 | |||
|
Wednesday May 15 2002 Web Services Solution for HIPAA Compliance Using J2EE-based Web Services Printer-friendly
HTML version The Health Insurance Portability and Accountability Act (HIPAA, The Act) is poised to become the next Year 2000 or Euro issue in terms of deadlines and revenue expenditures. What sets The Act apart from Y2K, however, is the geographical impact region - only the USA in this case. Just as solution providers are rising up after the economic downturn, this is a golden opportunity to both bring in new business and introduce new technologies into an otherwise legacy applications sector. This article looks at a J2EE-based Web Services methodology which can be used to provide industry standard solutions. Introduction The Act was passed by Congress in August 1996, and has two goals - improvement in system effectiveness, and protection of confidentiality. In an attempt to reduce healthcare costs and improve efficiency, The Act calls for simplification of administrative procedures and mandates health care organizations to implement standard formats for all transactions. The Act clearly defines requirements for storing patient information before, during, and after electronic transmission. It also identifies compliance guidelines for critical business tasks such as risk analysis, awareness training, audit trail, and disaster recovery plans. The major changes mandated by The Act cover the following five functional subgroups:
Apart from defining mandated transactions, The Act also sets severe penalties for non-compliance. What The Act Covers Any exchange of electronic data between two parties covered by the HIPAA legislation constitutes a transaction. The Act makes it compulsory for all such electronic transactions to conform to ANSI X12 EDI standards. The health care industry currently has more than 400 electronic data information (EDI) formats in use by various players. The Act applies to all healthcare service providers handling personally identifiable healthcare information. This includes, but is not limited to, healthcare providers, payers, clearinghouses, and insurance companies. The following are the major aspects of HIPAA that need to be addressed at any stage of a HIPAA solution:
For an indication of how many people are going to be affected by The Act, take a look at "Provider's HIPAA implementation points out policy strengths, areas of need", being the final instalment in a series from searchSecurity on HIPAA compliance, published 04 February 2002: http://searchsecurity.techtarget.com/originalContent/0,289142,sid14_gci799969,00.html Why a Web Services Solution Most of the bigger health organizations have their data on legacy systems. For such systems there are three solutions on the frontier to address the HIPAA mandates:
Web Services can overcome integration problems across different systems running across different platforms. In the data interchange process XML can be used to integrate applications by minimizing effort previously required for data transformation across different platforms. Moreover, it's easily extensible, scalable, and highly portable. Web Services are a very promising candidate for a solution to HIPAA compliance, since they enable application integration regardless of programming language or operating environment. Web Services concepts would introduce a single model for transaction, security, and so on. Moreover, business people would be able to visualize and design business processes and map process activities with Web Services without referring to technology. With strong vendor support for tools and frameworks to develop, deploy, and implement Web Services, it's very important to understand the thought process behind using Web standards like UDDI, SOAP, and WSDL while implementing a HIPAA solution. Why J2EE Platform There are some compelling reasons why Sun Microsystems' Open Net Environment (Sun ONE) makes a viable business choice. 1. Comprehensive API suite 2. Consistent Environment Security
3. Easy Integration of Additional Security
Technologies High Level Architecture Let us see the architecture of a typical form this solution will take:
In this solution, we provide wrapper functionality over the existing legacy applications. This is similar to the HIPAA accelerators provided by Microsoft for Microsoft BizTalk Server. The difference is that while they are available for the Microsoft platform, we have to develop them in the J2EE solution that we have been concentrating on. Web Services can be used to handle transactions using medical code sets. They would also enable health identifiers to be uniquely identified. Electronic security features can also be implemented to ensure that security and privacy standards for health information are met. This architecture could take two forms:
Advantages of the Architecture This Web Services architecture offers us the following advantages:
Economics The US Department of Health and Human Services estimates that The Act will cost the healthcare industry $4 billion and the Gartner Group expects that HIPAA compliance will cost around three times as much as Y2K compliance for the healthcare industry. Let us compare the economic parameters associated with putting a HIPAA solution in place the traditional way and using Web Services:
These costs prove that the payback period of such a solution is better than a conventional solution. The Web Services methodology also promises faster break-even point. What it also assures is that total compliance with The Act is possible even if someone were to start from scratch at so late an hour. The capability and maturity of the platform is ours for the taking. Summary J2EE has already overcome most of the effective distributed computing issues. By Q1 2003, SOAP and XML APIs will appear in the J2EE standard. Service providers can choose iPlanet and other third-party tools to implement Web Services solutions without a huge investment in developer expertise on Sun ONE. The bottom line is that the XML SOAP wrappers no longer need to be hand coded. With full API support, it should become even easier to develop Web Services on the Sun platform. This means that any HIPAA solutions developed now would become far superior in their quality and after-deployment support by the time the legislation is enforced. Whatever the solution, the interoperability of Web Services and the healthy competition between the two will ensure that the investments immediately made in either of them would protect investments and leverage existing applications for a long time to come. The extended PDF version of this article is available now. J2EE
based Web Services Solution for Health Insurance Portability and
Accountability Act Compliance by Kapil Apshankar Adobe Acrobat format (PDF) - 83K Keep up to date with all the new articles and features on
Web Services Architect: |
