20240729-174857-15

eHealth Exchange Integration
No significant work on eHealth integration was completed during this period since the remaining work cannot be performed until the DURSA is signed by BJA. That said, discussions have been held with the IJIS and PDMP TTAC staffs and representatives from a few states regarding the feasibility of doing a state DURSA for a reduced fee to get the project into production and to demonstrate value. A call will be scheduled with Nebraska and the CDC in mid-July to explore this option.

Title V Tribal Integrations
IJIS and PDMP TTAC team members have had ongoing conversations with several state PDMP administrators and integration vendors regarding EHR integrations, working to define technical or logistical barriers while identifying potential system resources for future integration. IJIS has also continued to engage with the CDC and ONC regarding their continued promotion of state PDMP EHR integrations with non-IHS tribal health care systems.

Denver Indian Health and Family Services (DIHFS)
DIHFS integration vendor eClinical Works (eCW) refused a request from DIHFS to do the RxCheck integration, so the CDC advised that a complaint be brought to the OIG for information blocking.

On January 22, 2024, Kirk Sripinyo, Deputy Branch Chief, Affirmative Litigation Branch, Office of Counsel to the Inspector General, U.S. Department of Health and Human Services, provided an email response to IJIS’s claim regarding eClinicalWorks (eCW) data blocking and their unwillingness to engage in discussions or participation in the CDC’s Tribal Heath Care pilot project for PDMP/EHR integration with the Denver Indian Health & Family Services (DIHFS). In Mr. Sripinyo’s email response, he stated: “I’ve reviewed and discussed this situation with my team and upper management; unfortunately, we are not presently able to take further action here.” Mr. Sripinyo’s email response was forwarded to the CDC’s pilot project team members.

A follow-up meeting was held with Wes Sargent, EdD, MA (CDC) and PDMP TTAC and IJIS staff members to discuss alternatives to providing PDMP/EHR integration to DIHFS and other Tribal HCE utilizing the eCW EMRs platform. Whereas, eCW has provisioned for only two PDMP/EHR vendors, Bamboo Health (BH) & LogiCoy Health (LCY), to provide EHR/PDMP integration services and LCY, has established EHR integrations utilizing the RxCheck Hub, it was agreed upon that the 3rd party EHR vendor “LogiCoy”, would be the alternative option for eCW EHR integrations in this pilot project until such time as eCW provides additional EHR vendors or other integration options.

IJIS held discussions with DIHFS regarding the only available option for participation within the CDC’s PDMP/EHR pilot project – for DIFHS to contract with LCY to provide the 3rd party vendor services within the eCW EMRs platform. DIHFS agreed to have follow up discussions with LCY and further evaluation of participation within the pilot project. Several meetings were held with DIHFS, LCY, and IJIS staff members. LCY provided demonstrations of their EHR integration services to include both patient risk assessment prescription dashboard and healthcare provider user authentication and audit analytics.

In June, DIHFS notified IJIS that they wanted to proceed with the integration services provided by LCY and they would follow up by entering an 18-month contract period with LCY for the PDMP/EHR integration services. At the end of this reporting period, DIHFS was still finalizing the MOU so that integration efforts with LCY can begin.

Other Tribal Integrations
IJIS staff has made considerable progress in contacting and meeting with PDMP administrators in the following states to promote Title V Tribal HCE integrations: Colorado, New York, Utah, Washington, and Wisconsin. State administrators have been provided a list of potential Title V HCE within their respective states that IJIS would like to make further contact with to evaluate their ability to participate in this program. A slide presentation of the goals of the tribal integration project was prepared and is being shown on calls to inform the administrators of what the project is all about. As of this report, no administrator has refused to move forward.

HIE and HCE Integrations (non-tribal):
Growth and development continue with RxCheck/EHR integrations, both in the form of HIEs and private vendor-supported HCEs. The states of Kentucky, Maryland, Nebraska, Pennsylvania, and Rhode Island have integrated their HIEs, and Maryland and Rhode Island are using their HIEs for all statewide PDMP EHR integrations.

IJIS staff participated in calls with the CDC and University of Washington regarding integrating the Clinical Opioid Summary with Rx Integration (COSRI). COSRI is a software application for viewing controlled substances, including pain medications, dispensed for a patient, along with personalized risk factors for opioid misuse. COSRI accesses both EHR and statewide PDMP data. It uses medication and other clinical information, as well as CDC prescribing guidelines and state prescribing rules, to provide clinical decision support to help providers more safely use pain medications. COSRI is a SMART-on-FHIR application that can be implemented either as a free-standing application or integrated with an existing EHR. It is open source, with no license fees to use. The IJIS staff conducted several calls to learn more about COSRI and obtained a scope of work and cost estimate from Tetra Ventures to implement COSRI in RxCheck in the summer of 2024.

Colorado continues to add new HCE integrations to the RxCheck Hub. In addition, Colorado has expressed a desire for interstate EHR integrations, especially with its border states, and conversations are ongoing with both Nebraska and Utah. Colorado is also participating with Denver Indian Health and Family Services integration in the CDC’s non-IHS tribal pilot project.

Illinois is fully integrating all of its statewide health care providers utilizing RxCheck. The Kentucky and Utah PDMPs have continued their integration efforts, including 25 percent of Kentucky’s HCEs and 20 percent of Utah’s health care providers (121 HCEs), respectively, statewide. Nebraska’s statewide integration model has resulted in 47 entity integrations including 6 pharmacies, 16 hospitals and 649 sub entities.

General integration technical assistance was provided during the reporting period as follows:
• Colorado integrations including Denver Indian Health and Family Services, Open Arms Pain Clinic, Gunnison Family Physician of Colorado, SurgOne of Colorado, Hope in the Valley, Colorado Primary Health Care, Intermountain Health of Colorado, and Psyche Behavioral Health of Colorado.
• Kentucky – worked with OpiSafe HCE integration to whitelist them.
• Nebraska – began discussions regarding integration of the Ponca HCE with assistance from LogiCoy.
• Oklahoma – began making calls to the PDMP to determine if they would be open to integrating Tribal HCEs.
• New York – efforts continued to integrate St. Regis Mohawk Indian Tribe and Langone HCE using Cerner EMRs
• Utah – worked with Athena integrations and with Revere Health instance to update their new IP address.
• Washington State – began discussions regarding integrating non-IHS Tribes.
• Wisconsin – held calls with the PDMP regarding Tribal HCE integrations.
• Several calls were held with the American Dental Association to see how they could integrate with RxCheck to connect dentists across the country.
• Held several calls with OpenEMR regarding integrations in Florida and Georgia. OpenEMR supports no-cost integrations for small HCEs.

Project Management:
Recurring project management activities continued during this period, including oversight, administration, and reviewing and approving monthly invoices of subcontractors, including Tetra Ventures for hub operations and technical support and Richard Gold Legal Services for legal review of memoranda of understanding (MOUs).

Ron Larsen, an SME consultant, continued to assist IJIS with the scope of work deliverables. Regular updates were prepared and distributed to representatives from BJA, the CDC, and PDMP TTAC, including periodic RxCheck connection status reports. Phil Winiarski of IJIS transitioned to the RxCheck project as the project manager. Bob May, the former RxCheck program director, began work on another assignment but will remain involved in RxCheck on a part-time basis.

Updated maps were sent to the PDMP TTAC team for posting on the TTAC and RxCheck websites. Excel spreadsheets were maintained to document all RxCheck activities within each state, including tracking transactions, interactions with the state, PDMP onboarding to authorize RxCheck accounts, etc. Monthly progress reports were prepared and provided to IIR with the monthly invoice documentation. Periodic updates and monthly updated state status charts, power point slides, and Excel spreadsheets were prepared for TTAC, CDC and BJA.

IJIS staff attended and presented a report at the RxCheck Governance Board Quarterly Meetings during the reporting period. IJIS staff members also participated in RxCheck workgroup meetings, including the Enhancements Workgroup meeting with Maryland-CRISP PDMP and BizTek; RxCheck Marketing Workgroup which developed a promotional flyer that was posted on the RxCheck website and distributed to member PDMPs; RxCheck Website Workgroup which involved TTAC and IJIS collaboration on the new RxCheck-dedicated website that was launched on January 24, 2024.

RxCheck 3.1 update
IJIS staff updated RxCheck to 3.1 in order to enhance capabilities and bolster security measures. The update required PDMPs to download and install the new State Routing Service (SRS). Several announcements were made at the Governance Board meetings and on calls with the Executive Committee. RxCheck staff beta tested and updated the Admin Console User Manual to include the enhancements included with Version 3.1.

The 3.1 upgrade went live in production on July 31, 2023, and all jurisdictions were live on 3.1 in May 2024. Version 3.1 was necessary to implement changes recommended and approved by the RxCheck Governance Board. These changes included enabling the new features of the RxCheck SRS Heartbeat and Health Monitoring Dashboard known as "Heartbeat," as well as incorporating other important improvements to provide users with a more comprehensive and secure experience. Specific changes included: removing support for deprecated NIEM2 and NCPDP SCRIPT 10.6 interfaces; updating third-party libraries to the latest versions to address security updates; performance improvements and bug fixes; enabling SRS Heartbeat and Health Monitoring enhancement; and adding the HL7 FHIR4 interface with NIEM4 mapping.

The RxCheck Heartbeat and Health Monitoring feature allows PDMP administrators and their IT vendors the ability to monitor the state's SRS connection to the Hub. The dashboard will show the activity patterns such as a state SRS being down for an unusually long period of time (approximately 15 minutes), or a state SRS with no inbound and outbound traffic for a set number of hours. The report will utilize data from the health logs captured using continuous ping messages from the SRS. The dashboard will also produce graphic reports to illustrate the desired monitoring data. Using the dashboard, the administrators can also monitor the disk, memory, and CPU utilization of the SRS instances.

Current Connection Status:
During this reporting period, two states disconnected from RxCheck (Iowa and Idaho), bringing the total connected PDMPs to 47 (43 states, 3 territories and the District of Columbia). These states dropped their connections at the end of their CDC grants which had been funding their vendor’s maintenance cost to support RxCheck connection.

Onboarding and Technical Assistance:
Assistance was provided to numerous states and integrated entities during office hours and other times, including:
• California – RxCheck Test site query simulation, UAT Login assistance
• CNMI – assistance updating to 3.1 and UAT Login assistance.
• Colorado – RxCheck MOU Review
• Florida – RxCheck MOU Review
• Illinois – RxCheck interstate data sharing Q&A
• Kentucky – PDMP SRS technical issues with EPIC HCE, SRS assistance & interstate data sharing
• Maine - Bamboo Health SRS connectivity issue
• Maryland-CRISP – Enhancements calls and vendor BizTek discussions, NPI validation error assistance, SRS outbound errors.
• Nebraska - DMP/HCE integration audit & Heartbeat assistance.
• New York – RxConsole assistance, Timeout Errors, connection issues w/ BH vendor states
• Pennsylvania – PDMP assistance w/NCPDP & HIE interstate data sharing
• Rhode Island/RIQI – Timeout Errors, connection issues w/ BH vendor states
• Tennessee - PDMP Admin user account inactivated, MFA email request issue
• Utah – RxCheck delivery status notification messages, PDMP/HCE integration audit & Heartbeat assistance
• West Virginia – Updated to 3.1, & RxConsole access issues.
• Wisconsin – Updating to 3.1
• Multiple Bamboo states required assistance with SRS connectivity issues.

Office Hour Calls:
Numerous technical and general office hour calls were scheduled during the reporting period by PDMP TTAC and IJIS team members. These included numerous technical assistance calls/emails and HCE/EHR integration conference calls/emails. In addition, the IJIS team responded to numerous requests for technical or general operating information; assisted with HCE integrations; and participated in calls with BJA.

Conferences and Meetings:
IJIS team members participated virtually in numerous meetings, including quarterly RxCheck Governance Board meetings; RxCheck Governance Board executive calls; RxCheck Hub v 3.1 and enhancement calls; IJIS/Tetra Ventures RxCheck administrative/technical calls; eHealth Exchange calls; PMIX executive leadership calls; PDMP on FHIR weekly calls; and CDC title 5 tribal integration calls.

Support and Maintenance:
IJIS continued to support and work with PDMPs, HCEs, and integration vendors during this reporting period to assist with implementing and acclimating to the new RxCheck Hub.
Azure Government Cloud for the RxCheck production environment—IJIS staff members moved the RxCheck production environment from the Tetrus-managed cloud to the IJIS tenant and billing account during the last reporting period. This puts the RxCheck production environment under IJIS management. All Tetra Ventures RxCheck staff members retained their necessary access to the production environment. The testing and development environment is still in the public cloud managed by Tetra Ventures; however, it will also be moved to IJIS in late 2024 and upgraded to the Azure Government Cloud.

IJIS’s information technology (IT) vendor, Partnered Group, now manages the RxCheck production environment in the Azure Government Cloud, but Tetra Ventures still manages the RxCheck production application in the Azure Government Cloud.

Recurring tasks for managing the environment include maintaining virtual servers in the Azure Government Cloud, monitoring RxCheck Hub instances daily, applying Linux and third-party patch updates on the RxCheck Hub instances, running daily test transactions, monitoring Azure logs for security vulnerabilities, debugging production and connectivity issues for states, analyzing Tomcat server logs, and completing development and testing on the complex event processor for continuous monitoring.

Other routine activities include working with states and vendors integrating to RxCheck; working with Steel Patriots on SOC II Type 2 audit and HIPAA compliance controls RxCheck and IJIS; continuing to collect and review documents for the annual audit of Tetra Ventures; and updating the RxCheck Console users guide with enhanced features.

Security and Audits:
The current SOC 2 Type II audit being conducted by auditing firm 360 Advanced, which began in November 2023, is still in process. The initial requested documentation was provided and, upon review by 360 Advanced, additional clarification documentation was requested from the IJIS team (IJIS, BizTek Innovations, Partnerd Group, Steel Patriot Partners, and Tetra Ventures) in June 2024 in order to finalize the report.

IJIS, as detailed in the previous report, continues to engage Steel Patriot Partners to provide the managed security services to RxCheck to maintain compliance with SOC 2 controls and improve cybersecurity. These managed security services include Change management to create a change control process and approval workflow in IJIS’s software development tool; Quarterly web application and infrastructure penetration testing of 25 to 50 resources; Security operations center and security engineering support incident response 24/7/365; Event collection platform; Endpoint vulnerability management; and Cloud vulnerability protections.

Tetra Ventures’ Financial and Program Review Audit

During this reporting period, to comply with and be prepared for the enhanced project review by IIR, IJIS advised Tetra Ventures to provide an audit report by an independent auditor as well as numerous documents. Tetra Ventures has complied with all the document requests except the financial audit. Tetra Ventures contracted with a firm to conduct the financial audit during this period. The audit is underway for the years of 2020, 2021 and 2022.

Technology SME for PMIX Support, HL7, PDMP on FHIR Calls:
IJIS discontinued the services of Carlson Consulting for the PMIX Technical Subcommittee per direction from BJA, which has terminated support for the PMIX group. However, IJIS representatives are still participating in the PMIX Technical Subcommittee and Operations Subcommittee conference calls. The PMIX Executive Committee is now supported by NASCSA. IIR/IJIS work on the PMIX solution standardization strategy to strengthen PMIX.

IJIS participated in the HL7 and PDMP on FHIR weekly technology calls.