zagar

The SAFE Standard:Digital Signatures for Achieving Global, Compliant Requirements for Health Care: 

The SAFE Standard: Digital Signatures for Achieving Global, Compliant Requirements for Health Care Terry Zagar Northrop Grumman Information Technology Health Solutions for the SAFE-BioPharma Association

The Business Case For SAFE: 

The Business Case For SAFE

What’s Wrong With a Signature on Paper?: 

What’s Wrong With a Signature on Paper? Signatures & signed content can be fabricated Possible to recreate a modified copy as good as, or better than, the original Growing expense: Signed record management, retrieval & storage Mailing of signed originals Physical signing process can be onerous e.g., Physician signature on each and every page of each case report form associated with a clinical trial/study Hard to recall distributed copies needing correction Physical central repository not practical

Financial Impact in Today’s Environment - Pharmaceuticals: 

Financial Impact in Today’s Environment - Pharmaceuticals Industry spends > $1 billion per year on independent identity credentialing models Over 200,000 clinical investigators sites 1,500 CRO’s 1,000 university medical centers 1,000 medical labs Total amounts to ~700,000 individual users All use independent proprietary credentials for remote access to information systems Approximately 40% of annual R&D costs attributed to paper based business processes ($9 Billion in US alone)

Financial Impact in Today’s Environment – Health Care: 

Financial Impact in Today’s Environment – Health Care New England Journal of Medicine, 2004, et.al. Paperwork = 31% of all health costs / $500 billion in 2004 Emergency Department: 1 hr. care / 1 hr. of paperwork Surgery & Inpatient Acute Care: 1 hr. care / 36 min. paperwork Skilled Nursing Care: 1 hr. care / 30 min. of paperwork Home Health Care: 1 hr. care / 48 min. of paperwork Without a legally enforceable and interoperable identity and digital signature solution, industry cannot eliminate or reduce either of these expense bases There is a clear business case for electronic signatures & records

So What’s Hindering Us?: 

So What’s Hindering Us? Regulatory Concerns Good clinical, lab, safety, and manufacturing practices; global digital signature requirements; privacy protection Legal Concerns Global operations; legal liabilities; regional acceptance Trust Concerns Digital identity; consistency across trading partners Infrastructure Concerns Reuse of current investments; vendor support; interoperability with trading partners; multiple overlapping standards Basic recognition: One business alone cannot address these

The Global Identity Challenge: 

The Global Identity Challenge 4-5x user overlap 10x+ user overlap If tackled independently  recipe for management nightmare

Enter SAFE ...: 

Enter SAFE ... Health industry partnership to address regulatory, legal, trust, & infrastructure concerns SAFE-BioPharma Association

SAFE Overview: 

SAFE Overview

SAFE Mission: 

SAFE Mission Provide a digital signature standard & associated operating rules Built on existing standards minimize reinvention Delivers unique electronic identity credentials Legally enforceable Regulatory compliant Acceptable across the global biopharmaceutical environment Provides shared services in support of health industry electronic transactions Business-to-Business Business to Regulator

SAFE & Bio-Pharmaceutical Community Timeline: 

SAFE & Bio-Pharmaceutical Community Timeline MAY 2003 SAFE  strategic PhRMA initiative DEC 2003 Seed investment  12 bio-pharmaceuticals JUN 2003 SAFE Standard v1.0 DEC 2004 SAFE-BioPharma  8 bio-pharmaceutials SEP 2005 SAFE Bridge & SAFE Standard v2.0

SAFE-BioPharma – the Association: 

SAFE-BioPharma – the Association Not for profit entity: Created by biopharmaceutical industry Not about financial return via the SAFE entity; return delivered to members through the use of the system Ensure open access to all within the broad healthcare industry Provides: Delivery & maintenance of common global standard and service offerings Outsourcing of credential providers Trust Bridge Leverage for application enablement and certification Member support Seeks to minimize financial impact to “owners/system members” “Shared-service” model Revenue stream from Member fees

SAFE – a Community Framework: 

SAFE-BioPharma Member Issuer SAFE – a Community Framework Services Certification Authority Credentials for Members Identity Proofing

Using SAFE: 

Using SAFE

SAFE Business Scope: 

SAFE Business Scope Common digital signature use & acceptance agreement  execute once Continuing accreditation & audit of Members / Issuers Capped liability limits on SAFE digital signature use Dispute resolution process & framework for SAFE stakeholders Independent certification of SAFE-enabled applications Commitment to SAFE digital signature standard  updates driven by SAFE community

SAFE Governance: 

SAFE Governance

SAFE Technical Scope: 

SAFE Technical Scope Issuance of a unique SAFE identity credential & its binding to a specific individual Provide business-to-business trust across different infrastructure implementations via the SAFE Bridge Digitally sign an electronic record or object Validate one or more digital signatures on an electronic record or object, and confirm integrity of the electronic record or object Present & display a SAFE signature on a document

SAFE Bridge: 

SAFE Bridge Ensures trust across heterogeneous Issuer systems Ensures transactional interoperability among these “bridged” systems Reduces cost & extends flexibility for SAFE Members by promoting availability of competitive external supply sources or ability to utilize internal solutions Reduces application complexity by minimizing need to cross-certify with multiple Issuers for credential validation support SAFE Bridge SAFE Issuer A SAFE Issuer B SAFE Issuer ... SAFE Member B SAFE Member C SAFE Member A Other Bridges

SAFE Signature Block – Visual Representations: 

SAFE Signature Block – Visual Representations √ Jane Doe Reason: Affirm information on Form 1472 DN: CN=Jane Doe, C=US, O=Miracle Cure Pharma, OU=000000000177 Date: 2005.10.19 20:33:07 – 4’00’ X Jane Doe Reason: Affirm information on Form 1472 DN: CN=Jane Doe, C=US, O=Miracle Cure Pharma, OU=000000000177 Date: 2005.10.19 20:33:07 – 4’00’ Valid Signature Invalid Signature Complete Validation Report Can Be Viewed & Saved for Audit Purposes

SAFE in Operation: 

SAFE in Operation

Strategic Approach to Build Critical Mass for SAFE: 

Strategic Approach to Build Critical Mass for SAFE Systems and Centers of Gravity NCI Clinical Pilot EMEA Safety Pilot Application-Enablement SAFE Bridge CA CRO Enablement SAFE-Biopharma Formation SAFE will Influence these Centers of Gravity in order to stimulate demand pull that is aligned to value delivery on a sustained and accelerating basis SAFE Baseline v1.0 Centers of Gravity SAFE is focusing its resources and efforts around a small number of Centers of Gravity (Programs) to ensure early stage successes that are self-sustaining and leverageable by others with or without follow-on support from SAFE

Pfizer & SAFE: 

Pfizer & SAFE Situation: Pfizer manages identity credentials for over 200,000 employees and contractors It spends an estimated $10 million per year for password resets Every digital signature utilized for regulatory and non-regulatory transactions eliminates the costs of approximately $125 dollars required per wet signature Approach: Replace the multiple ID architectures that were in place with a common internal identity management framework Leverage SAFE to uniquely align identity credentials with secure information exchange Pfizer chose a unified identity model that links multiple credentials onto one cryptographic hardware device (Smart Card). The unique ID badge provided a consistent user experience for access control and digital signing. Results & Benefits: Pfizer has deployed a unique ID platform across their infrastructure Elimination of costly paper-based business processes and creation of universal identity badges Full-scale systems reengineering & identity management solution that impacted all Pfizer employees & contractors Pfizer employees and contractors being able to have their identity authenticated at remote Pfizer locations without having to travel to visitor's station for additional screening Challenges Adopting an identity management strategy, and linking multiple identity credentials to one token Keeping up with demand for identity badges once employees realized the convenience of using a single ID badge.

Leveraging SAFE Membership: 

Leveraging SAFE Membership

SAFE Participation & Drivers: 

Vendors Issuers, Applications providers, Systems Integrators Drivers Access to a channel Customer driven product enhancements Leadership advantage New business opportunities Business Partners Labs, Investigators , CROs, Bio-Techs, Manufacturing Supply Chain, Sales Drivers Simplified end user experience, standard interoperability requirements Community of practice Improved and lower cost partner interactions Operational value added services Sponsors Merck, Johnson & Johnson, Abbott Labs, AstraZeneca, Sanofi-Aventis, Bristol Myers-Squibb, Covance, Pfizer, GlaxoSmithKline, Procter & Gamble Drivers Shared cost model, and experience Cost avoidance Interoperability at scale Broad application Risk management infrastructure Government, Regulatory Agencies, Associations (EU, USA, ASIA PAC) PhRMA (sponsor), EFPIA (sponsor), FDA, EMEA Drivers Standard Compliance Cost Avoidance Less Paper Interoperability at scale Broad application SAFE Participation & Drivers

Participation Benefits: 

Participation Benefits SAFE Working Groups  opportunity to share solutions & lessons learned Best Practice guides for Members (under development): SAFE / 21 CFR Part 11 Implementation Guidance Checklist Credential provisioning and applications support guideline Vendor programs: Application & infrastructure product SAFE-enablement workshops Applications certification program Issuer accreditation program While SAFE does not provide its members with hardware or software directly, SAFE has a standard user desktop hardware & software bundle for investigators. This ensures: Consistent end-user experience Ensures application accessibility for key apps – Adobe, web browser Bundle can be readily obtained by Members through SAFE Issuers

SAFE Directions: 

SAFE Directions Expanding Membership Shared service model – more members = lower cost to each member Enhances ubiquity of digital credential approach Broaden beyond biopharmaceutical companies to all healthcare/healthcare related entities Expanding new business process opportunities Move beyond clinical trials and investigators to other areas common across our industry Linkage to evolving e-Health and e-HR initiatives Applications Identification of common applications Ability to approach application vendors as an industry versus individual companies Does not take away individual company ability to work on their own applications

Becoming a SAFE Member: 

Becoming a SAFE Member Visit: http://www.safe-biopharma.org

Slide28: 

Questions?