MaceMed and Related Activities

1. MaceMed and Related Activities Rob Carter Duke University rob@oit.duke.edu 12 January 2001

2. Origins of MaceMed • Originated with Mace discussions about HIPAA impact on universities with medical centers • Ken convened initial gathering at I2 Fall 2000 I2 member meeting in Atlanta • Co-chairs: Rob Carter (Duke University) and Jack Buchanan (UT Memphis/VA Hospital) • Current members include representatives from Internet2 & various universities w/ medical centers (Hopkins, Wisconsin, Pitt, UWash)

3. Activities to date • Conference calls • Discussion to date focused on three topics: • Scoping: What is our purpose? • Identifying existing initiatives and other groups to build relationships with (Mace Shibboleth, AAMC, HealthKey, HEPKI-{P,T}AG) • Defining initial projects and objectives

4. MaceMed Scope • Originally identified as “middleware issues for academic medical institutions”, with focus on HIPAA-related issues • Recent discussions leaning toward somewhat wider view • Starting with a traditional view of “middleware” (authn, authz, directories), but with an eye toward potentially expanding scope into medical “upper middleware” (terminology mapping, etc.)

5. Issues of Interest • PKI, PKI, PKI • HIPAA P&S requirements add up to at least one thing – PKI is in our not-so-distant future • Large medical centers have special needs for authn portability, scalability, reliability, and managability • Academic medical centers complicate the issue by fostering collaboration and supporting academic research relying on “covered” info

6. Issues of Interest (cont’d) • Directory design and interoperability • Authz issues more complex in medical environs • Only made more so by HIPAA P&S regs • Roles and relationships unique to medical situations – patient/provider, provider/payer, provider/credentialer, etc. • Academic medical centers exhibit much higher incidence of inter-institutional collaboration and referrals – standards and interoperability

7. Related Work in Progress • HealthKey (http://www.healthkey.org) • NC, UT, MA, WA healthcare group consortium • Developed recommendations for PKIs for healthcare • Working under Robert Wood Johnson grant to develop PKI bridge technology for use in healthcare industry • Working with Federal PKI bridge authority to ensure interoperability with HHS, DEA, etc. • Hoping to have pilot bridge ready in March, 2001 • Interestingly, not really working on directory issues & authz

8. Related WIP (cont’d) • AAMC HIPAA response/cookbook • Collaboration between I2, AAMC, and others • Producing a document to describe how academic medical centers should go about complying with HIPAA P&S requirements • Document recently finalized -- may be reviewed by HHS as well • Other I2 groups • Shibboleth (inter-inst authz) HEPKI-PAG (PK policy), Apps Health Sciences Initiatives group

9. MaceMed 1st Project: MeduPerson • We’re impressed with the EduPerson directory definition – succinct compared with other proposals for healthcare • EduPerson doesn’t cover requirements of medical centers – roles and relationships need to be defined specific to medical environments • Considering a similar definition for academic medical centers which will maintain interoperability with EduPerson but support medical needs

10. Contacts • Rob Carter rob@oit.duke.edu • Jack Buchanan buchanan@memphis.mecca.org • Hoping to have web site @ middleware.internet2.edu soon • Macemed@internet2.edu mailing list