Boston PING Project

Journal of the American Medical Informatics Association Volume 12 Number 1 Jan / Feb 2005 47 OriginalJAMIAInvestigations Model Formulation j The PING Personally Controlled Electronic Medical Record System: Technical Architecture WILLIAM W. SIMONS,MS,KENNETH D. MANDL,MD,MPH,ISAAC S. KOHANE,MD,PHD Abstract Despite progress in creating standardized clinical data models and interapplication protocols, the goal of creating a lifelong health care record remains mired in the pragmatics of interinstitutional competition, concerns about privacy and unnecessary disclosure, and the lack of a nationwide system for authenticating and authorizing access to medical information. The authors describe the architecture of a personally controlled health care record system, PING, that is not institutionally bound, is a free and open source, and meets the policy requirements that the authors have previously identified for health care delivery and population-wide research. j J Am Med Inform Assoc. 2005;12:47–54. DOI 10.1197/jamia.M1592. The recently released strategic framework for the National als to have an integrated record over time and across institu- Health Information Infrastructure calls for the creation of per- tions to securely store and access that record and to have fine- sonal health records.1 Personally controlled health records2,3 grained control in delegating access to portions of that record. represent a subset of the possible implementations of per- The PING architecture will support the evolution of underly- sonal health records in that they are designed to exist outside ing data models such as the HL7 RIM and LOINC8 as well as the administrative structures of any particular health care in- specific applications that can be built to serve local needs, stitution.1,4,5 Most existing personal health record systems are such as online scheduling of appointments and patient–doctor institution- or company-specific repositories for health infor- communications. We want to describe the architecture for mation.6 We have designed and implemented an instance of three reasons: first, to use the architectural description to fully an interoperable, personally controlled health record that specify the desiderata that we had previously alluded to only we call the Personal Internetworked Notary and Guardian elliptically and thereby provide grounds for very specific (PING).7 PING has been designed to capture the usage, con- agreements or disagreements with our design choices; sec- trol, and range of policies that we have previously described, ond, to motivate others to take our free open-source code many of which have been adopted as part of the national base [PING software and documentation are available under agenda.4 the Gnu Lesser General Public License (Gnu LGPL) at http:// It is our goal in this paper to describe an architecture that we ping.chip.org] and implement PING applications and con- believe would enable the implementation of the national tribute their enhancements to the PING code base; third, to goals and to discuss the motivation behind each architectural encourage others to provide similar transparency and disclo- decision. The architecture that we describe enables individu- sure in the designs of other personal health records. While it has become increasingly accepted that the largest hurdles in implementing a society-wide software solution are not technical ones, the architectures of these solutions can contribute to Affiliations of the authors: Children’s Hospital Informatics Program the difficulty or ease of addressing the societal roadblocks. To (WWS, KDM, ISK), Division of Emergency Medicine (WWS, KDM), and Division of Endocrinology (ISK), Children’s Hospital Boston, date, even when consumer groups and health care institu- Boston, MA; Harvard Medical School, Boston, MA (KDM, ISK). tions have been motivated, they have been stymied by poor interoperability of software and vendor-locked, nonexten- Supported by the National Library of Medicine through contracts 4 N01-LM-3-3515 and N01-LM-9-3536. sible software that does not conform to standards. Fur- thermore, as societal concerns are likely to change, adopted The authors thank Matvey B. Palchuk, MD, MS, for his work on architectures should allow flexibility of locus of control and developing the original PING clinical document data model and access control model. They are grateful to Ulrich Sax, PhD, and capabilities. Again, not all architectures or their implementa- Lucas Jordan for their ongoing effort in defining the new PING tion are equally amenable to the necessary flexibility. record and clinical document data models. We include below, a brief scenario to serve as a motivation of Correspondence and reprints: William W. Simons, MS, Children’s our architectural decisions. The scenario is annotated with Hospital Informatics Program, Enders 1, 300 Longwood Avenue, the relevant architectural components. These components are Boston, MA 02115; e-mail: <[email protected]>. illustrated in Figure 1 and described in detail in the following Received for publication: 03/26/04; accepted for publication: 09/21/04. section. 48 SIMONS ET AL., PING Electronic Medical Record System that the dose is incorrect and that she has notified her local pharmacy. At the end of the visit, Dr. First informs Jill that given the strong family history of ovarian and breast cancer, she might want to consider genetic testing. After further discussion, Jill wants to think about it some more, and so Dr. First uploads the consent and also an order form that she can bring to, or electronically share with, a regional commercial laboratory where the blood sample would be obtained. He also asks her if she could provide him read access [Authorization Module] to the result and she immediately agrees. However, when he asks her if she would like to make her PING record available [by providing read access to a PING polling program (PING Client)] to an anonymized population-wide query of patients at high risk of breast cancer, she expresses reservations. Five weeks later, the genetic test comes back with equivocal results. It does not seem that Jill has any of the known cancer-associated mu- tations in the genes that they tested, but there is a novel, possibly clinically irrelevant mutation on one gene. Dr. First immediately re- fers her to a genetic counselor at the New Cancer Center (just across the street from WMC but a direct competitor of WMC). Jill asks her family members whether any of them have had the same test. One aunt has done so, and Jill provides her with a cover sheet that she can use to fax [PING Client] a copy of that test into the family history section of her PING record. Jill meets with the genetic counselor who was able to review, before the meeting with Jill’s explicit permission, the primary documentation of the WMC stud- ies, Jill’s genetic test, her aunt’s test, and all the notes and tests per- formed by Dr. First. PING Overview For those who are unfamiliar with PING, it is a system designed as a fully distributed electronic medical record in which patients have control over who can read, write, or modify components of their records. It is not designed to be the primary record of the health care system but a comprehen- sive compilation of all medical data longitudinally across the patient’s history. PING allows a patient to make and maintain his or her own electronically collated copies of his or her record encrypted in a storage site of his or her choosing. Storage sites can range from server farms to individual Internet server provider (e.g., America Online) accounts. Access, authentication, and authorization all occur on one of several available PING servers, which are also responsible for encryption of the record. To date, PING systems have shown early promise through prototype applications at Figure 1. PING layers. Children’s Hospital Boston and in primary care clinics and unconventional venues for health care (e.g., supermarkets) in Canada. The latter have been developed independently Scenario by developers using the aforementioned public open-source code base (see Validation section). Specific applications for Jill [PING Actor] is visiting her primary care physician, Dr. First these pilots include maintaining continuity after discharge [PING Actor] who is conveniently located a half mile down the from the emergency department and integrating the pharma- dirt road. She just has had a yearly repeat mammogram at the cist and dietitian into the documented care of the patient. Women’s Medical Center (WMC) 20 miles away where she ‘‘loaded Currently, the largest PING development effort is to provide up’’ her PING record with the images and reports via the WMC’s an integrated view of patient populations in the New patient portal [PING Client]. Dr. First reviews the mammogram England area under routine and disaster conditions.9 and compares it with the last two, also obtained at WMC. There are no changes. As Jill is currently taking L-thyroxine for hypothy- Background roidism, he reviews the dose, uploaded [PINGTalk, Communication The PING architecture is not the first model to address Layer] into the PING record from one of the two regional pharmacy the issues involved in allowing patient access and participa- benefits management companies and notes that she is taking ten tion in the development of their medical records. Care- times the dose that he had prescribed. Before he has a chance to be Group, a multihospital and physician practice network in alarmed, he sees an annotation entered by Jill in which she notes eastern Massachusetts, has developed an application called Journal of the American Medical Informatics Association Volume 12 Number 1 Jan / Feb 2005 49 PatientSite10 that seeks to address some of the aspects of per- Finally, when an actor A is acting as a proxy for another actor sonal health records.

Load more