I'm gonna have to write another letter ...

This time to my primary care provider.  I just downloaded my last Visit Summary from my PCP (it's been a seven year wait for that capability).  I did a manual review of the CDA content, validated it with the CDA Schema, and the CCDA 1.1 Schematron delivered by HL7.  While there are plenty of online tools that you can use to do such validation, I do not recommend them unless you want your PHI hanging around on the web somewhere.  We aren't all John Halamka after all.

Here are the errors that I found.

<ClinicalDocument
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
  xmlns="urn:hl7-org:v3"
  xsi:schemaLocation="urn:hl7-org:v3 CDA.xsd">

The xsi:schemaLocation may be valid on an XML document, but it is never appropriate to use in an exchanged CDA document.  According to section 1.4 of the XML Implementation Technology Specification - Data Types (used by the CDA R2 Standard):

xsi:schemaLocation must not be used in an instance to point to a schema document to be used for validation. Instance processors are expected to provide their own schemas.

This is a mostly harmless error as demonstrated above.  The reason that schemaLocation must not be used however is related to security concerns.  An improperly coded receiver could attempt to read the file at that location.  If the location were a web URL, it could be a specially constructed URL designed to cause some sort of stack overflow that might result in execution of code of an attackers choice.

Two other errors that are easily spotted are that the visit summary itself does not correctly reflect information found in the narrative of the clinical document, or in other data on the portal.  It indicates that I'm on unknown meds, but elsewhere on the portal they have correctly recorded all my medications.  There's clearly no reason for this inaccuracy in the visit summary. It also incorrectly reports my smoking status in the document, even though it is directly reflected in the problem list in the visit summary.

Effective times are missing in the machine readable data, but present in the narrative.  This is clearly an error.

There are also some translation issues for problems coded in ICD-9-CM as translated to SNOMED CT:

• Cardiomegally (SNOMED CT) is NOT left atrial enlargement (ICD-9).  The former applies to the whole heart, while the latter applies only to one portion of the heart.
• Obesity (SNOMED CT) is not overweight (ICD-9), the two have different clinical definitions.

And while I'm writing a letter, I'm also personally e-mailing technical staff of the vendor who creates this portal and pointing them to this blog post.  There are several bugs in my visit summary resulting from their software, and I expect them to be fixed in a future version.

   Keith

---

Here's the e-mail I just sent to the vendor's technical folks:

In my role as a patient of a practice that uses your product, I recently downloaded a visit summary from my healthcare provider through their implementation of your portal, I have discovered several implementation errors in the CDA summary it provides. Please read: http://motorcycleguy.blogspot.com/2015/09/im-gonna-have-to-write-another-letter.html for details. Shortly I will also be contacting my healthcare provider (your customer), and letting them know of these particular errors.

I'm honestly just wanting to see this fixed, and I'm hoping you will respond appropriately. Since this is a personal issue for me, please direct all communication on this matter to this e-mail address. If you would like to speak to me personally, I can be reached at ___________.

        Keith W. Boone