Interstate Data Sharing: Sorting FACT from Fiction

Since their inception, prescription monitoring programs (PMPs) have proven to be effective in combating prescription drug abuse and misuse on a local level. However, the issue of individuals crossing state lines is an often-cited priority that is not addressed by traditional PMPs. An effective way to address this missing piece is by creating a holistic view of all the controlled substance prescriptions a person has received, regardless of the pharmacy or the state in which those prescriptions were dispensed. This view can be provided by a state PMP that is supported by an interstate data-sharing infrastructure.

Providing this much-needed infrastructure is PMP InterConnect, an interstate data–sharing “hub.” Currently, 51 PMPs have agreed to securely share PMP data through PMP InterConnect.

The use of PMP InterConnect to share data has grown significantly from supporting a few thousand interstate transactions in 2011 to supporting more than 162 million a month in 2019.

However, the work is not complete until ALL 50 states and jurisdictions are actively sharing data and fulfilling the PMPs’ ultimate mission—to improve patient safety, curb drug diversion, and save lives.

Unfortunately, barriers still exist to realizing this mission. Many of these barriers relate to misinformation regarding the technology standards of PMP InterConnect.

Following are some of these misconceptions and the facts behind them:

Misconception/misinformation:

PMP InterConnect does not fully conform to the Prescription Monitoring Information Exchange (PMIX) Architecture for PMP interstate data sharing.

FACT:

PMP InterConnect was developed using all of the standards utilized by the PMIX Working Group at the time PMP InterConnect was created. PMP InterConnect data payloads use the exact same National Information Exchange Model (NIEM) Information Exchange Package Documentation (IEPD) data standard as defined in PMIX to facilitate the information exchange of patient prescription drug history information. All PMP InterConnect data payloads validate against the XML schema as defined by the IJIS Institute in the ijis_pmix_III_niem_2_0_iepd_v0_20_20101108 version of the PMIX standard.

To secure the data, PMP InterConnect utilizes REST as the transport protocol for connecting the state web services, and key encapsulation for encryption of data, both of which are industry standards. PMP InterConnect provides a secure, functional, easy-to-use system agreed upon by 45 PMPs.

Misconception/misinformation:

PMP InterConnect has security issues and does not conform to the security and encryption standards set forth in the PMIX Architecture.

FACT:

PMP InterConnect utilizes a secure standard for data encryption and transmission. It is a well–recognized and widely adopted standard across multiple industries. In fact, PMP InterConnect uses the data security standards that are most common in the health care industry. Furthermore, it complies with the federal standards set forth by NIST 800-53.

PMP InterConnect has an annual Health Insurance Portability and Accountability Act (HIPAA) audit and is confirmed to be HIPAA and HITECH compliant. PMP InterConnect has also been audited by states and deemed secure.

It should be noted that at no time can PMP InterConnect decrypt the protected health information or personally identifiable information that is passing through it. The message is encrypted and confidentiality is guaranteed from end to end.

PMP InterConnect continues to meet security standards and obtain third-party audits every year to ensure that states’ data is secure.

Misconception/misinformation:

States receiving federal grants to operate their PMPs are required to use a hub that conforms to the PMIX standard and may lose future Bureau of Justice Assistance (BJA) grant funding if they connect to PMP InterConnect.

FACT:

Since 2012, BJA has provided the following guidance to states to allow for the use of PMP InterConnect: “ . . . BJA will immediately permit HRPDMP grant funding to be utilized for implementation of PMP InterConnect solution for those states that require it.”

See https://www.bja.gov/Programs/PDMPPolicy.pdf

Summary:

The effort to create an interstate data–sharing infrastructure predates PMP InterConnect by six years.

In late 2010, several states, frustrated by the slow progress, sought to develop an interstate data sharing hub based on the state PMPs’ standards and needs.

With a strong focus on implementing a working hub that supported the secure exchange of data between states, PMP InterConnect adopted state requirements as defined in 2010 and added well-established technology standards related to security, encryption, and connecting systems. After intensive development activities over seven months, PMP InterConnect was launched in mid-2011 and connected four states that same year.

All of the 50 PMPs that participate in the PMP InterConnect data-sharing arrangement have focused on developing and operating a highly secure system that supports real-life exchange of patient data with authorized users to improve patient safety and minimize drug abuse, addiction, and diversion.

This relentless focus on practical, real-life solutions has led to the tremendous growth in participation—nearly 90% of the nation uses PMP InterConnect to exchange data for hundreds of millions of patient encounters each year.

Our goal is for every PMP to be able to connect with every other PMP.

PMP InterConnect is capable of sharing data among all 54 PDMP programs today. Technology is not a barrier.