The Patient Choice Project
Phase 2: Basic Choice for Research Consent Use Case Working Session
November 18th, 2016
Call Logistics
• If you are not speaking, please keep your phone on mute
• Do not put your phone on hold – if you need to take a call, hang up and dial
in again when finished with your other call
• This meeting is being recorded
• Feel free to use the “Chat” feature for questions, comments or any items
you would like the moderator or participants to know
2
Agenda
Topic
Time Allotted
General Announcements
5 minutes
Patient Choice Use Case Development
• Use Case Timeline
• In/Out of Scope, Assumption, Scenarios
• Introduction to User Stories
50 minutes
Next Steps/Questions
5 minutes
3
General Announcements
• The Patient Choice project will meet weekly on Fridays @ 11 am ET
» The next working group meeting will be on Friday, December 2nd, 2016 at 11
am ET
4
5
Proposed Use Case & Functional
Requirements Development Timeline
Week
Target Date
Working Session Tasks
Review and Provide Comments via Confluence
(due Thursdays @ 12 pm ET)
1
11/4
Introduce Use Case Development Process
-
2
11/11
CANCELLED (VETERAN’S DAY)
-
3
11/18
Introduce: In/Out of Scope, Assumptions, and User Stories
Review: In/Out of Scope, Assumptions and
User Stories
4
11/25
CANCELLED (THANKSGIVING)
Review: In/Out of Scope, Assumptions and
User Stories
5
12/2
Review: In/Out of Scope, Assumptions, Scenarios, User
Stories
Review: In/Out of Scope, Assumptions and
User Stories
6
12/9
Review: Finalized In/Out of Scope, Finalized Assumptions
and User Stories
Review: User Stories
7
12/16
Introduce: Pre/Post Conditions
Review: User Stories
Review: Pre/Post Conditions and User
Stories
8
12/23
CANCELLED (CHRISTMAS)
-
9
12/30
CANCELLED (NEW YEAR’S)
-
10
1/6
Review: Pre/Post Conditions and User Stories
Review: Pre/Post Conditions and User
Stories
11
1/13
Review: Finalized User Stories
Review: Pre/Post Conditions
6
Proposed Use Case & Functional
Requirements Development Timeline
Week
Target Date
Working Session Tasks
Review and Provide Comments via Confluence
(due Thursdays @ 12 pm ET)
12
1/20
Review: Finalized Assumptions, Finalized Pre/Post Conditions
Introduce: Actors and Roles
Review: Actors and Roles
13
1/27
Review: Finalized Actors and Roles
Introduce: Activity Diagram and Base Flow
Review: Activity Diagram and Base Flow
14
2/3
Review: Activity Diagram and Base Flow
Introduce: Functional Requirements & Sequence Diagram
Review: Activity Diagram and Base Flow
15
2/10
Review: Finalized Activity Diagrams, Finalized Base Flow,
Functional Requirements & Sequence Diagrams
Introduce: Data Requirements, and Risks & Issues
Review: Functional Requirements &
Sequence Diagrams, Data Requirements,
and Risks & Issues
16
2/17
Review: Finalized Functional Requirements & Sequence
Diagrams, Data Requirements, and Risks & Issues
Review: Data Requirements and Risks and
Issues
17
2/24
CANCELLED (HIMSS)
Review: Data Requirements and Risks and
Issues
18
3/3
Review: Finalized Data Requirements, and Finalized Risks &
Issues
End to End Review
7
Section Review
• 1. Introduce and review the following sections:
1. Scope Items
2. Assumptions
Click the icon to
open the
Word Document
3. Draft User Stories
8
Phase 2: In-Scope
• Semantic understanding of a basic choice for research consent decision and
the corresponding information that comprises a privacy consent directive
• Demonstrate the use of computable consent to enable privacy policy
implementation and information access control decisions
9
Phase 2: Out of Scope
• The exact methods through which consent is captured, e.g., whether
consent is captured ahead of time via a patient portal or in-office using a
tablet
• The user interface presented to the patient at the time that consent is
captured
• Mechanisms for managing a privacy consent directive once supplied
» Organizational policies surrounding retroactivity, that is, how to respond
when a patient changes their privacy consent directive to “Do not share”
» Organizational policies regarding subsequent restrictions on future use
» Mechanisms to update privacy consent directives
• Maintenance and updating of consent repositories and registries
10
Use Case Assumptions
•
The requirements of the use case can be implemented in a variety of architectures
•
Researchers are aware of and comply with the federal requirements regarding consent
•
Electronic systems have the capability to manage and update consent registries/repositories
•
Electronic service information is known to all systems involved in the exchange
•
All parties in the exchange comply with applicable privacy and security rules
»
Policy is in place for handling missing or not yet recorded patient preferences for data sharing
»
All parties comply with patient privacy preferences and subsequent handling instructions unless law
requires otherwise, for example a subpoena or a search warrant
•
Disclosures are appropriately updated in the system to be reflected in accounting for
disclosures that may be requested by the patient
•
Requesting entity is verified and authorized to conduct a query for patient data
•
Appropriate security audit mechanisms are in place
•
Appropriate methods for capturing consent are in place
•
Appropriate patient interfaces are in place
11
Basic Choice for Research Consent – Use Case Development Agenda
• Lack of standards recording elements of research consent
» In scope: Common Rule Informed Consent elements, HIPAA Patient
Authorization elements, and compound authorizations
» Potentially out of scope: FDA Informed Consent elements (although the
elements are nearly identical to the Common Rule Informed Consent elements)
» Which elements are necessary to exchange/assert to indicate true consent?
• Real-Life Use Cases
» Open Discussion and ideas for research consent use cases illustrating
computable privacy – consistently capturing, communicating, processing, and
automating individual choice
» Overview of User Story 1 featuring dynamic consent/consent to re-contact
12
Common Rule Informed Consent: Elements (45 CFR 46.116)
Basic elements
Additional elements
1 Description of Study
1 Statement regarding unforeseeable risks
2 Patient risks or discomfort
2 Situations warranting termination
3 Patient benefits
3 Additional costs
4 Alternative procedures or treatments
4 Procedures for patient termination
5 Scope of confidentiality
5 Disclosure of new findings
6 Compensation or further treatment for
sustained injuries
6 Approximate number of participants
7 Point of contact
8 Statement regarding voluntary
participation
13
HIPAA Patient Authorization: Elements (45 CFR 164.508)
Core elements
Required statements
1 Description of data used or disclosed
1 Patient’s right of revocation
2 Persons authorized to disclose
1a Procedure and exceptions, or
3 Others that may be contacted for
disclosure
1b Whether noted in Notice of
Privacy Practices
4 Statement of the purpose of disclosure
2 Conditioning of services on authorization
5 Expiration date or event
2b Inability to do so, or
6 Signature and date
2c Consequences where able to do so
3 Potential for re-disclosure
14
Common Rule Informed Consent: Detailed Elements (1)
45 CFR 46.116—Basic Elements
(1) A statement that the study involves research, an explanation of the purposes of the
research and the expected duration of the subject's participation, a description of the
procedures to be followed, and identification of any procedures which are
experimental
(2) A description of any reasonably foreseeable risks or discomforts to the subject
(3) A description of any benefits to the subject or to others which may reasonably be
expected from the research
(4) A disclosure of appropriate alternative procedures or courses of treatment, if any,
that might be advantageous to the subject
(5) A statement describing the extent, if any, to which confidentiality of records
identifying the subject will be maintained
15
Common Rule Informed Consent: Detailed Elements (2)
45 CFR 46.116—Basic Elements, cont.
(6) For research involving more than minimal risk, an explanation as to whether any
compensation and an explanation as to whether any medical treatments are available
if injury occurs and, if so, what they consist of, or where further information may be
obtained
(7) An explanation of whom to contact for answers to pertinent questions about the
research and research subjects' rights, and whom to contact in the event of a researchrelated injury to the subject
(8) A statement that participation is voluntary, refusal to participate will involve no
penalty or loss of benefits to which the subject is otherwise entitled, and the subject
may discontinue participation at any time without penalty or loss of benefits to which
the subject is otherwise entitled
16
Common Rule Informed Consent: Detailed Elements (3)
45 CFR 46.116—Additional Elements
(1) A statement that the particular treatment or procedure may involve risks to the
subject (or to the embryo or fetus, if the subject is or may become pregnant) which are
currently unforeseeable
(2) Anticipated circumstances under which the subject's participation may be
terminated by the investigator without regard to the subject's consent
(3) Any additional costs to the subject that may result from participation in the
research
(4) The consequences of a subject's decision to withdraw from the research and
procedures for orderly termination of participation by the subject
(5) A statement that significant new findings developed during the course of the
research which may relate to the subject's willingness to continue participation will be
provided to the subject
(6) The approximate number of subjects involved in the study
17
HIPAA Patient Authorization: Detailed Elements (1)
45 CFR 164.508—Core Elements
(1) A description of the information to be used or disclosed that identifies the information in a
specific and meaningful fashion
(2) The name or other specific identification of the person(s), or class of persons, authorized to
make the requested use or disclosure
(3) The name or other specific identification of the person(s), or class of persons, to whom the
covered entity may make the requested use or disclosure
(4) A description of each purpose of the requested use or disclosure. The statement “at the
request of the individual” is a sufficient description of the purpose when an individual initiates the
authorization and does not, or elects not to, provide a statement of the purpose.
(5) An expiration date or an expiration event that relates to the individual or the purpose of the
use or disclosure. The statement “end of the research study,” “none,” or similar language is
sufficient if the authorization is for a use or disclosure of protected health information for
research, including for the creation and maintenance of a research database or research registry.
(6) Signature of the individual and date. If the authorization is signed by a personal representative
of the individual, a description of such representative’s authority to act for the individual must also
be provided.
18
HIPAA Patient Authorization: Detailed Elements (2)
45 CFR 164.508—Required Statements
(1) The individual’s right to revoke the authorization in writing, and either:
(a) The exceptions to the right to revoke and a description of how the individual
may revoke the authorization; or
(b) To the extent that the information in subsection (a) is in the Notice of Privacy
Practices, a reference to such Notice
(2) The ability or inability to condition treatment, payment, enrollment or eligibility for
benefits on the authorization by stating either:
(a) The covered entity may not condition treatment, payment, enrollment or
eligibility for benefits on whether the individual signs the authorization when
the prohibition on conditioning of authorizations in 164.508(b)(4) applies; or
(b) The consequences to the individual of a refusal to sign the authorization
when, in accordance with 164.508(b)(4), the covered entity can condition
treatment, enrollment in the health plan, or eligibility for benefits on failure to
obtain such authorization
(3) The potential for information disclosed pursuant to the authorization to be subject
to re-disclosure by the recipient and no longer be protected by this subpart
19
20
21
Next Steps
• Review and provide feedback to posted materials: User Stories, In/Out of
Scope, Assumptions, and Scenarios sections by the following Wednesday at
12pm ET
» http://confluence.siframework.org/display/PATCH/Phase+2%3A+Basic+Choice+f
or+Research+Consent+Use+Case+Development
• Next meeting is Friday, December 2nd, 2016 at 11 am ET
• Reminder: All Patient Choice Announcements, Schedules, Project Materials,
and Use Case will be posted on the Patient Choice Confluence page
» http://confluence.siframework.org/display/PATCH/
22
Project Contact Information
OCPO-ONC Lead
Jeremy Maxwell
[email protected]
Project Coordinator
Johnathan Coleman
[email protected]
Project Manager
Ali Khan
[email protected]
Project Support
Taima Gomez
[email protected]
Staff SME
Kathleen Connor
[email protected]
Staff SME
David Staggs
[email protected]
23
Thank you for joining!
@ONC_HealthIT
@HHSONC