Date : July 27, 2010 Time : 10:30 am – 1:00 pm Location : NC Hospital Association

1. Date: July 27, 2010 Time: 10:30 am – 1:00 pm Location: NC Hospital Association 2400 Weston Parkway, Cary, NC 27513 Dial in: 1-866-922-3257 Participant Code: 654 032 36#

2. Agenda

3. Meeting Objectives • Define ideal consent framework for NC statewide HIE for uses other than treatment purposes (e.g., research, payer access to data), not restricted by current NC law • Finalize consent model recommendations for Pathway One (assuming compliance with existing NC law)

4. Meeting Schedule Revisions

5. New NC Health IT Website Launched www.healthit.nc.gov 5

6. Proposed Operational Plan Drafting Schedule • July 13 Board Meeting • Review Operational Plan structure • Approve, reject or modify Workgroup recommendations • July 14 – August 2 • Draft Operational Plan components by Domain including decisions endorsed through July 13 Board meeting. • Meaningful Use final rules expected in mid-July. Educational webinar for Board and all workgroups on final regs. • August 2 – August 6 • Core project team and co-chair review of working draft • August 6 Workgroup final meetings prior to Operational Plan • August 9 – August 12 • Updates and revisions to Operational Plan draft to include August 6 • August 17 • Board meeting to review July and August recommendations and preliminary Operational Plan draft • August 19– August 25 • Board and public review of revised Operational Plan draft (revisions based on direction in August 17 board meeting) • August 27 • Tentative Board call • August 27 – August 30 • Prepare final draft for submission to ONC by August 31 Board Meeting Plan Submission to ONC

7. Consent Model Options for Treatment Purposes for Pathway 2(Assuming Change in Existing NC Law)

8. Subcommittee Recommendations for Pathway Two: Consent Model for Treatment Purposes • The Legal/Policy Subcommittee recommends an Opt-Out model for treatment purposes that includes all available data from all provider types and that allows consumers to restrict disclosure of data to the exchange on a provider-by-provider basis.

9. Subcommittee Recommendations for Pathway Two: Consent Model for Treatment Purposes The Subcommittee also recommends that the NC HIE conduct further research on the pros and cons, and feasibility of allowing more granular patient control over what information is disclosed to or accessed through the exchange, taking into account evolving technology and with an eye toward the impact that more granular patient control may have on both provider and patient participation in the HIE. 9

10. Consent Model Options for Uses of Data Other Than Treatment for Pathway 2(Assuming Change in Existing NC Law)

11. Data Uses • Other Data Uses: • Research • Public Health Reporting  • Provider-Based Quality Improvement  • Payer-Based Care Management • Development of Personal Health Records • De-Identified Data • Marketing • Improvement and Evaluation of Local/Community HIO Operations • Disclosures to Government Agencies for Health Oversight • Law Enforcement

12. Subcommittee Recommendations for Pathway Two: Consent Model for Other Data Uses • Provider-Based Quality Improvement:The Subcommittee recommends that provider-based quality improvement activities follow the same rules as treatment uses (i.e., Opt-Out model that includes all available data from all provider types and that allows consumers to restrict disclosure of data to the exchange on a provider-by-provider basis), in compliance with federal regulations. • Public Health Reporting:The Subcommittee recommends that public health authorities and designees of public health authorities be permitted to access data via the HIE for public health purposes, subject to restrictions of existing law.

13. Potential Role of HIE in Research Researcher Researcher Disclosure per IRB authorization waiver Disclosure of limited data set per data use agreement Statewide IRB IRB Agreement HIE BAAs permitting disclosures for research consistent with HIPAA Hospitals Medical Groups Other Providers

14. Payer Access to Data • Activities by a health plan that include: • Conducting case management and care coordination; and • Disease management which can include a range of activities through which the health plan has direct access to patient-identifiable clinical data without the provider serving as an intermediary. • (Source: Modified from HIPAA) Payer-based care management

15. Consent Model Options for Pathway 1(Assuming Compliance with Existing NC Law)

16. Legal Framework for Consent • Federal and state laws regulating the disclosure of patient health information provide a framework for the development of a consent policy for statewide HIE in North Carolina.

17. Implications of Existing NC Law for NC HIE Consent Policy • Allowing exchange without affirmative consumer consent (through a pure opt-out or no consent model) appears infeasible absent a change in law. • Existing NC law requires consent for 1) disclosure by certain types of care providers and 2) disclosure of certain types of health information. • A “mixed” opt-in and opt-out or no consent model could conceivably be implemented provided: • Substance abuse treatment providers, mental health facilities, nursing homes and possibly home health agencies obtain affirmative consent before disclosing information through the HIE. • Providers obtain affirmative consent before disclosing information about reportable communicable diseases or such information is filtered out of the HIE.

18. Consent Model Options Under Existing NC Law 18

19. How Durable and/or Revocable Should Consents Be? * Note that in a consent to access model, every health care provider would be required to renew their consents consistent with NC law governing mental health information because there would be no way of knowing whether or not mental health information was in the exchange. Under a consent to disclose model, only mental health providers would have to renew their consents consistent with the law.

20. Where and By Whom Should Consent Be Obtained? 20

21. Next Steps • Upcoming Meetings • Full Workgroup Meeting – July 29 (last meeting of this phase) • Questions or Comments? • Contact: nc.hie@healthwellnc.com 21

22. Open Public Comment

23. ATTACHMENTS

24. Consent Model Options 24

25. 25

26. Potential Definitions of Uses of Information The provision, coordination, or management of health care and related services among health care providers or by a health care provider with a third party. A third party is an entity with whom a health care provider has a contractual relationship related to the provision, coordination or management of health care and related services for a consumer. Under this contractual relationship, the health care provider must ensure that the contracted entity adheres to new consent policies and procedures; Consultation between health care providers regarding a patient; and The referral of a patient from one health care provider to another. (Source: Modified from HIPAA) Treatment • Activities by a provider and/or its contracted entities that include: • Conducting quality assessment and improvement activities, population-based activities relating to improving health or reducing health care costs, and case management and care coordination; and • Disease management which can include a range of activities that involve the provider-controlled exchange of consumer health information with third parties with whom the provider has a contractual relationship related to the provision, coordination or management of health care and related services for a consumer. • Third party entities may include health plans • (Source: Modified from HIPAA) Provider-based quality improvement

27. Potential Definition of Uses of Information A systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge. (Source: HIPAA) • Activities by a health plan that include: • Conducting case management and care coordination; and • Disease management which can include a range of activities through which the health plan has direct access to patient-identifiable clinical data without the provider serving as an intermediary. • (Source: Modified from HIPAA) Payer-based care management Research • Any communication about a product or service that encourages recipients to purchase or use the product or service. 1 • An arrangement whereby an RHIO participant and another entity discloses consumer health information, in exchange for direct or indirect remuneration, for the other entity to communicate about its own products or services encouraging the use or purchase of those products or services. 2 • (Source: Modified from HIPAA) Marketing 1 2 The HIPAA Privacy Rule contains a number of exceptions to marketing that do not require patient authorization. HITECH Section 13406 amended HIPAA such that if a Covered Entity is paid by an outside entity to send a communication to a patient, the communication is deemed to be marketing and requires prior authorization from the patient – even if that communication falls into one of the current exceptions to the definition in the Privacy Rule.

28. Potential Definitions of Uses of Information Consistent with applicable provisions of HIPAA: Disclosure to a law enforcement official as required by law including laws that require the reporting of certain types of wounds or other physical injuries. Disclosure in response to a law enforcement official’s request for PHI for the purpose of identifying or locating a suspect, fugitive, material witness, or missing person. Disclosure in response to a law enforcement official’s request for PHI about an individual who is or is suspected to be be a victim of a crime. Other types of disclosures as allowed under HIPAA and state law. (Source: HIPAA) • Disclosure to a public health authority authorized by law to collect or receive information for the purpose of preventing or controlling disease, injury, or disability, including, but not limited to, the reporting of disease, injury, vital events such as birth or death, and the conduct of public health surveillance, public health investigations, and public health interventions. (Source: Modified from HIPAA) • Other types of public health disclosures as allowed under HIPAA and state law. Public health Law enforcement