Notice F1: Implementation of the WHO digital documentation of COVID-19 certificates: vaccination status (DDCC:VS) technical specifications

DHIS2 DDCC:VS FHIR Adapter

Two Sentence Overview: 
The aim is to develop the DHIS2 FHIR Adapter to use a subscription service to export WHO-DHIS2 COVID-19 toolkit-based data which is collected on the DHIS2-Tracker app, and to transform it into the corresponding FHIR Resources (Compositions), conformant with the DDCC:VS specification. Our team at Itinordic is maintaining the official source code repository for the DHIS2 FHIR Adapter, leading support for the adapter in the DHIS2 community, and have developed Android apps on the platform. We also participate in the WHO coordinated ‘Computable Care Guidelines - Working Groups 1 & 2’ where we contribute on issues related to the practical implementation of FHIR in Low and Middle Income Countries (LMICs).
Executive Summary: 
The project aims to develop an adapter that retrieves COVID-19 surveillance and national vaccine delivery data entered on DHIS2 into the DDCC:VS format using an interoperable, robust and scalable technology infrastructure. While many LMIC’s are using adaptations of the WHO-DHIS2 standardized packages for the capture and retrieval of COVID-19 vaccination status information, many of these projects remain ad hoc in their implementation of certificate standards and trust frameworks. They are particularly reliant on stable Internet for the retrieval of COVID-19 vaccination status. These systems do not conform to any information exchange standards and implement custom verification which is specific to country implementations. In pursuit of the goal of equitable access to healthcare, the preferred solution is a digital certificate which can be verified offline as is specified in the DDCC:VS document. However, the development and implementation an appropriate solution is complicated for many, hence a focus on immediate needs. This has led to compromises on security and scalability issues, alongside the proliferation of new technology solutions in response to the pandemic. Limited internet connectivity has also contributed to further fragmentation of these health information systems, with COVID-19 data existing on paper. Consequently, clients still have to go through central points (eg district, provincial and national health facilities) in order to retrieve proof of COVID-19 vaccination. In some cases, there has also been theft of vaccination cards which diminishes the effectiveness and trust around paper-centric certification processes. The basic architecture of the system envisaged will provide interfaces that enable other systems to communicate with the adapter and be integrated with standard tools and processes for signing the certificates. We have started with DHIS2 due to our expertise on the technology, our existing client base, and the systems’ near universal use in LMICs. We are officially maintaining the DHIS2 FHIR Adapter and we lead on its development and use in production. We have also developed FHIR compliant Android apps which are interoperable with the DHIS2 FHIR Adapter. Support is specifically sought from Digital Square to fund development costs of the DHIS2 DDCC:VS FHIR Adapter component and to increase our alignment to the global work on the implementation of standards in LMICs. Our mission is to bring these latest technology advancements to those who need them the most in LMICs. The Adapter will play a major role in bringing these tools to end users and will contribute to the OpenHIE community/stack considering that DHIS2 and FHIR are an integral part of it.
Consortium Team: 
The project team is led by Itinordic in the specific roles of Project Lead & DHIS2 Specialist - Itinordic (Norway), Project Coordinator - Itinordic (Norway), Lead Developer - Itinordic (Zimbabwe), Senior Developer - Itinordic (Zimbabwe), RabbitMQ and Messaging Specialist - (Independent Consultant) and a Developer - Itinordic (Zimbabwe). This team has specifically been actively developing FHIR conformant tools on Android and DHIS2 for the last 3 years and consists of at least 4 expert level developers with extensive experience in the areas relevant to this project. Some support roles, eg on security mechanisms will be sought from amongst consultants within our network.
Project Description: 
Integration of DHIS2 through the use of the FHIR® specification constitutes an area of technology development through which existing implementations can extend from a top-down programmatic focus to the electronic health record orientation which is necessary for vaccine registries. The DHIS2 FHIR® Adapter is a tool that has been developed to exchange FHIR compliant data with DHIS2. For the past 2 years, our team has been leading the development of the DHIS2 FHIR® Adapter, and now maintains the official repository. The initial scope of the Adapter was the import of FHIR Resources into DHIS2 Tracker by using FHIR Subscriptions. The Itinordic team has deployed a system which uses the adapter to send FHIR Resources created via Android into DHIS2. The aim therefore is to develop the Adapter so it can be used to export DHIS2 Tracker data, in this case COVID-19 vaccination data, into FHIR Resources, conformant in this case with the DDCC:VS specification. The basis on which the adapter is built is, as previously alluded, the WHO-DHIS2 health data toolkits for COVID-19 surveillance and national vaccine delivery. According to the DHIS2 Website, at least 42 countries are using DHIS2 for COVID-19 surveillance and at least 40 for national vaccine delivery. These are standardised packages with coded elements, on which FHIRPath attributes can be added to complete the mapping to COVID-19 FHIR Compositions. We will have opportunity to pilot the DHIS2 DDCC:VS FHIR Adapter in some of these implementations in order to refine the technology. Our ongoing collaboration with the University of Oslo within a number of projects, including participation in the integration team, and our background of working with WHO on the feasibility of computable guidelines for FHIR implementation will server to assure our work is on the leading edge. A core component of the system is mapping between DHIS2 and FHIR data. DHIS2 is highly customisable and allows for the addition of FHIRPath attributes to existing data elements from the WHO-DHIS2 health data toolkits for COVID-19 surveillance and national vaccine delivery. The adapter will understand the meaning of these attributes and use them to do the mapping between DHIS2 and the DDCC:VS FHIR Compositions. As data is entered into DHIS2 in real time, a subscription service built on a robust messaging framework, will be able to recognise COVID-19 surveillance and vaccine data, and thereby begin the process to check and produce the DDCC:VS document. In addition, signing of the certificates can proceed using whatever the preferred Public Key Infrastructure a client chooses to implement in accordance with international standards. In particular, RabbitMQ will be incorporated as part of the DHIS2 FHIR® Adapter architecture, to provide an efficient and resilient data processing channel between interacting entities using the industrial standard, Advanced Message Queueing Protocol (AMQP-0.9.1/1.0). RabbitMQ is an industry trusted, multi-purpose messaging broker, built on highly scalable, fault tolerant and resilient technology, such as needed in critically deployed ecosystems as DHIS2. It is a feature-rich open source system, licensed under the Mozilla Public License v2.0. The unit of processing in RabbitMQ is it’s queues, which provide both persistent and/or transient message retention for high performant, asynchronous message processing between two or more applications or processes. Given the need for multiple systems to interact securely in this architecture, a robust identity management solution in accordance to industry standards such as OAuth2 and OpenId Connect will be implemented. A number of open source tools for identity management exist, such as keycloak and gluu. In this case, the focus will be on choosing best practices so we can benefit from the community which has for instance developed tools for integrating FHIR servers with some of the existing open source identity management tools. We aim to secure a a good test case to pilot the system as we will adopt the SCRUM methodology for rapid prototyping. We have certified scrum competence and experience in the team. This way we will ensure that while our approach is generic, it addresses real world challenges in the process and therefore mitigates the risk of failure. In addition, we will use a participatory approach with the community such as those working with DHIS2, FHIR and OpenHIE to ensure the ideas implemented have a good foundation. We have also discussed with colleagues who have expressed interest in implementing our solution. Another risk is the fact that COVID-19 certificates constitute a complex area of technology development which encompass a number of issues relating to trust and security. We will endeavour to assure implementors on the open source technologies used in the system such that it can be trusted. In addition, nations are using other systems besides DHIS2 we can incorporate into the the infrastructure that is developed. The team has gained experience in this arena of interoperability, mobility and standards, and these will be important in identifying and mitigating risk. A draft system flow diagram is attached. The anticipated timeline of the project is a total of 9 months, including analysis, development and testing. The first 6 weeks will be dedicated to analysis and design, where we will develop the idea into a project inception report. After inception, We will devote 4,5 (four and a half) months to development sprints. We expect the first prototype to be available for user testing within the first 8 weeks of the development phase, and more frequent releases made thereafter for new features and bug fixes. We would then pilot the system for an additional six weeks to get final feedback, and then complete product development and documentation in the remaining 6 weeks on the project.
Application Status: 
Pending Review & Investment

Comments

Thank you for the application. For the full technical application, in addition to general recommendations per the email, please expand more on plans for:

-Privacy, data protection, and security activities (in addition to identity management).

-Working with the broader HISP/DHIS2 community.

-Aligning with Instant OpenHIE and engaging with the OpenHIE community/other communities.