Senior lawmaker pushes on EHR access issues

A top appropriator wants answers on how clinicians at the Department of Veterans Affairs will access information on the shared electronic health record system being implemented by the Department of Defense and VA.

Rep. Debbie Wasserman-Schultz (D-Fla.), who chairs the Military Construction and Veterans Affairs subcommittee of the House Appropriations Committee, said she's hearing about "huge access issues" related to the security authorization levels required to use the DOD's MHS Genesis system.

VA Inspector General Michael Missal, who testified at the panel's March 13 hearing, said the issue in part centers around differences in DOD and VA credentialing. Some accommodation must be made for the VA's use of the PIV card -- a personal identity verification system that contain employee data, biometric information and encryption key -- to access data in MHS Genesis. Currently MHS Genesis is configured to accept the DOD's CAC card credential.

Additionally, even within VA, obtaining PIV credentials can be difficult. Missal said that medical residents who work in the VA system have a hard time obtaining PIV cards and use "workarounds" to get into the current Vista electronic health record system.

"It's hard just to get into the VA system," Missal said. "If you increase security -- it's going to be that much more challenging."

David Norley, a spokesperson for the Defense Healthcare Management System, which is managing the initial rollout of the Cerner-based MHS Genesis system, told FCW in an interview that different security requirements isn't impinging on the ability of VA clinicians to access health data.

"This is a non-issue," Norley said, noting that VA and DOD clinicians already routinely swap data using the Joint Legacy Viewer system that connects Vista with a host of DOD legacy systems and the new MHS Genesis record.

"The technology is there. We just have to level the policies," Norley said. "We don't see that there's an issue that would put anything on delay."

Norley indicated that plans to configure the Cerner system to accept CAC cards and PIV cards were in the works.

"The CIOs at DOD and VA are working to solve this problem," Norley said. He added that the problem is really one of layers upon layers of legacy requirements that are applied to all DOD business systems.

"With MHS Genesis, because we're bringing another agency into it -- it means we find out our policies might be arcane or don't apply or need to be updated," Norley said. "In the process of bringing VA into the DOD health record, DOD is committed to doing that. We are all-in on the DOD-VA electronic health record, and we'll make the policy adjustments necessary to do that, provided it doesn't have a risk involved to patient data and confidentiality."

How those decisions get made is also an issue for Wasserman-Schultz and for Missal.

"DOD has to sign off on any modifications that VA makes to the system," Wasserman-Schultz said in the hearing, adding that her sources tell her that "despite collaboration, DOD is the final decision maker."

Currently VA and DOD are developing business process and clinical workflows through joint councils. But Missal said it's not clear where decisions are being made. He said that after the council process, decision-making "moves to a black box," and added: "That's where we're concerned -- like who's making the decision, what information are they getting ... we haven't seen that yet."

Acting VA Deputy Secretary James Byrne told the same subcommittee on March 6 that top officials were getting closer to naming a "purple person" to act as a decider in cases where lower-level councils can't come to an agreement on workflow or business process decisions.