36C77619R0006-0002007.docx

Veterans Health Administration Office of Informatics and Analytics Strategic Investment Management

Requirements Elaboration

VA Direct Secure Messaging System For Virtual Lifetime Electronic Record (VLER) Health Work Effort Unique Identifying #20120505 Requirements Elaboration Document

September 2014

Template Version 1.0 (remove prior to publication) <Template Name> ii <Month> <Year> Template Version 1.0 (remove prior to publication)

Revision History Note: The revision history cycle begins once changes or enhancements are requested after the Requirements Elaboration Document has been baselined.

Shawn Faherty (9/11/2014)

Table of Contents

VA Direct Secure Messaging for VLER Health Requirements Elaboration Document ii July 2014 Introduction Purpose The purpose of this Requirements Elaboration Document (RED) is to highlight the business requirements in support of the Business Requirements Document (BRD) VA Direct Secure Messaging that need elaboration due to the requirements being changed, added, or descoped. The Veterans Health Administration (VHA) Virtual Lifetime Electronic Record (VLER) Health Program Office seeks the development of Direct Project for Secure Messaging, which allows for the sharing of medical information between the Department of Veterans Affairs (VA) and non-VA care providers. The intended audience for this document is the Office of Information and Technology (OIT).

Scope The scope of the VA Direct Secure Messaging for VLER Health is to:

· Provide basic email functionality to include: opening the inbox, reading messages, creating and sending a new message, replying to/forwarding messages, reading attachments, saving attachments, inserting attachments/files, moving messages, and deleting messages.

· Provide tools for designated end-users to perform administrative functions such as setting up accounts/groups without developer input for approved users of the Direct system.

· Provide reporting capabilities including recording any accounting of disclosures in the Veterans Authorizations and Preferences (VAP) system (where VLER Health Exchange disclosures are currently recorded).

· Provide the ability to send, receive, view, and save in VA, file types received from non-VA care providers, including Continuity of Care Documents (CCD), Clinical Document Architecture (CDA), and/or Consolidated Clinical Document Architecture (C-CDA) documents required for Meaningful Use (MU) Stage 2.

· Provide tools to allow creation and maintenance of a Provider Directory of VA Direct Users that can be searched and accessed by trusted Direct partners.Providing administrative tools for authorized users to create mail groups/ and contact lists.

· Provide users the ability to be “notified of” and “more confident in” knowing that their sent message was received by the intended recipient. Notification standards will be provided by the Office of the National Coordinator (ONC).

· Provide reporting capabilities Description of New Product Direct Secure Messaging will permit the electronic exchange of information over the Internet using the Direct Project standards published by Health and Human Services, the Office of the National Coordinator for Health IT. Users of Direct require a generalized, secure messaging system that is equivalent to other email systems in use within VA today (for example, Microsoft Outlook), but which can not be used to send Personal Health Information outside VA. The Direct Secure Messaging system will include functionality for sending, receiving, tracking, recalling, using and tracking notifications, and securely communicating within and external to VA.

The Direct system is an integral part of the national requirements for Meaningful Use II, and the secure exchange of information between VA and non-VA providers will assist VA to meet the Department goals of Meaningful Use certification.

Overall System Attributes Dependencies and Constraints Dependencies Since this request will follow Agile development processes, there is a dependency on creating User Stories prior to the actual stand up of any projects; Health Systems will work in conjunction with OIT and/or VLER IT support personnel to develop User Stories for the identified requirements.

Constraints Some workflows within NVCC will not allow any manipulation (to include extraction) of C-CDA attachments; as a result, some user groups will not be allowed access to perform this function andand the solution to be flexible to accommodate situations such as this that are identified.

Risks Not applicable at this time.

Text Description

Total

*Risk Impact: High, Medium, Low **Risk Severity: 1-5: 1 = High, 5 = Low

Specific Requirements

Not applicable for this effort.

VA Direct Secure Messaging for VLER Health Requirements Elaboration Document 11 July 2014 Business Needs/Owner Requirements The following are requirements from the VA Direct Secure Messaging System for VLER Health BRD that not have not been met and have either been changed, added, or descoped.

Number

Medium

Right now a pdf document opens in another window. Make this easier, e.g. Hover over and see the information about the document without opening the entire document or preview on the side.

Patient safety issue.

Low

2.26

Provide the ability to send a message to all VA Direct Users from within the Direct Secure Messaging System.

High

2.28 New

2.29

BN 3: Provide basic secure messaging (email) functionality that allows administrative users to perform an array of administrative activities for managing users, groups and directories within the Direct Secure Messaging System.

National standards are being developed. Should be an optional task for a contract in case the standard is not in place during the term of the contract.

Medium

BN 4: Provide the ability to create/run /view/print reports utilizing role based traits with varying degrees of access/authority within the Direct system

BN 5: Provide expanded services to manage both inpatient and outpatient request for services.

5.3 Elaborated

Elaborated

Note:AVS folks have a way to do this.

DAS?Policy?

Low

5.7

5.8 Elaborated

5.9

5.10

NEED

OWNR

10661

BN 7: Provide the ability to access the Direct Secure Messaging System when working in other interfacing applications without having to be logged into the Direct system.

This should occur without having to be first logged into the Direct Secure Messaging System. Provider does not want to have to log in to another system to work outside normal workflow.

CCOW compliant is an option.

Medium

7.2

NEW

Provide the ability for Direct to recognize patient context for a patient record selected in an application (for example, CPRS or eHMP) accessing Direct functionality.

7.3

NEW

Provide the ability for a third-party application to use a Direct widget to take advantage of the Direct As a Service. Widget would allow other software to include all Direct functionality, e.g. inbox, a compose message screen in their software user interface, access Healthcare Directories.

Direct provides a few lines of code that would be included by the other software package to create a “widget.”

User Story: A user in the CPRS application selects the widget and a Direct compose screen opens, allowing the user to attach a document, e.g. progress note, to a Direct message and send it to the non-VA Direct recipient entered in the To: line.

High

BN9: Provide access to test and demonstration environment(s) for Direct.

9.4

9.5

Business Use Case

Functional Requirement 1 Not applicable for this effort.

Functional Requirement 2 Not applicable for this effort.

Business Rules Enterprise Level Requirements 508 Compliance ENTR11: All Section 508 requirements will be adhered to. The Veterans Health Administration (VHA) recognizes that these are Enterprise cross-cutting legal requirements for all developed Electronic & Information Technology (IT). To ensure that these requirements are met, they are addressed through the Enterprise-level requirements maintained by VHA Health IT, Software Engineering and Integration (SEI), and Enterprise Requirements Management.

Identity Management ENTR8: All Enterprise Identity Management requirements will be adhered to. VHA recognizes that these are Enterprise requirements for all developed Electronic & IT. These requirements are applicable to any application that adds, edits, or performs lookups on persons (patients, practitioners, employees, IT users) to systems within VHA. To ensure that these requirements are met, they are addressed through the Enterprise-level requirements maintained by VHA Health IT, SEI, and Enterprise Requirements Management.

Interoperability (Executive Order) ENTR7: In keeping with the President’s Executive Order: Promoting Quality and Efficient Health Care in Federal Government Administered or Sponsored Health Care Programs, the VHA Office of Health Information (OHI) must promote quality and efficient delivery of health care through the use of health IT, transparency regarding health care quality and price, and incentives to promote the widespread adoption of health IT and quality of care. To support this mission, to the greatest extent possible, any new IT system development, or acquisition of commercial system shall:

Use interoperability standards recognized by the Secretary of Health and Human Services or the appropriate designated body at the time of the system update, acquisition, or implementation, in all relevant information technology systems.

Ensure interoperability with the Nationwide Health Information Network (NwHIN), as appropriate.

The interoperability and certification standards are constantly evolving; for questions relative to these standards, contact Tim Cromwell, Director of Standards and Interoperability.

Privacy ENTR10: All Department of Veterans Affairs (VA) and VHA Privacy requirements will be adhered to. Efforts that involve the collection and maintenance of individually identifiable information must be covered by a Privacy Act system of records notice.

Security ENTR19: The system shall comply with the laws, regulations, policies, and directives that specify mandatory encryption requirements for the security and privacy of personal health information.

HIPAA Compliance ENTR78: All efforts must be made to comply with the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule, which provides federal protections for personal health information held by covered entities and gives patients an array of rights with respect to that information.

HL7 Messaging ENTR63: The Health Level Seven (HL7) (VistA Messaging) package assists M-based applications to conduct HL7 transactions. It provides the facilities to create, transmit, and receive HL7 messages over a variety of transport layers.

Patient Safety ENTR31: All efforts must be made to comply with VA and VHA Patient Safety requirements.

Non Functional Requirements The following are non requirements from the VA Direct Secure Messaging System for VLER Health BRD that have been changed, added or descoped.

1. Operational Environment Requirements

· Provide the ability for a Direct Secure Messaging System user to log into the system either by using a VA issued PIV

· As Direct gets more usage, maintain response times to be consistent with industry standards

· User should be able to request and view a CCDA pulled from Adapter within one minute.

2. User Access/Security Requirements

· Provide the ability to validate the presence of an approved Interagency Support Agreement (ISA) between VA and the Direct partner prior to the exchange of any protected health information

Performance If this is a system modification, how many users does the current system support?

How many users will the new system (or system modification) support?

What is the predicted annual growth in the number of system users?

The system will experience exponential growth as more VA partners implement Direct messaging. We envision that the number of users will at least double annually for many years. Additional use will be driven by Direct’s role in Meaningful Use Criteria.

Availability Describe when the envisioned system will need to be available (business hours only, weekends, holidays, etc) to support the business.

The Direct Secure Messaging System needs to be available 99.9% of the time. Even during system outages, all messages need to be handled properly—either resending messages automatically once the system is available or clearly alerting the sender that the transmission failed.

Capacity What is the predicted size (average) of a typical business transaction?

In the initial stages, messages will be either text, or more likely, messages with a several page attachment. The system currently has a 4 MB limit which we are requesting to be expanded for select use cases. Generally messages will be smaller than 1 MB.

What is the predicted number of transactions per hour (day, or other time period)?

Initially the message volume will be fairly low—probably a few dozen a day. In the next few years that should increase to hundreds per day, especially as additional use cases are added.

Is the transaction profile expected to change (grow) over time?

Yes

What are the dependencies, interactions, and interfaces with other systems?

Messages are exchanged with non-VA messaging systems, so there is dependency that VA partners have properly functioning Direct systems and a federally approved level of security and trust.

What is the process for planning/adjusting capacity?

There should be no need for real time capacity adjustment in the early stages. The development teams will monitor usage and system performance and request additional capacity if needed.

Does the solution require a surge capacity that would be different from the base application?

No

Business Process Models AS IS Workflows Not applicable for this effort.

TO BE Workflows Not applicable for this effort Requirements Traceability The purpose of establishing traceability for Work Effort 20120505 is to help:

Understand the source of requirements.

Manage the scope of the work effort.

Manage changes to requirements.

Assess the work effort impact of a change in a requirement.

Assess the impact of a failure of a test on requirements. (i.e., if test fails, the requirement may not be satisfied.)

Verify that all requirements of the system are fulfilled by the implementation.

Verify that the application does only what it was intended to do.

Note: The requirements for this work effort were not entered into Rational® RequisitePro®, and should be entered into the new RDM respository by the analyst assigned to the BRD.

Appendix A Process Model Summary Report

Appendix B Stakeholders

· Cyndi Kindred, Acting Director, Chief Business Office (CBO), Purchased Care

· Stephania Griffin, VHA, Director Information Access & Privacy Office

Provide oversight of activities as relates to program office; directs work of assigned SMEs.

· Bouhaddou, Omar, Business Analyst, DoD/VA IPO, OIA VLER Health

· Teal, Jennifer, VHA, HIM Specialist

· Pugh, Peggy, VHA Privacy Specialist

· Wallace, Maureen, Program Analyst, CBO

· Whitaker, Michael, Chief, Business Process Re-engineering, CBO

· Davis, John M., VHA, OIA, Security Architect

· Shawn, Christopher, VHA, OIA, Enterprise Security

· Wilson, Janet, VHA, OIA, HIM Specialist

· Cave, Alice, VHA, OIA, Identity Management (IdM) Provide background on current system and processes. Describe features of current systems, including known problems. Identify features of enhancement. Acts on behalf of assigned program office for review of BRD.

· Maureen Wallace, Program Analyst, CBO

· Theresa Hancock, MHV Program Manager Ensure that the enhancements will account for current business processes and existing software capabilities.

Shawn, Christopher, VHA, OIA, Enterprise Security

Responsible for determining compliance with the Heath Information Portability and Accountability Act (HIPAA) and other health care security requirements for the request.

Appendix C References VA Handbook 6500 – Information Security Program http://vaww1.va.gov/vapubs/viewPublication.asp?Pub_ID=638&FType=2

Appendix D Acronyms and Definitions.

Table 1: Acronyms

Table 2: Definitions

Appendix E Approval Signatures The requirements defined in this document are the detailed functional requirements gathered during the elaboration process necessary to meet the design and development needs of Product Development (PD).

Business Liaison Signifies that the Business Liaison takes responsibility for quality and communication of said detailed requirements to include business related configuration and change management of stated requirements.

Signed: See below P. Shawn Faherty, Date: 9/11/14 Health Enterprise System Manager (ESM)

Business Owner Signifies that the customer approves the documented detailed requirements which adequately satisfy the customer’s desired needs.

Signed: ______________________________________________________________________________ 9/10/14

Glen Crandall, VHA Direct Program Manager Date image1.jpeg image2.jpeg image3.JPG image4.jpeg