Invited talk, Special Session on IEEE/UL P2933. How to avoid the standard lock-in e vendor lock-in using enterprise architectures

1. Achieving Interoperability through IHE
IEEE/UL P2933 - Special Session on IHE, Interoperability and Health IT
Massimiliano Masi
max@mascanc.net
http://www.mascanc.net
October 13, 2020

2. Introduction: Who Am I?
Java developer
IHE, Security ”specifications”
European Commission, cross-border eP/PS exchange, point of
contact with IHE
Security for Austrian, Albanian, County-wide American pilots,
South African and other African countries.
Massimiliano Masi: IHE Interoperability October 13, 2020 2/24

3. The issue
Interoperability as a key
enabler to build sustainable
health it services
HIMSS definition of
interoperability as
foundational, structural,
semantic, organizational
Cost Reduction in switching
between vendors
Massimiliano Masi: IHE Interoperability October 13, 2020 3/24

4. The issue / 2
Two effects:
vendor and
standard
lock-in
See, e.g., HL7
FHIR, v2, v3,
RLUS, DICOM
Massimiliano Masi: IHE Interoperability October 13, 2020 4/24

5. The issue / 3
Example: the
Smart Grid
M/490
identified 302
standards from
three different
bodies
Massimiliano Masi: IHE Interoperability October 13, 2020 5/24

6. The issue / 4
The project manager dilemma
How can we achieve technical and economical sustainability of a
project if there are so many competing standards, each one with
different lifecycle?
Massimiliano Masi: IHE Interoperability October 13, 2020 6/24

7. Typical hospital setting
EHR standards: HL7 CDA profile, REST, HTTP, SAML, TLS,
syslog, ebXML, vocabularies,
EMR standards: DICOM, HL7V3, FHIR STU2,3,4
Device standards: ISO/IEEE 11073-10201/10101, HL7 v2.6,
ISO 19005-1, UCUM
Architectures comes to the rescue!
There is a need of a overarching governance initiative who selects
standards and provides rules on how to avoid vendor-and
standards-lock in at a global scale
Massimiliano Masi: IHE Interoperability October 13, 2020 7/24

8. Enterprise Architectures
Reference Architecture is a set of guidelines and options for
developing specific architectures and solution implementations
Solution Architecture describes the specific business
operations/activities and the ways in which IT systems and
the underlying technology support them
Do not think directly to a solution
In (usually ”complex”) systems, defining firstly the rules on how
the various solutions will be developed, guarantees sustainability
Massimiliano Masi: IHE Interoperability October 13, 2020 8/24

9. Enterprise Architectures
Modularity
Enterprise architecture bring modularity: use cases are grouped in
building blocks, logical containers of requirements
Sustainability
IT Solution Architectures are made by assembling building blocks
according to the rules defined by the Reference Architecture. RAs,
and the modularity of the BB guarantee the sustainability of the
solution, even enabling formal reasoning over abstract assets
Massimiliano Masi: IHE Interoperability October 13, 2020 9/24

10. Enterprise Architectures
And the Governance?
Governance is achieved when an overarching organization takes
care of the maintenance of the BB.
Connecting the EU Facility (CEF) maintains the EU public
administration BB
Integrating the Healthcare Enterprise (IHE) maintains the BB
for the healthcare enterprise
Massimiliano Masi: IHE Interoperability October 13, 2020 10/24

11. IHE
A bit of history
IHE born around 2000 with a joint effort from Industry (GE,
EPIC, Cerner, Microsoft, IBM) and Academia (WU, TU
Wien, FhG)
Mission is to select standards to connect healthcare
enterprises — prior to that technologically advanced islands
Divided in application domain including IT Infrastructure, Eye
Care, Devices, Patient Care, Pharmacy, Public Health,
Research
Defining open and free specifications to be included in
intra-and extra-hospital settings
Massimiliano Masi: IHE Interoperability October 13, 2020 11/24

12. IHE
Basic concepts
Actor a functional component of the healthcare organization
(e.g., a device, a computer, a database)
Transaction a standards-based specification of the
interactions between actors
Profile a high-level functional unit composed of related
transaction with the capacity to address specific IT
requirements for a single case. Those are the IHE’s building
blocks
Massimiliano Masi: IHE Interoperability October 13, 2020 12/24

13. IHE
Basic concepts
Profiles are contained in Technical Frameworks, per each
domain, freely available
A profile contains specifications under the Actors/Transactions
formalism, on how to solve a particular clinical use case
Technical Frameworks contain mandatory rules (profile
groupings) on how profiles can be assembled together to
solve complex use cases
Grouping
IHE solutions architectures are a list of profile grouped together
Massimiliano Masi: IHE Interoperability October 13, 2020 13/24

14. Example
Use Case
”Two hospitals need to exchange data about patients”
The architect starts looking
at the available IHE profiles
Cross Enterprise Document
Sharing: ”Agnostic Data
Exchange across hospitals”
Patient Identifier Cross
Reference: ”Define a
database of common
patients identifiers in
multi-hospital setting”
Massimiliano Masi: IHE Interoperability October 13, 2020 14/24

15. Example
The solution architecture is therefore composed by the profiles
XDS, and PIX.
Mandatory Grouping!
The IHE Reference Architecture (within the Technical Framework)
prescribes the mandatory grouping with ATNA.
This guarantees the presence in each transaction of audit
trails and channel confidentiality.
ATNA as security baseline (security-by-design)
Massimiliano Masi: IHE Interoperability October 13, 2020 15/24

16. IHE
And if the technical frameworks do not include my use case?
A new profile is submitted
Continuously, new profiles can be submitted for consideration
to each domain’s planning committee, PC
PC, will add the new work items in the backlog that will be
discussed in plenary meetings
When a profile reaches the PC consensus, it goes to the
Technical Committee
TC meets 5 times per year:
1st meeting: Define the use case
2nd: selects the standards
3rd: define the variability points and creates the profile
4th: prepare the supplement for public comment
5th: review the comments and prepare for trial implementation
Massimiliano Masi: IHE Interoperability October 13, 2020 16/24

17. Testing
Testing is made at connect-a-thons
Connectathons are the official IHE testing methodology
Made worldwide (America, China, Europe, Japan, Australia,
South Korea)
Using OASIS Test Assertions
Reproducible tests
Results are publicly available
(https://connectathon-results.ihe.net/)
Project-a-thons
Massimiliano Masi: IHE Interoperability October 13, 2020 17/24

18. The IHE Model
Massimiliano Masi: IHE Interoperability October 13, 2020 18/24

19. Security in IHE architecture
Audit Trail and Node Authentication: guarantees reliable data
over unreliable network (audit trails) and the establishment of
confidential channels (TLS1.3)
Enterprise User Authentication: use of Kerberos for the
authentication of web-services and users locally
Cross Enterprise User Assertion: use of SAML for the
cross-enterprise authentication and authorization
Internet User Assertion: use of JWT for the RESTFul
authentication (e.g., FHIR transactions)
Document Encryption: CMS-based encryption of data
Digital Signature: XDS-based lifecycle for authenticated
digital signatures
Massimiliano Masi: IHE Interoperability October 13, 2020 19/24

20. Who uses IHE?
Canada
USA
The Nation Wide Healthcare Information Network
The CareQuality
Europe
The EU commission decision 2015/1302
The Cross-Border Patient Summary and ePrescription
National projects: ELGA (AT), DMP (France), EPR
(Switzerland), Italy, UK, Spain, Germany ...
Asia
Shangai Imaging Information Sharing,
Japan XDS-based regional network linking stroke treatments
Massimiliano Masi: IHE Interoperability October 13, 2020 20/24

21. Take Away Message
Standards may have enough options to allow project-specific
profiling, to be used to a broader, international scope
IHE architectural variability is defined by options in
transactions
Options could be constrained as transactions
Massimiliano Masi: IHE Interoperability October 13, 2020 21/24

22. Conclusions
We have seen
The problems of interoperability
How Enterprise Architectures help achieving interoperability
and sustainability
Enterprise Architecture in Healthcare: IHE
How IHE works
How IHE enable security-by-design
Massimiliano Masi: IHE Interoperability October 13, 2020 22/24

23. Input from Attendees / Discussion
Massimiliano Masi: IHE Interoperability October 13, 2020 23/24

24. Thank You
Massimiliano Masi: IHE Interoperability October 13, 2020 24/24