Date : July 14, 2010 Time : 10:30 am – 1:00 pm Location : NC Hospital Association

1. Date: July 14, 2010 Time: 10:30 am – 1:00 pm Location: NC Hospital Association 2400 Weston Parkway, Cary, NC 27513 Dial in: 1-866-922-3257 Participant Code: 654 032 36#

2. Agenda

3. Meeting Objectives • Begin to define “ideal” consent framework for NC statewide HIE, not restricted by current NC law

4. Meeting Schedule Revisions

5. New NC Health IT Website Launched www.healthit.nc.gov 5

6. NC Statewide HIE Cooperative Agreement Timeline Strategic Plan Operational Plan Stakeholder Outreach & Begin Transition Biweekly+ Workgroup Meetings with Monthly Board Meetings Strategic Plan Submitted to HHS LaunchPhase 2 Publish Draft Operational Plan for Review/ Comment NC HIE Formed Workgroups Formed & Begin Meeting State HIE Grant App. • Convene Advisory Board & Workgroups • Draft Operational Plan • Publish Draft Operational Plan for Review • Engage and educate stakeholders Aug. 31Submit Operational Plan to HHS Funding Announcement Letter of Intent Submitted 6 6

7. NC Statewide HIE Operational Plan Development Timeline Operational Plan Consensus Recommendations Drafting of Operational Plan Governance WG: Confirm governance model, advise on scope of governance, craft recommendations on bylaws and board structure for new entity; develop recommendation for consumer engagement plan approach Clinical/Technical WG: Recommendations on technical architecture approach for statewide HE, begin prioritization of core and value-added services, begin landscape assessment Governance WG: Participation policies and enforcement mechanisms for the statewide HIE; develop recommendations on roles of State in public/private partnershipprocesses for coordination with other ARRA funded programs in the state Clinical/Technical WG: Development of clinical and business use cases, prioritization for core and value-added services, technical approach May 14 – initial NC HIE Board Meeting Master project planning, develop WG charters and workplans; stakeholder meetings, Legal/Policy WG meetings Aug. 31: Submit Operational Plan to HHS Legal/Policy WG: Conduct legal scan for NC laws related to consent for treatment purposes; draft legal principles; conduct legal scan for NC laws related to health information data security; develop recommendations on approach to 4As; develop initial consent approach recommendation under existing law Finance WG: Develop financial model assumptions; data collection to inform financial models. Legal/Policy WG: Develop recommendations for an “ideal” consent policy not restricted by current law and approach to changing the law; develop recommendations on breach policy principles and role based access principles; develop security recommendations beyond access; review emerging consent policies in neighboring states and identify barriers. Finance WG: Develop 2-3 financial models based on modeling assumptions and develop process for sustainability planning. • Compile NC HIE Board & Workgroup recommendations and decisions • Draft Operational Plan – iterative process with WG review • Publish Draft Operational Plan for Public Review Workgroups formed Workgroups formed 7 7

8. Proposed Operational Plan Drafting Schedule July 13 Board Meeting • Review Operational Plan structure • Approve, reject or modify Workgroup recommendations July 14 – August 2 • Draft Operational Plan components by Domain including decisions endorsed through July 13 Board meeting. • Meaningful Use final rules expected in mid-July. Educational webinar for Board and all workgroups on final regs. August 2 – August 6 • Core project team and co-chair review of working draft • August 6 Workgroup final meetings prior to Operational Plan August 9 – August 12 • Updates and revisions to Operational Plan draft to include August 6 August 17 • Board meeting to review July and August recommendations and preliminary Operational Plan draft August 19– August 25 • Board and public review of revised Operational Plan draft (revisions based on direction in August 17 board meeting) August 27 • Tentative Board call August 27 – August 30 • Prepare final draft for submission to ONC by August 31 Board Meeting Plan Submission to ONC

9. Consent Model Options for Pathway 2(Assuming Change in Existing NC Law)

10. Working Assumptions • Based on subcommittee discussion at July 9 meeting, initial consent framework discussion for Pathway 2 will be focused around an Opt Out patient consent model for the statewide HIE. • As a starting point, the subcommittee will consider an Opt Out model for the exchange of data between providers for treatment purposes. • As part of the continuing discussion, the subcommittee will consider implications for use of data other than for treatment purposes.

11. Opt Out Consent Approach – a Continuum of Options Based on subcommittee discussion at July 9 meeting, initial consent framework discussion for Pathway 2 will be focused around an Opt Out patient consent model for the statewide HIE. Recommended approach: subcommittee will discuss a set of threshold questions related to Opt Out consent, through the lens of defining the best consent policy framework for North Carolina, to determine where on the continuum the group’s recommendation fits, rather than making a recommendation solely based on the categories on the continuum and applying that recommendation to the threshold issues.

12. How Do We Define Provider and Treatment for Statewide HIE? As a starting point, the subcommittee will consider an opt-out model for the exchange of data between providers for treatment purposes. • What is our proposed definition of provider? • What is our proposed definition of treatment?

13. Should Opt-Out Be Applied Universally to all Provider Types? • Option 1: Opt-out applied universally • Must include exception for federally assisted alcohol and drug abuse treatment program and facilities, in compliance with federal law • Option 2: Opt-out applied to most providers, with exceptions for some provider types • Mental health? • Public health clinics? • Others? • Note: Under current NC law, certain types of providers must obtain consent before disclosing for treatment purposes: • 1. Certain mental health facilities and programs • 2. Nursing homes • 3. Adult care homes • 4. Home health agencies (possibly)

14. Should Consumers Have a Granular Level of Control Over their PHI in an Opt Out Model?

15. Opt-Out Model Options • No Consent – Patient’s information automatically included in and made available through the exchange (in compliance with federal HIPAA regulations and 42 CFR Part 2). • Provides no opportunity for accommodation of individual preference with regard to participation in the exchange.

16. Opt-Out Model Options • Full Opt-Out – Pre-defined set of data is automatically eligible for exchange, with a provision that patients be given the opportunity to opt out in full. • Could mean either that that the information of the patient who opts-out is collected through the exchange (and used only for legally required purposes, e.g. public health reporting) but never shared with accessing providers, OR patient’s clinical information never enters exchange. • Regardless of where information exchange is blocked, this option allows for no granularity of patient preference (i.e., a patient’s information is either all in or all out).

17. Opt-Out Model Options • Partial Opt-Out – Pre-defined sets of data are automatically eligible for exchange, but patients can either opt-out in full, or: • Limit disclosure and/or receipt of their information to specific providers • Limit exchange of categories of data/specific data elements (e.g. sensitive information) • Limit exchange of their information for specific purposes (e.g. treatment, research, etc.) • Technical and procedural complexity increases with level of granularity for opt-out.

18. Opt Out Consent Model Options 18

19. Opt Out Consent Model Options 19

20. How Does Opt-Out Impact Emergency Access? • In Opt-Out model, two options for information of patient who has opted-out of the exchange: • Collected through the exchange for only legally permitted purposes (e.g., public health reporting), but not otherwise accessible to participants. • Patient’s clinical information never enters exchange. • If NC HIE pursues the former approach, should information of patient who has opted-out of the exchange be made available for medical emergencies?

21. How Should Services to Which Minors May Consent Be Handled in an Opt-Out Model?

22. Other Consent Issues for Future Consideration • Other Data Uses: • Public health reporting • Quality improvement • Payer-based care management • Research • Development of personal health records • De-identified data • Marketing • Improvement and evaluation of local/community HIO operations • Disclosures to government agencies for health oversight • Law enforcement • Physician liability concerns • Requests for restrictions on disclosures to payer organizations (new HITECH requirement) • Others?

23. Next Steps • Upcoming Meetings • Security Subcommittee – July 14th • Full Legal/Policy Workgroup Meeting – July 21st • Questions or Comments? • Contact: nc.hie@healthwellnc.com 23

24. Open Public Comment

25. ATTACHMENTS

26. Potential Definitions of Uses of Information The provision, coordination, or management of health care and related services among health care providers or by a health care provider with a third party. A third party is an entity with whom a health care provider has a contractual relationship related to the provision, coordination or management of health care and related services for a consumer. Under this contractual relationship, the health care provider must ensure that the contracted entity adheres to new consent policies and procedures; Consultation between health care providers regarding a patient; and The referral of a patient from one health care provider to another. (Source: Modified from HIPAA) Treatment Activities by a provider and/or its contracted entities that include: • Conducting quality assessment and improvement activities, population-based activities relating to improving health or reducing health care costs, and case management and care coordination; and • Disease management which can include a range of activities that involve the provider-controlled exchange of consumer health information with third parties with whom the provider has a contractual relationship related to the provision, coordination or management of health care and related services for a consumer. • Third party entities may include health plans (Source: Modified from HIPAA) Provider-based quality improvement

27. Potential Definition of Uses of Information A systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge. (Source: HIPAA) Activities by a health plan that include: • Conducting case management and care coordination; and • Disease management which can include a range of activities through which the health plan has direct access to patient-identifiable clinical data without the provider serving as an intermediary. (Source: Modified from HIPAA) Payer-based care management Research • Any communication about a product or service that encourages recipients to purchase or use the product or service. 1 • An arrangement whereby an RHIO participant and another entity discloses consumer health information, in exchange for direct or indirect remuneration, for the other entity to communicate about its own products or services encouraging the use or purchase of those products or services. 2 (Source: Modified from HIPAA) Marketing 1 2 The HIPAA Privacy Rule contains a number of exceptions to marketing that do not require patient authorization. HITECH Section 13406 amended HIPAA such that if a Covered Entity is paid by an outside entity to send a communication to a patient, the communication is deemed to be marketing and requires prior authorization from the patient – even if that communication falls into one of the current exceptions to the definition in the Privacy Rule.

28. Potential Definitions of Uses of Information Consistent with applicable provisions of HIPAA: Disclosure to a law enforcement official as required by law including laws that require the reporting of certain types of wounds or other physical injuries. Disclosure in response to a law enforcement official’s request for PHI for the purpose of identifying or locating a suspect, fugitive, material witness, or missing person. Disclosure in response to a law enforcement official’s request for PHI about an individual who is or is suspected to be be a victim of a crime. Other types of disclosures as allowed under HIPAA and state law. (Source: HIPAA) • Disclosure to a public health authority authorized by law to collect or receive information for the purpose of preventing or controlling disease, injury, or disability, including, but not limited to, the reporting of disease, injury, vital events such as birth or death, and the conduct of public health surveillance, public health investigations, and public health interventions. (Source: Modified from HIPAA) • Other types of public health disclosures as allowed under HIPAA and state law. Public health Law enforcement