[WSO2 Summit Americas 2020] Healthcare Interoperability Through FHIR® APIs.pdf

6640 © Prime Therapeutics LLC CONFIDENTIAL
Healthcare Interoperability Through FHIR® APIs
Murad Merchant

6640 © Prime Therapeutics LLC CONFIDENTIAL
• Prime Therapeutics Overview
• Healthcare Data Background
• Overview of the CMS 9115
• What is FHIR®
• Interoperability Mandate Impacts to Healthcare
• Prime’s Approach to Interoperability
• Prime’s API Journey
Agenda

6640 © Prime Therapeutics LLC CONFIDENTIAL2
Who is Prime Therapeutics
Prime Therapeutics
• While a health plan like Blue Cross Blue Shield manages medical benefits, Prime manages pharmacy benefits. We also work
together to effectively manage specialty prescriptions that are covered by the health plan.
• We work closely, and sometimes behind the scenes, to help make the pharmacy benefits package provided from the health plan
stronger.
• When a PBM and health plan are integrated, like Prime is with Blue Cross health plans, it gives a bigger picture. Everything we
do has its roots in the integration of medical and pharmacy data. That’s how we help employers find more ways to lower overall
health care costs—in a way other PBMs can’t.
• Prime works with your company to manage costs by providing the right formulary (list of medicines covered by insurance) and
creating and maintaining clinical programs for specialty and other drugs.
• Prime collects and uses data to develop more effective programs through next generation analytics, which can improve
outcomes.
Prime is a pharmacy benefit manager (PBM). Health plans contract with pharmacy benefit managers
(PBMs), like Prime Therapeutics (Prime), primarily for processing and paying prescription drug claims.
But there’s a bigger picture. Prime helps members get the medicine they need to feel better and live well.
Our pharmacy experts work hard to make medicine more affordable and experiences for members easier.
Benefits of a PBM:

Healthcare data background
State of Healthcare Data
Healthcare data exists in organizational silos. Information is duplicated to process patient cases, but the
Patient themselves must work hard to get their data.
Advent of personal devices like Wearables, IoTs, Mobile Devices, etc. have changed how patients are
managed and the data they need.
• Until recently most Providers kept paper
medical records
• Affordable Care Act (ACA) mandated
Electronic Medical Records
• Patients have limited capability to access
their physician's reports
• Most integration between healthcare
organizations is through batch files
• File structures and information in these files
have not changed in a long time
• Most patient payment data is shared as
paper record

Overview of the CMS 9115
Overview of CMS 9115-F Interoperability Requirements
The Interoperability and Patient Access rule was issued May 1 by the Centers for Medicare and Medicaid Services (CMS)
It requires some lines of business to meet certain requirements regarding patient access to their health care information, including requirements related to
application programming interfaces (APIs). CMS 9115-F applies to Medicare Advantage (MA) plans, Medicaid, Children’s Health Insurance Program
(CHIP) and Health Insurance Marketplace (HIM) qualified health plan (QHP) issuers in the federally-facilitated exchanges (FFEs)
CMS 9115-F Rule reference standards established by the ONC 21st Century Cures Act (Interoperability, Information Blocking, and Certification Program).
Key Payor Requirements:
➢ Patient Access API - Implementation Date: January 1, 2021
- Implement a standards-based API to enable members to easily access their claims information including cost and a subset of clinical data through a
third-party application.
•Claims information must be available within 1 business day after the claim is adjudicated.
•Clinical data such as lab results maintained by the plan.
•Drug benefit data, pharmacy directory information, formulary or preferred drug list
➢ Provider Directory API – Implementation Date: January 1, 2021
- Make provider directory information publicly available via a standards-base API.
- Providers will be required to maintain their digital contact information in the National Plan and Provider Enumeration System (NPPES)
- Includes names of providers, addresses, phone numbers and specialty
The effective date of the API provisions is Jan. 1, 2021
(CMS is not expected to enforce these provisions until July 1, 2021 because of the COVID-19 pandemic, and to provide additional flexibility to payers).

Overview of the CMS 9115
ONC Twenty First Century Cares Act
Interoperability mandate refers to ONC 21st Century Cares Act. It establishes HL7 FHIR® as the
interoperability standard. The mandate highlights three areas of focus.
The rule unlocks Patient data from healthcare organizations with a anti information blocking mandate. It
requires organizations to enable APIs. It allows certified developers to offer patients their applications
which can consume these APIs

What is FHIR®
What is Fast Healthcare Interoperability Resources (FHIR® ) and why do we need it?
HL7 FHIR® is an API format which enables healthcare data exchange.
Developed by Health Level Seven International HL7 a
healthcare IT standards body.
Prime created their first five APIs with FHIR® in 2019
Prime is the only PBM on the HL7 governing body,
alongside global powerhouses Apple, Amazon and Google +
some Blue Cross plans.
Promotes healthcare tech
First adopted by Electronic Health Records (EHR) and
Electronic Medical Records (EMR)
International standard with Global development
Machine readable
US standards are being defined by (US Core, Da Vinci and
CARIN) groups focused on domains
Unlocks data with security and privacy
RESTful level 2 maturity model compliant
Defines information content and structure for core healthcare
Normalized terminologies through standards bodies (RxNorm,
SNOMED, ICD, LOINC)
OAuth 2.0 compliant
Creates a common standard interface
Removes duplicity
Encourages re-use
Conforms to industry standard terminologies removing
need for translation
Conforms to HIPPA standards
https://www.hl7.org/fhir/overview.html

Interoperability mandate impacts to healthcare
Connected Healthcare
Office of the National Coordinator of Health (ONC) plans to build on the standards created by the
interoperability mandate. Two potentials are SMART® on FHIR and CDS Hooks.
Substitutable Medical Applications and Reusable
Technology (SMART®)
• A SMART® app is a web app
• Uses HTML5 and Javascript
• Typically embedded with EHR
• EHR Data is accessed via FHIR ®
• Use OAuth 2.0 for security
• Supports smart phone and is patient controlled
CDS Hooks
• Vendor agnostic remote decision support specification
• Open source through Apache
• Emerging standards with active development and
widespread participation from stakeholders
• An external service that is invoked by the EHR via a hook
• Trust through EHR TLS endpoint using OAuth 2.0 for
security
https://github.com/cds-hookshttps://sandbox.cds-hooks.org
https://cds-hooks.org
https://smarthhealthit.org

Prime’s approach to interoperability
Approach to Interoperability Mandate
Prime is the pharmacy data provider for the interoperability mandate. We are creating FHIR APIs to meet
the mandate before 1/1/2021
Data Domain Medicare
Advantage
MA-PD Part D Medicaid MCO CHIP MCO QHPs on FFEs Accountability FHIR API
Patient Access API
Claims Yes Yes, for Covered
Part D Drugs
Yes Yes Yes Payor + PBM EOB
Encounter Data Yes N/A Yes Yes N/A Payor
USCDI Clinical
Data Classes and
Elements
Yes, to the extent
the organization
maintains the
information
N/A Yes, to the extent
the organization
maintains the
information
Yes, to the extent
the State maintains
the information
Yes, to the extent
the organization
maintains the
information
Payor
Drug Coverage
Information
N/A Yes (Formulary and
UM)
Yes (Covered
outpatient drugs
and Preferred Drug
List)
Yes (Covered
outpatient drugs
and Preferred Drug
List)
N/A Payor + PBM Plan Drug
Formulary
Provider Network API
Provider Network Yes N/A Yes Yes N/A Payor
Pharmacy
Directory
N/A Yes N/A N/A N/A Payor + PBM Network
Pharmacy
Directory

Prime’s API journey
Integration Capability Struggles
Mostly point
to point
integrations
Inconsistent
reuse
Inconsistent
security
Operational
struggles
Unique
implementation
with every
application
Growth
deterrent
Prime’s journey started like most organization. We had ERP and a single system for all compute work. Some early distributed compute
work left us a point to point integration enterprise.

Capability Uplift
Prime created an investment to uplift the capability. We focused on People Process and Technology. Our goal was to
use the right technology for its purpose.
• Project Seeded
• Hire right people
• Train them in the architecture and technology
• Utilize them to spread the knowledge
People
• Integration Competency Center
• Define the charter
• Establish ICC
• Assign people
Process
• Purchase the right products
• Forum Sentry System
• WSO2 product suite
• AppDynamics
Technology

Security Gateway
Security Gateway architecture change

Integration and API Gateway
Integration architecture change

WSO2 Suite
WSO2 Product Suite

Application Performance Management
AppDynamics – Monitor Service Flows

Process Uplifts
Prime focused on improvements next. We added CI/CD pipelines to improve deploys. We also introduced and add an
Integration Competency Center (ICC) to the enterprise.
“Well-run enterprises are creating a new IS function,
the Integration Competency Center, to streamline and
improve their application integration activities”
“It is a full-time, permanent group that operates as a
service center to other parts of the enterprise”
The ICC is a “organization body that brings the
diverse skill set together helps create focus,
momentum, critical mass, processes and standards
required to build and execute a world-class
application integration strategy.”
Source: Gartner Group

Uplifting Competency
Integration Competency Center (ICC) has improved consistency and federation of use. We now have a community of
practice (CoP) to share knowledge amongst developers
• Build processes
• Architect and advise SOA project activities
• Coordinate with PMO to manage the SOA project lifecycle
Process
• Best Practices
• Standardization of architecture and integration product rolesStandards
•Provide a governance role for reusable components
•Support a business-aligned IT Strategy by managing the integration strategy
•Establish and maintain partnerships with other governing bodies
•Define business ownership of APIs
•Evangelize SOA within the IT organization
Governance
•Internal Competencies
•Create APIs that extend business capabilities to consumers improving user
experience
•Accomplish enterprise wide SOA transformation through iterations based on
reusable artifacts
•Create measurable improvements
Improvements

Uplifting Deploys
Partnering with WSO2 Prime created Ansible scripts and Jenkins pipes to implement Continues Integration and
Controlled Deployments. Prime is in a regulated industry, therefore production deploys must follow a process.

FHIR based standardized APIs
Coverage
Explanation of Benefit
Medication Knowledge
Claim
Coverage Eligibility Request
Search and view prescription plan and enrollment information for your members
Provides a summary of paid claims covered by a member's prescription plan. Includes:
summary claim information; and adjudication information from the processing of a claim.
Search and view all medications regardless of coverage to find drug form, ingredients,
strength, and packaging. Example: 100 capsules of Amoxicillin 500mg per bottle.
Find estimated cost for a drug based on your Member’s prescription plan. A provider issued list of professional services and
products which have been provided, or are to be provided, to a patient which is sent to an insurer for reimbursement.
Check to see if a drug will be covered under your Member's prescription plan. Patient and insurance
coverage information is provided with information regarding whether the stated coverage is valid and active.
Prime moved to (standard create once use many type) APIs for our consumers. This was a new concept for Prime as
Prime customized APIs for each consumption use case.

Security Uplift
Prime uplifted API security stance by including dynamic OAuth tokens. WSO2 helped Prime implement and adapt use
of OAuth grant types.
Forum Sentry – Allow X.509 pass-thru
Single Service account per
consumer(Client/Vendor
etc.) to access all APIs
Provision X.509 credentials
for mTLS
WSO2
Solution Context Diagram
Final
7/8/2019Author:Mohammad Mohsin
Page-1
Data
Store
File/
Document
Note /
Comment
Role/
Actor
Legend
Modified
Existing
Retire
Function/
Object
Business
Process
Platform
Internal
Application
External
Application
Component
External
Entity/
External
Group
Internal
Entity/
Internal
Group
New
Callout
API Manager
1. Registers API
consumer and
generates Consumer
Key + Secret
Identity Server (IS)
Policy Manager
API Consumer
API Support
2. Provides Consumer
Key + Secret to
access API
3. X.509 Call with API Key + Secret
EI/ESB
7. Forward the JWT
(JSON Access Token)
8. Entitlements
9.Permit/Deny
conditions
DSS
10. conditions
Data Service
IDP
API Gateway
4. Validates the
key/secret
Service Accounts
(Consumer Key +
Secret)
AD Group
Token Server
5. Returns Oauth Access Token with expiration
API Store
Coverage API EOB API
Patient API
6. Calls the API with Oauth Token
3. X.509 Creds Pass-thru
With API Key + Secret
8
8
** The Security call out is about Audit Logging and if we
should send all security audit logs to Qradar, or send logs
to WSO2 and have WSO2 send alerts to Qradar.
2 5 9
Access control restrictions:
- FEP
-FEP VIP
- Client code filter
- Any other Prime s Privacy rules/filters
API Ops Team
managed
** Audit Logs or
Alerts to QRadar

Open ID Connect
Partnering with WSO2 Prime is working on implementing Open ID Connect. Prime plans to implement identity provider
services and policy decision & enforcement service.

Partnership
With the success of FHIR APIs and as CMS mandated interoperability, Prime partnered with WSO2 to create a product
update to bring FHIR connectors to WSO2. As the Healthcare advisory council co-chair Prime worked with WSO2 to
stand up the Healthcare Integration vertical. This led to the Platform which Nirmal will talk next.

Questions

[WSO2 Summit Americas 2020] Healthcare Interoperability Through FHIR® APIs.pdf

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to [WSO2 Summit Americas 2020] Healthcare Interoperability Through FHIR® APIs.pdf

Similar to [WSO2 Summit Americas 2020] Healthcare Interoperability Through FHIR® APIs.pdf (20)

More from WSO2

More from WSO2 (20)

Recently uploaded

Recently uploaded (20)

[WSO2 Summit Americas 2020] Healthcare Interoperability Through FHIR® APIs.pdf