment to develop these links for the pilot test. In addressing this concern, Mr. Bizzaro said First DataBank, as a market-driven for-profit company, would do the work if the market shows the need. He believes that there will be a market need but he could not project as to when the linking work would need to be done.

Mr. Bizzaro added that nothing has to happen for RxNorm to be part of the standards used within the pilots and that they should move forward. For RxNorm to be included into those standards, work must be done outside of the pilot by an RxNorm advocate. This sponsor would review the different standards and data elements of areas without the standards that currently require RxNorm as a qualifier; and then delineate where the concepts belong in the standards. Mr. Robinson felt that this advocate role would be suited to someone with the business need and desire to see RxNorm as part of the standards rather than assigned to the Task Group at NCPDP.

NCPDP was described as a pragmatic organization that wants to see a business need for changes to the standard and inclusions of new data elements. Mr. Robinson added that he thought RxNorm would prove valuable to pharmacy within NCPDP and also within institutional pharmacy and healthcare.

At best, Dr. Steindel believes that a mixed case exists for the use of RxNorm in the actual e-prescribing process because, at present, it is identified by other means. Because a change would take years, a dual-coding system would exist in the near future. He is not convinced that RxNorm codes need to be sent with a prescription if a set of mapping tables is available. He differentiated between the development of drug terminologies and the maintenance of mapping tables, which work best when centralized. He supported NCVHS’s assertion that NLM should take ownership of the various mappings, develop processes to make them available, and keep them adjudicated for clinical use. Dr. Nelson clarified that no mapping exists between First DataBank’s drug vocabulary and Medispan’s or between First DataBank and Medimedia. None of them can speak to one another except via RxNorm. Viewing the use of RxNorm between systems as a preprocessing step, he also thought that preprocessing an RxNorm code between other codes would be much easier than trying to incorporate it into all software. Mr. Bizzaro agreed that RxNorm is an opportunity to get information out in different ways to multiple people, thus generating healthy competition.

Open Microphone Discussion

Mike Simco, Walgreens: The most affected group of patients covered by the Medicare Act use a higher amount of controlled substances for many reasons, which becomes a barrier to physicians using electronic prescribing, especially since much of it is given in combination with other medications. If controlled substances have to be dispensed one way (by phone, fax, or in written form), the physician is probably not going to send the others electronically. This barrier becomes stronger in winter with so much cough and cold medicine (codeine is controlled) used with antibiotics (not controlled). He urged the Subcommittee to approach the DEA again about the requirements of Schedule III – V, to request allowance for these substances to be sent electronically. He clarified that in Walgreen pharmacies, the adult population constitutes about 30% of the total of controlled substance users but he noted that the older the patient, the higher the percentage of usage.

Richard Brook, ProxyMed: As a member of the RxFill Task Group, Mr. Brook stated that there is still no business case for RxFill. Who will pay for the transaction between the physician’s office and the pharmacy – the payer? With a SCRIPT transaction, physicians generally pay subscription fees to use applications and pharmacies pay transaction fees that generally result in fills. ProxyMed has come up with a model that equalizes the cost of subscription and transaction fees (see transcript for specifics).

Subcommittee Discussion

Mr. Reynolds thought that, prior to writing the letter of recommendation to HHS (an initial draft of which has been prepared by Ms. Amatayakul), that the e-prescribing package would benefit from development of a matrix related to the business case, the patient, and the process.

Mr. Rothermich wondered how to have input into the Subcommittee’s discussion on NPRM. He believes that introducing a separate standard for Medicare prescriptions into the prescribing process could undermine adoption of RxNorm. A physician’s need to ask about a person’s drug coverage could deter adoption even more than controlled substance issues (where a “work-around” has been found). Because pre-emption could accelerate or decelerate the process, it would be useful for the Subcommittee to discuss this concern, especially since there are legal ramifications in addition to confusion caused by lack of resolution.

The NCVHS process was clarified by Dr. Cohn. A second set of recommendations about e-prescribing will be drafted by the Subcommittee for eventual submission from NCVHS to the Secretary. The letter will include recommendations about e-signature, information from the Subcommittee on Privacy and Confidentiality, and additional advice on issues raised in today’s meeting. A separate letter of recommendations about NPRM will be drafted by the Subcommittee for review by the full Committee. Information will be published about open conference calls on these matters through the third week of February 2005. Because the process of commenting on NPRMs differs from the NCVHS process for submitting recommendations to the Secretary, Ms. Trudel suggested keeping those processes separate. Comments about problems with the NPRM (i.e., HHS chooses not to follow a recommendation for an “inadequate” reason; or the Committee revises its original recommendations) should be sent to a certain address in the Federal Register by April 5, 2005. HHS is now in a 60-day comment period, which allows industry to comment directly to HHS. Contributing to the NCVHS comment letter should not substitute for commenting to HHS directly.

Work on the Second Set of Recommendations draft letter

Facilitated by Ms. Amatayakul

This is the second letter on e-prescribing. E-signature background is included that gives an overview of prescribing; e-prescribing networks; use of PKI in e-prescribing; privacy concerns; and industry experience. Then come observations and recommended actions, presented in the same format as the first letter, as well as two appendices and perhaps a glossary of terms.

The first few paragraphs of the draft read as follows:

The National Committee on Vital Health Statistics (NCVHS) has been called upon by the Medicare Prescription Drug Improvement and Modernization Act of 2003 (MMA) to develop recommendations for uniform standards to enable electronic prescribing (e-prescribing) in ambulatory care. This letter is the second set of recommendations on e-prescribing and sets forth recommendations relative to the electronic signature and other important issues relative to pilot testing for e-prescribing.

The first set of recommendations, since September 2, 2004, addressed message format standards that provide communication protocols and data content requirements, terminologies to ensure data comparability and interoperability, and identifiers for all relevant entities within the e-prescribing process. The recommendations were sequenced so that any foundation standards that in themselves did not need to be pilot tested were identified first. Then, actions were identified to address additions to the foundation standards, development of new standards, and pilot testing of standards necessary to meet the MMA requirements. The September letter also provided a description of the current prescribing environment, current e-prescribing capabilities and the process NCVHS used to evaluate standards.

Issues to revisit

  • In second paragraph, are recommendations for “other important issues” or specifically for pilot testing?

E-prescribing Overview (suggested title revision: Current Security and Authentication Practices in E-Prescribing Networks)

Prescription writing is a critical factor in patient care and patient safety. The National Association of Chain Drug Stores (NACDS) estimated that 1.4 billion new prescriptions were written in 2003 along with 2.0 billion refills and renewals. The Center for Information Technology Leadership (CITL) estimated that $154 billion was spent on prescription drugs. CITL also estimated that, as a result of adverse drug events (ADEs), approximately $2 billion was spent in ADE-related hospitalizations and visits.

The U.S. Department of Justice’s Drug Enforcement Administration (DEA) has regulatory authority over prescribing and dispensing of controlled substances. These are substances that have addiction and abuse potential. They are divided into five schedules. Schedule I substances are illegal and may not be prescribed. They are not applicable to these recommendations. Schedule II substances are highly addictive and their prescriptions must be handwritten and delivered to a dispenser. They may not be phoned or faxed to a dispenser (above statement needs verification).Schedule III – V substances are controlled but may be phoned or faxed to a dispenser. Prescribers must be authorized to prescribe controlled substances by the DEA and receive a DEA number for this purpose.

Suggested revisions A discussion ensued about the need to differentiate between machine and computer-generated faxes (a footnote was suggested). Ms. Amatayakul will add that 85% of substances are not controlled. Mr. Blair suggested adding a general statement (e.g., “testimony from the National Committee indicated…”) about the higher percentage of prescriptions involving controlled substances in the adult Medicare population (i.e., elderly and disabled). Statistics might be available from the National Ambulatory Medical Care Survey at NCHS or from Medicare data.

E-prescribing Networks

Today, most prescriptions are handwritten by prescribers on paper. Prescribers may fax or phone these to a dispenser or give them to a patient. The patient may then take them to a dispenser or use an on-line or mail order service. Prescribers are starting to use their computers to send faxes to dispensers and still others are starting to send prescription transactions via e-prescribing networks. E-prescribing networks are value-added networks that receive prescriptions from prescribers in the form of a transaction using the NCPDP SCRIPT standards. These are routed to the designated dispenser. Testimony to NCVHS indicated that the electronic transaction form of e-prescribing offers the greatest potential to improve patient safety and achieve quality benefits as outlined in MMA. Electronic transaction conducted over e-prescribing networks is the definition NCVHS uses for e-prescribing in these recommendations.

Noting that the value-added networks are bringing e-prescribing to the market, Mr. Blair suggested revising the following: “Testimony to NCVHS indicated that the electronic transaction form of e-prescribing offers the greatest potential to improve patient safety and achieve quality benefits as outlined in MMA.” Ms. Amatayakul clarified that the intent was to distinguish between an electronic transaction using SCRIPT vs. what some call e-prescribing, which only includes electronic facts (a revision will occur). Mr. Blair suggested including a definition of e-signatures used in e-prescribing networks.

E-prescribing networks use a combination of the following as a means to provide proof or prescriber and dispenser identity and security: a minimum of a user ID and password for access to e-prescribing software, credentialing upon enrollment in a value-added network VPM, use of a network-assigned electronic signature process, and transmission of the prescription message through a private lease line or through the Internet using a virtual private network VPN connection or the secure socket layer SSL protocol.

The electronic signature process used by e-prescribing networks varies with the network. In general, the process includes identification of the source system, that is, prescribers, e-prescribing system, or dispenser’s pharmacy system, date and time stamp, sending system identifier, prescriber’s name, DEA number, internal sender ID, name of prescriber’s agent, if indicated (change of terms), destination, dispenser name, address and phone number, and destination dispenser internal receiver ID.

Discussion

There was a question about whether the above is an electronic signature or a security process that includes authentication. Ms. Amatayakul, who will make revisions to reflect a process of authentication and security, clarified that line 18 is about proof of prescriber and dispenser identity and security. Ms. Reed-Forquet reiterated that, according to the ASDM electronic signature standard, what is being discussed are signature attributes for health care that must be part of the healthcare electronic signature, rather than digital signatures. The healthcare electronic signature must carry other signature attributes such as time stamps and credentials.

Dispenser paragraph

Dispensers rely upon the network to verify that the sender and receiver are authorized users of the network, that none of the signature components are missing and that the message is in the NCPDP standard format and version. Some e-prescribing networks translate the message format or version of messages that they receive into the appropriate format or version for subsequent transmission. There may also be pass-offs from one VPN to another or to a gateway to route the prescription to its final destination. See Appendix A for an illustration of electronic prescribing security and authentication standards being used by e-prescribing networks. {Note: the diagram on security presented by Phil Rothermich and Terry Swanson in December 2004 was referenced}

The current e-prescribing transaction communication process uses a signature that is consistent with the electronic signatures in Global and National Commerce Act e-sign definition of electronic signature that is “an electronic sound, symbol, or process attached to or logically associated with a record and executed or adopted by a person with the intent to sign their record.” Although e-prescribing transactions are reportedly occurring between 39 and 41 states, only nine state pharmacy statutes or regulations address electronic signature directly, and only three reflect the e-sign definition. It is important to note that e-prescribing is not used for writing prescriptions for Schedule II controlled substances. It is estimated that approximately 15% of all prescriptions written are for Schedule II – V controlled substances and that less than two to three percent are for Schedule II controlled substances.

Discussion

Dr. Cohn suggested that the above information about controlled and non-controlled prescriptions be placed in the Prescribing Overview section of the letter. In addition, the numbers are incorrect. Ms. Friedman asked for a citation for the sentence about states. Also, it would be useful to note that e-prescription is not used for writing Schedule II prescriptions due to DEA regulations (DEA’s requirement of a “wet” signature will be added to the letter). Ms. Helm suggested making a distinction between electronic prescribing and electronic transmission, stating that no states prohibit the creation of a Schedule II prescription using an electronic system. Rather, they have requirements related to signature and transmission. Despite the fact that controlled substance issues only apply to a small percentage of the SCRIPT, it was noted they still pose possible barriers to implementation of e-prescribing.

Use of PKI in E-Prescribing

NCVHS heard testimony regarding the current status of the use of digital signature and in particular, public key infrastructure (PKI) because the Federal Government and other initiatives seeking to strengthen authentication and provide non-repudiation from messages transmitted over the open Internet.

Discussion

It was suggested that sentence seven be split up and that “to respond to” replace “because of.” Mr. Whittemore suggested the addition of “proposed use” because the testimony stated that digital signatures are not being used much at present and Ms. Friedman suggested the removal of “current status” so the sentence reads: “…regarding the proposed use of digital signatures…” Dr. Cohn disagreed, stating that digital signatures are being used in the Federal Government and elsewhere. Ms. Reed-Forquet wondered whether there is actually a trend toward health informatic standards and toward proposed DEA initiatives. Ms. Amatayakul agreed to review these issues further.

Use of PKI in E-Prescribing (cont.)

One initiative was the attempt to include digital signature in the proposed HIPAA regulations (however, standards for digital signatures were not retained in the final HIPAA regulations). Another initiative is the Federal E-Authentication Initiative, promoted through the Office of Management and Budget, OMB, Authentication Guidance for Federal Agencies, M0404. This is based on the National Institute of Standards and Technology, NIST, Electronic Authentication Guideline SP 863. NCVHS sought testimony from OMB and NIST to thoroughly understand the E-Authentication Initiative and how it sets forth standards based on risks associated with information being exchanged over the open internet. NCVHS’s analysis of the OMB guidance is provided in Appendix B. This analysis highlights the level of security risk associated with transmissions sent over the open Internet. This was helpful but does not address the risks when secure protocols at other practices are used to authenticate prescribers and dispensers as currently employed by the e-prescribing networks.

Discussion

Dr. Warren did not agree that the analysis was helpful although others stated that it was helpful to have clarity about application to the open Internet (but not to other use cases). Dr. Cohn thought that the risks were well described but that the issues lay with what should happen as a result of the risk assessment. Dr. Warren stated that the OMB Guideline articulated what to consider when conducting interactions over the open Internet although the use of VPN and SXL indicates a level of security that is already there. Ms. Trudel added that there has already been mitigation of the risk. Mr. Blair thought that the solutions offered by the OMB/NIST matrix were helpful to viewing risk in terms of potential privacy violation and personal healthcare information but less relevant to addressing different levels of risk in an e-prescribing network. While the risk analysis yielded useful information, the methods used to address risk levels were not relevant to the e-prescribing environment (Ms. Amatayakul will work on these concepts for the letter).

Use of PKI in E-Prescribing (cont.)

NCVHS also heard testimony and studied guidance and standards developed by the Electronic Financial Services Council and from ASTM International Committee on Health Informatics on digital signature {Note: testifiers will be listed in appendices}.

Discussion

There was confusion about who discussed e-sign and electronic signature vs. digital signature and PKI in previous testimony. Ms. Reed-Forquet confirmed that ASTM gave testimony on electric signatures, digital signatures, and PKI. It was suggested that “Electronic Financial Services Council” be taken out of the above sentence in order to record distinct reports from them and ASTM.

Debate ensued about how to approach this section of the letter – with explicit reasons why certain entities took a stand or simply with a statement that testimony from certain groups helped the Subcommittee formulate its thinking? Mr. Blair noted that the statement about NIST/OMB was included in the appendix because it was the only assessment to identify the risk of the information. Further discussion ensued about whether to say that NIST and OMB standards were for the open Internet at this point in the letter and to then say in the observations section that many security issues raised by NIST and OMB standards have been mitigated by the e-prescribing networks. Dr. Cohn did not think it would be helpful to state in the recommendation section that the Subcommittee did not find the OMB information to be helpful (though others thought the information very helpful in providing a “structure” or a “useful frame for analysis”). Ms. Greenberg thought it important to mention all parties who gave testimony. It was decided to table the discussion for future versions of the letter.

Industry Experience

Testifiers that currently use PKI [in health care] are experimenting with it in environments that are relatively limited in scope and, in general, use only certain aspects of PKI. These testifiers describe considerable overhead in their implementation of PKI and the lack of PKI product interoperability.

Testimony from the e-prescribing networks, software developers, and prescription transaction standards developers express concerns that the use of PKI would impair the ability of the e-prescribing networks to reformat or update the version of the prescription, if necessary, before it is sent to the dispenser, create severe performance problems, due to the [complexity and]overhead of managing PKI across disparate entities, impose significant additional costs in an industry which is struggling to establish an adequate business case for e-prescribing and delay the adoption of the use of e-prescribing as a result of the cost and burden to install and maintain a system.

Discussion

A suggestion was made to add “complexity” as noted in the above statement. There was discussion about the level of security and authentication in today’s environment and PKI’s place within that environment. Mr. Martin thought people were saying that the incremental benefit did not justify the additional costs and burden imposed by PKI and that it was important to ask, “Are we doing okay with what we have?” Ms. Amatayakul suggested adding to “where we have imposed significant additional costs” the following: “with insufficient incremental value in an industry, which is struggling to establish an adequate business case for e-prescribing.”

Dr. Cohn thought that cost should be accompanied by a quality argument. The value of the equation is not just the business case for those trying to establish e-prescribing but also for the prescriber, the dispenser and all participants who are part of the process. Ms. Gilbertson added that the issues were more about people skirting the system or doing something illegal than about cost or system technology. In other words, fraud and abuse would happen due to the human factor rather than to electronic or computerized components. Mr. Blair suggested adding a statement that confirmed that there is no current evidence of fraud or abuse over e-prescribing networks. Mr. Brook added his testimony of several weeks ago: that over 19 million transactions had occurred with no break-ins into the network. Ms. Amatayakul will add a statement to reflect the above information.

Dr. Cohn raised the issue of time in the process and the need to better define “now” and “some point in the future.” Ms. Reed-Forquet thought it important to avoid statements from the three parties that testified saying that the use of PKI won’t work with pass-offs. What was said was that the process would be complicated with pass-offs.

Industry Experience (cont.)

The final part of the background part of the letter gave the following recommendations:

Focus on the development and adoption of industry guidelines to ensure the protection of health information over the e-prescribing networks and evaluation of the feasibility for adopting stronger authentication and non-repudiation methods.

The meeting of February 1, 2005 was adjourned at 4:47 p.m., to reconvene the following morning.

DAY TWO February 2, 2005

CALL TO ORDER, WELCOME, INTRODUCTIONS, AGENDA REVIEW

DSMO Annual 2004 Report

Gary Beatty

The 2004 DSMO (Designated Standards Maintenance Organizations) Annual Report focuses on process improvements to the timeliness and predictability of the changes that HIPAA has imposed on the standards development process from a short-term emergency perspective and a long-term perspective. During the sixteen months covered by the annual report, DSMO had only thirty-five change requests (monthly volume dropped from 11.4 – 4.2 and change requests completing the DSMO dropped from 8.4 – 2.2 monthly). In 2004, the DSMO did not receive any new appeals and only one appeal from the last annual report was completed during the last reporting period. The reason for this decline is unclear. It could be a sign of maturity of the healthcare industry’s implementation of the current transaction standards or it could be due to the fact that change requests can be submitted directly to the Standards Development Organizations (SDOs) rather than to the DSMO change request system. The SDOs track or are developing processes to track modifications to show DSMO change requests vs. the DSMO change process. The DSMO Steering Committee is working to ensure a change request protocol that is responsive and appropriate to community needs.

In 2004, the DSMO began processing its first request to adopt a new version of an already adopted HIPAA transaction. The DSMO is currently requesting the collection of supporting cost/benefit information from the industry (e.g., WEDI, AMA, and AHA), which will be presented at a future hearing (note graph on page three that shows the number of change requests processed [excluding withdrawn changes] since the DSMO began processing change requests as well as the spikes and declines of change request workload activity.

The DSMO has worked to improve the overall change management and development process. Public improvement, a major revision to the DSMO Website (www.hipaa-dsmo.org), supports the change request system by providing a more robust change request submission and by separating requests so that they can be processed at different stages. On the horizon is CRS support of code set change requests. The DSMO also continues to work with HHS on ways to facilitate implementation of the existing HIPAA standards to arrive at processes that expedite change coming from regulatory requirements. Six entities were named by HHS as DSMOs designated to work together on maintenance and development of HIPAA administrative simplification transaction standards. These include three Standards Development Organizations (SDOs) [Accredited Standards Committee X12; HL7; NCPDP] and three Data Content Committees (DCCs) [Dental Content Committee; NUBC; and NUCC).

The prior DSMO Steering Committee report to the Subcommittee on 3-31-04 covered monthly batches from May 2002 – June 2003. The chart on page six of the 2004 Annual Report details the DSMO change requests in monthly batches from July 2003 – October 2004. Aggregate comparative statistics of DSMO change requests are imperfect but average monthly volumes give a baseline for change in volume over time. During this reporting period, the number of change requests dropped by 63 percent and the number of change requests completing the DSMO process dropped by 74 percent (note: for the first time, there were no change requests in January 2005). There has also been a drop in the number of change requests that are being withdrawn by submitters. The chart on page seven breaks down the 35 change requests by various categories such as modifications (12); maintenance; no change; DHHS policy (1); and recommendation for adoption of new/modified HIPAA standard (new category added in 2003). Appendix I completed the list by naming all the changes sorted by category and their definitions as well as DSMO requests and responses.

Three change requests are highlighted:

  1. Change Request 795, an appeal that closed out the last DSMO report, resulted in the NUBC and ASC X12 attaining agreement on the definition of various provider types. The recommendation satisfied the business case because Medicaid and all provider types were examined.
  2. Change Request 1005 impacts the ICD-9 for bed confinement status, which could impact future implementation. A new diagnosis code for bed confinement status was proposed in the October 2004 ICD-9 Coordination and Maintenance Meeting.
  3. Change 1008 will assist NCVHS and HHS in initiating a federal regulatory process to adopt a new version of the 835 for the permits advice claim payment. The process has been tentatively approved, pending the collection of additional cost-benefit information, to support this recommendation through industry outreach, working through organizations such as WEDI, ADA, and AHA. The DSMO asks to be added to the agenda of a future Subcommittee on Standards and Security hearing to present official recommendations and support information to adopt this new version.

The DSMO and the Steering Committee are addressing other matters related to implementation, including the new DSMO Website (see transcript for details); and streamlining the HIPAA standards maintenance process (one of the major items to come out of the 2003 report). Much effort has been focused on developing an emergency maintenance process that allows for industry changes to an adopted HIPAA implementation specification between modification cycle. HHS is preparing a Notice of Proposed Rule Making (NPRM) to propose changes to the definition of maintenance under HIPAA that outline and request comments on a streamlining process to the change process that would reduce the timeline for maintenance changes. Additional effort has gone toward the development of a long-term modification process within the regulatory process, which must be followed to name a new version of a HIPAA transaction or to name a new transaction (see transcript for details of this multi-year process). Another outcome of the HHS-DSMO discussions is the development of a more predictable process for the modification of the HIPAA-adopted transaction standards.

Discussion

To summarize the presentation, Mr. Beatty’s (unofficial) recommendation is to move to the next version of 835, although more information gathering is required (i.e., outreach efforts would be made to software vendors) before a formal recommendation is made (hopefully by April 2005). He clarified that DSMO does not track the “whys’ of what change requests fall off but said that other transactions are moving forward, from an X12N and X12 perspective, including Version 5010 Implementation Guides, which will incorporate change requests. The DSMO is trying to find a predictable mechanism and timely process to move from one version to the next.

Dr. Cohn wondered about the applicability of “backward compatibility,” a concept that the Subcommittee has recommended to the Secretary that enables forward movement without going through the entire regulatory process. Mr. Beatty said that some “maintenance” changes will not have to go through a full regulatory process but that a change from one version of a transaction to another would. Since every change costs the industry, it is a balancing act between maintenance and adoption of new versions. While backward compatibility is something to strive for, regulation requirements mandate that only one version of a given transaction can be active at any given point short of the transaction time.

Mr. Blair wondered what could be done about differing payer companion guides, which undermine the ability of providers to submit claims in one single format and standard. To a degree, this has eroded the concept of HIPAA. What can be done, then, to minimize the need for companion guides or to converge companion guides? Mr. Beatty (from a personal rather than DSMO point of view) responded by talking about the variability within the healthcare industry and the ever-present need, at times, for “over-clarification.” Companion documents are intended to “over-clarify,” but problems arise when some in the industry misuse this by changing the meaning and intent of the implementation guide. He suggested that WEDI might be a good organization to determine what areas of clarifications are appropriate and reasonable and what clarifications impair standardization and interoperability.

Mr. Reynolds pointed out that companion guides define the fields but not the relationships. While data has working relationships, Mr. Beatty said that in some cases, the relationship of data content can’t be defined. Mr. Reynolds applauded the work of the DSMO in streamlining a process and eliminating backlog. The Subcommittee will think about whether HHS would benefit from expanding the MLU beyond HIPAA – to use the DSMO process to field IT comments during the NPRM process for e-prescribing.

Subcommittee Discussion of Draft Recommendation Letter on E-Prescribing

Simon Cohn; Jeff Blair; Margret Amatayakul

This is the first time the Subcommittee is discussing its observations and associated recommendations for e-prescribing.

Observation One: “Development and Testing of Baseline Guidelines for Securing Prescription Transactions over E-Prescribing Network”

Many testifiers emphasized to NCVHS how important it is that e-prescribing be adopted in support of patient safety and that transactions currently are conducted in compliance with HIPAA security regulations. Today’s e-prescribing transactions are conducted using several important security features, including credentialing prescribers and dispensers, trading partner agreements to grant access to the networks, and security protocols to provide secure transmission. The e-prescribing networks have indicated that they provide the added value of reformatting a prescriber’s transactions to enable acceptance by the dispenser system. In addition, the e-prescribing networks must reconcile NCPDP codes across different versions of standards where prescribers have used older versions for which there is no backward compatibility. The result of e-prescribing has been improvements in patient safety through eliminating the need for the dispenser to transcribe often illegible, handwritten fax or paper prescriptions. In many cases, there are also additional benefits of medication decision support embedded in e-prescribing software. E-prescribing processes can support return receipts sent from dispensers to prescribers that also contribute to identification of potential fraud and abuse, should a prescriber receive receipts for prescriptions not written.

Discussion

Ms. Greenberg noted that while the two observations are about security, only one description about patient safety is included in the second observation and only a brief general statement about good security contributing to patient safety is included in the recommendations. She asked for clarification about whether the first sentence (above) was saying that many testifiers emphasized to NCVHS about the importance of transactions being conducted in compliance with HIPAA or whether they were testifying about the importance of adopting e-prescribing to support patient safety. They also testified that electronic transactions currently are conducted in compliance. She suggested moving the issue of patient safety up and dividing the first sentence into two, to clarify two different concepts. The observations section should be about observations rather than reporting on testimony. More concretely, she suggested starting Observation One with: “Many testifiers emphasize that electronic transactions…” Ms. Amatayakul said that the point of Observation One was to explain the added value and how the networks are in compliance with HIPAA, and to say that everyone should comply with these guidelines.

Recommended Action 1.1

Original (with some revisions) [See Post Discussion Revised Recommended Action 1.1 below]

HHS should work with DEA and State Boards of Pharmacy in establishing baseline guidelines for securing prescription transactions over e-prescribing networks. These guidelines would define the processes to be supported for secure, end-to-end transmission of electronic prescription transactions for all non-controlled substances [revised]. These processes would include: A) credentialing prescribers and dispensers; B) compliance with HIPAA security requirements, including those relative to access controls, authentication, data integrity, audit control, and transmission security; C) trading partner agreements to establish security requirements based on risk analysis; D) requirement for adoption of a minimum version of NCPDP code translation and requirement for acknowledgement of receipt return from dispenser to prescriber that identifies drugs prescribed. HHS should clarify that these guidelines only apply to e-prescribing network transactions using private leased lines or secure protocols over the Internet. Different guidelines may be needed for other forms of electronic transmission.

Discussion

Mr. Bizzaro suggested that Schedule II not be excluded because he hopes that, in time and with proper security in place, all prescriptions can be prescribed electronically. Mr. Blair thought that adding a separate sentence indicating different criteria for Schedule II would address that concern. A suggestion was made to include only Schedules III – V in the above and address Substance II in Action 1.2. Mr. Whittemore expressed concern about mixing controlled with non-controlled substances. He questioned the DEA’s role with non-controlled substances, especially since the DEA has expressed a strong preference for the PKI and digital signature, which would be problematic for the industry to apply to non-controlled substances. Three separate action items might be needed for non-controlled substances; Schedules III – V; and Schedule II substances. Ms. Reed-Forquet thinks that Schedules III – V should be included with Schedule II under controlled substances to assure security because of significant abuse in controlled substances such as Xanax (Schedule IV substance).

Clarification was requested about whether the baseline guidelines represent model language or a list. What will the guidelines be used for? What is a proposed baseline as opposed to a proposed standard? According to Ms. Amatayakul, the intent of the guidelines is to bring all network participants to a baseline of certain activity. Dr. Steindel suggested inclusion of the following: “HHS should initiate a process that works with industry, the State Boards of Pharmacy, and the DEA to develop baseline guidelines to secure…” in order to allow for more ambiguity such that the process can define the end product. Mr. Rothermich thought that the term “baseline guideline” could give permission to states to “tinker” and thus work against a systematic approach. He suggested that HHS pick a floor and propose it as a rule (several participants thought it would be the security rule); and then do a pilot test to see if it would adequately secure the system. If everyone agreed to it, it could be called a standard. Mr. Blair thought that forward movement would mean moving everyone toward consensus, starting with baseline guidelines and over time, moving to agreement about standards. Dr. Steindel pointed out that the Subcommittee was trying to be prescriptive when HHS had already decided not be prescriptive about a security rule. He suggested backing off and saying that e-prescribing networks should do a risk assessment and define the way they will secure their information, which HHS would evaluate in the same way that they evaluate the security rule. Then, a separate recommendation could be made relative to the DEA and controlled substances.

Participants struggled with the possibility of fragmentation where prescribers would use different methods for different schedules. The challenge is to construct guidelines that don’t impose unnecessary restrictions and don’t create fragmentation. Discussions with the DEA are necessary for guidelines about Schedules III – V. Mr. Reynolds recommended categorizing for 1) non-controlled substances; 2) Schedules III – V; and 3) Schedule II. The first two, which comprise the majority of substances, should have similar security structures, even though the second is controlled. While Schedule II needs a further step, he recommended that the DEA incorporate the second and third recommendations into the first because overall usability will ultimately decide the success of the guidelines. Mr. Steindel acknowledged that only two categories: non-controlled and controlled substance, with two cases in controlled substances. He pushed for the same treatment of controlled and non-controlled substances, with the hope that the DEA would consider the system to be secure enough to treat all substances in the same way (but he does not think this will happen). He thinks that the Subcommittee should recommend an open position stating that “all substances will be treated the same” but then be willing to bargain about putting Schedule II into a separate category. Dr Huff added that it would be useful to, without specifying, make functional recommendations in each area about the requirements and the technology needed to meet those requirements.

Ms. Anagnostiadis suggested a clear statement about the need for the State Boards of Pharmacy to work with the DEA. Ms. Greenberg reminded the group that the overall heading of the letter is “Electronic Signature Observations and Recommended Actions.” She wondered if the process being recommended would actually get to an NPRM and a regulation on electronic signature or whether the recommendations would be in lieu of that. She urged the Subcommittee to be explicit about its intentions and the process. Dr. Huff thought it important to say “what we want this to be – a standard or a rule or regulation.” He believes it should be a rule or regulation that suggests the creation of an NPRM around electronic signatures and e-prescribing.

Dr. Cohn summarized by saying that the Subcommittee would like to know that current approaches are satisfactory relative to security. He acknowledged that controlled substances are separate but should be handled in the same manner as non-controlled substances; and that Schedule II drugs are very different and would require more analysis and possibly, a different approach or special handling. With so much e-prescribing occurring and with security in place, the focus needs to be on working through the DEA issues. Ms. Anagnostiadis summarized by saying that it would be nice for all prescriptions to follow the same system. She added that most State Boards of Pharmacy agree that an electronic signature is sufficient for secure transmission and suggested that one system that follows HIPAA standards would be nice, with a caveat that the DEA might have further requirements for controlled substances. Some felt that the HIPAA standards were working and others disagreed. Mr. Reynolds pointed out that within HIPAA, the dispenser is responsible for the validity of the prescription but if one covered entity sends it to another covered entity, no one is in charge. Another law (clarified as not a law but a regulation of all State Boards of Pharmacy) goes one step further by putting the dispenser in charge. A combination of the HIPAA regulations and this dispenser’s responsibility would be more effective as a recommendation.

Mr. Blair asked to add the following: As HHS works with the DEA and State Boards of Pharmacy to accomplish Recommendations 1.1, 1.2, and 1.3, they should establish guidelines that minimize or avoid an impact on prescribers caused by different processes to support different requirements for different levels of controlled substances. Dr. Cohn thought further conversation needed to happen between HHS, State Boards of Pharmacy and the DEA to resolve issues surrounding e-signature and other security issues related to controlled substances. Finally, the Subcommittee urged a consistent approach for Schedules III – V and non-controlled substances with Schedule II requiring further investigation. A risk assessment is needed to follow the guidelines from the security rule.

Ms. Amatayakul stated that revised text would include:

HHS should accept that the initial experience with HIPAA provides satisfactory protection for all prescriptions. However, the DEA may feel that there are additional requirements for Schedule II controlled substance [one suggestion was to eliminate “the DEA may feel…” in that there may be additional requirements – not just from the DEA].

Dispensers’ risk analysis must be satisfied that relative to state regulations, they can validate the authenticity of prescriptions.

Mr. Reynolds believes that the above could be used in pilots now because it uses frameworks, laws, and structures that are in place while allowing the DEA to weigh in. The framework is not overly prescriptive but is clearly defined. Mr. Rothermich asked if the Subcommittee might advocate for the use of e-prescribing for controlled substances (more secure than paper) to the DEA. Dr. Cohn thought that several steps would be involved: the first would be to make an assertion about the safety of the e-prescription process. The next would be to acknowledge the DEA’s input for control over controlled substances. HHS would also have to explore and clarify with the DEA how controlled substances should be handled. The Subcommittee’s position is that Schedules III – V should be handled in the same way but that Schedule IV may need additional research and evaluation to make that determination. Mr. Blair emphasized that HHS needs to obtain clarification and agreement with the DEA before moving forward.

Ms. Anagnostiadis thought it would be helpful for the State Boards of Pharmacy to be part of the conversation about controlled substances. The letter also will say that if a different security methodology is used for controlled substances, there is a possibility that e-prescribing for controlled substances will not be used. Testimony to this effect has been gathered from all segments – prescribers, dispensers, etc. as well as the results of one pilot.

Post Discussion Revision of Recommended Action 1.1

HHS should accept that the HIPAA security rule, in conjunction with the dispensers’ responsibility to validate authenticity of prescriptions, provides satisfactory protection for all prescriptions. However, HHS should clarify and reach agreement with the DEA and State Boards of Pharmacy on how controlled substances should be handled within e-prescribing. If controlled substances require a significantly different level of security, no one may use e-prescribing for controlled substances, and therefore the benefits of e-prescribing may not be able to be achieved.

Dr. Cohn suggested adding the following to the above: “However, NCVHS recognizes that the DEA has the major role and provides oversight on matters related to controlled substances.” Mr. Whittemore suggested adding “the satisfactory protection for all prescriptions, including Schedule III – V controlled substances over e-prescribing networks” to the first sentence.

Recommended Action 1.2

[original] HHS should work with DEA to support analysis into the potential risk associated with sending prescriptions for Schedule II controlled substances through an e-prescribing network as established in the baseline guidelines for securing prescription transactions over e–prescribing networks.

[revision] HHS should seek acceptance from DEA for adopting baseline guidelines for securing prescription actions over e-prescribing networks for Schedules III – V controlled substances.

[revision] HHS should work with DEA to support analysis in the potential risk associated with sending prescriptions for Schedule III controlled substances through an e-prescribing network.”

[revision] NCVHS recognizes that the DEA has a major role in oversight on controlled substances. HHS should clarify and reach agreement with the DEA and State Boards of Pharmacy on how controlled substances should be handled within e-prescribing [networks] [to determine whether or not controlled substances can be handled the same way as non-controlled substances]. HHS should urge the DEA to conduct a risk analysis to support that Schedule III – V is handled the same as all non-controlled substances. The controlled substances require a significantly different level of security. No one may use e-prescribing for controlled substances, and therefore the benefits of e-prescribing may not be able to be achieved.

[revision] HHS should work with DEA to clarify that III – V should be handled the same as non-controlled substances was changed to: HHS should work with DEA to determine the risk analysis, whether Schedule III – V can be handled the same as…

Discussion

The Subcommittee recommended that HHS take the position that Schedule III – V should be handled in the same fashion as non-controlled substances. Some members of the Subcommittee believed that the security rule in conjunction with the dispenser’s responsibility provides adequate protection for Schedule II over an e-prescribing network but others thought that treatment of Schedule II would require further investigation. Florida’s Medicaid Program, for example, testified that much more fraud and abuse were uncovered using both electronic and paper systems. Dr. Warren thought that controlled and non-controlled drugs would require separate statements. Ms. Greenberg suggested stopping Recommendation 1.1 at e-prescribing (at networks) but then recognize the need to work with the DEA, followed by a statement about Schedule III – V and about Schedule II. Then, add in the idea that if controlled substances required a different process, the benefits might not accrue. Testimony has already indicated that that many people won’t use e-prescribing under those circumstances.

Ms. Reed-Forquet suggested including the DEA’s risk assessment and issues that need to be worked through by HHS and the DEA. At existing networks, there is little incentive to break security to get an uncontrolled substance but there is a big incentive for the general population to abuse the code substances of multiple schedules (Schedules I – IV) and others. Mr. Brook added that ProxyMed has not had security issues in transmitting Schedules III – V. Dr. Cohn thought that more stringent measures might be needed in more open networks but clarified that these recommendations are limited to e-prescribing networks.

According to Ms. Greenberg, HHS cannot unilaterally accept that the HIPAA security rule is fine for all transactions because it does not have control over controlled substances. The Subcommittee could recommend that HHS “take the position that…” Dr. Cohn asked if Subcommittee members thought that Schedule II should part of the risk analysis of Schedules III – V. Dr. Steindel thought the analyses should be separate to avoid a situation in which Schedule II becomes the “bar” for the other schedules. Dr. Cohn suggested that a risk analysis is only needed for Schedule II, which Subcommittee members supported.

Further revisions suggested by Ms. Anagnostiadis were to: make the statement about the DEA’s oversight role stronger in the first sentence; eliminate State Boards of Pharmacy from the second sentence (because they have no authority over making regulations for controlled substances) but add in that HHS would work with the DEA in consultation with the State Boards. Ms. Helm thought that the State Boards should be included in the process. She would not want to see a different requirement for controlled substance Part D prescriptions vs. controlled substance prescriptions for the general population. Ms. Gilbertson emphasized the importance of making sure that a regulation or floor has a “proof of concept” with what the industry can support and as such, industry involvement in the process would be necessary for Recommendations 1.2 and 1.3. Dr. Cohn thought that HHS should work with representatives of the states to ensure uniform implementation of the DEA requirements for e-prescribing of controlled substances. Some questioned whether it was HHS’s role to work with states to effect implementation of the DEA regulations. Dr. Cohn suggested eliminating the sentence pertaining to this altogether.

Recommended Action 1.3

[original] HHS should include in its e-prescribing pilot tests the evaluation of the adequacy of the baseline guidelines for securing prescription transactions over e-prescribing networks established through Actions 1.1 and 1.2.

[later revised] HHS should work with DEA and State Boards of Pharmacy relative to supporting analysis into the potential risk associated with sending prescriptions for Schedule II controlled substances through an e-prescribing network as established in the baseline guidelines.

Observation Two: “Evaluating the Feasibility of Strengthening Authentication Requirements and Providing Non-Repudiation”

Today’s HIPAA security rule requires adoption of unique user identification for access control, as cited, and procedures to verify that a person or entity seeking access to electronic protected health information is the one claimed for person or entity authentication, as cited. Within the construct of the risk analysis also required by HIPAA, as cited, covered entities may select the appropriate level of authentication. Current security services used for authentication include personal identification number (PIN), password, telephone call-back procedure, token, biometric identification, or any of these in combination. The combination of two measures is referred to as ‘two-tier authentication’. Today’s e-prescribing networks assign unique user IDs to prescribers and dispensers and require a password for log-on to the network. These authentication measures are bolstered by use of either private leased lines or security protocols for transmission of prescription transactions across e-prescribing networks. Testifying from chain and community drug stores reported that no prescriptions were accepted through email attachment or other non-secure use of the Internet. However, in the future there may be a reason to use the open Internet to send prescriptions. In this case, non-repudiation services would be critical. There may also be the need to enhance the security of prescriptions for Schedule II controlled substances. Therefore, it is important to begin exploring the feasibility of adopting public key infrastructure or other form of digital signature to strengthen authentication and provide non-repudiation.

Recommended Action 2.1

HHS should conduct pilot tests to evaluate the feasibility of adopting stronger authentication and non-repudiation measures such as (those) provided for through PKI. These pilot tests should be conducted in the general prescribing community and (should) test the ability to scale adoption of these security services for e-prescribing across prescribers and dispensers in multiple environments.

Discussion

A clarification about “pilots” was sought – do they pertain to the 2006 MMA pilot or to testing additional functionality and piloting (noting that different timeframes and technology would be needed)? Are pilots needed? If so, what is the timing? Is this a longer-term agenda for AHRQ? Mr. Blair thought that of multiple pilots, a majority would be over e-prescribing networks with at least one pilot with the 2006 MMA Pilot examining the possibility of a future over the open Internet.

Ms. Reed-Forquet pointed out the implication in Observation Two that, if other protocols conducted over private networks are server side SSL, they would be conducted over the open Internet with assurance of authentication and encryption between the end user and the application service provider. Mr. Blair and Dr. Steindel questioned the need for Observation Two, in light of what had already been said, that: the HIPAA rules apply; the dispenser is responsible; there must be security and a validation of security. Mr. Reynolds thought that Observation Two should be removed. Ms. Friedman pointed out that Observation Two opened the door to open Web-based applications. Ms. Amatayakul added that the CMS Internet policy does not allow for claims to be transmitted over the open Internet. Dr. Steindel was not interested in pursuing a PKI pilot while Ms. Reed-Forquet hoped for a pilot that would bring together health informatics standards and health information vendors’ approaches to security and digital signatures in conjunction with electronic prescribing pilots.

The challenge of how to leave the door open to new technology when moving forward, was raised (e.g., PKI and biometric technology that is not yet on-line).

Dr. Cohn thought that Observation Two was a long-term research agenda for HHS that would explore methods of improved authentication and non-repudiation (such as PKI and biometrics) that would not be limited to e-prescribing but would also move toward the NHII. Mr. Reynolds and Dr. Warren would not recommend a pilot, especially since what will happen depends upon what the DEA decides. Ms. Reed-Forquet thought that the group was grappling with whether to recommend that PKI be piloted as part of the 2006 request, which would entail putting out an RFP. If the RFP is created in a more general format, it might not be precluded from the 2006 pilots because it’s been named a long-term research agenda.

Recommended Action 2.2

HHS should conduct pilot tests to evaluate whether methods of authentication stronger than those required by HIPAA – for example, two-tier biometrics – provide sufficient additional risk protection in relation to cost as to require them for use in e-prescribing. (No discussion)

What else goes in the letter

  1. Language from the Privacy and Confidentiality Subcommittee.
  2. Recommendations about what other issues?
  3. Advice to the Secretary about the progress of the formulary identifier and other items from the first letter such as the RxHub standard and RxHub medication history (in process within NCPDP, so there may not be much more to add at present; industry input will be important). 60;

Discussion

The NPRM has said that if the formulary medication history standard gets through the accreditation process, they can be ready by Part D and adopted as foundation standards that do not need to be piloted. The codified sig could be piloted. Previous testimony should be reviewed to differentiate between foundations and pilots because of significantly different ramifications as of January 1, 2006.

Subcommittee Discussion and Planning for Next Meeting

Simon Cohn, Jeff Blair

To Do List

  • Electronic signature
  • Privacy and security issues that shift to e-prescribing
  • A directory that would identify prescribers, nursing facilities, and pharmacies (some work has been done; this was an NCPDP testimony)
  • Codification of allergens, drug interactions, and other adverse reactions to drugs (no work has been done)
  • Incorporation of indications for drug therapy into e-prescribing messages
  • Units of measure (being addressed to an extent in a codified sig)
  • Methods for patient identification for e-prescribing
  • Confidentiality
  • General MHII issue
  • Use of the national health plan ID for e-prescribing
  • Formulary identifier
  • Exchange of medication history among all participants in the e-prescribing process
  • Exchange of medical history within the e-prescribing process (longer-term “to do”)
  • How to ensure the interoperability among e-prescribing standards (being worked on)
  • Standard codes for orderable items (no work has been done but this is being addressed in a context of RxNorm)
  • Exchange of drug labeling an drug listing (cannot comment but may want to say that SPLs are working and moving forward)
  • Clinical decision support in e-prescribing (Subcommittee has investigated; reference white paper developed on clinical support)

Mr. Cohn thought that the Subcommittee might want to update on progress relating to HL7 and NCPDP for prescribing in the letter to the Secretary and in the NPRM letter.

Regarding the Notice of Proposed Rule, Mr. Reynolds and Mr. Blair will take the lead (conference calls will be set up). Mr. Blair thought it would take two long public conference calls to finish the letter on e-prescribing and two public conference calls to comment on the regulations (comment period is through April 2005 and the full Committee needs to review the comments before sending them). Comments from Committee members should go to Ms. Amatayakul. For the NPRM letter, Mr. Blair, Ms. Friedman, and Dr. Cohn suggested comments on unresolved issues and those needing clarification or on omissions (mostly, they want to know if the foundation standards are the “right” ones). Comments should be selective and rely on the previous set of recommendations (a 16-page document that was the basis of the NPRM has already been sent). Mr. Blair humorously suggested saying that HHS based their NPRM on “excellent” input.

The intent is to complete the two letters by President’s Day (February 21, 2005)

Dr. Cohn then adjourned the meeting at 12:32 p.m.

To the best of my knowledge, the foregoing summary of minutes is accurate and complete. To the best of my knowledge, the foregoing summary of minutes is accurate and complete.
/s/ 9/21/2005

Co-Chairman Date

 /s/ 9/21/2005

Co-Chairman Date