11 th Meeting Date : April 15, 2011 Time : 9:00 am – 11:00 am

1. 11th Meeting Date: April 15, 2011 Time: 9:00 am – 11:00 am Location: NC Medical Society, 222 N Person St., Raleigh, NC Dial in: 1-866-922-3257; Participant Code: 654 032 36#

2. Agenda

3. Statewide HIE RFP Building the RFP for Statewide HIE Services

4. High level overview of the procurement process

5. RFP draft review process – Getting from today until April 25

6. Introduction to the RFP draft Request for Proposal - Table of Contents Section 1: Executive Summary Section 2: Introduction to NC HIE Section 3: Scope of Work. This section includes: Overviews of the statewide HIE organizational approach, clinical functions, and envisioned technical approach including core, value-added, and non-functional services Key assumptions regarding the healthcare delivery landscape and the current rollout/integration plan Reference to key documents including the Strategic and operational plans and the full list of reconciled requirements Section 4: Overview of the procurement process including the Schedule of Activities Section 5: NC HIE Evaluation Criteria Section 6: Disclaimers for the proposal process Section 7: Terms and Conditions that will be used in the contract with a selected Vendor Section 8: Detailed instructions for Vendor responses Appendix A: Services and Requirements Template Appendix B: Resumes Appendix C: Pricing and Cost Template Appendix D: Financial Information

7. Critical dependencies A successful and timely RFP release is dependent upon completion of the following critical items – All items are currently on schedule and we’ll reach to you for input to finalize all items: Requirements Rollout assumptions RFP Legal Language (Terms and Conditions, Disclaimers) Evaluation Criteria Evaluation Team Recruitment

8. Statewide HIE RFP Statewide HIE Requirements

9. Statewide HIE Requirements: Compilation • NC HIE received feedback from 13 Work Group members • NC HIE has inventoried and compiled more than 400 individual comments, suggestions, and recommendations in the file NC HIE Inventory of Feedback on Requirements_Final.xls.

10. Statewide HIE Requirements: Integration of Feedback • Steps Taken from March 18 Workgroup Discussion • Reviewed requirements with individuals for clarification • Restructured requirements to consolidate security functions • Categorized and incorporated Request for Comments with Work Group recommendations • Modified specific requirements for clarity and further segmented functional requirements to architectural components • Summarized and reviewed requirements and comments with MAeHC • Classification of Work Group’s Input • Acknowledged: Comment is read and understood. Comments will be transmitted to the RFP team for their consideration. • Changed or clarified: The original functional requirement’s intent is kept intact but the language is modified per the reviewer’s recommendation. • Added: The reviewer introduced a new function or suggested that an existing be split into multiple requirements. • Removed: Requirement was removed as recommended.

11. Statewide HIE Requirements:Concepts Requiring Clarification • Core vs Value-added HIE Services • Core services refer to the system architecture that is shared across the system. • Value-added services are the functions that are utilized by end-users. Comments relating to how value-added services are packaged for communication and marketing purposes are acknowledged. • Key principles used to modify requirements (credit to Jim Murphy): • Define requirements with objectives and leave to the vendor to describe how to meet the objectives • Restrict asking questions as functional requirements • Ensure that any redundancies ask for the same level of detail across sections • Repeated Requirements • Vendors responding to the RFP may propose multiple systems, hence there are some repeated requirements. A provider directory may be separate from an identity management system, but both will require integration to role based access and logging.

12. Statewide HIE Requirements:Key changes from previous version • Security section now includes: • Baseline privacy and security requirements • Audit and logging • Identity Management and Authentication • Transactional logging is maintained separately as a core service • System response times for core and value-added services are not specified, rather vendors are asked to document and define their performance measure approach • Added functional requirements to support future federation of core services • Modified undefined standards for provider directory export and security assertion expressions to request vendor approach rather than establishing functional requirements

13. Statewide HIE RFP Request For Comments

14. Request for Comments: Overview • Input Received • 24 sets of comments from a wide variety of organizations... • 9 vendors • 6 associations • 4 individuals/organizations delivering care • 3 State government agencies • 2 Regional Health Information Organizations • Comments available online at http://www.ncdhhs.gov/healthit/ • Topics Addressed • Participation in statewide HIE • Value proposition and location of HIE services • Selection of HIE services • Sequencing and deployment of HIE services • Considerations for other work groups

15. RFC Responses: Participation in Statewide HIE • Comments • Is it the expectation that existing HIE’s connect directly to each other, or would there be a requirement to connect via the NC HIE? • Is an HIE allowed to enter an exchange agreement directly with a federal or state agency? • Participation in the statewide HIE will be voluntary. • Organizations may connect with whomever they like and will not be required to use the NC HIE infrastructure to exchange data. • It is our goal to create a shared infrastructure that eliminates the need to create and maintain costly, multiple point-to-point connections.

16. RFC Responses: Sequencing and Deployment of HIE Services • Comments • Do not implement this system until most of the value-added functions are included. If the provider cannot easily use the HIE network to accomplish this, he/she will scrap the system and never come back. The first impression is the most important. • Beginning with a minimum set of core services is essential to demonstrate value and engender long-term support and the funding necessary to build out a more fully-functional capabilities that most providers will need to optimize the potential for HIE. • We recommend the RFP articulate a modular approach for adding services over time rather than all at once. • The NC HIE Board has committed to the development of a robust, first class statewide HIE that delivers the services to improve the quality, safety, effectiveness, and efficiency of care. • Services will be delivered in phases over time. • By December 2011, we expect to have available a foundational set of services, including core and selected HIE services. • Additional capabilities will be deployed based on an assessment of the value, cost, complexity of the candidate service.

17. RFC Responses: Value Proposition and Location of HIE Services • Comments • What additional value will the NC HIE provide to the organizations already participating in an HIE? • We believe Qualified Organizations and even some hospitals will choose to provide many of the advanced services contemplated by the NC HIE. Making them mandatory as part of the NC HIE will duplicate the services and the cost for implementation and maintenance, as well as disincentivize innovation at the QO level. • Our system already provides terminology translation services within out IT systems. If these service are in the Statewide HIE we essentially pay twice. • NC HIE will deliver value in two ways: (1) offering a cost-effective mechanism for securely identifying and retrieving data across systems; and (2) providing and facilitating access to value-added services. • NC HIE is committed to ensuring that all organizations in the state have access to a rich array of HIE services. • Given the nature of the statewide HIE as a “system-of-systems”, there will be some duplication of processes and data. • We have a systemic design approach that tolerates duplication in so far as it provides value and it doesn’t create inefficiencies.

18. RFC Responses: Candidates for Statewide HIE Services • Respondents from regional exchanges indicated that the following are attractive candidates for statewide HIE services and activities: • Services • CCD/CCR exchange • Immunization registry integration • Access to State and federal resources (substance abuse, disease registries, etc) • Public Health Reporting which could be rolled into a quality reporting service. • Nw-HIN integration • Activities • Standardization of policy/governance across other NC-based HIEs • State-level group purchasing power • Patient educational materials. • We will integrate these suggestions into the plan for selection and deployment of services.

19. RFC Responses: Feedback Applicable to Other Work Groups • Legal and Policy Considerations • Authentication: Are we going to require the authentication of every individual behind the firewalls of every enterprise or will we rely on agreements to ensure that only properly individuals authorized by that enterprise may request and receive message content that contains PHI? • Cross-State Exchange: Leverage the policy work that has been done to facilitate cross-state and multi-state exchange. • Access and Disclosure: To share information with schools (school nurses), the HIE must establish policies that comply with the Family Educational Rights and Privacy Act (FERPA). • Data ownership and stewardship: Policies for data access, use and control need to be created. The HIE must determine the “gold” standard for each data source and agree who owns the data, including duplicate record tables and data transaction logs. • Patient’s role: Determine the patient’s role in accessing and/or updating data stored by the HIE. Education to the patients on the HIE will need to be provided in a clear, concise, and easily understandable method. • Finance Considerations • Minimize the costs that will be passed onto providers • Ensure the system is affordable for organizations and providers in underserved areas • These comments will be shared with the appropriate Work Groups

20. Public Comment

21. Next Steps

22. Next Steps Upcoming Meetings Requirements Meeting – April 19 Final RFP Draft Review – April 21 Key Dates Release of RFP – April 25 Responses to RFP due – May 20

23. Attachments

24. Clinical & Technical Operations Work Group Members

25. Statewide HIE Components Core HIE Services • Foundational services hosted by NC HIE that facilitate exchange health information across organizational boundaries, such that multiple entities can: • Identify and locate each other in a manner they both trust; • Reconcile the identity of the individual patient to whom the information pertains; • Exchange information in a secure manner Security Services Provider Directory Message / Record Routing / Return Receipt Identity Management and Authentication Transaction Logging Consent Management Terminology Service Transformation Service Patient Matching / RLS NHIN Gateway • Value-Added HIE Services • Services that support the clinical priorities and use cases to help providers, patients, and care givers improve the safety, quality, and cost effectiveness of heath care. • Value-added services will be accessible via core services • Value-added Services can be offered at the state, regional, or enterprise level. • Value-Added services will be incrementally deployed based on feasibility, cost, and magnitude of benefits CCD Exchange Lab Results Delivery Lab Normalization Lab routing for reporting Quality Reporting Immuniz Access Rad Results Delivery Med Hx Rad Image Delivery Procedure Results Delivery Disease Surveillance CCD Translation Access to Aggregated Data Clinical Decision Support Phase 1 Value Added Services proposed in Operational Plan Phase 2 Value-Added Services proposed in Operational Plan Final decision regarding phased implementation will be informed by forthcoming statewide HIE RFP

26. Technical Relationships: Core HIE Services, QOs, & QO Participants Key Points: • Core services provide a foundation for identifying QOs, ensuring security, and providing a gateway to other QOs and additional HIE services • QOs link to core services by conformance to interoperability specifications • QOs provide a gateway to core services for their participants NC HIE Security Services Provider Directory Message / Record Routing / Return Receipt Identity Management and Authentication Transaction Logging Consent Management Terminology Service Transformation Service Patient Matching / RLS NHIN Gateway Example QOs... Physicians (IPA, PHO, PO) Regional HIO Large Hospital System Example QO Participants... Physician Practice Hospital Physician Practice Physician Practice

27. Technical Relationships: Value-added Services, QOs, & QO Participants Key Points: • Value-added Services are available to network participants and can be hosted by different entities. For example: • NC HIE could host a CCD Exchange service • The Dept of Health could host an Immunization Access service • A QO could host a CCD Translation service • Based on considerations of efficiency and practicality, the NC HIE Tech/Clinical Ops Work Group continues to evaluate the ideal location for Value-added Services Physician Practice Physician Practice Large Hospital System NC Immunization Registry 3. CCD Translation 2. Immuniz Access NC HIE Security Services Provider Directory Message / Record Routing / Return Receipt Identity Management and Authentication Transaction Logging 1. CCD Exchange Consent Management Terminology Service Transformation Service Patient Matching / RLS NHIN Gateway Physicians (IPA, PHO, PO) Regional HIO Large Hospital System Physician Practice Hospital Physician Practice Physician Practice