North Carolina Statewide HIE OPERATIONAL PLAN

Transcription

1 North Carolina Statewide HIE OPERATIONAL PLAN Ver Date Description 1.0 August 31, 2010 Version 1.0 submitted to ONC 1.1 Updated to incorporate a new effort to facilitate the electronic transportation of structured laboratory results. See page 62.

2 TABLE OF CONTENTS NC HIE OPERATIONAL PLAN North Carolina Health Information Exchange Page INDEX OF FIGURES AND ILLUSTRATIONS... iv LIST OF COMMONLY USED ACRONYMS... v EXECUTIVE SUMMARY...1 O.1. INTRODUCTION Vision Statement...5 O.2. BACKGROUND Overview State HIE Cooperative Agreement Program Meaningful Use Collaborative Stakeholder and Workgroup Process Timeline and Next Steps...12 O.3. APPROACH TO STATEWIDE HIE Overview Qualified Organizations Health IT and HIE Landscape...17 O.4. GAP FILLING STRATEGY Overview E-Prescribing Electronic Delivery and Receipt of Structured Lab Results Patient Care Summary Exchange...63 O.5. Governance Overview Articles of Incorporation Board of Directors Bylaws Authority and Involvement of the State Ongoing Development of Governance and Policy Structure Next Steps...73 O.6. TECHNICAL INFRASTRUCTURE Overview Clinical and Technical Principles...75 Statewide HIE Operational Plan i

3 6.3. Technical Approach Clinical Functions Statewide Core and Value-Added Services Alignment with NHIN Approach to Implementing Standards and Certification Next Steps...95 O.7. BUSINESS AND TECHNICAL OPERATIONS Data and Services Staffing Plans for Statewide HIE Approach for Technical Assistance to HIOs Standard Operating Procedures for HIE Continuous Improvement Use of NHIN Protocols/Standards and State Level Shared Services O.8. LEGAL AND POLICY Overview Consent Approach for Statewide HIE Current North Carolina Law Pathway One (Consent Model Compliant With Existing North Carolina Law) Pathway Two (Assumes a Change in Current North Carolina Law and Full Compliance with Federal Law) Security Next Steps O.9. FINANCE Overview Financing Model & Approach to Sustainability Key Assumptions Environmental Data Collection Cost and Adoption Models Revenue Mechanisms Approach to Sustainability Controls and Reporting Next Steps Statewide HIE Operational Plan ii

4 O.10. COORDINATION Overview State Health IT Coordinator Medicaid & Public Health ARRA Programs Federal Care Delivery Networks Other States O.11. RISK ASSESSMENT O.12. PROJECT MANAGEMENT PLAN O.13. APPENDICES Definition of Terms NC HIE Articles of Incorporation NC HIE Board of Directors NC HIE Workgroup Participants NC HIE Workgroup Suggested Reading List North Carolina Legal/Policy Workgroup Legal Scan Documents NC HIE Finance Workgroup Environmental Data Collection Statewide HIE Operational Plan iii

5 INDEX OF FIGURES AND ILLUSTRATIONS Figure 1: Workgroup Process and Structure...8 Figure 2: Workgroup Input to HIE Implementation Requirements...11 Figure 3: Approaches to Statewide HIE...13 Figure 4: Attributes of a Qualified Organization...14 Figure 5: Data Link s Geographic Footprint and Hospital Members...27 Figure 6: Interactions between Practices and e-prescribing Facilitators in the North Carolina e-prescribing Adoption Initiative...31 Figure 7: E-Prescribing Volume...32 Figure 8: Broadband Distribution...54 Figure 9: E-Prescribing Workflow...56 Figure 10: Laboratory Ordering and Results Delivery Workflow...60 Figure 11: Illustration of Node-to-Node Messaging Architecture...78 Figure 12: Illustration of Centralized Technical Architecture...79 Figure 13: Illustration of Share Statewide Technical Architecture...81 Figure 14: Illustration of Hosted Shared Services Architecture...82 Figure 15: Illustration of Statewide Core and Value-Added HIE Services...85 Figure 16: Illustration of Statewide Core Services and Targeted Meaningful Use HIE Transactions for Figure 17: Proposed Core Services & Phased Implementation of Value-Added Services...98 Figure 18: North Carolina Healthcare Landscape Figure 19: Number of Potential Qualified Organizations, by Provider Types Figure 20: HIE Connectivity Figure 21: Flow of Funds Figure 22: Office of Health Information Technology Figure A1: Healthcare Landscape Figure A2: Provider Landscape Figure A3: Hospitals and Health Systems Figure A4: Most Prevalent Free Health Clinics (with more than one site) Figure A5: E-Prescribing Adoption Metrics from Figure A6: E-Prescribing Adoption Percentages from Figure A7: E-Prescribing Utilization Percentages from Figure A8: Ten Most Prevalent Labs (with more than one site) Figure A9: Most Prevalent Radiology Centers (with more than two sites) Statewide HIE Operational Plan iv

6 LIST OF COMMONLY USED ACRONYMS 4 A s Authorization, Authentication, Access and Audit ACO AHEC Accountable Care Organization North Carolina Area Health Education Centers (NC REC) ARRA American Recovery and Reinvestment Act of 2009 BCBSNC CAH CCD CCNC CCNC CCR CIA CLIA CMS CPT CVX DMA DURSA EHR EP FOA FQHC GAAP Health IT Blue Cross Blue Shield of North Carolina Critical Access Hospital Continuity of Care Document Community Care of North Carolina Community Care of North Carolina Continuity of Care Record Confidentiality, Integrity and Availability Clinical Laboratory Improvement Amendments Centers for Medicare and Medicaid Services Current Procedural Terminology Codes for Vaccine Administered North Carolina Division of Medical Assistance Data Use and Reciprocal Support Agreement Electronic Health Record Eligible Provider Funding Opportunity Announcement released by ONC for Statewide HIE Cooperative Agreement Program Federally Qualified Health Center Generally Accepted Accounting Principles Health Information Technology Statewide HIE Operational Plan v

7 HHS HIE HIO U. S. Department of Health and Human Services Health Information Exchange Health Information Organization HIPAA Health Insurance Portability and Accountability Act of 1996 HITECH HISPC HITSP HL7 HWTF ICD IDN IHE IRB LOINC MH/DD/SAS MITA MMIS NC DHHS NC HIE NCCCN NCMIPS NHIN Health Information Technology for Economic and Clinical Health Act (part of ARRA) Health Information Security and Privacy Collaboration Healthcare Information Technology Standards Panel Health Level Seven (not-for-profit, ANSI-accredited standards developing organization) North Carolina Health and Wellness Trust Fund International Statistical Classification of Diseases and Related Health Problems (classification code set) Integrated Delivery Network Integrating the Healthcare Enterprise Institutional Review Board Logical Observation Identifiers Names and Codes (a database and universal standard for identifying medical laboratory observations) North Carolina Division of Mental Health, Developmental Disabilities and Substance Abuse Services Medicaid Information Technology Architecture Medicaid Management Information System North Carolina Department of Health and Human Services North Carolina Health Information Exchange North Carolina Community Care Network North Carolina Medicaid Incentive Payment System National Health Information Network Statewide HIE Operational Plan vi

8 NIST OERI ONC PCMH PIN QO REC RFI RFP RHC RHIO RxNorm SAMHSA SCHIP SDE SNOMED-CT SOP SPCCP VistA National Institute of Standards and Technology North Carolina Office of Economic Recovery and Investment Office of the National Coordinator for Health Information Technology Patient Centered Medical Home Program Information Notice, additional guidance requirements for Statewide HIE Strategic and Operational Plans released by ONC in July 2010 Qualified Organization Health Information Technology Regional Extension Center Request for Information Request for Proposal Rural Health Center Regional Health Information Organization RxNorm (a standardized nomenclature for clinical drugs and drug delivery devices, is produced by the National Library of Medicine) Substance Abuse and Mental Health Services Administration (an agency of HHS) State Children s Health Insurance Program State Designated Entity Systematized Nomenclature of Medicine--Clinical Terms Standard Operating Procedures Southern Piedmont Community Care Plan (Beacon Community) Veterans Health Information Systems and Technology Architecture Statewide HIE Operational Plan vii

9 EXECUTIVE SUMMARY North Carolina strongly supports the wide adoption and meaningful use of health information technology (IT) and the development of a robust health information exchange (HIE). We will facilitate the secure, real-time exchange of health information throughout North Carolina, and in the process, enhance medical decision-making and coordination of care, increase system efficiencies and control costs, and improve healthcare quality and health outcomes. We will aggressively support providers meaningful use of health IT and align our HIE capacity with the priority areas identified by the Office of the National Coordinator for Health IT (ONC). This effort is led by the North Carolina Health Information Exchange (NC HIE), a CEO-level public-private partnership responsible for North Carolina s HIE strategy, in cooperation with the Health and Wellness Trust Fund (HWTF) Commission, the State Designated Entity. The NC HIE has established a fully open and transparent collaborative process in which the broadest range of stakeholders have come together to shape the vision of statewide HIE and create the technical, legal, and business rules under which it will operate. This ongoing collaborative process resulted in virtually unanimous consensus among stakeholders and the public on the elements of the North Carolina HIE Strategic and Operational Plans. A History of Innovation and Cooperation as the Foundation for HIE North Carolina has long been a recognized leader in the delivery of innovative, excellent health care. We are the home of Community Care of North Carolina (CCNC), a pathbreaking system that provides a medical home and delivers coordinated care to over one million Medicaid patients, as recognized by the 2007 Harvard University, John F. Kennedy School of Government Innovations in Government Award. We have world class medical institutions with advanced IT systems, and a thriving biomedical and health services research community. We have state of the art health quality initiatives, robust public health programs at the state and local levels, and perhaps the most effective provider support program anywhere in America through our Area Health Education Centers (AHEC). Perhaps most important, however, is the decades-long history of cooperation among those involved in the delivery of health care. Our physicians, hospitals, public health agencies, insurers, labs, pharmacies, academic medical centers, government entities, non-profit organizations, businesses, employers, foundations and consumer groups have developed a spirit of cooperation unmatched anywhere. We have worked together time after time to improve the care delivered to the people of this state. All of us have now come together again to develop a highly effective HIE that provides timely and accurate medical information. The wise use of this information will allow the citizens of this state to lead healthier and more productive lives. North Carolina s Strategic and Operational Plans for Statewide HIE The North Carolina HIE Strategic and Operational Plans detail the four-year trajectory to design and build a world class HIE. Following is an overview of the plans, organized by the ONC program domains. Statewide HIE Operational Plan 1 August 31, 2010

10 Governance The NC HIE Board of Directors is composed of twenty-one CEO-level leaders across the broad spectrum of the state s health care community. Ex-officio seats have been reserved for State officials. The bylaws of NC HIE will require full transparency and accountability, and those provisions may not be altered without the consent of the Governor. The bylaws will also provide an advise and consent role for the Governor in the future selection of board members. NC HIE will continue to coordinate the ongoing statewide HIE collaboration process, including the development and maintenance of policies and procedures to govern the Statewide HIE. It will also assume design and operational responsibility for the HIE, and will contract with technology vendors to manage a set of statewide shared HIE services. The NC HIE Board of Directors is advised by four Workgroups (Governance, Clinical and Technical Operations, Legal and Policy, and Finance) composed of all relevant stakeholder groups. These Workgroups were initially charged with developing recommendations for the NC HIE Operational Plan and will remain in place to advise the Board with regard to ongoing implementation of the Operational Plan. The Board will also convene a Consumer Advisory Council. NC HIE will define the responsibilities of organizations that seek to exchange health information through the statewide system, and will provide oversight and enforcement of the rules for participating in the HIE. The requirements for becoming such a Qualified Organization and a Statewide HIE Participation Agreement will be developed by mid-january These Qualified Organizations will serve as the portals through which individuals and organizations can access the HIE. Technical Infrastructure NC HIE will establish statewide services to facilitate the exchange of information among the Qualified Organizations that choose to participate in the HIE. Hosted shared statewide HIE services will include Core Services and Value-Added Services. Core Services are the basic functions needed for exchange of information, and include systems to accurately identify patients and doctors, registries, record locator services and security functions. Taken together, these Core Services will provide the accurate, secure, and cost-effective mechanism for the exchange of information to and from Qualified Organizations. Value-Added Services represent the specific elements of health information exchanged over the HIE. These services will be added incrementally, based on the importance of the information and the challenge in providing it. Value-Added Services may also be offered by state agencies, HIOs, vendors, or other organizations. The highest priority is given to facilitating providers ability to meet ONC s 2011 priorities for Meaningful Use 1. Therefore, this plan includes a robust assessment of the current HIT and HIE landscape in three areas: e-prescribing, delivery of structured lab results and exchange of summary care records across unaffiliated organizations. The plan then describes the steps necessary to fill the gaps to achieve meaningful use in those areas, including the key processes, the applicable meaningful use requirements, and the technical and non-technical 1 As part of the requirements for the State HIE Cooperative Agreement Program, ONC issued a Program Information Notice (PIN) that provided guidance for states landscape assessments and gap filling strategies. The PIN is available online at: HTML_7-6_1028AM.htm Statewide HIE Operational Plan 2

11 mechanisms needed to increase utilization and adoption. Data collection for the landscape assessment and gap analysis will continue, so that HIE strategies are based on the most current information. NC HIE will also serve as a gateway to the Nationwide Health Information Network (NHIN) for all providers in the state, and will comply with all national standards defined in the Health Information Technology for Economic and Clinical Health (HITECH) Act, and the final Standards and Certification Criteria established by ONC. The plan sets out an aggressive timeline, with a request for proposals and identification of a vendor for the provision of statewide HIE Core Services by early Business and Technical Operations The day-to-day operations of NC HIE will be undertaken by multiple entities in the public and private sectors. Execution of business and technical operations will be conducted by NC HIE, state agencies, and other organizations in accordance with statewide policies to be developed by the NC HIE, organizational bylaws, and applicable federal and state law. NC HIE will manage the Statewide HIE infrastructure as a contracted service. Technical solutions for Phase 1 (2011 and 2012) will focus on the procurement of Core Services supporting Stage 1 Meaningful Use requirements for e-prescribing, lab results delivery, and care summary exchange. NC HIE will develop and release a RFP for these services, lead the process for selection of vendor(s), and oversee deployment and operations of the acquired services. Spanning Phase 1 and Phase 2 (2013 and 2014), NC HIE will develop additional Value-Added Services based on ongoing prioritization, including an assessment of the optimal location (i.e., at the organizational, regional, statewide or cross-state level) and entities for hosting the service. Legal and Policy NC HIE conducted a comprehensive scan of North Carolina law to determine the ways in which current law affects the exchange of health records. The work group members recognized the importance of ensuring that patient records are accurate and complete while maintaining patient privacy. It concluded that a number of North Carolina laws are ambiguous and others are decades old and do not serve patient interests with regard to sharing electronic health information. Therefore, NC HIE will pursue changes to current North Carolina law to allow records to be exchanged unless a patient opts out of the system, and also allow flexibility to consider more specific levels of patient control (initially on a provider-by-provider basis) with the goal of creating a framework that allows for a robust exchange of accurate health information while ensuring that patients have a meaningful choice concerning their personal health data. Immediately after the submission of these plans, we will convene a collaborative process to determine the best legal standards for North Carolina. This process will be led by members of the NC HIE Board who are also members of the NC General Assembly, and will include legislative staff, legal experts, representatives of stakeholders, patients and the public, seeking consensus on a legal framework for patient consent that optimizes both privacy and excellent medical care. The recommended changes to state law will then be taken to the NC General Assembly for consideration in its January 2011 session. While we are confident that consensus can be reached and that these changes will be adopted, a less desirable but still workable patient consent framework can be implemented under existing law, and is described in the plan. Statewide HIE Operational Plan 3

12 NC HIE has also established a set of guiding security principles and recommendations related to access, authentication, authorization, audit and breach and a set of core considerations related to confidentially, integrity and availability (CIA) of data. NC HIE will draft specific, detailed privacy and security policies and procedures by early Finance NC HIE has developed a financing model to support the initial operations and ongoing maintenance of the HIE organization and network. The model s underlying assumptions have been established, a significant data collection effort has informed the modeling exercise, and various cost and revenue models have been assessed. Next steps include more closely evaluating financing and revenue mechanisms as the technology approach is solidified and establishing the procedures and protocols necessary to satisfy compliance with American Recovery and Reinvestment Act (ARRA) and state reporting requirements. Based on this work, we will promptly develop a Sustainability Plan to ensure the financial viability of the HIE. Coordination with Other Initiatives The development of the Statewide HIE must be carefully coordinated with many other programs to ensure the meaningful use of Health IT. North Carolina and its stakeholders have received notice of awards totaling approximately $203 million to support health IT and broadband infrastructure development in addition to incentive payments to eligible providers and hospitals. A core component of North Carolina s statewide HIE strategy is to ensure full coordination among all relevant initiatives, including North Carolina s Regional Health IT Extension Center, Medicaid program, Beacon Community initiative, Children's Health Insurance Program Reauthorization Act (CHIPRA) health IT grant, Broadband Access and Health IT Workforce Development Program. Conclusion A robust health information exchange will be of enormous value to the people of North Carolina. It will allow patients and their families to take a more active role in their care, provide accurate and complete information so that physicians can diagnose health problems earlier and provide better and more coordinated care, reduce medical errors and avoid duplication of services, provide safer care at lower cost, and support providers and payers in developing new and better models of care. The State of North Carolina and its key stakeholders proudly submit this Statewide HIE Operational Plan as a critical milestone in our efforts to that end. Statewide HIE Operational Plan 4

13 O.1. INTRODUCTION Advances in information technology systems have dramatically altered the world in which we live. Huge investments, both public and private, make it virtually impossible to carry out the activities of daily living without utilizing some form of automation. For a variety of reasons, the healthcare system has been slow to adopt new technology on a broad scale. Only a small percentage of healthcare providers nationwide have successfully integrated information technology into their own practices. Even fewer have connected their systems with other providers in any meaningful way to improve care coordination and exchange of health information. Consequently, in North Carolina, most medical records remain paper-based and the vast majority of providers provide ambulatory care in small practices which do not exchange healthcare records on a regular basis with other medical providers. For health IT to be adopted widely, not only must it be affordable, provide value to the practitioner, be easy to implement and cost effective to maintain over time, it must also engage the public s trust in the safety and security of the system. North Carolina has a long and proud history of innovation, both in terms of technology and in seeking out better ways to provide high quality health care services to all of its citizens. North Carolina is home to some of the most progressive health care institutions in the country and has been nationally recognized for its commitment to removing barriers to coordinating care across providers and its development of a patient-centered medical home model (PCMH) of care through the state s Medicaid program. North Carolina is uniquely positioned to evolve a better model of health, one informed and enhanced by information. The critical elements for success already exist: a culture of collaboration and innovation, successful pilot projects and programs, substantial information technology (IT) investments and infrastructure, health care and medical informatics thought leaders, a robust biomedical research community, private funding partners with a track record of investing in health IT, a payer community that leads the nation in innovative and progressive models to support care coordination and quality improvement, large VA medical centers, a strong underpinning of safety net providers, and strong core public health programs at the state and local levels. The state of North Carolina in partnership with health care leaders and key stakeholders from across the state is working to establish a statewide health information exchange infrastructure and capacity to support clinicians in quality and population health improvement, and help control the unsustainably escalating cost of health care by reducing duplication and waste in the system. In addition to providing a critical resource in the short term, North Carolina stakeholders see the value of a coordinated health care exchange infrastructure as a foundation to support new models of care delivery such as PCMH and Accountable Care Organizations (ACOs) Vision Statement The NC HIE, a public/private collaboration, will provide a secure, sustainable technology infrastructure to support the real time exchange of health information to improve medical decision-making and the coordination of care to improve health outcomes and control health care costs for all residents of North Carolina. Statewide HIE Operational Plan 5

14 O.2. BACKGROUND 2.1. Overview The American Recovery and Reinvestment Act (ARRA) of 2009 authorized new funding opportunities and resources for health information technology (IT) and health information exchange (HIE). The Health Information Technology and Clinical Health Act (HITECH) within ARRA provides for: New incentives for Medicaid and Medicare providers to adopt and meaningfully use electronic health records (EHRs); Appropriations for health IT in the form of loans, grants, and technical assistance; Appropriations for HIE planning and implementations allocated to each state and territory; Grants to support the continuing development of broadband and telehealth; and Workforce training grants to support the development of a skilled health IT and HIE workforce. Following the passage of the HITECH Act, North Carolina Governor Perdue signed Executive Order 19, naming the North Carolina Health and Wellness Trust Fund Commission (HWTF) as the State Designated Entity (SDE) for North Carolina. 2 The HWTF Commission subsequently established an HIT Collaborative to provide guidance and oversight as the HWTF Commission prepared its application for health IT funding under the State HIE Cooperative Agreement Program. Under the guidance of the Collaborative, the HWTF Commission completed and successfully submitted its application to the Office of the National Coordinator for Health IT (ONC), receiving notice of award for $12.9 million on February 8, The State HIE Cooperative Agreement Program is one of several programs North Carolina is pursuing under the HITECH Act. An inventory of ARRA-funded health IT projects in the state is below. To date North Carolina and its stakeholders have received notice for approximately $203 million in funding to support health IT and HIE adoption. ARRA Program Awardee Amount State HIE Cooperative North Carolina HIE $12.9 million Agreement Program State Medicaid Planning State Medicaid Agency $ 2.3 million Regional Extension Center Cooperative Agreement Program Beacon Community North Carolina Area Health Education Centers Program (at UNC Chapel Hill) Southern Piedmont Community Care Plan $13.9 million $15.9 million 2 Under HITECH only States or State Designated Entities (SDEs) may access funds through the State HIE Cooperative Agreement Program; an SDE must be named by the Governor. Statewide HIE Operational Plan 6

15 ARRA Program Awardee Amount Health IT Workforce Community College Consortia Program Pitt Community College $10.9 million Health IT Curriculum Development University-level Health IT Workforce Training Broadband BTOP Round 1 Broadband BTOP Round 2 Total funding to date Duke University Duke University 2.2. State HIE Cooperative Agreement Program MCNC/North Carolina Research and Education Network (NCREN) MCNC, City of Charlotte, Olive Hill Community Economic Development, WinstonNet, Yadkin Valley Telephone Membership Corporation $ 1.8 million $ 2.1 million $28.8 million $115 million $203.6 million Under the State HIE Cooperative Agreement Program, states or SDEs are required to complete and submit HIE Strategic and Operational Plans to ONC; guidance as to the structure and requirements for these plans was originally published in the Statewide HIE Cooperative Agreement Funding Opportunity Announcement (FOA) in August ONC has subsequently provided further guidance through a Program Information Notice (PIN) published on July 6, The submission and approval of the North Carolina HIE Strategic and Operational Plan is a critical milestone that will trigger the flow of funding from ONC to North Carolina. Under the cooperative nature of the program, North Carolina and its leadership will continue to work with ONC following the approval of its plan to provide regular updates and report on specific measures ONC has identified (e.g., receipt of structured lab results, electronic prescribing, and clinical summary exchange). North Carolina submitted its application and initial Statewide HIE Strategic Plan in October After receiving notification that North Carolina had been awarded $12.9 million for statewide HIE planning and implementation in February 2010, governance and planning responsibilities shifted from the HIT Collaborative to the North Carolina Health Information Exchange (NC HIE). NC HIE was created as a new non-profit, public-private partnership organization responsible for the execution and oversight of North Carolina s HIE strategy, including the completion and submission of North Carolina s HIE Strategic and Operational Plans. The NC HIE Board of Directors is a diverse group of CEO-level representatives of key health care constituencies in North Carolina. The HIE Strategic and Operational Plans are organized into five domains that NC HIE is required to address in detail: Governance; Finance; Business and Technical Operations; Technical Infrastructure; and Legal and Policy. At the recommendation of its Board, NC HIE convened four workgroups to assist with strategic planning for each of their respective areas. The Workgroups are described in greater detail below in Section 1.4. Statewide HIE Operational Plan 7

16 2.3. Meaningful Use On July 13, 2010, the Centers for Medicare and Medicaid Services (CMS) issued its final rule on the EHR Incentive Programs under Medicare and Medicaid as required by the HITECH Act. Beginning in 2011, the EHR Incentive Programs provide Medicare and Medicaid financial incentives for providers who are meaningful users of certified EHR technology; subsequently, beginning in 2015, the rule imposes Medicare payment penalties on eligible providers that do not become meaningful users. The three stages of meaningful use generally support an incremental approach to health IT and HIE adoption and implementation among providers. The initial stage of meaningful use focuses on the electronic capture of information in a structured format to track clinical decisions and improve care coordination, while later stages are anticipated to focus on continuous quality improvement, broader HIE among unaffiliated entities, and ultimately a patient-centered approach to HIE to improve population health. CMS is expected to release further guidance and the proposed rule for stage 2 meaningful use in late The NC HIE has monitored federal guidance closely and has reviewed the Meaningful Use Final Rule in detail with its staff and stakeholders. The NC HIE is committed to support an approach to enable all providers in the state to satisfy meaningful use in stage one and beyond, and will continue to monitor guidance from CMS and ONC Collaborative Stakeholder and Workgroup Process In pursuit of a transparent and collaborative stakeholder process, the NC HIE created four Workgroups to assist with the development of the state s HIE Strategic and Operational Plans: Governance; Finance; Clinical and Technical Operations; and Legal and Policy. The Workgroup process and reporting structure is depicted in the figure below and was adopted under the belief that a participatory process inclusive of diverse stakeholders would naturally engender stakeholder support. The Workgroups have met regularly during the Summer months, some Workgroups meeting as often as weekly. Governance Board/Steering Committee Facilitated analysis, discussion tracking & documenting of decisions Draft and Final Plans Governance Work Group Legal & Policy Work Group Clinical & Tech Operations Work Group Components of Strategic and Operational Plan Finance Work Group Compile Drafts, Feedback, and Public Input Figure 1. Workgroup Process and Structure Statewide HIE Operational Plan 8

17 Workgroup participants were nominated by the NC HIE Board for their expertise in a particular field and overall commitment to improving healthcare quality, access, and affordability for all North Carolinians. The Workgroups were designed to foster multi-stakeholder, open discussions, and to invite feedback from the public at large. Each Workgroup was charged with addressing specific components required for the completion of the HIE Strategic and Operational Plans. An overview of the Workgroups charges and deliverables is below. All workgroup meeting materials and meeting summaries are accessible online at Workgroup meetings have been well attended. Every meeting is open to the public and includes open public comment time as well as an opportunity for public comments on the deliberations of the workgroup to be submitted in writing via . All Workgroup recommendations are vetted and approved by the NC HIE Board. Statement of Expectations for NC HIE Workgroup Participants Participants have been nominated and invited to participate by the NC HIE governing board co-chaired by Secretary Lanier Cansler and Dr. Charlie Sanders for their expertise in their field and their commitment to improving health care quality, access, and affordability for all North Carolinians. Workgroup members are asked to draw on their expertise and perspective from across industry sectors with an eye toward supporting the greater goal of developing a statewide resource for North Carolina. Workgroups are expected to be multi-stakeholder and nonpartisan and all discussions, meetings and decision-making processes to be fully transparent. Workgroups are asked to consider multiple stakeholder group perspectives when working toward solutions. Workgroups will be asked to make consensus-based recommendations to the NC HIE governing board. In cases where consensus is not reached, the workgroup is expected to put forth a balanced, fair consideration of the pros and cons of an issue. Workgroup members are expected to respect the opinions and input of others and to engage in fair meeting conduct to work toward consensus recommendations. Workgroup members are strongly encouraged to attend meetings in person whenever possible. Public stakeholder input is encouraged. Governance Workgroup The Governance Workgroup is charged with recommending to the NC HIE Board of Directors: A governance framework that will ensure broad-based stakeholder collaboration, transparency, and accountability Methods to ensure the governance framework is characterized by: Statewide HIE Operational Plan 9

18 o o o o Alignment with Medicaid and public health programs The ability to provide oversight and accountability to protect the public interest Statewide support of providers to achieve meaningful use Consumer oriented principles and policy priorities for HIE activities Mechanism(s) to ensure stakeholder perspectives are invited and integrated throughout the Statewide HIE planning process Legal and Policy Workgroup The Legal and Policy Workgroup is charged with recommending to the NC HIE Board of Directors: A statewide policy framework that protects the privacy and security of health information and allows for the incremental development of policies over time Practical privacy and security strategies and policies to support secure HIE while protecting consumer interests A process to harmonize federal and state legal and policy requirements to support HIE Policies to resolve identified potential barriers to intrastate and interstate HIE Legal agreements governing participation in statewide HIE Statewide compliance with applicable federal and state legal and policy requirements Clinical and Technical Operations Workgroup The Clinical and Technical Operations Workgroup is charged with recommending to the NC HIE Board of Directors: High-value/high-priority uses and use cases for HIE consistent with meaningful use of certified EHRs and additional clinical priorities Strategy for statewide HIE infrastructure to address high-priority use cases and clinical objectives Development of a flexible and scalable statewide technical architecture that supports statewide interoperable HIE How shared technical services may be utilized for the state s approach to: Electronic eligibility and claims transaction Electronic prescribing and refill requests Electronic clinical laboratory ordering and results delivery Electronic public health reporting (i.e. immunizations, notifiable lab results) Statewide HIE Operational Plan 10

19 Quality reporting Prescription fill status and/or medication fill history Clinical summary exchange Strategy to support health IT and HIE adoption and meaningful use among the state s providers Evaluation of project including data collection and performance measurement Finance Workgroup The Finance Workgroup is charged with recommending to the NC HIE Board of Directors: Analysis of the costs and ongoing funding streams associated with HIE Financing strategies to support adoption of HIE The value and business case (return on investment) of investments at the state, regional, and institutional levels Strategies to ensure sustainability The figure below depicts how the Workgroups charges and tasks outlined above have informed the implementation requirements in the HIE Strategic and Operational Plans. Governance Work Group Legal & Policy Work Group Clinical & Tech Operations Work Group Finance Work Group Define roles, decision making authority Identify goals Define measures Identify privacy issues Define options Identify policy/tech requirements Identify clinical/business objectives Define architecture Identify services Detail functions, options Develop high-level costs Collect relevant environment data Define revenue sources Identify funding constraints and timing considerations Implementation Requirements Technical specifications Implementation sequencing Detailed cost estimates Detailed, 4 yr budget Evaluation strategy Figure 2. Workgroup Input to HIE Implementation Requirements Statewide HIE Operational Plan 11

20 2.5. Timeline and Next Steps The Workgroup charges described above and in greater detail later in their respective sections are no small tasks. It is anticipated that the Workgroups will continue beyond the submission of the state s HIE Operational Plan to address outstanding questions and implementation of the approved Plans. Recognizing the dynamic nature of the health IT and HIE environment, the Workgroups may change in scope or welcome new members with different areas of expertise to appropriately address the questions and tasks at hand. Statewide HIE Operational Plan 12

21 O.3. APPROACH TO STATEWIDE HIE 3.1. Overview The NC HIE considered a spectrum of approaches to support statewide HIE in North Carolina. The implications of the various approaches were considered primarily in the context of governance and technology implementation, but were discussed in each of the Workgroups and before the Board. The Workgroups specifically considered the four approaches displayed in the figure below. The two ends of the spectrum represent two divergent approaches to statewide HIE. On the far left Statewide HIE is the Market the Statewide HIE would become the primary vehicle for HIE in North Carolina, making regional health information organizations (HIOs) obsolete and empowering the State to drive the market. On the far right Market Determines Structure and Statewide HIE Backfills the Statewide HIE would not actively build or offer core infrastructure or technology services, leaving the provision of technology to the market, vendors, and emerging HIOs. Both the Governance and Clinical and Technical Operations Workgroups advised against the approaches at either end of the spectrum, noting that neither approach has been particularly successful in the past and the desire to continue with a collaborative and transparent governance model. Statewide HIE is the Market Statewide Network Comprised of Diverse Qualified Organizations Regional HIEs given Exclusive Territories Statewide HIE Provides Governance, Outreach Market Determines Structure Statewide HIE Backfills Statewide HIE is primary vehicle for HIE Statewide HIE builds infrastructure, consolidates HIEs for economies of scale NC HIEs focus on local governance, adoption Clinical/Technical Operations Workgroup advised against this option Range of qualified organizations pursuing regional or localized exchange are core structure Statewide HIE provides statewide policy guidance, core services to enable interoperability Statewide HIE may provide value added services that benefit a range of participants to support sustainability. Divide North Carolina into markets/territories assigned to existing HIEs, new HIEs or the Statewide HIE Statewide HIE provides governance, manages monopolies for public good Statewide HIE works with regional HIEs to develop service matrix to avoid duplication and to support joint sustainability. Abandon core services focus, leaving the private market to address interoperability Provide backfills where market fails to assure No provider left behind Focus on education, convening, and statewide policy guidance Clinical/Technical Operations Workgroup advised against this option Figure 3. Approaches to Statewide HIE The two remaining approaches for consideration were a 1) Diverse Statewide Network Comprised of Qualified Organizations; and 2) Regional/Territory-based Approach where a Statewide HIE Provides Policies and Guidance. A short description of these approaches is provided below. Diverse Statewide Network Comprised of Qualified Organizations. In this approach, Qualified Organizations (e.g. regional HIOs, hospitals, labs, etc.) Statewide HIE Operational Plan 13

22 aggregate providers and connect to a statewide network. The Statewide HIE provides policy guidance, structure, and oversight of participation in the network. The Statewide HIE may also develop core infrastructure and services to enable interoperability among providers and ultimately value-added services to support a sustainability model. Regional HIEs Given Territories and Statewide HIE Provides Governance and Outreach. In this approach, North Carolina would be divided into a set number of regions or markets; subsequently each region would be assigned to an organization responsible for implementing HIE among the region s providers. The Statewide HIE serves as an overall governance body for the state, providing policy guidance to promote interoperability and adoption among the regions. The considerations relative to the two approaches are described in the figure below: Qualified Organizations Territory Based / Regional HIEs Allows for a greater level of flexibility wider range of entities can participate / serve as on ramps. Complexity could present need for greater level of administrative and technical support. Policies and procedures would need to be adopted by and monitored across a larger and more diverse participant body. Potential for more variation in core and value added service needs. Allows for greater level of control limited number of on ramps. Potential cost savings due to fewer on ramps. Could present higher level of risk failure of one regional entity will impact many providers. Requires significant stakeholder education and outreach. Requires developing geographic boundaries and potentially close collaboration among competitors. Responsibilities for service offerings more readily defined (some owned by Statewide HIE, others by RHIOs). Figure 4. Attributes of a Qualified Organization and Regional HIE Approach In both approaches described above, organizations act as aggregators of providers; these aggregators may be, for example, a hospital system, Federally Qualified Health Center (FQHC) network, or regional HIO. The regional approach determines a definitive number of connections or regional efforts, and may be difficult to execute in a state without robust HIE efforts statewide. The qualified organization approach allows for greater flexibility and for organizations to emerge as provider aggregators as the HIE market evolves and changes. While the qualified organization approach is a relatively new concept, the NC HIE believes that it presents important benefits for North Carolina, including: Efficiency and cost savings from aggregation of providers and data. Support for innovation in the marketplace and the emergence of new partnerships and collaboration. Statewide HIE Operational Plan 14

23 Leverages existing private and public infrastructure and investments among health care organizations. Responsiveness to North Carolina s complex health care landscape. Given the considerations and benefits described above, the NC HIE is recommending the pursuit of a qualified organization approach to a statewide HIE network. This approach is described in greater depth in subsequent sections Qualified Organizations The NC HIE will implement a Qualified Organization participation model for the North Carolina statewide HIE. A Qualified Organization is a health care organization or aggregator of organizations capable of: Aggregating providers for purposes of connectivity to the Statewide HIE network; Adherence to statewide policy guidance Fulfillment of technical, legal, policy, and procedural obligations as defined by the Statewide HIE; and Entrance into a binding contract with the Statewide HIE Qualified Organizations invite a diverse array of participation in statewide HIE; this is appealing in North Carolina because of the diverse health care landscape and existing investments in HIE that may be leveraged. Qualified Organizations may be a variety of organizations or networks that have relationships with, or provide services to, providers. Potential Qualified Organizations may be, but are not limited to: Provider Networks Consortia of providers Federally qualified health centers (FQHCs) Health systems Hospitals Integrated delivery networks (IDNs) Provider groups Local public health departments or public health organizations Regional HIOs Rural health centers (RHCs) Regional Health Information Organizations Private, Non-Provider Networks Clearinghouses Laboratories Pharmacies Vendors Payers including North Carolina Medicaid and private insurers Statewide HIE Operational Plan 15

24 Qualified Organization Participation Structure The Statewide HIE will create and oversee a structured review and accreditation process to ensure that potential Qualified Organizations are capable of fulfilling the technical and policy requirements associated with participation in the Statewide HIE network. While participation in the Statewide HIE will be voluntary, a Qualified Organization must sign a contract or participation agreement with the NC HIE, binding it and its participants to compliance with the Statewide HIE s policy and technical guidance. There will also be a process and policies established to ensure ongoing oversight of Qualified Organizations to protect the interest of state s providers. If a Qualified Organization is identified as noncompliant with the Statewide HIE s requirements as described in its contract, a Qualified Organization s participation may be terminated. Also, it is important to note that should a Qualified Organization terminate its relationship with the Statewide HIE, there will be reasonable rules and processes in place to ensure the affected providers are not abandoned and left without a mechanism for connectivity to the Statewide HIE network. Accountability and transparency will be central to ensuring the success of statewide HIE and encouraging provider participation. Qualified Organizations will be expected to execute similar participation agreements and contracts with its members, binding those members to requirements for all statewide HIE members. Value to Qualified Organizations Why Participate in the Statewide HIE? In the rapidly evolving HIE market environment, organizations must consider the benefits and risks of participation in a statewide HIE network. The benefits identified by the NC HIE planning process to date focus on easing the burden of individual organizations to design and build robust HIE infrastructure; leveraging group purchasing power; interoperability among disparate organizations; and alignment with State programs. These and other benefits are outlined below. Participation in the Statewide HIE will: Facilitate access to core services and satisfaction of meaningful use requirements among Qualified Organizations and participants. Increase provider access to important data at the point of care by enabling HIE among organizations outside of a single network more rapidly and at a lower cost. Offer referral and care coordination services via the sharing of clinical summary information with external organizations. Facilitate access to North Carolina state government information, including possible access to Medicaid and public health data. Lower development cost of statewide shared services offered through the Statewide HIE which could include services such as master patient index (MPI); consent management; lab ordering and results delivery; and medication reconciliation. Support shared learning and best practices across the Statewide HIE. Facilitate participation in national (such as the National Health Information Network) and interstate HIE activities. Statewide HIE Operational Plan 16

25 Alternative Provider Pathway The NC HIE feels strongly that the Statewide HIE should leave no provider behind and offer providers unaffiliated with or unable to participate in Qualified Organizations an alternative pathway to connect to the Statewide HIE network. The Governance Workgroup has recommended that the NC HIE explore a web-based provider portal through which the Statewide HIE may offer providers access to core services to satisfy meaningful use requirements. The NC HIE will partner with the North Carolina Regional Extension Center for identification of and outreach to providers who may need or prefer an alternate mechanism for participation in the Statewide HIE. This is an active discussion that will be continued during implementation of the Operational Plan and ultimately incorporated into a future procurement process for technical services Health IT and HIE Landscape In North Carolina, the health information infrastructure consists of various organizations operating at the enterprise, local, regional and state levels. Operating as a system of systems, North Carolina s health information infrastructure includes: HIOs that serve multi-stakeholder entities and enable the movement of health-related data as hubs of natural information markets; Health systems, affiliated providers, and ancillary services; Specialized participants that operate for specific purposes, including, but not limited to, laboratory services, radiology, public health, research, and quality assessment; Information and service providers that operate in vertical markets such as e- Prescribing, State registries, Medicaid and Medicare; Care coordination organizations; Private payers and clearinghouses that transmit administrative data for claims purposes and for pay for performance programs; and Credential Service Providers (CSP) and Identity Service Providers (IDP) that provide identity credentials and identity management services to the healthcare industry. Many of these organizations have their own health IT systems and networks. At any point in time the networks will be in different stages of their life cycles, will be built on many different technologies, and will have differing priorities regarding the data they collect and transmit. The evolving statewide health information infrastructure in North Carolina is intended to complement and integrate, not supplant these networks. Reflecting the geographic and demographic diversity and economic complexity of North Carolina are a number of other overlapping influences on the development of healthcare delivery and policy. It is expected that communities across the state will continue to extend collaborative relationships between community leaders, healthcare providers, and public health officials. Statewide HIE Operational Plan 17

26 As a means for tracking the progress of the expansion of health exchange in North Carolina, NC HIE has catalogued the current exchange capabilities across the transactions identified in the ONC State HIE Cooperative Agreement Program and those necessary to support eligible providers meet stage 1 meaningful use requirements. 3.3.a. Health IT Adoption The success of health information exchange depends upon many factors, not the least of which is the extent to which providers, practices, clinics, and hospitals acquire, implement and certified EHR technologies. Below are findings from the studies of EHR adoption in North Carolina conducted over the last four years. The NC HIE, North Carolina Department of Health and Human Services (DHHS), and the North Carolina REC will continue to track adoption of certified EHR technology. Physician Adoption of EHRs North Carolina s experience with adopting electronic health records (EHRs) appears similar to the findings documented by national and other state-level studies. A survey conducted by the North Carolina Academy of Family Physicians (NCAFP) on behalf of the Carolinas Center for Medical Excellence found that as of January 2006, 22% of North Carolina physicians had adopted EHRs and another 30% were actively considering implementing an EHR system. 3 A study by Rosenthal and Layman of information technology utilization by physicians in eastern North Carolina published in 2008 found, consistent with national survey findings, that smaller practices were less likely to use EHRs and other health information technologies. 4 In order to provide budget estimates to CMS, the Medicaid Health IT team completed a preliminary estimate and analysis of an EHR survey submitted by North Carolina providers as part of a North Carolina Medicaid reenrollment process. The table below provides the results of the 885 respondents analyzed by the Office of Medicaid Management Information Systems (MMIS) Services as of July 27, Percent of Count Respondents Respondents that Currently Use EHR % Respondents that Plan to Purchase Within 12 Months % Clinic Adoption of EHRs In 2009, 32% of both state-funded rural health clinics and federally funded community health centers had implemented EHRs. This is the equivalent of eight out of the 25 state-funded rural health clinics and nine of the 28 federally-funded community health centers. Hospital Adoption of EHRs In 2009, the North Carolina DHHS conducted a survey of the current landscape on hospital adoption of EHR. Of the 125 hospitals that responded to the survey, 3 NC Academy of Family Physicians, Inc. EHR Survey Results Overview Final. January Rosenthal DA, Layman EJ. Utilization of information technology in eastern North Carolina physician practices: determining the existence of a digital divide. Perspectives in Health Information Management. 2008;5(3). 5 The Office of MMIS Services continues to input responses into a database for tabulation. Statewide HIE Operational Plan 18

27 15% (19 hospitals) are using electronic health records exclusively 49% (61 hospitals) are using both paper and electronic records 21% (26 hospitals) are not using electronic health records 15% (19 hospitals) had no response or did not know One major barrier commonly noted was the amount of capital needed to adopt EHRs. Fifty-nine percent of respondents indicated that this was an issue of major significance Other major barriers to adoption identified include: Finding an EHR that meets providers needs (38% of respondents indicated it as an issue) Resistance to adoption by physicians (33%) Capacity to select, install and implement an EHR (28%) State Agency Adoption of EHRs The North Carolina DHHS Division of Mental Health is implementing a recently approved Community Electronic Health Record Web Infrastructure for Treatment Services (WITS) project to advance EHR adoption amongst its stakeholders. The Community EHR initiative will result in better coordination of services for consumers, improved data quality, standardization, data availability, and improved administrative efficiencies across the system. The objective of this initiative is to develop a community electronic health record system that will ensure continuity of care for North Carolina Division of Mental Health, Developmental Disabilities and Substance Abuse Services (MH/DD/SAS) consumers across all types and levels of care by providing standardized data collection and interoperability among community service providers, Local Management Entities (LMEs), and state operated MH/DD/SAS facilities. For this initiative, the North Carolina Division of Mental Health has selected the Web Infrastructure for Treatment Services system as the solution for managing care in community settings. It is primarily for community providers' planning and delivery of services, and secondarily for LMEs' management and oversight of services. The North Carolina DHHS is also developing plans to support the implementation of VistA (Veterans Health Information Systems and Technology Architecture) as an EHR for the 15 state-operated facilities. With the VistA system, the state operated facilities would have access to CPOE; data from labs, pharmacies, and radiology; physician and nurse assessments, progress notes, consult reports and discharge summaries. Pending the availability of funds, deployment of VistA would begin at two acute care hospitals. Statewide HIE Operational Plan 19

28 Support for EHR Adoption North Carolina Regional Extension Center The NC Area Health Education Centers (AHEC) Program at the University of North Carolina, Chapel Hill received a notice of grant award dated February 8, 2010 to perform the function of the North Carolina Regional Extension Center (NC REC) for health information technology. The award of $13.6 million dollars over two years will allow NC AHEC to reach at least 3,465 priority primary care physicians and assist with practice assessment, workflow redesign, selection and implementation of EHR to achieve meaningful use of the technology and improve health outcomes throughout the state of North Carolina. NC AHEC will expand its consulting workforce throughout the nine regions of the state to help practices implement technology and/or use previously existing technology to meet the federal standards of meaningful use to achieve incentive payments. The NC REC has hired 27 well-trained personnel with experience in EHR implementation and technical expertise to assist primary care practices across the state, and plans to hire an additional professionals. A training mechanism for these new staff members has been built with assistance from the REC subcontractors at the Carolinas Center for Medical Excellence (CCME), the North Carolina Medical Society Foundation and the Institute of Public Health. Additionally a website and tracking tool has been developed by CCME to enable the NC REC to provide tools and resources while tracking the progress of each practice through the necessary steps of readying for, selecting and implementing an EHR. To date, over 1,000 providers have submitted information and been entered into the web-based system. NC AHEC has worked with the Carolinas Center for Medical Excellence, the North Carolina Medical Society Foundation, Community Care of North Carolina (CCNC) and the NC Institute for Public Health to build a detailed training program including over 40 hours of instruction and interactive learning for newly hired personnel within the nine regional AHECs across the state. These new personnel will engage with primary care providers across the state to help them implement and use electronic health records to achieve the incentive payments and improve care for their patients. Additionally, NC AHEC has developed a plan to identify a REC-supported EHR vendor list to guide primary care providers across the state in their selection of certified EHR products. This process includes the development of a detailed request for information (RFI) that will be sent to EHR vendors across the country. NC AHEC has also identified a committee of physicians, practice managers and an expert in HIPAA and security to score the responses to this RFI. Those EHR systems that demonstrate a high enough score will be invited to demo their product for the committee to ensure that the product performs to the meaningful use standards. Once the demos have been completed the systems that the committee deem appropriate will be listed on a REC-supported vendor list. At that time, all RFI responses and the scores that they received will be made available to providers across the state to use in their process of selecting EHR systems. Community Care of North Carolina (CCNC) Provider Portal CCNC s Informatics Center is currently upgrading its capacity to host a secure web portal for direct provider access to Medicaid patient information, include care team contacts, medical and pharmacy claims history, medication adherence and clinical care gap alerts. Statewide HIE Operational Plan 20

29 North Carolina Electronic Health Record Loan Fund Pilot Program In August 2010, the HWTF announced the creation of the North Carolina Electronic Health Record Loan Fund Pilot Program. The pilot will provide financial assistance to healthcare providers in Tier 1 counties seeking to create or upgrade EHR systems required for Medicare and Medicaid reimbursements beginning in A grant of $127,461 was awarded to the North Carolina Medical Society Foundation to provide technical assistance for and evaluation of the EHR loan fund pilot program over a five-year period beginning July 1, The Center for Community Self-Help (Self-Help), a Durhambased nonprofit, will manage the $750,000 loan fund and underwrite prospective borrowers. Self-Help will work in partnership with the North Carolina Medical Society Foundation and the North Carolina Area Health Education Centers to identify eligible providers and help them transition to advanced EHR systems. The revolving loan fund is designed as a pilot program to expend its initial capital within the first year of operation. Individual loans are expected to range in size from $40,000 to $60,000 and may be used to: Purchase a certified EHR technology or upgrade an existing EHR to meet certification criteria; Train personnel in the use of such technology; and/or Improve the secure electronic exchange of health information. Loans will vary in pricing based on the borrower s credit/collateral profile and will feature flexible repayment terms to better serve the needs of a wider variety of practices. 3.3.b. Statewide and Regional Health Information Exchange The statewide HIE that will be overseen and managed by the NC HIE will leverage and support existing and emerging information exchange efforts across the state. In North Carolina, several health information organizations (HIOs) have formed or are forming to offer providers direct access to a range of HIE services. It is envisioned that many of these HIOs could eventually serve as Qualified Organizations and provide gateways to the shared services that would be offered at a statewide level or offer to host services for other participants in statewide HIE. Currently, one HIO, Western North Carolina Health Network (WNCHN) Data Link, is operational within the state and a second effort, the North Carolina Healthcare Exchange (NCHEX) launched pilot projects in August Five other HIE efforts are in advanced planning stages. These initiatives are more fully described below. In addition to those described here, North Carolina has a significant number of enterprise-level private networks and emerging collaborations throughout the state that could support and be enhanced by participation in the NC HIE. HIE Initiatives Coastal Connect Health Information Exchange In 2007, the Coastal Connect Health Information Exchange (Coastal Connect) initiative was first conceptualized by a committee of Chief Information Officers from member hospitals of Coastal Carolinas Health Alliance in Wilmington, NC. The Alliance currently represents nonprofit Statewide HIE Operational Plan 21

30 hospitals in nine counties, seven of which are located in North Carolina and two in South Carolina, serving approximately one million residents. In 2010, CCHIE was officially incorporated and corporate bylaws approved for submission for the organization to receive its 501(c) (3) status. For Phase I of the initiative, Coastal Connect is targeting at least ten counties including: Bladen, Brunswick, Columbus, Duplin, New Hanover, Pender, Pitt (associated counties within the system to be identified), Robeson, Sampson, and Scotland. New Hanover County and Pitt County are the home of two major health systems (New Hanover Regional Medical Center and University Health System, respectively) that will be integral in creating the HIE. In addition to large, urban hospitals, both of these systems also encompass rural-based providers and practices. With the help of Computer Sciences Corporation (CSC), Coastal Connect has completed a survey assessment to determine providers needs in the community related to health IT and HIE and is using the information to help select a vendor for implementing the exchange. The organization plans to launch a pilot in late 2010 to demonstrate the value of the exchange to Coastal Connect members. The demonstration project will include 5 hospitals and as many as 100 affiliated physician practices (in five counties) as participating partners, and will seek to achieve the following goals and objectives: Improve access to care in underserved and uninsured areas Create a resource for clinicians to access, exchange and manage meaningful patient data Improve quality of care Provide electronic collection of 646 chronic disease measures to improve patient health outcomes Develop policy or guidelines for data collection and publication Improve coordination of care Implement use of clinical summary document to facilitate care delivery at care transitions Improve efficiency of data flow through real-time applications minimizing time spent completing paperwork and patient registration Provide laboratory results data Coastal Connect expects to utilize a hybrid-federated HIE data model which will extract data from source systems and store the information in federated repositories, all operated by a centralized information management system. With this hybrid model, CCHIE expects full push/pull capabilities through clinical messaging and master patient index (MPI)/record locator service (RLS) technologies. Coastal Connect also expects standardized interoperability capability between providers and anticipates interoperability on the state and national levels. Finally, Coastal Connect submitted a grant proposal to HRSA in 2009 and received $50,000 in grant funding which was used to develop a sustainability model for the exchange. Additional achievements include the creation of a Data Usage and Reciprocal Support Agreement Statewide HIE Operational Plan 22

31 (DURSA) and a standard Patient Consent Form based on an opt-out model with restrictions, both of which have been sent to the organization s legal team for final approval. North Carolina Healthcare Exchange (NCHEX) Currently in development at two pilot sites, the North Carolina Healthcare Exchange (NCHEX) is a voluntary HIE with hospital and physician practice participants sponsored by the North Carolina Hospital Association (NCHA) and the North Carolina Medical Society (NCMS). NCHEX, with technology partners Thompson Reuters and Care Evolution, builds on the experience and technology of the North Carolina Hospital Surveillance System (NCHESS), created in 2004 as a public-private partnership between NCHA and the North Carolina Division of Public Health (NCDPH) to provide critical data from 114 emergency departments to enable the state to recognize and respond to acts of bioterrorism, disease outbreaks, emerging infections, and other public health emergencies. 6 The pilot phase, launched in Summer 2010, includes the Moses Cone and WakeMed health systems and seven hospitals, three free-standing emergency departments and 57 hospitalowned physician practices. NCMS is working to identify several independent physician practices to join the pilot. NCHEX also seeks to provide clinical insight to additional stakeholders such as the NC Department of Public Health, emergency medical services, CCNC, and safety net providers. The NCHEX HIE architecture uses a hybrid model (neither fully centralized nor fully federated) that collects a limited amount of information from hospital and physician practice EHRs and stores it in a secure data center where it is processed. The exchange will be initially populated with about a year of history (based on HL7 journal logs collected on the NCHESS servers) and will update data at least once a day. In the future, it is anticipated that updates from providers to the NCHEX system will be in near-real-time. The inpatient/hospital data will be mapped to the following hospital information systems (HIS): ADT/Registration, Lab, Dictation, and Pharmacy (if available) The deliverables for the initial work stream include: creation of a community Master Patient Index of all patients across the pilot hospitals a record locator service for the participating entities embedded terminology management to deliver data consistency across diverse data contributors implementation of methods for medical episode grouping to create longitudinal linking of episodes of care creation of a Virtual Single Patient Record (vspr) that can be viewed on a webbased Continuity of Care Viewer (CCV) 6 Please see Section 3.3i for a full description of NCHESS. Statewide HIE Operational Plan 23

32 Across the balance of 2010, NCHEX will bring up HIE functionality between the pilot hospitals and their ambulatory care practices, with the following conditions: Only hospital-owned practices running GE Centricity Logician and AllScripts Enterprise will be eligible for consideration in the pilot Pilot hospitals will have to provide direct database access to their ambulatory EMR systems to support their inclusion in this work stream Independent physician practices in the Wake and Guilford county medical trading areas will be recruited to join the pilot Deliverables for this work stream include: implementation of existing direct connect drivers to GE Centricity EMR and Allscripts Enterprise expansion of the unified Master Patient Index to include the ambulatory practice patient records creation of a Virtual Single Patient Record (vspr) that can be viewed on a webbased Continuity of Care Viewer (CCV) The CCV will not only be able to show one patient/one record across a pilot hospitals' ambulatory and inpatient settings, but also data shared for that same patient across hospitalclinical system settings. NCHEX has placed an emphasis on supporting providers in meeting the HIE-enabled meaningful use requirements. The HIE plans to also provide the following value-added capabilities: electronic prescribing. hosted EHR 'lite' for small practices or free clinics. public health reporting, immunization registry reporting, CCD generation for use with external providers and HIEs, NHIN connectivity capability, patient inquiry through the Continuity of Care Viewer by community physicians and case managers, medication reconciliation, clinical alerts (surveillance) and never event management. Sandhills Community Care Network Health Information Exchange (SCCN) The Sandhills Community Care Network is a regional component of the NC Community Care system which provides case management services to the Carolina Access Medicaid recipients in Harnett, Hoke, Lee, Montgomery, Moore, Richmond and Scotland counties. SCCN has proposed to build on this existing foundation to establish a community health information exchange. The SCCN network consists of multiple entities of varying size with disparate IT capabilities with providers that have multiple stand-alone product-centric applications. As such, SCCN faces inefficiencies stemming from these silos of irretrievable information. SCCN is committed to eliminating these barriers by 1) partnering with the South Regional- Area Health Education Center (SR-AHEC) to research available EHRs and produce a slate of choices selected to meet the needs of SCCN providers based on cost, capabilities, support and ability to exchange information, and 2) working with network hospitals, practices and other partners who already have significant IT integration to select a best of breed HIE service for the entire region. Statewide HIE Operational Plan 24

33 SCCN utilizes an HIE Committee comprised of both Board members and SCCN staff. SCCN has invested $180,000 over the last two years working with consultants to ascertain present needs and capabilities and future objectives. The SCCN HIE Committee, working in a facilitative role with SR-AHEC, has interviewed several cost-effective, web based, CCHIT certified electronic medical record vendors and is in the process of vetting a preferred list. The SCCN HIE Committee is seeking to initiate, develop and sustain a Health Information Exchange that allows appropriate, privacy-protected access to data in a common format. Several leading HIE consulting firms have been interviewed. In a recently repeated survey, SCCN approximates that 50% of network practices already have EHRs in place highlighting the anticipated reality of data exchange. In addition, one hospital and several large practices have implemented advanced IT systems and early collaborative efforts have been successful. Moving forward, the goal of SCCN is to encourage Network providers to obtain a low-cost, certified, Web-based EHR while concurrently building a health information exchange to allow communication across practices, hospitals and other members of the community. SCCN anticipates working on two parallel tracks to facilitate regional HIE development: 1) an on-going commitment to the implementation of EHRs within the Network and 2) simultaneously appending to an existing HIE project with a local hospital and a few large group practices. SCCN s focus is to assist SR-AHEC who has an additional 30 practices within the SCCN network at various stages of EHR implementation currently. SCCN s desire to align with ONC initiatives is strengthened by developments in two areas: 1) approximately 40% of Network providers utilize e-prescribing (an additional 14 practices utilize standalone e-prescription modules) and 2) aggressive marketing of the newly established Provider Portal of the NC Community Care Informatics Center to stimulate data exchange of information related to Medicaid recipients. SCCN has hired a full-time information technology specialist to help facilitate HIE development in the network. Southern Piedmont Community Care Plan Health Information Exchange The Southern Piedmont Community Care Plan (SPCCP) was selected by the ONC Beacon Community Program as one of the 15 Beacon Community award recipients and will receive more than $15 million to build and strengthen health IT infrastructure and health information exchange capabilities in its area of operation to enhance quality of patient care and cost efficiency. SPCCP will incorporate health IT to advance community level care coordination in areas including hypertension, diabetes, blood pressure control, asthma, medication reconciliation, non-emergent ED visits and preventable readmissions. SPCCP collaborated with nearly 400 health care providers within the community to establish priorities as a Beacon Community. The group considered priorities identified by recent public community health assessments for the three participant counties (Cabarrus, Rowan, and Stanly), the goals of the North Carolina Community Care Network s (NCCCN) Medicare Modernization Act 646 program, other SPCCP initiatives such as asthma management, alignment with HHS meaningful use objectives, and alignment with the State HIE and regional extension center plans. High level objectives of the project include: 1. Enhance Health IT Infrastructure and Exchange Increase EHR penetration by implementing EHRs in free clinics, public health departments, FQHCs, and small practices. Statewide HIE Operational Plan 25

34 Increase provider and patient access to health data to facilitate management of personal health data. Reduce rates of performing duplicate imaging tests by enabling the sharing of imaging study reports and results. Reduce rates of readmission for chronic disease and ED utilization for ambulatory care sensitive conditions with a care transition notification system for hospitalization and ED use. 2. Care Quality Improve chronic disease care for patients with hypertension, diabetes, congestive heart failure, and asthma. For example, reduce high blood pressure levels, improve hemoglobin A1c levels, and decrease the number of ED visits due to asthma attacks. Increase patient quality related to pharmacotherapy. A central focus of the Southern Piedmont Beacon Community is to improve health outcomes and learn from the early health IT adoption experiences and share the related lessons-learned with other, later EHR/HIE adopters. Health outcomes will focus on the evaluation of quality measures in high-risk populations (diabetics, asthmatics, patients with congestive heart failure, and hospitalized patients with complicated problems who are transitioning to their medical homes) and be conducted with support from experienced healthcare researchers at the Duke and UNC-CH Schools of Medicine and the UNC-CH Sheps Center for Health Services Research. The evaluation will assess the impact of the Southern Piedmont Beacon Community interventions on care process and outcome measures and on the cost of care. Southern Piedmont Health Information Exchange (SoPHIE) In mid 2008, the Southern Piedmont Partnership for Public Health (SPPPH) started a planning process for a person-oriented health information exchange called SoPHIE the Southern Piedmont Health Information Exchange. The planning was carried out by a group including representatives from local public health agencies, the NC Division of Medical Assistance (Medicaid), the NC Institute for Public Health (the outreach arm of the UNC Gillings School of Public Health), private clinics, informatics experts, medical researchers, security and privacy experts, and consumer advocates. This planning process was supported by the Robert Wood Johnson Foundation s Common Ground Project. SoPHIE planning focused on using health information exchange to support NC public health agencies objectives -- as key providers of clinical services across the state, as population health entities, as health promotion agents, and as connective agents for health in their communities working with all other clinical and health-related community services. This focus led to SPPPH s development of a set of principles about HIE that in aggregate are called person-oriented. Following these person-oriented principles will result in an HIE that has an associated store of longitudinal data per patient/consumer (though not necessarily all patients in the same store) and can engage in exchanges without storage. This is generally considered to be a hybrid HIE model. The planning process involved creating value propositions for using SoPHIE, prioritizing and sequencing those value propositions, developing business plan outlines for the top value propositions, developing key business process descriptions for these business activities, and Statewide HIE Operational Plan 26

35 creating an architecture that explored how the technical, governance, and business needs of SoPHIE might be met. Since June 2009, the work has focused on determining how to pilot/demonstrate SoPHIE. With support from an additional grant, we intend to complete the tactical planning for such a demonstration. By March 2011, we expect to have done an RFI and created an RFP for the demonstration. This demonstration project is viewed as a potential first step towards a more general deployment of an HIE based on SoPHIE principles. The SoPHIE demonstration project will seek to involve several public health agencies, non-public health care providers, payers (one private payer and one public payer, preferably Medicaid), consumers and medical/health services researchers. WNC Data Link of the WNC Health Network The 16 far-western counties of North Carolina, with a combined population of 750,000, are predominantly rural and mountainous, characterized by isolated communities and pockets of extreme poverty in which patients often travel substantial distances to obtain needed care. This often results in patients medical histories being disbursed across a number of providers. To address this, in 2002, the 16 hospitals serving these counties collaborated to identify options for the purpose of securely and efficiently exchanging electronic patient medical information. In February 2006, Data Link went into production to provide authorized providers and clinicians access to a virtually integrated view of a patient s electronic records from across all WNC hospital systems. Data Link s goal is to allow every WNC resident to have a longitudinal electronic medical record that can be accessed and updated in real time by any authorized provider. Data Link s current geographic footprint map can be seen in the figure below. Figure 5. Data Link s Geographic Footprint and Hospital Members Through a detailed request for proposal process, the WNC hospitals chose MEDSEEK for the provision of software and interfaces. Hosting services are currently provided by Peak 10 Data Center Solutions. Currently, upon provider request, WNC Data Link searches all of the WNCHN hospitals information systems for a patient s records and collates them in a standardized format in real time. Clinicians can access the records through any internet connected device. Patientcentric data available through Data Link includes: admission/discharge information, lab results, Statewide HIE Operational Plan 27

36 microbiology reports, radiology reports, medications, allergies, discharge summaries, history & physicals, Emergency Department notes, progress notes and other transcribed reports. Lab results available inside the EHRs connected to Data Link are accessible for exchange in Data Link today and an evaluation is being conducted to assess whether a need to connect to other lab vendors exists and, if so, how to negotiate that connectivity on behalf of regional providers. Also, all hospital radiology providers within the region have their results available within Data Link and technical scoping is underway with the largest regional privately-owned radiology provider for connectivity. Data Link has begun focusing on making medical images and outpatient medication history available through the exchange. Medical images will include radiology, nuclear medicine, tomography and ultrasound images, as well as images of medical mappings such as EEGs, EKGs, or ECGs. Access to outpatient medication history will be added to facilitate medication reconciliation, as well as e-prescribing tools, via a link to a retail pharmacy database. E- prescribing tools will also be available with this developed link to Surescripts. Planning is also ongoing to have a patient portal available on Data Link within the next year. Technical scoping is underway to connect the regional Cerner Healthe Hub, E-Clinical Works regional hub, and other vendor regional hubs to Data Link. Additionally, a point-to-point interface is being developed to connect the EHR of the Hot Springs Health Program of Madison County, a full service (physician office, home health, hospice, and urgent care center) Federally Qualified Health Center (FQHC), and a second to connect the EHR of the largest regional home health and hospice program managed by CarePartners (which currently covers seven of the 16 counties). Finally, Data Link is currently implementing the ability to accept and produce CDA Release 2 Level 2 CCD C32 Patient Summary Records. In the initial phase, the C32 record includes: demographic information, allergies, problem lists, medications, and information source. Those documents will be accessible technically to federal partner(s) via the NHIN Gateway by October 2010 pending the on-boarding process. To date, there is an average of 450 providers using Data Link on a monthly basis, with over 20,000 hits in Data Link each quarter. Data Link averages 13,300 lab transactions, 1,550 microbiology transactions, 1,600 inpatient pharmacy transactions, 12,500 radiology transactions and 35,800 transcription transactions per month, and over 2.6 million medical records are available to be accessed via Data Link. Statewide HIE Operational Plan 28

37 A table summarizing key components of these initiatives is provided below: HIE (Lead Org(s)) CCHIE (Coastal Carolinas Health Alliance) NCHEX (North Carolina Hospital Association) Sandhills HIE (Sandhills Community Care Plan) Year Established Region Range of Participants Technical Approach 2010 Pilot includes 5 5 hospitals Hybrid counties in Eastern Up to 100 physicians North Carolina (including New Hanover and Pitt) 2010 Pilot involves multiple sites TBD Seven Counties in south of the state (Harnett County, Hoke County, Lee County, Montgomery County, Moore County, Richmond County, Scotland County) 7 Hospitals 8 Emergency Departments 57+ Physician Practices 6 Hospitals 1 CAH 250 providers (92 practice sites) 4 labs 1 FQHC 29 SNFs Hybrid Hybrid Data Exchanged as of August 2010 Planning to exchange: CCD erx (Will commence in October 2010) All data available in EMR/EHR systems including ADT, labs, Rx, care summary, immunization data, etc. Transitional Care Summaries E-Prescription Lab results Diagnostic images (data types currently being electronically exchanged within Sandhills region) Clinical Priorities Provide tools to enhance delivery of care Facilitate effective coordination of care across clinicians Provide tools to enhance delivery of care Facilitate effective coordination of care across clinicians Financing/Sustainability Model Participant Financing (membership fees) Leveraging NCHESS footprint. Participant financing (membership fees) Seeking additional funds to support state-wide expansion. Participants funding (membership fees, subscription fees & marketing) Grant financing (discretionary funds from cost savings for 646 Medicare Demonstration Project Southern Piedmont Community Care Plan HIE (Southern Piedmont Community Care Plan) 2010 Three counties in western central North Carolina (Cabarrus, Rowan, and Stanly) 1 FQHC (two sites) 3 local health departments 3 local hospitals 4 community free clinics 1 VA Med Ctr 796 providers (physicians, PAs, NPs) Hybrid Planning to exchange: Transitional Care Summaries Public Health Data Medication History Medical Images Facilitate effective coordination of care across clinicians Provide tools to enhance delivery of care Grant financing (Beacon Community Grant) Statewide HIE Operational Plan 29 August 31, 2010

38 HIE (Lead Org(s)) Southern Piedmont Health Information Exchange (SoPHIE) (Southern Piedmont Partnership for Public Health) WNCHN Data Link (WNC Health Network, Asheville, NC) Year Established Region Range of Participants Technical Approach Data Exchanged as of August 2010 Clinical Priorities Financing/Sustainability Model 2008 Eleven counties in Planning to include: Hybrid TBD TBD Grant financing (Robert western/central Local and state public Wood Johnson North Carolina health departments Foundation s Common (Alexander, Providers Ground Project) Cabarrus, Catawba, Payers Cleveland, Gaston, Consumers Iredell, Lincoln, Medical/Health Services Mecklenburg, Researchers Rowan, Stanly, and Union) 2006 Sixteen counties in western North Carolina ( Buncombe, Cherokee, Clay, Graham, Haywood, Henderson, Jackson, Macon, Madison, McDowell, Mitchell, Rutherford, Transylvania, and Rutherford) 16 hospitals 1270 physicians Federated moving toward hybrid Demographics Lab Results Radiology Reports Inpatient Rx List Admission Info Microbiology Allergies Transcriptions including ED reports, Consultative notes, Progress Notes, History and Physical, and Discharge Summaries. Provide tools to enhance delivery of care and moving toward facilitate effective clinical coordination of care across clinicians For development, grant funding was used from HRSA and the Duke Endowment. For sustainability, participant financing are subscription based fees and participant pro rata fees. Statewide HIE Operational Plan 30 August 31, 2010

39 3.3.c. e-prescribing E-prescribing is the use of health IT to improve prescription accuracy, increase patient safety and reduce costs, as well as enable secure, bi-directional, electronic connectivity between physician practices and pharmacies. Physicians Use of E-Prescribing Tools North Carolina has demonstrated leadership in health IT adoption gains. One measure of the increase in e-prescribing adoption is the percentage of physicians who route their prescriptions electronically. The percentages of North Carolina providers routing e-prescribing at year end were: 9 percent in 2007, 23 percent in 2008; and 24 percent in The figure below represents the number and type of interactions between practices and e- prescribing facilitators participating in the BCBS/CCNC/NC Medicaid e-prescribing adoption program (July 2008-present). It demonstrates the depth and intensity with which North Carolina is able to deploy health IT-centric initiatives statewide and across stakeholders. This health IT adoption program acted as the precursor to the Regional Extension Center effort. Figure 6. Interactions between Practices and e-prescribing Facilitators in the North Carolina e- Prescribing Adoption Initiative Sponsored by BCBSNC/CCNC/NCDMA 7 Surescripts. State Progress Report on Electronic Prescribing. Data as of June Statewide HIE Operational Plan 31

40 Routing of Scripts According to data compiled by Surescripts, there were over 9 million electronic prescriptions in North Carolina in Figure 7. E-prescribing Volume Pharmacy Access to E-Prescribing In North Carolina, there are 2,461 in-state pharmacies of which 1,119 are retail chain pharmacies, 622 are independent, and 180 are hospital based. Of the 12,526 active pharmacists licensed in North Carolina: 3,286 work at retail chain pharmacies 2,117 work at hospital pharmacies 1,407 work at retail independent pharmacies In 2009, Surescripts reported that 1,777 out of 1850 or 96% of community pharmacies have the ability to receive electronic prescriptions and refill requests. 8 Based on this data, we believe there are robust capabilities among pharmacies within North Carolina for accepting electronic prescribing and refill requests. 3.3.d. Electronic Delivery of Laboratory Results The electronic delivery of laboratory results is a multi-step process that begins with the creation of an order for a laboratory test. The test results can be sent directly to the clinician s EHR system or another clinical data system in support of the provisioning of historical results and results for non-ordering, providers of care. Providers of care may receive test results in the 8 Surescripts. State Progress Report on Electronic Prescribing. Data as of June Statewide HIE Operational Plan 32

41 EHR system or another clinical data system or receive notification of the results (for later retrieval). According to the Clinical Laboratory Improvement Amendments (CLIA) laboratory demographics file, North Carolina s distribution of laboratory facilities is as follows: Hospital labs 154 Independent labs 101 Ancillary test sites 58 County public health labs 1 State Laboratory of Public Health The 154 independent labs sites represent 72 laboratories. The table below illustrates the top 10 labs with more than one site. Lab Corp, Spectrum Lab and Carilion Lab make up 71% of all independent lab sites in the top 10 labs. Facility Name Total Percent of Labs Labcorp Labs 30 19% Spectrum Labs 20 13% Carilion Labs 16 10% Select Diagnosis 5 3% Pathologists 5 3% Celligent Diagnosis 5 3% Quest Diagnostics 3 2% Piedmont Health 3 2% Raleigh Radiology 2 1% Coastal Carolina 2 1% Carolina Med 2 1% Ascertaining the state of structured lab results activities currently taking place in North Carolina requires an understanding of the: Percent of labs able to produce and deliver structured lab results Percent of labs able to receive orders electronically Percent of lab results currently being delivered electronically Percent of providers receiving structured lab results Using the list of unique organizations based on license numbers, the NC HIE will conduct a survey of laboratories that seeks information on their current ability and plans to (1) produce and 9 CDC Oscar database. Accessed on August 3, Statewide HIE Operational Plan 33

42 deliver structured lab results electronically and (2) the data content and transmission standards deployed. 3.3.e. Care Summary Exchange The ability to create, transmit, receive and interpret patient care summaries can enhance a wide range of health services, including continuity of care, accurate diagnosis and treatment, and patient and care giver engagement. As the patient centered medical home model becomes a more accepted method of practice for primary care physicians, the desire to exchange summary records will underscore the need for availability of electronic data from all possible healthcare sources. The extent exchange of patient care summaries can be measured by assessing volume of transactions at multiple levels. Across the state, one fully operational HIE in North Carolina, WNC Data Link, currently facilitates the exchange of patient care summaries. In addition, the NCHEX project has launched pilot projects that present summary care records to clinicians. At the provider level, the NC HIE will work with Medicaid and NC REC to develop a survey that assesses the current level of adoption of EHR technology capable of producing and receiving summary care records. 3.3.f. Medicaid Within the North Carolina Department of Health and Human Services (DHHS), the Division of Medical Assistance (DMA) oversees the State s Medicaid and Health Choice programs. North Carolina Medicaid is the single largest payer of health services within North Carolina. In , North Carolina Medicaid served approximately 1.7 million children, aged, blind and/or disabled individuals. The budget for the Medicaid program was $11.3 billion which is supported by $8.4 billion in revenue (predominately federal Medicaid funds) and $2.9 billion in state appropriations. North Carolina s Health Choice for Children (NCHC) is a free or reduced price comprehensive health care program for children. NCHC provides funding to extend health care coverage to roughly 115,000 children each month whose family income exceeds Medicaid financial eligibility criteria. The budget for NCHC was $226.8 million of which $167.4 million was supported by federal funds and $59.4 million in state appropriations. Inter-agency Coordination North Carolina DHHS has established a committee (DHHS HIT Workgroup) to direct the health IT and HIE activities of Medicaid and all associated DHHS agencies including Public Health, Mental Health, and Rural Health. While many states vary widely in the extent of their coordination of mental health, substance abuse, and Medicaid agencies with external behavioral health entities, North Carolina has all of these programs under a single umbrella, the Department of Health and Human Services (DHHS). In an effort to narrow coordination and data consistency gaps among these services, Statewide HIE Operational Plan 34

43 the Centers for Medicare & Medicaid Services (CMS) and the Substance Abuse and Mental Health Services Administration (SAMHSA) have entered into a national joint project to adapt Medicaid Information Technology Architecture (MITA) planning tools and processes for behavioral health services. North Carolina has the unique advantage in this initiative to have already centralized behavioral health activities to facilitate greater coordination, cooperation, and interoperability among agencies, programs, and systems at the State level. In NC approximately 16 percent of all claim reimbursements in the Replacement MMIS multipayer systems will be related to the behavioral health spectrum of treatment. While there are many safeguards around data specifically related to Behavioral Health services, the adoption of national behavioral health-mita standards increases the potential for inclusion of these services within an EHR. Community Care of North Carolina (CCNC) The Medicaid program has worked closely with various organizations across the state on the implementation of various health IT initiatives. CCNC operates a medical home based patient care model, and currently has the single largest Medicaid provider group in North Carolina, with more than 3,000 participating primary care physicians in more than 1,400 practices across North Carolina, serving approximately 1 million Medicaid and North Carolina Health Choice for Children enrollees. CCNC utilizes Medicaid claims data for multiple purposes, including identification of patients in need of high-risk case management, disease management, or care coordination; facilitation of practice-based quality improvement; monitoring of cost and utilization outcomes; and monitoring of quality of care with performance feedback at the network, practice, and patient level. North Carolina Medicaid Management Information System (MMIS) The Department established the Office of MMIS Services (OMMISS) as a Program Management Office (PMO) to oversee the various health information technology projects associated with the replacement of the State s MMIS system. The replacement system is as a multi-payer initiative with Medicaid, State Children s Health Insurance Program (SCHIP), Public Health, Rural Health and Mental Health, Developmental Disabilities and Substance Abuse Services. The projects that are a part of this effort include the MMIS Replacement, decision support and health informatics, surveillance and utility review and the MITA State Self- Assessment. North Carolina Department of Health and Human Services project for Design, Development, and Implementation (DDI) of a new MMIS that is aligned with the CMS defined Medicaid Information Technology Architecture (MITA) is underway. MITA is setting the standard for MMIS systems of the future and provides the basic infrastructure and framework for healthcare modernization of state public welfare systems amid the implications of evolving health information exchanges, electronic health records, emerging national standards, ever-changing federal and state directives, and the critical need for immediate and better access to health data for all providers, consumers and administrative entities within the healthcare delivery system. The replacement MMIS system will utilize service-oriented architecture and with the ongoing development of federal HIE standards will be able to support EHR protocols such as CCD. The first phase of the MMIS modernization includes a service-oriented architecture to enable connectivity of disparate systems, a Workflow component, a master file transfer protocol, and Statewide HIE Operational Plan 35

44 integrates with NCID, the official North Carolina Identity Management Service. Upon implementation, the system will support new e-prescribing technology using NCPDP and Medicare Part D standards. These new HIE capabilities will ultimately improve care by consolidating and making all current prescription information available to providers and pharmacists to work in partnership for the patient to reduce the incidence of adverse drug effects. For the Department, the Replacement MMIS will be a key component of North Carolina s HIE infrastructure. Patient claims data will continue to be available to CCNC regional care coordination networks and Medicaid providers via a data repository download to the centralized CCNC Informatics Center. In addition, the improved MMIS type HIE services will supply claims to support creation of a CCD standard record that will be available to providers as a part of their new EHR systems. All components of the NC Replacement MMIS Project are being developed with HIE capability and aligned with MITA. The Reporting and Analytics Project replaces the current Medicaid decision support data warehouse with a more robust centralized informatics reporting solution capable of storing all NC public healthcare program claims data, including Medicaid, Children s Health Insurance Program, Public Health, Behavioral Health, and Migrant and Rural Health data. Future plans include the option for further expansion to claims data from the State Employees Health Plan. North Carolina s Administration of Meaningful Use Incentive Program The Division of Medical Assistance has established a timeline for creation of a written State Medicaid HIT Plan to be submitted to CMS as part of their responsibility for enabling the utilization of EHRs by providers and monitoring Meaningful Use by Medicaid providers in North Carolina. The Planning Advanced Planning Document (PAPD), the initial funding document required from North Carolina by CMS, was resubmitted to CMS on January 29, 2010 and approved by CMS effective February 4, The approved document meets the requirements outlined in Section 4201 of the Recovery Act and the guidance found in the State Medicaid Director s letter, /ARRA HIT#1, dated September 1, Approved FFP is $2,288,648 with $255,512 in state matching funds. On April 30, 2010, CMS provided a more comprehensive plan detailing interface requirements between a National Level Repository (NLR), other federal computer systems and state incentive payment management systems. The project team completed an alternative analysis to identify options for meeting these new requirements and has contracted with CSC to build the North Carolina Medicaid Incentive Payment System (NCMIPS). North Carolina is the first state to test interfaces with the NLR. Currently, CMS has a dedicated technical team working with the NCMIPS team, which provides a unique opportunity for NC to be at the forefront of developing the interfaces required in order to launch the EHR Incentive Payment program. The NLR interfaces represent one component of NCMIPS that must be designed, built and configured before NC will be able to begin making incentive payments. Work on NCMIPS is underway and NCMIPS is expected to be integrated with the replacement MMIS. Initially, prior to full MMIS integration, NCMIPS will interface with the Enrollment, Verification and Credentialing (EVC) system and be accessed via NCTracks. Statewide HIE Operational Plan 36

45 3.3.g. Quality Reporting and Improvement The exchange of information in support of quality reporting involves the documentation, collection and transmission of patient information relevant to the calculation of an established quality measure for clinician quality, where a specific clinician can be identified as responsible for ensuring adherence to best practices. Examples include measurement of clinician performance in both inpatient and outpatient settings, including but not limited to physician offices, emergency departments, and surgical settings. In North Carolina, quality reporting and improvement initiatives occur across both the public and private sectors and at the local, regional, and statewide levels. North Carolina Healthcare Quality Alliance (NCHQA) NCHQA is a Section 501c3 non-profit organization with the goal of dramatically improving the quality of care across the state of North Carolina. NCHQA is a collaboration of virtually all the leaders in the delivery of medical care in North Carolina. The Board of Directors consists of members appointed by the Governor and other public officials, various medical societies, insurers, the state hospital association, the Foundation for Advanced Health Programs, and Community Care of NC. It also includes representatives of academic medical centers, business, consumers, and other key players dedicated to improving care. NCHQA was initially organized under the auspices of the Governor, and now operates as an independent non-profit organization. NCHQA works with physician practices to improve the quality of care delivered to patients with chronic diseases. NCHQA s quality improvement activities are administered by the NC Area Health Education Center (NC AHEC), a federally designated Regional Extension Center (REC). To accomplish its goal of improving the quality of care in primary care settings, the NCHQA (1) develops nationally recognized quality measures for the treatment of chronic diseases, (2) ensures that those measures are supported by all insurers, (3) recruits primary care practices willing to adopt those measures and improve their delivery of chronic disease care, (4) provides training, support and tools to assist those practices in improving the quality of care, and (5) provides feedback to practices regarding their performance in meeting quality standards. NCHQA has selected five common chronic diseases diabetes, asthma, hypertension, congestive heart failure, and post-mi care as the first diseases to include in the initiative. Selection of measures for these conditions was guided by the following principles: Measures used in the NCHQA are based on nationally recognized evidence-based standards such as those developed by the National Committee for Quality Assurance (NCQA) and endorsed by the National Quality Forum (NQF) and which have been widely accepted in the North Carolina provider community. Whenever possible, NCHQA measures will build on existing reporting systems, particularly Community Care of North Carolina (CCNC) measures, to assess quality. Building on existing systems will reduce burden and ensure the most comparable results across time. Assessment in progress regarding quality of care will be regularly conducted and will include critical review of the measures being used and the need to adjust them. Changes in measures will be linked to the release of new national standards and improvements in the measurement process suggested by evidence-based practice. Statewide HIE Operational Plan 37

46 Expansion of NCHQA to measures for other conditions and across the continuum of care is a long-term goal. Data to calculate measures will be obtained both through claims data and chart audits. Collection of data will consider the privacy concerns of providers and patients and every effort will be made to reduce the cost and administrative burden on practitioners of additional data collection activities. Other NCHQA activities to assist practices in improving quality will provide support for provider-based data collection for short-term assessment of improvement. North Carolina Division of Medical Assistance Managed Care North Carolina s Division of Medical Assistance (DMA) is responsible for required reporting to CMS on the following EPSDT components annually: Total individuals eligible for EPSDT State Periodicity Schedule Number of Years in Age Group Annualized State Periodicity Schedule Total Months of Eligibility Average Period of Eligibility Expected Number of Screenings per Eligible Expected Number of Screenings Total Screens Received Screening Ratio Total Eligibles Who Should Receive at Least One Initial or Periodic Screen Total Eligibles Receiving at One Initial or Periodic Screen Participant Ratio Total Eligibles Referred for Corrective Treatment Total Eligibles Receiving Any Dental Services Total Eligibles Receiving Preventive Dental Services Total Eligibles Receiving Dental Treatment Services Total Eligibles Enrolled in Managed Care Total Number of Screening Blood Lead Tests Statewide HIE Operational Plan 38

47 The DMA s quality evaluation and health outcomes unit reports HEDIS data broken out by Medicaid and the Managed care programs. The reported data consists of: Breast cancer screening Cervical cancer screening Diabetes related services Appropriate medication for asthma Access and utilization of ambulatory care for adults and children Prenatal care Childhood immunization status North Carolina Quality, Evaluation & Health Outcomes Unit The Quality, Evaluation and Health Outcomes Unit (QEHO) of the North Carolina Division of Medical Assistance: Identifies opportunities for strategic improvement in Medicaid program operations; Monitors the performance and effectiveness of Medicaid programs; and Analyzes information to identify patterns of utilization, trends in performance, and opportunities for improvement in delivering care to the populations served by Medicaid in North Carolina. In its annual county-specific reports, QEHIO reports some high-level quality and overall health measures for each of North Carolina s 100 counties in comparison to a state average: Percent Women with no Prenatal Care in 1st Trimester Infant Mortality per 1000 Medicaid births Percent of live births with low birth weight Adult Cardiovascular Risks: Tobacco Use (from Behavioral Risk Factor Surveillance System) Obesity (also BRFSS) Hypertension incidence Diabetes incidence AHRQ Quality Indicators: Diabetes short-term complication admission rate Diabetes long-term complication admission rate Chronic obstructive pulmonary disease admission rate Congestive heart failure admission rate Statewide HIE Operational Plan 39

48 Adult asthma admission rate Pediatric asthma admission Quality Measurement and Feedback for Community Care of North Carolina Since its inception in 1998, CCNC has used performance measurement and feedback to help meet its goals of improving the quality of care for Medicaid recipients while controlling costs. Quality measurement is intended to stimulate or facilitate quality improvement efforts in CCNC practices and local networks, and to evaluate the performance of the program as a whole. Under the direction of the Clinical Directors, CCNC s measurement and feedback process has evolved over time to meet the changing needs of the program. Several factors necessitate a continuing need to evolve, such as 1) expansion of Community Care s enrolled population and increasing focus on aged, blind, and disabled patients with multiple chronic conditions, 2) practice participation in other quality initiatives (such as PQRI, NCQA HSRP and DPRP, Bridges to Excellence, NCHQA), and desire that measures be aligned as much as possible, and 3) changes to evidence-based clinical practice guidelines over time. A Quality Measurement and Performance workgroup, with representation from all fourteen networks, meets periodically to review performance measures. Goals are to identify measures with: 1) clinical importance (based on disease prevalence and impact, and potential for improvement), 2) scientific soundness (strength of evidence underlying the clinical practice recommendation; evidence that the measure itself improves care; and the reliability, validity, and comprehensibility of the measure), and 3) implementation feasibility. Workgroup recommendations are presented to the CCNC network leaders, and final measures are chosen by vote of the Clinical Directors. As of January 2009, patients are eligible for chart review on the basis of asthma, diabetes, ischemic vascular disease, and heart failure. Chart review measures pertain to: appropriate asthma management; diabetes glycemic control and foot care; management of blood pressure, cholesterol, and tobacco use; appropriate aspirin use; and assessment of LV function in heart failure. Community Care has contracted with Area Health Education Centers (AHECs) to perform independent randomized chart reviews for >26,000 recipients in >1325 CCNC practices, with an electronic data abstraction tool. Practice-level results with patient-level detail are available to the networks by secure Internet reporting services on a next-day basis. Program-level results are reported annually. An additional set of quality of care measures are derived from Medicaid claims data, pertaining to: medication therapy for asthma, heart failure, and post-mi patients; adult preventive services (breast, cervical, and colorectal cancer screening); and pediatric preventive services (dental care and well child exams). Claims measures are reported quarterly at the practice, county and network level. A care alert system to readily identify patients in default of recommended services is set to be released in Fall of Practices and networks receive monthly, quarterly, or annual feedback on process, cost, utilization, and quality metrics. A critical element to Community Care s success centers on the ability of the networks to locally implement system changes needed to improve quality in practices. The network Clinical Directors are instrumental in engaging community providers to implement the quality initiatives. Providing credible and provider friendly reports are powerful tools, particularly when accompanied with benchmarks and comparisons to peers, helping to motivate providers to improve processes that will enable them to provide best care. The focus is on implementing evidence-based best practices in the medical home. Statewide HIE Operational Plan 40

49 In addition CCNC reports monthly on utilization measures designed to monitor quality initiatives such as e-prescribing, transitional care and ED diversion. Community Care of North Carolina Informatics Center The CCCN s Informatics Center is an electronic data exchange infrastructure maintained in connection with health care quality initiatives for the State of North Carolina sponsored by the Department of Health and Human Services Division of Medical Assistance, Office of Rural Health and Community Care, and the United States Department of Health and Human Services Centers for Medicare & Medicaid Services. Currently, the Informatics Center contains health care claims data provided by Medicaid, as well as health information about program participants obtained directly from health care providers and care managers and/ or the primary care medical record. Additional data sources will be integrated into the Informatics Center in 2010, to include: Medicare claims and Surescripts pharmacy data for dual eligibles, Labcorps (laboratory results), and real-time hospital admission/discharge/transfer data from 48 large NC hospitals. Information is accessed by the Community Care networks to identify patients in need of care coordination; to facilitate disease management, population management, and pharmacy management initiatives; to enable communication of key health information across settings of care; to monitor cost and utilization outcomes; and to monitor quality of care and provide performance feedback at the patient, practice, and network level. Informatics Center applications include: Case Management Information System (CMIS): CMIS is a user-built, patientcentric, electronic record of care management activities used by CCNC care managers since 2001, with over 1,000 active users statewide. CMIS contains demographic data and claims data on over 2 million Medicaid recipients, over 1 million of whom are currently enrolled with a practice in a CCNC network. CMIS also contains enrollment, eligibility and case management services for HealthNet projects across the state, which are regional collaboratives for the care of the uninsured, currently serving 12,500 enrolled individuals. Patients enrolled in Medicaid, Health Choice and HealthNet all reap the benefits of the continuity of care provided by CMIS, which maintains a health record and single care plan that stays with the patient as he or she moves from one area of the state to another, or across eligibility programs. CMIS contains standardized health assessment and screening tools, disease management and health coaching modules, and workflow management features. and health coaching modules, and workflow management features. Pharmacy Home. The Pharmacy Home Project was created to address the need for aggregating information on drug use and translating it to the network pharmacist, case manager and primary care provider in a manner best suiting their care delivery needs. To accomplish this charge, the system was set up to provide both: 1) a patient level profile and medication history for point-of-care activities as well as 2) a population-based reports system to identify patients that may benefit from pharmaceutical care delivery via pharmacists, case managers and PCPs in the medical home. The Pharmacy Home drug use information database is used both prospectively (for identification of care gaps and problem alerts, targeting of at-risk patients, and development of the pharmaceutical care plan) and retrospectively (for continuous quality improvement and program evaluation). Statewide HIE Operational Plan 41

50 Quality Measurement and Feedback chart audit system: NCCCN conducts over 26,000 medical record reviews in over 1250 primary care practices statewide on an annual basis, to abstract medical record data pertaining to quality of care measures for asthma, diabetes, hypertension, heart failure, and ischemic vascular disease. Medicaid claims data is used to generate a random sample of eligible patients, and to pre-populate audit tool elements according to an individual s identified chronic conditions. Secure client-server software allows users to work offline when Internet access is not available in the clinic location. When access to Internet is available, the system automatically synchronizes data with the server. Data is fully encrypted offline and in transit. Data sent to the server automatically updates a variety of process, progress, and analysis reports. Practices and CCNC networks have immediate access to chart review results, with local, state, and national comparative benchmarks, through a secure web portal. Informatics Center Reports Site: NCCCN creates patient-, practice-, county-, and network-level reports related to population management, case management/case identification and quality of care/performance measurement through a secure web portal and report distribution system. Provider Portal: NCCCN released a Provider Portal in August 2010, which allows secure web-based query access to the health record of NC Medicaid recipients, by treating providers involved in CCNC quality initiatives. The portal provides medical home and care team contact information, medication fill history and current med regimen (with indication of adherence and therapy gaps); clinical care alerts for point-of-care decision support; and visit history including inpatient, ED, office visits, imaging, DME supplies. Medical home providers have direct access to cost, utilization, and quality, and care gap reporting for their patient population to assist with population management. The portal also provides access to a comprehensive resource of low-literacy patient education materials and multilingual medication counseling tools. North Carolina Medicare 646 Waiver In 2003, Congress established the Medicare Health Care Quality Demonstration Program (Section 646 of the Medicare Prescription Drug, Improvement, and Modernization Act of 2003). The program has become known as the 646 Demonstration. The goal of the 646 Demonstration is to improve the quality of care and services delivered to Medicare beneficiaries through system redesign that fosters best practice. A competitive process was used to select health care organizations (physician group practices, integrated delivery systems, and regional coalitions of physician group practices and integrated delivery systems) to participate in this five-year demonstration. Under the 646 Demonstration, CCNC will carry out an intervention that combines a physiciandirected care management approach with the use of health IT to connect providers, support care management and delivery, measure performance, and implement pay-for-performance financial incentives. CCNC will extend its medical home and community based care management system to dual-eligible and Medicare-only populations. During years one and two, CCNC will manage approximately 44,000 dual eligible beneficiaries who receive care from 165 Community Care practices in 26 counties. At the beginning of year three, an estimated 170,000 Medicare-only beneficiaries, who receive care from those 165 practices, will be added to the demonstration. From years three to five, Community Care will Statewide HIE Operational Plan 42

51 manage approximately 214,000 Medicare-only and dual eligible beneficiaries. As part of the demonstration there will also be a comparison group, which will be composed of the beneficiaries who receive their care from approximately 200 practices in 32 North Carolina control counties. 3.3.h. Public Health Reporting North Carolina Public Health collaborates with local health departments, hospitals, community health centers, practitioners, and community agencies throughout the state and nation to promote and contribute to the highest possible level of health for the people of North Carolina. NC Public Health has a dual role in health IT, as public health includes both individual care level services and population health services. North Carolina Public Health Information Network (NC PHIN) NC Public Health, including state and local health departments, organizes health IT and HIE under the concept of the Public Health Information Network (PHIN) according to National Health Information Network (NHIN) standards. NC PHIN was initially built through the use of Federal Public Health Preparedness funds that came to states following the events of September 11, The NC PHIN infrastructure provides 24/7/365 secure operations with high availability for applications that support the CDC Preparedness Goals. NC PHIN supports the national standards and objectives that are critical elements of a new statewide HIE such as open source development, interoperability, HIE, and certified standardsbased messaging. Listed below are additional details on some of the NC PHIN public health services provided. North Carolina Health Alert Network (NC HAN) NC HAN is a secure web-based alerting/communication system within NC PHIN designed to automatically and immediately alert appropriate users to health and bioterrorism threats. The service provides an effective method of ensuring that all appropriate personnel within the NC Division of Public Health, local health departments, hospitals, laboratories and other community partners are notified via , pager and/or fax according to PHIN PCA requirements. Syndromic Surveillance North Carolina has several systems in place to facilitate syndromic surveillance. In North Carolina, 100% of local health departments have access to syndromic surveillance information from emergency departments via the NC DETECT system. NC Disease Event Tracking and Epidemiological Collection Tool (NC DETECT) NC DETECT is the web-based early event detection and timely public health surveillance system in the NC PHIN. NC DETECT provides services for situational awareness, case finding, contact tracing and timely surveillance related to injuries, chronic diseases, environmental exposures and other public health concerns. NC DETECT receives data on at least a daily basis from four data sources: emergency departments (via a system called the North Carolina Hospital Emergency Surveillance System, or NCHESS, more fully described below); the statewide EMS data collection system (called the Pre-Hospital Medical Information System, or PreMIS, also more fully described below); Statewide HIE Operational Plan 43

52 the statewide poison center; and a regional wildlife center. Data from select urgent care centers and three laboratories from the NC State College of Veterinary Medicine are in pilot testing. North Carolina Hospital Emergency Surveillance System (NCHESS) NCHESS was developed in 2004 by the North Carolina Hospital Association (NCHA) and the NC Department of Public Health using funding provide by the U.S. Department of Homeland Security through the Centers for Disease Control (CDC). NCHESS is a statewide clinical data surveillance program that captures real-time clinical data from hospital information systems and analyzes that data to quickly and accurately identify public health emergencies at specific hospitals, in certain geographic locations, or across the state. The NCHESS Emergency Department Data Interface (EDDI) is in place at 114 hospital emergency departments statewide, and collects 23 discrete data elements and provides syndromic surveillance, situational awareness, and clinical information of public health interest. In addition to the surveillance function, NCHESS Investigative Monitoring Capability (IMC) is in place at 45 of 114 hospitals, will 11 more capable of enabling this feature. Utilizing technology created by Thomson-Reuters, the IMC monitors all hospital clinical data in real time for patterns suggestive of public health threats and alerts hospital and public health officials accordingly. The IMC allows epidemiologists at DPH and at hospitals the ability to electronically reachback into hospital data systems to access electronic data on individual patients as needed to further investigate specific public health concerns. Over its lifespan, NCHESS has collected and reported on over 19 million unique patient records and over 115 million individual records. The data from 114 NCHESS hospitals comprise 93% of the data monitored by NC DETECT for public health surveillance in North Carolina. This represents approximately 25% of all the hospital data contributed to the CDC s BioSense surveillance system. NCHESS anticipates adding approximately 9 new emergency departments to the program by the end of Pre-Hospital Medical Information System (PreMIS) PreMIS is primarily an Emergency Medical Service (EMS) electronic medical records system that is also used as a mandated statewide system for collecting and analyzing EMS data from the over 1.4 million EMS events that occur in North Carolina every year. North Carolina regulations require that an electronic patient care report be completed on each EMS patient contact. EMS Agencies are required by regulation to complete an electronic patient care report and submit it into the PreMIS system within 24 hours of the event. EMS Agencies can meet this electronic data submission requirement by using the free PreMIS web-based data entry tool or through a commercial EMS data system which has been certified as a National EMS Information System (NEMSIS) Gold Compliant vendor. NC DETECT downloads daily files from the PreMIS and analyzes the EMS data for particular syndromes based on standardized pick lists for dispatch complaint and primary symptom. The North Carolina Office of Emergency Medical Services (NC OEMS), the state regulatory agency for EMS, established the EMS Improvement Center (EMSPIC) at the University of North Carolina-Chapel Hill to provide technical support and assistance to North Carolina s 540 EMS Agencies and 100 county-based EMS Systems in the use of EMS data. PreMIS is maintained through a contractual agreement by the EMSPIC. The PreMIS system is based on the National Statewide HIE Operational Plan 44

53 EMS Data System standard adopted by all 56 US states and territories. Currently there are 26 different commercial EMS software packages active within North Carolina. Additionally, the Duke Endowment recently funded the EMSPIC s development of 5 EMS Performance Improvement Toolkits based on the NC EMS Data Systems. The Toolkits address key patient types or EMS events including EMS Response Time, Acute Trauma Care, Acute Cardiac Care (STEMI), Acute Pediatric Care, and Cardiac Arrest Care. The Centers for Disease Control and Prevention has also funded the development of an Acute Stroke Care Toolkit. All 6 EMS Performance Improvement Toolkits are now active within all 100 EMS Systems. Finally, this past year, the NC OEMS and the EMSPIC have focused on the linkage of EMS data with other existing North Carolina data sources. The purpose of the linkage is to better describe, evaluate, plan, and improve the healthcare provided to the citizens of North Carolina. At this time, NC OEMS and EMSPIC are linking PreMIS data and Trauma Registry data and have been granted approval by NC DHHS to obtain North Carolina Emergency Department, and Stroke Registry Data for linkage. NC OEMS is also seeking other ways to make EMS data available for HIE initiatives, including working on an initiative to make copies of EMS patient care reports retrievable by hospitals from the PreMIS system. Notifiable Results North Carolina has created a system to facilitate notifiable lab results reporting. In North Carolina, 100% of local health departments have electronic access to reportable lab results via the North Carolina Electronic Disease Surveillance System. Electronic lab reporting has been implemented with two laboratories, the State Laboratory of Public Health and LabCorp (both major sources of lab data for communicable disease surveillance). NC Electronic Disease Surveillance System (NC EDSS) NC EDSS is a statewide disease surveillance, outbreak/case management and early detection system. NC EDSS is utilized by public health users to receive, manage and analyze electronic data from public health entities, clinics, laboratories, hospitals and health care providers. NC EDSS replaced several communicable disease databases that had previously existed in the state, including TIMS (tuberculosis), NETSS (general communicable diseases and vaccinepreventable diseases), STD*MIS (STDs), HARS (HIV) and the Perinatal Hepatitis B Database. NC EDSS services include support for required case or suspect case reporting of reportable diseases, electronic lab reporting, outbreak management, emergency situational awareness and GIS mapping capabilities. Immunization Reporting North Carolina has created a system to facilitate statewide access to immunization data. In North Carolina, 100% of local health departments have electronic access to immunization information via the North Carolina Immunization Registry (NCIR). The state is evaluating ways to provide an interface that will enable EHRs to send as well as receive immunization information. North Carolina Immunization Registry (NCIR) NCIR is a secure, web-based clinical tool which is the official source for North Carolina immunization information. The NCIR takes the place of handwritten charting of immunizations administered in the state. Immunization providers may access all recorded childhood Statewide HIE Operational Plan 45

54 immunizations administered in North Carolina, regardless of where the immunizations were given. The primary purposes of the NCIR are: To give patients, parents, health care providers, schools and child care facilities timely access to complete, accurate and relevant immunization data; To assist in the evaluation of a child's immunization status and identify children who need (or are past due for) immunizations; To assist communities in assessing their immunization coverage and identifying areas of under-immunization; and To fulfill federal and state immunization reporting needs. Statewide Registries In North Carolina, various statewide databases exist and may be made accessible to authorized users through statewide HIE services. These registries include: North Carolina Central Cancer Registry (CCR) The North Carolina CCR collects, processes, and analyzes data on all cancer cases diagnosed among North Carolina residents. All health care providers are required by law to report cases to the CCR, but the primary data source is the hospitals of the state. The CCR supplements hospital data with reports from physicians who diagnose cases that are not seen in a hospital. Death certificates and pathology laboratory reports are used to help identify cases that are missed in the routine reporting. Duplicate reports are consolidated in the data editing process. This is primarily a cancer surveillance activity, monitoring the incidence of cancer among the various populations of the state. The data are used by: State and county health departments to target resources for health education and screening services, Researchers for investigations into the causes and treatment of cancers, Public health advocates for focusing attention on the risk of cancer, The CCR staff to educate the public and provide evaluations of geographic and behavioral risk. Summary data are published on the internet and in several periodic publications. National organizations (CDC and NAACCR) that pool the data for national estimates of cancer incidence. These data submissions are also used to evaluate the quality of the CCR data. North Carolina Collaborative Acute Stroke Registry The North Carolina Stroke Care Collaborative (NCSCC) is part of a national effort to reduce the incidence of death and disability caused by stroke. The NCSCC assesses the use of best Statewide HIE Operational Plan 46

55 practice guidelines for stroke treatment by conducting real-time data collection on stroke treatment within North Carolina hospitals. Using these data, hospitals are able to measure and improve the quality of patient care. In February, 2007, Congress passed a bill to appropriate $390,000 annual recurring funds to the North Carolina Collaborative Acute Stroke Registry. The NCSCC is currently in its 3 rd year of the current funding, with a total of 53 hospitals participating. Since 2006, the number of NCSCC participating hospitals has grown from 35 to 53. The NCSCC is the only program in NC in which data is collected prospectively; concurrent with care, and allows participating hospitals to measure their performance on an ongoing basis. This process will improve the quality of stroke care by continually promoting compliance with best practice guidelines. In addition, the registry's performance measures include the Stroke Measure Set utilized by the Joint Commission on Accreditation of Healthcare Organizations for awarding the Certification of Primary Stroke Center. The mission of the North Carolina Stroke Care Collaborative is: To measure, track, and improve the quality of acute stroke care To decrease the death and disability from acute stroke through secondary prevention. To increase public awareness of stroke treatment and prevention. To reduce the disparities in acute stroke care through increased access to quality acute stroke care. North Carolina Trauma Registry (NCTR) The North Carolina Trauma Registry collects data from 15 hospitals in the state, eleven of which are designated as Level I, II, or III trauma centers. State designated trauma centers are required to submit data to the NCTR which is maintained by the Office of Emergency Medical Services. The overall mission of the registry is to collect information on injured patients in North Carolina for the purposes of performance improvement, outcomes measurement, resource utilization, injury prevention, and clinical research. North Carolina Birth Defects Monitoring Program (NCBDMP) NCBDMP is part of the State Center for Health Statistics in the North Carolina Division of Public Health and was formally established by the State General Assembly in However, the NCBDMP has been collecting information about birth defects since NCBDMP is a team of public health professionals dedicated to providing information about birth defects in our state and working toward reducing the occurrence of birth defects everywhere. The NCBDMP gathers information on infants who are born with serious birth defects (also called congenital anomalies) that are diagnosed within the first year of life and also collect information about affected pregnancies from stillbirths and elective terminations. The NCBDMP is an active, population-based surveillance system. This means that it actively collects information about all medically diagnosed cases of birth defects across the entire state. Data are collected by a team of trained field staff who systematically review and abstract (summarize) medical records. These data are combined with other information from Statewide HIE Operational Plan 47

56 administrative health databases such as hospital discharge records, birth certificates and newborn screening records. The NCBDMP performs several other services, such as: Maintaining a central registry with information about birth defect cases in NC. As required by state law, all personal identifying information in the registry is confidential. Responding to inquiries from health departments, health care professionals, legislators and the public about the occurrence of birth defects in our communities. Conducting epidemiologic studies of birth defects in North Carolina. We often work with other state agencies, advocacy groups, local universities and other research organizations with the common goal of identifying new ways to prevent birth defects. Improving the delivery of services to children with special needs through identification and referral to appropriate services. Vital Statistics The Vital Statistics team is located within the Statistical Services Unit of the State Center for Health Statistics (SCHS). The team is responsible for the processing and dissemination of vital statistics data. The Vital Statistics team is comprised of two main work groups, although these groups often work together to achieve common goals. Quality Control: This group is charged with developing and implementing thorough quality control initiatives to improve the accuracy of vital records data. The Quality Control group works closely with staff in the Vital Records Office to investigate data quality issues and work toward reasonable solutions. Each year, this group processes and finalizes the following data files: Deaths Births Fetal Deaths Matched Birth/Infant Deaths Marriages, and Divorces. An annual Infant Mortality Report is also generated by this group. In addition, the members of this group perform infant death/live birth matching, code vital events that occur out-of-state, and contribute to other annual publications based on Vital Statistics data. Data Dissemination: This group produces and disseminates statistical information to the public. These statisticians respond to requests from citizens, health departments, students, the media, private corporations, hospitals, universities, and legislators. They work with researchers and government agencies on special projects involving vital statistics data. The Data Dissemination group creates the Population, Abortion, and Communicable Disease data files. This group also assists with the production of SCHS reports and publications, such as the County Health Statewide HIE Operational Plan 48

57 Data book for Community Assessment, North Carolina Reported Pregnancies, and the Pocket Guide. Health Services Analysis Team (HSAT) The Health Services Analysis Team (HSAT) is located within the Statistical Services Unit of the State Center for Health Statistics. Statisticians in the HSAT work in partnership with North Carolina health agencies to provide program managers with timely statistical information that will be used to inform decisions about the health management of populations, cost effectiveness of programs, quality of care, and cost management and accountability. The goal is to improve health programs in North Carolina, resulting in better health for our citizens. One important use of health services data facilitated by the HSAT is to identify emerging morbidity and mortality patterns. Often, this process is facilitated by combining a program's health service data with birth, death, or other health records, to get a broader understanding of the health status of North Carolina populations. The HSAT also provides researchers in other agencies and university settings with assistance in research design and with data files for public health evaluation and research projects. Clients regularly served by the HSAT include: Many agencies of the Division of Public Health North Carolina Supplemental Food and Nutrition Program for Women, Infants, and Children (WIC) Division of Medical Assistance North Carolina's Community Care Program: Carolina Access and Access II and III Children's Environmental Health Branch, Division of Environmental Health Local Health Departments of North Carolina School of Public Health, University of North Carolina, Chapel Hill Cecil B. Sheps Center for Health Services Research, University of North Carolina, Chapel Hill North Carolina Healthy Start Foundation Wake Forest School of Medicine Citizens of North Carolina Specific areas of focus of the HSAT s work include: Quality assurance for health care programs Assessment of cost-effectiveness of health programs Inter-agency health database development Statewide HIE Operational Plan 49

58 Data support for medical record audits Demographic profiling of health program populations Medicaid systems of care evaluations and comparisons Description of and analysis of hospitalization patterns in North Carolina Annual reports & special requests generated from North Carolina Medical Examiner's data Annual child fatality reports North Carolina Health Care Personnel Registry The NC Health Care Personnel Registry Section operates under state and federal laws for unlicensed health care workers and their employers. The Personnel Registry s scope includes review and approval of Nurse Aide I education programs and of Nurse Aide I and Medication Aide testing programs. The Personnel Registry maintains competency based registries for Nurse Aide I and Medication Aides. The Health Care Personnel Registry Section also investigates abuse, neglect, and other allegations against unlicensed health care workers and lists allegations and substantiated findings on the Registry. Information from the registries is used by health care providers in their hiring process. Additional Public Health IT Systems Health Information System for NC Public Health Agencies (HIS) This new system is essentially a centrally provided Electronic Medical Record system that provides an automated means of capturing, monitoring, reporting and billing services provided in local health departments, children s developmental services agencies (CDSA) and the state lab. The rollout of this system will be completed by the middle of September The HIS is designed to provide better client service at lower cost and to provide higher quality health care services through better availability and integrity of relevant patient information. The centrally served architecture of HIS requires that each public health clinic user s workstation have an active session with the central servers (in Raleigh NC) whenever the system is being used. NC Comprehensive Assessment for Tracking Community Health (NC-CATCH) The State Center for Public Health Statistics houses an innovative data warehouse known as NC-CATCH (Comprehensive Assessment for Tracking Community Health.) NC-CATCH is a collaborative effort between state and local public health agencies in the state to provide community and county health profiles with easy assembly of a wide array of demographic and community health data, along with comparisons with peer counties and the state. This information is used to establish community public health priorities which in turn inform public health interventions and decisions. Secondary data from a number of sources is compiled and organized for access by public health agencies. Statewide HIE Operational Plan 50

59 3.3.i. Telehealth and Telemedicine North Carolina Telehealth Network (NCTN) The North Carolina Telehealth Network (NCTN) is a collaboration of NC healthcare providers, both public and private that organized prior to ARRA for the purpose of responding to federal funding opportunities with the FCC. NCTN includes collaborators from e-nc (a state authority devoted to broadband adoption), the NC Association of Local Health Directors, the state Division of Public Health, the NC Association of Free Clinics, the NC Hospital Association, NC Medical Society, the Southwestern Commission, Albemarle Health, and University Health Systems of Eastern NC. The overall goal is to create a dedicated broadband network for health in NC. The project set leverages $12.1M in broadband discounts from the FCC s Rural Health Care Pilot Program. The NCTN is now three projects. The NCTN-Public Health Phase (NCTN-PH) supports a broadband network for public health agencies and free clinics in NC. The NCTN-H is a similar (and connected) broadband network for hospitals in NC; NCTN-H is currently in an RFP phase and is expected to be active in the fall of The NCTN-AMB is devoted to developing a broadband network component for private ambulatory practices in NC that interconnects with the NCTN-PH and NCTN-H, and is currently in a planning stage. MCNC MCNC is a non-profit organization incubated by the State of North Carolina General Assembly in One of MCNCs main activities is to operate the North Carolina Research and Education Network (NCREN). NCREN provides broadband communications technology services and support to all 115 K-12 school districts, 20 of 58 North Carolina Community Colleges, all University of North Carolina system institutions, 24 of 36 of North Carolina s Private Colleges and Universities and public health facilities across the state. In January 2010 and as described more fully below, MCNC received federal funding to expand their middle mile network into 37 counties in the west and southeastern portion of the State. In addition, MCNC has applied for federal recovery funds to build middle mile fiber and direct fiber to select community anchor institutions in 69 rural counties. This will likely meet the last mile needs of several major non-profit and university hospitals. Both the North Carolina Office of Information Technology Services (ITS) and MCNC have a long history of working with providers in procuring last mile services to education facilities and has offered to help with this aspect for healthcare facilities and, if needed, physician offices. ITS and MCNC recently collaborated on and won a bid to connect County Health Agencies and County Free Clinics to the ITS and MCNC backbones. These backbones peer seamlessly and serve as resilient back-up to one another. The two entities are planning on another cooperative bid to provide backbone networks services to the non-profit and university hospitals in the State. 3.3.j. Broadband In order for HIE related applications and services to perform with proper speed and reliability, a robust fiber optic based broadband infrastructure is required. This fiber infrastructure should interconnect all elements of the health care ecosystem within North Carolina to an intranet Statewide HIE Operational Plan 51

60 infrastructure and then provide, through this intranet infrastructure, connections to the commercial Internet, advanced research networks and federal information repositories. The health care ecosystem includes all places where care is provided, information stored, reimbursement offered, or medication disbursed: 1) All in-state facilities that host repositories of healthcare information 2) DHHS 3) State and County public health facilities 4) Free clinics (county, local, non-profit) 5) Federal health facilities located in North Carolina 6) Hospitals - University, non-profit, publicly owned, privately owned 7) Practice offices 8) Insurance providers 9) Pharmacies Private sector and public sector networking technology providers must work together in order for such an infrastructure to be provided. North Carolina has been aggressive and successful in pursuing federal broadband recovery funds through both the Department of Commerce's BTOP and Department of Agriculture BIP funding. Through two rounds of funding, North Carolina has received the following infrastructure awards that have great potential to assist in building a core HIE network infrastructure. Broadband Technologies Opportunity Program Round 1 Award Through ARRA $7.2B in funding was allocated to the US Department of Commerce and the US Department of Agriculture to promote the deployment and use of broadband technologies to underserved and unserved populations in the United States. Commerce administers $4.5B of this broadband recovery funding through the National Telecommunications and Information Administration s (NTIA) Broadband Technologies Opportunities Program (BTOP), the majority of which is for deploying last mile and middle mile broadband infrastructure to unserved and underserved consumers and to Community Anchor Institutions (Schools, Libraries, Health Care facilities, other facilities of public importance). In January 2010, the NTIA announced that MCNC had been awarded $28.2M in middle mile broadband recovery funds. MCNC s funded proposal includes the construction of 500 new miles of fiber in 37 counties in the rural southeastern and western part of the state. Counties traversed by the initial build include: Eastern North Carolina Beaufort Bladen Carteret Columbus Craven Cumberland Edgecombe Greene Harnett Johnson Nash Western North Carolina Alexander Buncombe Burke Caldwell Catawba Cleveland Davidson Davie Gaston Haywood Henderson Statewide HIE Operational Plan 52

61 Eastern North Carolina Western North Carolina New Hanover Iredell Onslow Jackson Pender Lincoln Pitt McDowell Robeson Mecklenburg Wake Polk Wilson Rutherford --- Transylvania In May 2010, MCNC chose ONUG Communications from among 17 bidders for the engineering contract. In early June 2010, MCNC received responses from potential vendors for an earlierissued RFI related to provision of fiber, conduit and couplers, and in the same month issued an RFI for optical equipment that will light the fiber. MCNC s goal is to start building BTOP Round 1 by the end of summer BTOP Round 2 Award On August 18, 2010, Governor Purdue announced that North Carolina received an additional $115 million through five federal recovery grants to extend broadband connectivity in North Carolina: MCNC $75,757,289 This approximately $75.8 million award will allow MCNC to offer affordable middle-mile broadband service in 69 of the most economically disadvantaged rural counties along the northern and southern borders of North Carolina. The project plans to directly connect 170 community institutions to broadband. As many as 5.1 million stand to benefit as do 160,000 businesses. Yadkin Valley Telephone Membership Corporation $21,668,232 This approximately $21 million award, will allow Yadkin Valley Telephone Membership Corporation to offer a diverse Fiber-To-The-Home (FTTH) network to areas of six counties in the Piedmont area of western North Carolina. Approximately 12,803 people stand to benefit, as do roughly 606 businesses and 56 community institutions. City of Charlotte $16,702,490 This approximately $16.7 million award will allow public safety entities in the city to deploy an interoperable wireless public safety broadband network in the Charlotte/Mecklenburg County area. The project plans to construct 24 new wireless towers to complement six existing towers on the network, and bring over 11,000 public safety end users onto the system. As many as 890,000 people stand to benefit from this project. Olive Hill Community Economic Development $448,742 This nearly $450,000 award will allow the Olive Hill Community Economic Development Corporation to expand access to broadband in the greater western region of North Carolina by establishing a public computer center and providing community training and support, with a focus on helping disadvantaged local businesses, the unemployed, and individuals seeking higher education opportunities. Statewide HIE Operational Plan 53

62 North Carolina Health Information Exchange WinstonNet Inc. $926,537 This approximately $926,000 award, with $696,000 in matching contributions, will allow WinstonNet to improve broadband access for communities with the greatest need in Forsyth County, North Carolina. The following is a map showing the existing and BTOP Round 1 and BTOP Round 2 fiber routes: Figure 8. Broadband Distribution 3.3.k. Health Plan Support of Electronic Eligibility and Claims Transactions North Carolina's Medicaid program supports electronic eligibility checking and submission of claims. In North Carolina, Medicaid requires that all claims be submitted electronically. Due to a few provider and medical service exceptions, approximately 2 percent of providers claims submitted to Medicaid remain in paper form. Providers can submit claims via one of three methods: (1) North Carolina Electronic Claims Submission/Recipient Eligibility Verification Web Tool, an Internet-based portal, (2) through Value-Added Networks (VANs) which support real-time and batch 270/271 transactions; and (3) an automated voice response system. Medicaid estimates that approximately 15 million claims are submitted electronically every month, 93.5 percent through VANs and 6.0 percent through the Web Tool. Statewide HIE Operational Plan 54

63 The NC HIE and the State Health IT Coordinator are working with the North Carolina Department of Insurance to determine the number of commercial health plans supporting electronic eligibility and claims transactions. Statewide HIE Operational Plan 55

64 O.4. GAP FILLING STRATEGY 4.1. Overview A key element of North Carolina s HIE Operational Plan is support of providers ability to meet the initial and anticipated requirements for the meaningful use of certified EHR technologies. 10 Based on the HIE landscape assessment conducted for North Carolina s HIE Strategic Plan and requirements established by the federal government for state HIE plans, the NC HIE has developed strategies to address gaps in three areas: (1) Electronic prescribing (e-prescribing) (2) Receipt of structured lab results (3) Sharing patient care summaries across unaffiliated organizations For each area, the NC HIE Operational Plan identifies the key processes, the applicable requirements for meeting meaningful use, and the technical and non-technical mechanisms to increasing utilization and adoption. As the data collection for the landscape assessment and gap analysis remain ongoing activities, the NC HIE will adapt existing and develop new remediation strategies as needed E-Prescribing E-prescribing is the use of health IT to improve prescription accuracy, increase patient safety and reduce costs, as well as enable secure, bi-directional, electronic connectivity between physician practices and pharmacies. An illustration of the components of e-prescribing is provided below. Figure 9. E-prescribing Workflow 10 As part of the requirements for the State HIE Cooperative Agreement Program, ONC issued a Program Information Notice (PIN) that provided guidance for states landscape assessments and gap filling strategies. The PIN is available online at: HTML_7-6_1028AM.htm Statewide HIE Operational Plan 56

65 The first major activity in the e-prescribing workflow is the prescribing of the medication for which the clinician can use one of several types of software to create and transmit the prescription. 11 Among these are stand-alone systems specifically designed to help a physician s practice manage their patient s prescriptions and fully integrated Computerized Provider Order Entry (CPOE) systems that are built around an EHR. The fully integrated EHR allows the prescriber to locate the patient being seen and to retrieve the patient s medication history, review past medical history including labs and other relevant clinical data, compare insurance coverage and formulary compliance, and check for potential drug interactions and patient intolerances for any new prescriptions written. The prescriber can then print the prescriptions and give them to the patient or fax them directly to the patient s pharmacy. The second activity in the workflow is transmission of the completed prescription. If the prescriber chooses not to print or fax new prescriptions in favor of electronic submission to the patient s pharmacy, the e-prescribing system will transmit the prescription via one or more network intermediaries. Intermediaries serve several purposes: facilitate the secure transmittal of prescriptions to the appropriate pharmacy, store and exchange prescription history with both prescribers and pharmacies to facilitate decision support, and provide connectivity among prescribers, pharmacies, and payers. Dispensing at the pharmacy is the third workflow activity e-prescribing. Most pharmacies have systems that support integration with network intermediaries. This allows their systems to automatically receive prescription data from any participating physician. The system then prompts the user to edit the received data as necessary so that it complies with the individual pharmacy system s data entry requirements. Once the received information has been entered as a complete prescription, the pharmacy s software typically performs an independent series of decision support activities (checks for allergies, drug-drug or drug-disease state interactions, formulary compliance, etc). If the patient has third party insurance coverage, the prescription data is then submitted to the third party through a network intermediary, where many of the same checks are repeated by the third party vendor s software. The federal government s incentive program for the meaningful use of certified EHR technology includes a required or core measure for e-prescribing. A certified EHR (or e-prescribing module) must be able, at a minimum, to generate and transmit permissible prescriptions electronically. In order for an eligible provider (EP) to meet the e-prescribing objective for meaningful use, more than 40% of all permissible prescriptions written by the EP are transmitted electronically using certified EHR technology. Current State and Gap Analysis Physicians Use of E-Prescribing Tools One measure of the increase in e-prescribing adoption is the percentage of physicians who route their prescriptions electronically. The percentages of North Carolina providers routing e- prescribing at year end were: 9 percent in 2007, 23 percent in 2008; and 24 percent in Routing of Scripts According to data compiled by Surescripts, as of 2009, there were over 9 million prescription messages in North Carolina. 11 Deloitte. The evolving e-prescribing landscape: Challenges, incentives, and the opportunities for industry stakeholders. March Surescripts. State Progress Report on Electronic Prescribing. Data as of June Statewide HIE Operational Plan 57

66 Pharmacy Access to E-Prescribing In North Carolina, there are 2,461 in-state pharmacies of which 1,119 are retail chain pharmacies, 622 are independent, and 180 are hospital based. Of the 12,526 active pharmacists licensed in North Carolina: 3,286 work at retail chain pharmacies 2,117 work at hospital pharmacies 1,407 work at retail independent pharmacies In 2009, Surescripts reported that 1,777 out of 1850 or 96% of community pharmacies have the ability to receive electronic prescriptions and refill requests. 13 Based on this data, we believe there are robust capabilities among pharmacies within North Carolina for accepting electronic prescribing and refill requests. The primary challenges for these pharmacies are the lack of pharmacy management systems and/or the cost of connectivity to e-prescribing networks. Gap Filling Strategies for E-Prescribing Statewide HIE Services North Carolina, along with ten other states, participated in the development of a RFI released in June 2010 to explore the viability of statewide Value-Added Service for medication management. Information from this RFI will inform North Carolina s assessment of options for: (1) medication history, including analytical services and medication reconciliation, and (2) e- prescribing support, including prescription management, eligibility, and formulary information. Statute, Regulations, Policy The North Carolina State Health IT Coordinator, the NC HIE, and other stakeholders will assess the effectiveness of using legislation and/or licensure to require the use of e-prescribing. Contracts, Grants, State Procurement Blue Cross Blue Shield of North Carolina (BCBSNC) offers an e-prescribing Web site which provides access to free, web-based software, vendor sources for discounted hardware (PDAs) and connectivity, as well as other e-prescribing technologies. BCBSNC also offers financial incentives to physicians to encourage the use of certified 13 Surescripts. State Progress Report on Electronic Prescribing. Data as of June Statewide HIE Operational Plan 58

67 e-prescribing technologies. BCBSNC s incentives for e-prescribing are now linked to the Blue Quality Physician Programs that reward providers for higher quality. 14 As part of an effort to accelerate adoption of statewide HIE services, the NC HIE and stakeholders will evaluate the benefits and return on investment of offering grants for early adopters, in particular to support: Unconnected pharmacies to acquire the pharmacy management systems, connectivity, and implementation support to participate fully in e-prescribing networks. Pilot projects for the prescribing of controlled substances. The NC REC program will encourage e-prescribing adoption through outreach and education in coordination with MU incentives. Goals and Tracking E-Prescribing Progress Activity Physicians Routing of E- prescribing Current State (Aug 2010) Goal (Aug 2011) Goal (Aug 2012) Goal (Aug 2013) 24% 35% 45% 60% Routing of Eligible Scripts 25% 30% 40% 60% Pharmacy Access 96% 97% 98% 99% The NC HIE will track physician adoption, volume of e-prescribing transactions, and pharmacy connectivity to e-prescribing networks. As part of its state HIE evaluation plan, the NC HIE will annually report progress against these measures Electronic Delivery and Receipt of Structured Lab Results The electronic delivery of laboratory results is a multi-step process that begins with the creation of an order for a laboratory test. The test results can be sent directly to the clinician s EHR system or another clinical data system in support of the provisioning of historical results and results for non-ordering, providers of care. Providers of care may receive test results in the EHR system or another clinical data system or receive notification of the results (for later retrieval). An illustration of the laboratory ordering and results delivery workflow is provided below Starting October 1, 2009, physicians participating in the Blue Quality Physician Program earned higher reimbursement for providing quality care (as determined by national standards) to BCBSNC customers. The company generally is offering the program to independent primary care physicians not affiliated with large hospital systems or academic medical centers. Primary care physicians are comprised of internal medicine, family practice, general practice, pediatrics, OB/GYN, and GYN practitioners. The Blue Quality Physician Program is based upon objective, agreed-upon data as determined by the National Committee for Quality Assurance and other organizations. The national quality movement in health care has focused on several key measures, including clinical quality outcomes, administrative efficiency and patient experience with care. Physicians participating in the program earn higher reimbursement for meeting criteria based on these measures. 15 About ELINCS available online at Statewide HIE Operational Plan 59

68 Figure 10. Laboratory Ordering and Results Delivery Workflow Integrating structured laboratory results into clinicians systems faces a number of challenges. Even when transferred electronically, physicians often deal with laboratory results from a variety of sources that are transmitted by differing modalities, including facsimile, , portal, and direct interfaces into EHRs. In addition, laboratory and the wide variety of care systems are rarely interoperable. While most laboratories use HL7 messages to send results, they use idiosyncratic codes to identify tests. 16 Therefore, clinicians systems cannot fully understand the results they receive which requires them to either adopt the producer s laboratory codes (which is difficult if they receive results from multiple sources), or map each result from a producer s code system to their internal code system. There are also difficulties associated with standardizing the use of LOINC among laboratories for result reporting, which is itself subject to variability. Moreover, there are no universal standard order code sets applicable to laboratory test orders, and the use of other existing vocabularies for this purpose would be extremely complex. The federal government s incentive program for the meaningful use of certified EHR technology includes an optional or menu measure for incorporation of structured lab results into EHRs. For an eligible professional, eligible hospital or critical access hospital to meet Stage 1 meaningful use requirements, more than 40% of all clinical lab tests results ordered by the eligible professional or by an authorized provider of the eligible hospital or CAH for patients admitted to its inpatient or emergency department whose results are either in a positive/negative or numerical format are incorporated in certified EHR technology as structured data. In addition, the ONC s Final Rule on Standards and Certification specifies the following criteria for EHRs in incorporating clinical-lab test results: Receive results. Electronically receive clinical laboratory test results in a structured format and display such results in human readable format. 16 Catherine J. Staes et al. A Case for Manual Entry of Structured, Coded Laboratory Data from Multiple Sources into an Ambulatory Electronic Health Record. Journal of the American Medical Informatics Association. 2006; 13: Statewide HIE Operational Plan 60

69 Display test report information. Electronically display all the information for a test report specified at 42 CFR (c)(1) through (7). (CMS lab test report standards) Incorporate results. Electronically attribute, associate, or link a laboratory test result to a laboratory order or patient record. Current State and Gap Analysis for Delivery and Receipt of Structured Lab Results According to the Clinical Laboratory Improvement Amendments (CLIA) laboratory demographics file, North Carolina s distribution of laboratory facilities is as follows: Hospital labs 154 Independent labs 101 Ancillary test sites 58 County public health labs 1 State Laboratory of Public Health Ascertaining the state of structured lab results activities currently taking place in North Carolina requires an understanding of the: Percent of labs able to produce and deliver structured lab results Percent of labs able to receive orders electronically Percent of lab results currently being delivered electronically Percent of providers receiving structured lab results Using the list of unique organizations based on license numbers, the NC HIE will conduct a survey of laboratories that seeks information on their current ability and plans to (1) produce and deliver structured lab results electronically and (2) the data content and transmission standards deployed. Gap Filling Strategies for Delivery and Receipt of Structured Lab Results Statewide HIE Services The NC HIE intends to develop a set of Core Services, which will include Master Provider and Master Facilities Indexes. Entities participating in statewide HIE will be able to leverage these indexes to route labs to the appropriate destinations. The NC HIE will conduct a cost-benefit assessment of a statewide Value-Added Service that transforms lab result messages to conform to the format, coding, and transport requirements of the receiving EHR or public health agency and a component to route and transform laboratory orders as well as results. 17 CDC Oscar database. Accessed on August 3, Statewide HIE Operational Plan 61

70 The NC HIE will participate with the NC REC, State HIT Coordinator, ONC NHIN development team, North Carolina Healthcare Information and Communications Alliance (NCHICA), LabCorp and other laboratories, providers, and EHR vendors in a coordinated effort to reduce the cost and complexity of electronic laboratory data exchange. o The goal of this effort is to establish secure, point-to-point transport of laboratory results, directly from labs to providers EHRs, implementing NHIN Direct protocols and specifications. o The initial stage of this effort will be work by ONC and the REC to encourage vendors to adopt NHIN Direct specifications in providers EHRs. Next, North Carolina and NC HIE will work to encourage participation by hospital labs and other labs operating in the state for adoption and use of NHIN Direct specifications for secure transmission of lab results. o The State HIT Coordinator will manage the collaborative efforts of the REC, the State, NC HIE and labs to advance these efforts. o As part of the Core HIE Services being developed through the NC Strategic and Operational Plan, the state will consider options for use of a Statewide Provider Directory to support look-up and/or routing functionality. o These efforts will be conducted in a manner that is consistent with advancing the NC HIE vision and implementation as outlined in the North Carolina s State HIE Operational Plan. Statute, Regulations, Policy The North Carolina State Health IT Coordinator, the NC HIE, and other stakeholders will assess the effectiveness of the following mechanisms to advance transmission and receipt of structured lab results: Development of regulation requiring laboratories to provide laboratory results in compliance with national standards by a specific data. Inclusion of standards-based interfaces in lab contracts with NC Medicaid. Assessment of State laws and regulations alignment with current CLIA regulatory guidance. Contracts, Grants, State Procurement As part of an effort to accelerate adoption of statewide HIE services, the State HIE Cooperative Agreement will evaluate the possibility and return of providing grants or subsidies for early adopters. The NC HIE s consideration of inclusion of funds will center on supporting laboratories acquisition of systems, connectivity, and implementation support to participate fully in the delivery of structured laboratory results. Statewide HIE Operational Plan 62

71 Goals and Tracking Progress for Delivery and Receipt of Structured Lab Results Activity Electronic delivery of structured lab results Current State (Aug 2010) Goal (Aug 2011) Goal (Aug 2012) Goal (Aug 2013) TBD TBD TBD TBD The NC HIE will track laboratories ability to transmit structured results electronically. In addition, the NC HIE will work with the Medicaid and the NC REC to survey providers receipt of laboratory results. Goals for the exchange of structured lab results will be developed once the baseline assessment of the current state of activity in North Carolina has concluded Patient Care Summary Exchange The ability to create, transmit, receive and interpret patient care summaries can enhance a wide range of health services, including continuity of care, accurate diagnosis and treatment, and patient and care giver engagement. As the patient centered medical home model becomes a more accepted method of practice for primary care physicians, the desire to exchange summary records will underscore the need for availability of electronic data from all possible healthcare sources. Within North Carolina, the importance of continuity of care has continued to grow, whether it is for individuals with mental health needs, military personnel transferring from government installations to civilian providers, or citizens navigating the Medicaid system. The volumes alone make this initiative critical for inclusion in North Carolina s HIE strategy. In 2003, the number of general acute care hospital discharges was 935,132; average expenses per inpatient day were $1,200 for that year and increased to $1,362 in There were 434 emergency department visits and 1,941 outpatient visits in 2006 per 1,000 North Carolinians. 18 The federal government s incentive program for the meaningful use of certified EHR technology includes both core and menu measures for patient care summaries. As part of the core measure set for Stage 1 meaningful use requirements, EPs and eligible hospitals and CAHs must perform at least one test of certified EHR technology's capacity to electronically exchange key clinical information (for example, problem list, medication list, medication allergies, diagnostic test results), among providers of care and patient authorized entities. As a part of the menu measure set for Stage 1 meaningful use requirements, EP, eligible hospital or CAH who transitions their patient to another setting of care or provider of care must provide a summary of care record for more than 50% of transitions of care and referrals. 18 Office of the National Coordinator for Health Information Technology (ONC). NHIN Trial Implementations Sustainability Planning for NC HIE: Version 1.2 Iteration. January 9, Statewide HIE Operational Plan 63

72 Current State and Gap Analysis of Patient Care Summary Exchange The extent exchange of patient care summaries can be measured by assessing volume of transactions at multiple levels. As the patient centered medical home model becomes a more accepted method of practice for primary care physicians, the desire to exchange summary records will underscore the need for availability of electronic data from all possible healthcare sources. The extent exchange of patient care summaries can be measured by assessing volume of transactions at multiple levels. At the statewide level, the NCHEX project utilized summary care records to present information to clinicians. At the regional level, the one fully operational HIE in North Carolina, WNC Data Link, currently facilitates the exchange of patient care summaries. Gap Filling Strategies for Patient Care Summary Exchange Statewide HIE Services The NC HIE intends to develop a set of Core Services, which will include a request for Master Provider and Master Facilities Indexes. Entities participating in statewide HIE could leverage these indexes to route summary care records to the appropriate destinations. The NC HIE will explore the cost/benefits of creating a Value-Added Service that offers a centralized clearinghouse for transforming clinical summary documents among providers and patient-designated entities. This service would be analogous to the laboratory-routing clearinghouse, and would enable organizations that may lack standards-compliant EHR systems to also exchange clinical summary data. This service will allow for the clinical summary exchange for care coordination, capability and capacity for the translation of legacy messaging to standardized CCD and/or CCR. In addition, North Carolina s Medicaid Management Information System, which is currently being upgraded, will provide summary records in CCDs to care managers. Statute, Regulations, Policy The North Carolina State Health IT Coordinator, the NC HIE, and other stakeholders will assess the effectiveness of the following options to advance the exchange of patient care summaries: Leverage Medicaid s administration of meaningful use incentive program to accelerate use of certified EHR technologies with capabilities to create, transmit, and receive summary care record. Development of statewide exchange policies that specify the use of certain terminologies as required if available. Contracts, Grants, State Procurement As part of an effort to accelerate adoption of statewide HIE services, the State HIE Cooperative Agreement will consider providing targeted grants or subsidies for early adopters. The NC HIE will consider inclusion of funds to support Qualified Organizations that provide capabilities to transmit summary care records for the participants in their systems. Statewide HIE Operational Plan 64

73 The NC REC program will encourage exchange of summary records through outreach and education in coordination with MU incentives. Goals and Tracking Progress for Patient Care Summary Exchange Activity Number of eligible hospitals and CAHs with certified EHR technologies capable of preparing, transmitting and receiving summary care records Number of eligible professionals with certified EHR technologies capable of preparing, transmitting and receiving summary care records Number of qualified organizations with capabilities to transport summary care records Current State (Aug 2010) Goal (Aug 2011) Goal (Aug 2012) TBD TBD TBD TBD TBD TBD TBD TBD TBD TBD TBD TBD Goal (Aug 2013) The NC HIE will track provider adoption of EHRs and qualified organizations capabilities to transport summary care records. Goals for the exchange of summary care records will be developed once the baseline assessment of the current state of activity in North Carolina has concluded. As part of its state HIE evaluation plan, the NC HIE will annually report progress against these measures. Statewide HIE Operational Plan 65

74 O.5. Governance 5.1. Overview North Carolina has convened the state s health care leaders and health IT and HIE stakeholder community through multiple forums across the past few years, as detailed in the Strategic Plan. Those efforts informed the decision to establish a public-private partnership to govern statewide Health Information Exchange services in North Carolina. As an independent statewide public-private HIE governance entity, the NC HIE will be responsible for ensuring ensure consistency, inclusiveness, transparency, focus, and accountability for HIE creation, sustainability, and operational effectiveness. The NC HIE non-for-profit entity was incorporated in April 2010 and its Board of Directors held its first board meeting on May 14, To support a collaborative, informed planning process and with an eye toward broad representation, the NC HIE Board of Directors invited stakeholders from all relevant stakeholder groups to participate on one of four Workgroups tasked with developing recommendations to inform the development of an Operational Plan that will serve as an implementation guide for the NC HIE and ensure that the Statewide HIE will be built in the public interest. The multi-stakeholder Governance Workgroup s deliberations have focused on the development and review of key provisions of the Bylaws for the Statewide HIE, the nomination process for future Board candidates for the Statewide HIE and the model by which organizations can become participants in the HIE Articles of Incorporation The North Carolina Health Information Exchange (the Corporation ) was incorporated under North Carolina Articles of Incorporation effective April 29, The Organization s interim CEO is Alan Hirsch. A copy of the Articles of Incorporation is included in Appendix Board of Directors The North Carolina Health Information Exchange Board of Directors held its first meeting on May 14, 2010 and has continued to meet monthly throughout the Statewide HIE Operational Plan development process. The Board was appointed in partnership with the Governor of North Carolina to ensure an appropriate balance of broad stakeholder representation, industry expertise, credibility among external stakeholders, ability of its members to make decisions to serve the greater public interests and commitment of its members to advancing the goals of statewide HIE in North Carolina. The Board of Directors is co-chaired by North Carolina Department of Health and Human Services Secretary Lanier M. Cansler and former chairman and CEO of GlaxoSmithKline, Inc and national pediatric health advocate, Dr. Charlie Sanders. Statewide HIE Operational Plan 66

75 Board members include: Dr. William Atkinson, CEO WakeMed Thomas Bridges, Director Henderson County Health Department Dr. Hadley Callaway, past President North Carolina Medical Society Anthony Civello, CEO Kerr Drugs Dr. Samuel Cykert, Co-Lead of North Carolina Regional Health IT Extension Center Dr. Allen Dobson, Chairman Board of Directors for North Carolina Community Care Networks Dr. Gloria Frelix, President of the Old North State Medical Society David King, CEO Labcorp Rebecca Kitzmiller, North Carolina Nurses Association Ben Money, CEO North Carolina Community Health Center Association Dr. Warren Newton, Chair of UNC s Department of Family Medicine and Chair of the American Board of Family Medicine John Richter, Executive Senior Principle Larsen Allen, LLP and Long-term Care Representative Dr. William Roper, Dean School of Medicine and CEO of the UNC Health Care System at the University of North Carolina at Chapel Hill and chairman of Board of Directors of the National Quality Forum Dr. George Saunders, President North Carolina Medical Board Dr. Sam Spicer, President NCHICA and Chief Medical Officer New Hanover Regional Medical Center Senator Josh Stein, North Carolina State Senator and Consumer Representative Dr. Dave Tayloe, Past President American Academy of Pediatrics Representative Thom Tillis, North Carolina State Representative Brad Wilson, CEO Blue Cross Blue Shield of North Carolina Ex Officio Members: Steve Cline, DDS, North Carolina State Health IT Coordinator Jerry Fralick, North Carolina Chief Information Officer Statewide HIE Operational Plan 67

76 Craigan Gray, North Carolina State Medicaid Director 5.4. Bylaws The NC HIE will draft and adopt bylaws that will describe in detail the composition of the Board of Directors, Committees of the Board, Workgroups and Advisory Bodies, Officers of the Board, and other general provisions. The NC HIE Governance Workgroup recommended, and the Board adopted, the following provisions: The Board must be composed of members, not including ex-officio members. Ex-officio members will include the state Health IT Coordinator, the state Chief Information Officer and the state Medicaid Director. Board members will serve three-year terms, terms will be staggered, and no member may serve more than two consecutive terms. The board will elect officers and establish governing committees such as an Executive Committee (established), Finance/Audit Committee and others as it deems necessary. Directors will be nominated by a Nominating Committee of the Board. Nominees will be subject to the advice and consent of the Governor of North Carolina. A majority of Directors will constitute a quorum for voting purposes. The Board will have the authority to establish advisory committees/workgroups as it deems necessary. The Board will comply with 501(c)(3) requirements, including those related to conflicts of interest policy and transparency. The NC HIE board endorsed further guiding principles related to governance of the organization, to be included in the NC HIE bylaws: Nomination Process for Future Board Members The NC HIE Board of Directors will be a self-perpetuating board. Board members shall be individuals who are recognized as high level leaders in their field and who are committed to maximizing statewide health information exchange to advance improvements in the North Carolina health care system. NC HIE board members will be selected based on merit and a commitment to diversity including, but not limited to, ethnic and cultural diversity, gender diversity, geographic diversity and diversity of viewpoint. These individuals must be wiling and able to: 1. Provide experience and expertise to approve the Organization s business and other plans; 2. Provide leadership and explore opportunities to ensure the sustainability of the HIE; Statewide HIE Operational Plan 68

77 3. Consider all stakeholder perspectives and participate in decision-making based on the needs of the state as a whole, rather than on the needs of any one individual stakeholder group; and 4. Develop and participate in initiatives aimed at building awareness, understanding and support for the Organization s initiatives. As recognition of its commitment to operating as a true public-private partnership, the NC HIE will adopt a process by which the Governor of North Carolina plays an active role in the overall governance of the organization through an advise and consent process related to future board nominees. The NC HIE Nominating Committee will vet candidates and ultimately select one candidate for each open Board seat, based on the Board selection merit-based principles, and send the name(s) to the Board for review and approval. If/when the Board endorses the nominee(s), the Board will send the list of final candidates (one candidate per open Board seat) to the Governor for review and approval. The Governor will review the slate of candidates, taking into consideration guiding principles, and advise or consent on nominations in a timely manner (e.g., within 60 days). Those candidates approved by the Governor will be extended invitations to become members of the Board. Should the Governor veto any of the candidates, the Nominating Committee must choose a new candidate to fill the related Board seat (subject to the approval of the Board and Governor, following the same process detailed above). Transparency The NC HIE strongly supports the state of North Carolina s commitment to transparency. In order to ensure the Organization s goals of transparency, accountability and openness, the NC HIE will develop a strong transparency policy with provisions detailing that: All meetings of the Board, advisory counsels and work groups shall be open to the public. All votes, actions and deliberations of such groups shall be recorded and readily available to the public (such as in the form of meeting notes). Financial records will be publicly disclosed. Limited exceptions will be allowed to protect the privacy of individuals or to protect the business interests of the organization. Statewide HIE Operational Plan 69

78 Conflicts of Interest Policy The NC HIE Board will adopt a Conflicts of Interest Policy to ensure that the Statewide HIE will operate in the best interest of the public and avoid any actual or perceived conflict of interest that may undermine public trust. The NC HIE recognizes that board members and workgroup and advisory council members will likely be participants in the NC HIE. In support of the Organization s commitment to ethical business practices and to ensure the NC HIE serves the greater public good and honors the good-faith participation of its members, the NC HIE will develop a robust conflicts of interest policy that outlines a process of: Amendments Disclosure of conflict. Recusal from voting or lobbying on the matter in conflict. Approval of any transaction in which a relevant party has a financial or personal interest by members of the board of directors not so interested or connected as being in the best interests of the organization. Documentation in minutes or notes of meetings at which such votes are taken recording such disclosure (with reasonable parameters to protect individual privacy as appropriate), abstention, and rationale for approval. Amendments to the organization s bylaws may be adopted by a majority vote of all Directors. Specific Articles and provisions of the bylaws shall not be altered, amended, or appealed without the Governor s prior approval, including those bylaws pertaining to the: Mission of the organization Nomination, approval, and election of Directors Transparency Policy Conflicts of Interest Policy It is believed that it is in the spirit of the public-private organization to seek the Governor s advice and approval on such provisions that impact the Organization and its ability to ensure the protection of the public interest Authority and Involvement of the State Statewide HIE must develop in a way that is fully consistent with public health and public policy objectives. The State has examined the mechanisms and legal issues associated with assuring that the State retains appropriate oversight authority with respect to the Statewide HIE. While it will be essential to maintain the integrity of the multi-stakeholder collaborative process in setting policy for the Statewide HIE, it is also the case that the State has a non-delegable role as the steward of State assets and the protector of the public interest that must be preserved. As a Statewide HIE Operational Plan 70

79 result, there are specific provisions in the Articles of Incorporation and bylaws that may not be altered, amended, or appealed without the Governor s prior approval, as outlined above. The State has determined that State officials may serve as Board members of the Statewide HIE; the Secretary of the North Carolina Department of Health and Human Services will be a co-chair of the Board and three Board seats will be reserved for the state Chief Information Officer, the state Health IT Coordinator and the State Medicaid Director as ex-officio members of the Board. The State will enter into a contract with the Statewide HIE for the provision of services that advance public policy objectives. Given that there is broad stakeholder consensus that no existing organization that would be capable or willing to take on the responsibilities of the Statewide HIE, it is likely that a single feasible source contract will be granted with a new organization; the Statewide HIE will subsequently receive funds for specific purposes approved by the State (including funds provided under the State s cooperative agreement with the U.S. Department of Health and Human Services (HHS) pursuant to the FOA) Ongoing Development of Governance and Policy Structure The NC HIE recognizes that its stakeholders are its partners and is committed to continuing to provide opportunities for direct input into the development and operations of the HIE as well as to setting clear goals and milestones and reporting back to its stakeholders and the community on progress against those goals. Workgroups or Advisory Bodies The Board may designate and appoint one or more workgroups or advisory bodies composed of subject matter experts to support the Board s activities and deliberations. The Board will name the members of such workgroups or advisory bodies and these groups will have no voting rights or binding authority over the NC HIE. The Board feels strongly that workgroups and advisory bodies provide a necessary and critical opportunity to ensure that a broad group of stakeholders has a voice in the strategic direction and decision-making of the organization. It is anticipated that the Board will constitute workgroups or advisory bodies on an as-needed basis, and as the NC HIE evolves and requires input specific to technical requirements and services; legal and policy issues; qualified organization interests, provider participation in the Statewide HIE; consumer engagement; and other issues that are not yet anticipated. For at least the first year of the Organization s operations, these groups will likely reflect the Workgroups that were convened as part of the NC HIE Operational Planning process: Governance, Finance, Clinical/Technical Operations and Legal/Policy. The Board will also convene a Consumer Advisory Council. Commitment to Consumer Outreach, Education and Engagement The support and engagement of consumers and patients is critical to the success of the NC HIE. The NC HIE is committed to helping all stakeholders consumers, patients, providers, health plans, employers understand how better information can improve the quality of care and to facilitating more ready, secure access to health information. Consumers who take an active, engaged role can help improve the quality of health care in their communities. The NC Statewide HIE Operational Plan 71

80 HIE supports a vision of patient-centered technology solutions that help providers deliver better care and help patients and their families to become more active participants in their own care. In an effort to ensure that consumers and patients have a continuing voice in the development of the NC HIE, the NC HIE will convene consumer experts to inform the development of a Consumer Communication and Engagement Plan. The plan will seek to increase the public s awareness of the changing health IT environment, including education on patient privacy and information security matters as they relate to electronic health information and provide education on the value and benefits of the Statewide HIE. Consumer Advisory Council Pursuant to a recommendation by the NC HIE Governance Workgroup, the Board will establish (through original convening or partnering with exiting entities) a standing Consumer Advisory Council, tasked with developing the consumer communication and engagement plan. The Council will be asked to consider and promulgate recommendations on the following questions, among others, in developing a Consumer Communication and Engagement Plan: How does the NC HIE earn the trust of consumers and patients? What really engages a consumer or patient? What tools work for a consumer or patient? How will the NC HIE know if it is engaging consumers and patients? Are there key consumer or patient groups that should be engaged? Are there key points of engagement? Are there social media outlets that can/should be leveraged? Are there potential partnerships with NC foundations or other organizations? Guiding Characteristics for Consumer Representatives on the NC HIE Board The NC HIE Board further adopted a set of guiding characteristics to consider when identifying consumer representative candidates for the NC HIE Board of Directors. These characteristics were adapted from a set of definitions outlined by the National Partnership for Women and Families. 19 Does not have a financial stake in the healthcare system; Affiliation with a nonprofit, mission-oriented organization(s) that represent a specific constituency of consumers or patients; Speak from a global perspective and have experience representing the diverse needs and wants of consumers and patients; 19 National Partnership for Women and Families. Quality Tool Box. Fact Sheet Consumer Definitions. Accessible online Statewide HIE Operational Plan 72

81 Have networks to empower and mobilize the community (e.g., lists websites, meetings, newsletters, and conferences) and share information and messages; Have established relationships with the media, policymakers, and elected officials; Have a background in health care or an understanding of the health care system; and Capable of reflecting the viewpoints and concerns of consumers and patients. Commitment to Stakeholder Outreach, Education and Engagement Effective communication with and meaningful engagement of stakeholders will be a critical component of ensuring the success of the Statewide HIE effort. Stakeholder engagement is key to facilitating broad community support, gathering useful data and ideas, enhancing the overall reputation of the project, and providing for more sustainable decision-making and project implementation. The NC HIE will be more likely to succeed, particularly in the long-term, if it takes into consideration the perspectives of stakeholder groups within the state, endeavors as much as possible to address their identified needs, and effectively educates and communicates project goals and activities to all impacted communities. To that end, the NC HIE will proceed with the development of a comprehensive and consistent marketing and communications approach to create a brand for the Statewide HIE needed to establish the initiative s unique identity in the marketplace. The NC HIE will also facilitate the creation of a Stakeholder Outreach, Education and Engagement strategy which will outline the steps that the organization will take to generate stakeholder involvement in and understanding of the Statewide HIE initiative. As part of this effort, the NC HIE will coordinate with the North Carolina Regional Extension Center, as well as other statewide health IT and HIE initiatives, to ensure a unified articulation of the approach and objectives for statewide HIE. Goals, Objectives and Performance Measures for the Exchange of Health Information The Board of the NC HIE will be charged with evaluating the effectiveness of the governance structure recommended in the NC HIE Strategic and Operational Plans, and may elect to revise or adjust the structure of the organization to best meet and support the goals of the organization. The Statewide HIE will continue to evolve to meet developing needs in the marketplace. The governance functions of the Statewide HIE will be called on to demonstrate an institutionalized ability to change and grow to assure that HIE in North Carolina meets the needs of all citizens of the State Next Steps Across the next 3-6 months, the NC HIE must: Draft, with the support of counsel, and adopt bylaws through an open and transparent process. Statewide HIE Operational Plan 73

82 Conduct an executive search. The Statewide HIE will quickly need to ramp up staffing or contracted support to continue the collaborative HIE stakeholder process and support the efforts of the Board of Directors. The Executive Committee of the Board has already begun a process to further define staffing needs and recruit qualified candidates. With the assistance of legal counsel, the State will develop and enter into a contract with the Statewide HIE, outlining the appropriate funding sources and mechanisms and respective evaluation and reporting requirements consistent with the Statewide HIE Cooperative Agreement Program. Further define the requirements of a Qualified Organization and, with the assistance of legal counsel, draft a participation agreement. Provide guidance and input into the development of a stakeholder communication and outreach plan. Establish clear and measurable goals for the NC HIE, including but not limited to: Diverse stakeholder involvement in the Statewide HIE at the Board and Workgroup levels Measurement criteria for determining the extent of statewide coverage enabling providers to satisfy meaningful use criteria Development of robust policies and procedures not limited to: participation agreements for Qualified Organizations in the Statewide HIE, consent policy to facilitate the disclosure and access of information, data privacy and security policies, oversight and enforcement mechanisms, and sanctions for abusing privileges of the HIE. Specific mechanisms for coordination with Medicaid, the North Carolina Regional Health IT Extension Center, and other federally-funded state programs Regularity of reporting and breadth of dissemination of reports Evaluate and document progress against those goals and the ONC program requirements through a formal evaluation progress. Statewide HIE Operational Plan 74

83 O.6. TECHNICAL INFRASTRUCTURE 6.1. Overview Over the last two years, the technical design for statewide HIE in North Carolina has evolved through a number of collaborative efforts. As part of its NHIN Trial Implementation project, NCHICA published a Sustainability Plan in January 2009 that proposed assumptions for statewide HIE, described a framework for a shared architecture, and analyzed a select combination of core, high value-add, and transforming services for coordinated state-wide implementation by all of North Carolina s healthcare stakeholders. 20 Between April and June 2009, the North Carolina HIT Task Force led an effort to develop recommendations for interoperable health IT architecture that would securely connect consumers, providers and others who have, or use, health-related data and services, while protecting the confidentiality of health information. 21 In May 2010, the NC HIE convened a Clinical and Technical Operations Workgroup to develop an implementation strategy for statewide HIE built around: (1) the identification of principles to guide design and development; (2) the selection of a technical approach to achieve statewide interoperability; (3) the definition of clinical functions to be enabled by statewide HIE services; and (4) the identification of core and candidate hosted shared services Clinical and Technical Principles As its first task, the Clinical and Technical Operations Workgroup developed a set of principles to guide decision making for the design, development, deployment, and operations of services to support the exchange of health information in North Carolina. On July 13, 2010, the NC HIE Board approved the clinical and technical principles listed in the tables below. Clinical Principles 1. The HIE solution must be consumer-centered. A critical element toward improving health is an engaged consumer who has the means, information, opportunity and the know how to better manage their own health and lifestyle choices. Consumers and authorized caregivers should be considered the primary beneficiaries of HIE services and meaningful use of health IT, and the design should be made patient-centric whenever possible. 2. Better health, and better health outcomes, not just better healthcare, must be the goal. Better health requires looking beyond just health IT and the traditional practices of healthcare providers and payers to create a virtual health home where care is coordinated and collaborative. Prevention is the key. It must be a shared commitment of public and private employers, government and nongovernmental organizations, communities and individuals to create a health system that supports high quality, safe, efficient and effective care that results in improved health outcomes. 20 Office of the National Coordinator for Health Information Technology (ONC). NHIN Trial Implementations Sustainability Planning for NC HIE: Version 1.2 Iteration. January 9, On June 24, 2009, the HIT Task Force released its recommendations in the report Improving Health and Healthcare in North Carolina by Leveraging Federal Health IT Stimulus Funds. Statewide HIE Operational Plan 75

84 Clinical Principles 3. Health IT investments must support improved individual health as well as population health. Health IT investments should support the overall system changes needed to create sustainable and continuous quality health improvements. North Carolina s technical and policy infrastructure for statewide HIE should leverage existing investments in technology, take advantage of innovations, and identify opportunities for new investments. 4. Health IT capacity is based on a commitment to supporting the delivery of the right care, at the right time and in the right setting. 5. The HIE should be designed to maximize value for all participants. Value will come in the form of improved outcomes, increased efficiency, and increased patient and provider satisfaction. Participation in statewide HIE should not be mandatory or exclusive. 6. All providers will submit the required minimum data set to the NC HIE. Under existing state law, certain specific health data are reported to the state primarily for the purposes of public health and communicable disease control. The NC HIE will facilitate mandatory reporting requirements through participant s submission of minimum data sets as defined by national standards. 7. Data will be made available for biomedical research purposes. Research and development are critical elements of an evidenced-based system of quality improvement. Any research requiring access to personal health information must be approved by an appropriate Institutional Review Board and follow accepted best practices of confidentiality and data quality. Technical Principles 1. The system must be based on federally recognized standards, and maintainable in a cost effective manner. 2. This is a marathon not a sprint. Health IT systems will be built incrementally. Every stakeholder in the process must be able to move ahead from where they are on the continuum from minimum health IT involvement to fully electronic and interoperable networks. This means that the implementation process will accommodate a broad range of participants, including the small independent community practitioner as s/he decides to implement an EHR in the practice, as well as a large hospital health system with an existing sophisticated health IT system. 3. Health IT and HIE investments must support improved individual health as well as population health. Federal stimulus funds will be used to drive the changes needed in the overall system that will create sustainable and continuous quality health improvements. The new health IT system and policies should leverage existing investments in technology, take advantage of innovations, and identify opportunities for new investments. 4. Statewide HIE specifications should be vendor neutral, allowing for implementation in the widest range of standards-based and interoperable hardware and software solutions. 5. Design a statewide HIE system that is consistent, repeatable and re-usable across participating systems Technical Approach A functional statewide HIE is a system of systems, or a collection of nodes that work together to achieve common purposes based on an agreed upon set of priorities, policies, and technical specifications. Within this system of systems, there are multiple entities (e.g., local provider entities using an EHR, regional networks using multiple systems, state agencies, and national organizations such as Surescripts) that provide and consume data. Statewide HIE Operational Plan 76

85 These entities have their own health IT systems and networks which at any point in time will be in different stages of their life cycles, will be built on many different technologies, and have differing priorities regarding the data they collect and transmit. The statewide HIE is not intended to supplant these networks, but rather is envisioned as a flexible, open framework that cost-effectively supports the inter-organizational exchange of data and access to shared services. As described in the Strategic Plan, North Carolina plans to establish statewide HIE services to facilitate the exchange of information for Qualified Organizations that voluntarily participate in statewide HIE. It is assumed that Qualified Organizations will exchange health information among their constituents and will need a pathway and a process to exchange information with other Qualified Organizations, state and national agencies and/or providers, interstate HIOs, and other information sources to be determined. Recognizing that HIE between nodes would be necessary, the Clinical and Technical Operations Workgroup evaluated four networking patterns that could be applied to statewide HIE services: Distributed Node-to-Node Messaging Architecture Centralized Statewide Technical Architecture Shared Statewide Technical Architecture Hosted Shared Services Architecture These architectures are focused on the types of functional HIE interactions across enterprises to achieve specific interoperable clinical objectives and goals and do not address specific underlying technical interactions or transactions at a local or regional level. Common HIE messages and interactions that would be required of each architecture include: Patient identity and address Provider identity and address HIE Event Triggers Secure Clinical Messaging HIE Event Notifications Record location Sequencing Document retrieval Document parsing Clinical element handling Statewide HIE Operational Plan 77

86 Terminology validation Distributed Node-to-Node Messaging Architecture In a distributed node-to-node architecture, there are no centralized services or components that manage or coordinate functions between nodes. Each node is responsible for providing all HIE functions, and each function includes capabilities to message to each other based on a defined and standard messaging protocol. In other words, each node acts as both client and server providing services to other nodes. The statewide HIE effort may recommend specifics of which protocols and events would be utilized for specific functions, but the key distinction is that each node is responsible for deploying and supporting the defined core HIE services. Figure 11. Illustration of Node-to-Node Messaging Architecture In a node-to-node technical approach, the state s role is to help facilitate agreement amongst the nodes. As noted earlier, there are no specific mechanisms to verify or enforce the recommended messages and implementation responsibilities lie with each node endpoint. This type of architecture already exists today between organizations, usually for administrative transactions utilizing a wide variety of protocols and typically very specific transactions. While this type of distributed architecture readily supports simple transactions, it is challenged by more complex transactions. For example, for e-prescribing or even clinical summary exchange, the catalog of messages gets complicated and difficult to maintain, especially as changes are defined or requirements are extended. Because the node-to-node technical approach relies heavily on development and deployment of HIE capabilities at each endpoint node, the Clinical and Technology Workgroup determined this option failed to ensure that each node was capable of achieving meaningful use and improving clinical quality. Statewide HIE Operational Plan 78

87 Centralized Statewide Technical Architecture In a Centralized Statewide Technical architecture, HIE applications, functions and data are separated from the underlying nodes and deployed into a single separate logical domain. By centrally managing and deploying HIE functions, the most complex set of functions and transactions is theoretically available as a single reference implementation of HIE functions. Existing nodes are considered clients to the centralized service and comply with the deployment guidelines and interactions specified by the centralized reference architecture. As components are consistent within a single architecture, specific design and implementation decisions can be enforced centrally throughout the technology stack, and transactions between clients and the centralized architecture can be tightly coupled. In this type of architecture, tight coupling usually occurs at the data layer hosted by the architecture in order to establish a single point of truth for all requesting clients. Figure 12. Illustration of Centralized Technical Architecture In a centralized technical architecture, the North Carolina HIE would be responsible for: (1) selecting, deploying and operating an end-to-end build of a specific HIE application which consists of the data layer, business logic layer and user interactions and (2) focusing on deployment and adoption by end-users at the client nodes. An example of this type of architecture is the deployment of a web portal with HIE functions directly to clinician end-users on a specific implementation. Within an organization or enterprise, it is common to see these types of centralized systems which enable a patient-centric view as a separate application. A centralized database is created and fed by multiple systems. A web portal or user interface is then deployed which allows for the enterprise user to look up a patient and view data that is Statewide HIE Operational Plan 79

88 transmitted by each of the connected systems in a consistent manner. The interactions by the client nodes are typically limited to sending data which is transformed or normalized to a specific database model. By limiting interactions to data or specific message example, rapid HIE functionality can be instantiated and deployed to end-users through a single-vendor implementation. Interoperability to this type of deployment at the statewide level would be through web services for specifically identified functions. This type of architecture addresses the heterogeneous nature of HIE by imposing a single, homogeneous implementation. It is important to note that centralized architectures do not necessarily exclude distributed components. For example, a centralized architecture can establish a set of web services that enables access to or exposes their centralized functions and data. The distinguishing characteristic is that a centralized approach lowers the requirements of a connecting node to providing data and does not require the development or deployment of specific HIE functions. In this type of implementation, there is usually a tradeoff: within the HIE, proprietary and tightly coupled interactions may be utilized. This results in significant difficulty for other systems to access or utilize HIE functions as shared services. The Clinical and Technical Operations Workgroup noted that the centralized architectural approach s reliance on single logical implementation represented too great an implementation risk and did not reflect the regional nature of healthcare delivery in North Carolina. Shared Statewide Technical Architecture In a Shared Statewide Technical architecture, HIE functions are separated and defined as specific web services based implementations. One of the design patterns used in this approach is the recognition that web services and enterprise integration over the Internet continues to change at a rapid pace, along with the expectation that as clinical end-users participate in HIE, existing definitions of core versus value-added services are likely to evolve. In a shared statewide technical architecture, patterns of messaging (protocols) between systems are defined and a statewide control process is established to allow for ongoing changes and further refinement. If there are existing health information exchange systems or nodes in place, a shared statewide architecture is necessary to orchestrate and standardize the functions performed by each of the regional instantiations. For example, if there are multiple hospitals and ambulatory EHR systems that are feeding a community patient index, there may not be a consistent approach or web service that would federate a patient search request across these existing indexes. The Shared Statewide architecture would establish a web service that would federate a patient search request across the existing indexes, aggregate the results, and present them back to a requesting system. This allows for separation of a patient search function from each separate implementation while still providing consistent access to any authorized system. It also provides a clear on-ramp for existing HIEs to participate and add value to the statewide network. Some distinguishing characteristics of the Shared Statewide architecture are: Using a service bus approach to coordinate messaging and queries/responses across enterprises Service buses act as agents and adapters to existing clinical information systems Statewide HIE Operational Plan 80

89 Statewide service buses serve as a mediator amongst the coordinating agents by maintaining service directories and coordinating requests As statewide, nationwide or other service providers are available, the ongoing service governance structure allows for these to be deployed into the architectural framework Collaboration between service providers and consumers are critical in order for there to be consistent delivery of HIE services and functions to connected systems Standard endpoints are deployed on each service bus so that statewide service bus can receive a consistent reply to requests for information Shared implementations (across underlying systems) coordinate interactions to deliver on specific goals Figure 13. Illustration of Shared Statewide Technical Architecture The Clinical and Technical Operations Workgroup was concerned that the Shared Statewide Technical Architecture approach depended too heavily upon stakeholders willingness and capabilities to create services. In addition, it was noted that this approach could lead to an increase in overall costs as it requires each organization to develop and perform the required services. Statewide HIE Operational Plan 81

90 Hosted Shared Statewide Services Technical Architecture In a Hosted Shared Statewide Services technical architecture, the role of the Statewide HIE is expanded to include two types of HIE functions: Core Services: HIE registries and functions that are statewide in scope and are common across multiple HIE functions. By separating these functions at a statewide level, this allows for the secure mediation and transport across the network while preserving flexibility and customization at the regional or local network. These core services can function in a standalone manner to support basic HIE functions and also serve as a template for more complex or orchestrated transactions. Value-Added Services: Rather than limiting the Statewide HIE functions and deployment to core services, Value-Added services are specific implementations that follow a centralized architecture but are encapsulated into a services architecture so that they can be utilized by other systems. Additionally, interoperability and a services architecture remain necessary because of the need for the Value-Added services to be able to invoke and utilize the Core Services that are established in this architecture. While a shared statewide technical architecture defines how an entity will perform a function, a hosted shared statewide services approach defines who participates and deploys an operational service. Existing implementations connect to a specific shared service which provides an implementation endpoint to organizations that do not have their own implementation, and connects to existing deployments. Additionally, for each HIE service, the Statewide HIE service includes a specific statewide implementation and coordination with existing services. For example, if there are existing or additional patient indexes, federating a query or distributed updates to synchronize indexes against a statewide MPI and other indexes is necessary to allow for ongoing local or regional innovation. Therefore, a statewide patient identity service would include querying for patient identities against both indexes or establishing a distributed update mechanism across indexes. Similarly, as additional nodes are made available via the NHIN, the services would be extended to include those, allowing the Statewide HIE customers to benefit from a scalable and extendable solution. Figure 14. Illustration of Hosted Shared Services Architecture Statewide HIE Operational Plan 82

91 In a shared statewide technical architecture, a statewide service orchestrates across existing indexes and provides a consolidated response for queries of patient records. Participating systems may connect directly to a hosted service for identity resolution or link their own index to the statewide system. The Clinical and Technical Operations Workgroup s analysis of the existing technical capabilities and systems, clinical delivery organizations, and planned HIE efforts highlighted the following unique characteristics of the North Carolina technical landscape: Clinical delivery organizations were already organized into regions. Through established programs such as Community Care of North Carolina, there are existing regional and collaborative efforts that create natural demand for information exchange. These organized regions form the clinical basis for modeling the information exchange. By adapting the technical architecture to support the existing interactions and types of information that crosses enterprise boundaries, the statewide HIE infrastructure enables the flow of clinical information in a scalable and extendable manner patterned after actual clinical processes and efforts. No dominant HIE networks connect systems across the state. While there are plans to develop and extend existing capabilities, there are no existing statewide HIE networks that cover the targeted functions. Valuable statewide data assets exist and are planned that existing clinical delivery organizations find useful. From immunization registries to Medicaid data, there are existing data sources in North Carolina that form a strong data foundation for establishing statewide HIE infrastructure. These data sources could be leveraged to provide early value, in that there are already information exchange requirements in place for these sources. Incorporating exchange between these statewide sources establishes value propositions that are key to sustainability. The Clinical and Technical Operations Workgroup recommended the adoption of a Hosted Shared Statewide Services architecture as it would provide an operational solution and, if built upon common needs, could provide a cost effective utility Clinical Functions Having agreed upon a technical approach, the Clinical and Technical Operations Workgroup defined the core clinical functions that would be enabled and enhanced by HIE services. In defining the clinical functions, the Clinical and Technical Operations Workgroup identified the activities that best support care delivery and offer opportunities to improve the quality, efficiency and effectiveness of healthcare delivery. Clinical Function 1. Incorporate essential data from external systems. Definition Incorporate data from outside systems, particularly laboratories, pharmacies, inpatient stays, and imaging centers. Facilitate effective coordination of care across clinicians. Value is augmented if the external data is standardized and machineinteroperable so as to be easily incorporated into quality measures, decision support, and disease registry systems. Statewide HIE Operational Plan 83

92 Clinical Function 2. Facilitate effective coordination of care across clinicians, patients and care givers. 3. Submit information on processes and outcomes of individual and population performance and quality of care. 4. Aggregate data for research purposes. 5. Provide tools to enhance delivery of care Definition Coordinate referrals to other clinicians and/or for tests. Provide patients (and/or caregivers) information after discharge from a facility. Coordinate post-discharge care with other entities (specialists, home health, disease management organizations, etc.). Communicate, plan care, and assign and track responsibilities with care managers or other professionals involved with management of patient. Automate submission of information for quality on the processes and outcomes of individual and population performance and quality of care. Provide the ability to query either a centralized repository or multiple data sources to produce a de-identified report for an approved research project. Offer services to improve decision making around diagnosis (clinical prediction rules), prevention and disease management (routine care reminders to doctors or patients), and treatment (electronic medication prescribing) Statewide Core and Value-Added Services Overview North Carolina s framework for hosted shared statewide HIE services consists of two categories of services: Core Services and Value-Added Services. In short, the Core Services represent the suite of registries, record locator service and security functions that will create a cost-effective pathway for Qualified Organizations to locate and route health data. The Core Services will facilitate providers ability to receive structured lab results and exchange summary care records, two of the three Meaningful Use HIE transactions identified by ONC as high priorities for Once available, Qualified Organizations will also utilize Core Services to access an evolving range of Value-Added Services offered by state agencies, HIOs, vendors, or other organizations. The availability of Value-Added Services will be based on state or federal priorities, guidelines, and/or mandates and deployed incrementally in phases based on the expected value derived from their use. By consolidating access to Value-Added Services through the Core Services, North Carolina will be able to share and minimize operational costs, increase user acceptance and participation, and maximize benefits to all stakeholders. The NC HIE will continue to assess the most effective mechanisms and timing for provision of Value-Added Services through Core Services, taking into account costs, contractual obligations, and sustainability considerations. A visual representation of the components and relationships between stakeholders and Core and Value-Added Services is provided below. Statewide HIE Operational Plan 84

93 Participating Organizations with gateways to access Core Services HIO HIO Hospital- Hospital- Provider Provider Clinic Clinic Network Network Fed Fed Agency Agency Core Services Service Access Layer: Transport, Orchestration, Audit, Reporting Security Security Services Services Patient Patient Matching Matching Master Master Facilities Facilities Index Index Master Master Clinician Clinician Index Index NHIN NHIN Gateway Gateway Value-Added Services Lab Lab Normalization Normalization Immunization Immunization Medication Medication Management Management Quality Quality Reporting Reporting Lab Lab Results Results Routing for Routing for Reporting Reporting Radiology Radiology Image Image Delivery Delivery Procedural Procedural Results Results Delivery Delivery CCD CCD Translation Translation Disease Disease Surveillance Surveillance Access Access to to Aggregated Aggregated Data Data Clinical Clinical Decision Decision Support Support Figure 15. Illustration of Statewide Core and Value-Added HIE Services The Core and Value-Added Services are described in further detail below. Core Services The NC HIE will provide a set of Core Services that support connectivity and data transport exchange between multiple entities and systems in the state. The goal of Core Services is to provide a lightweight and flexible infrastructure and serve as the gateway through which authorized organizations securely access Value-Added Services. Core Services create a foundation for organizations and participants to exchange health information across their organizational boundaries, such that two entities that have not necessarily exchanged information previously can: Identify and locate each other in a manner they both trust; Reconcile the identity of the individual patient to whom the information pertains; Exchange information in a secure manner that supports both authorization decisions and the appropriate logging of transactions; and Measure and monitor the system for reliability, performance and service levels. The architecture, based on a hub of hubs, assumes that although much HIE is local, increasing value will accrue to broader HIE from obtaining information relevant at the point of care, such as non-local encounters, and analytical services, such as clinical decision support and public health and emergency response. Statewide HIE Operational Plan 85

94 The Core Services will assure authentication of the clinician before enabling a request for information and authorization of the clinician to view the requested information. The Core Services will support both push and pull transactions. Push transactions will make use of the Master Clinician Index to enable sending information to a provider, once the sender has received authorization. For a pull transaction, the Core Services will identify the patient and locations of information across multiple venues and report the authorized patient information that is available back to the clinician. After reviewing the information, the clinician will be able to request that all or some of the information be retrieved and can then use the information for point-of-care discussion and decision making with the patient. The monitoring and measurement of these services is a core non-functional requirement for statewide services to take hold. Shared service consumers require reliability, especially if the HIE infrastructure is deployed into core clinical and care coordination processes. The Core Services consist of the following: Service Access Layer: The Service Access Layer consists of uniform transport and security infrastructure based on web services standards and a Service Oriented Architecture, and is responsible for mediating all access to and from other core services, specifically the various registries, security services and the NHIN gateway. The Service Access Layer is based on the NHIN messaging platform standard as approved by HHS where applicable. There may be specific integration nodes that will utilize other established and standards-based mechanisms that are necessary to include in order to deliver on the functionality described as part of health information exchange services. This uniform interface simplifies interoperability and shields the other Core Service components from requestors/receivers/information providers, while also ensuring proper basic security is enforced. The Service Access Layer handles all transactions (push/pull) to and through the core services. It acts as the method to transport information to/from Value-Added Services. It works with the security services to establish authentication and maintains statistics on users, transactions, and information traffic. Security Services: Security services consist of multiple functional layers that ensure only authorized users are able to access system or service resources. It also contains the functions that allow for system administrators to review and ensure that only those with the appropriate credentials and permissions have accessed the system. This is frequently described as the 4As Security Framework: Authorization, Authentication, Authorization, Access Control and Auditing. Identity management is used to generate a list of users and their associated roles. Access control represents the intersection between authentication and authorization between users and the system. In a Service Oriented Architecture, it is also necessary to detect and authenticate the systems that are connecting. This is frequently handled through digital certificates that prove to the HIE that the systems interacting are trusted sources. Because there are multiple services and components, auditing in health information exchanges is especially challenging. A consistent audit trail needs to be established across components in order to detect event anomalies from authorized users. The Security Services core will include an index of participating entities (or Qualified Organizations) which will include organizational details. It will store participating entity rules (based on data sharing agreements) to enable the sharing of clinical records. Information involved in the security transactions includes but will not be limited to roles, patient consent, participating entity provisioning, entity Statewide HIE Operational Plan 86

95 de-provisioning, auditing transactions, reporting transactions, compliance with policies and procedures, authentication of participating entities and certificate authority. Person/Patient Matching Service: The Person/Patient Matching Service provides three capabilities. The first capability is a reconciliation service that matches (i.e., cleans up) records from existing systems to provide a definitive mechanism for locating all records for a patient. This is usually accomplished via a probabilistic algorithm with optional manual resolution when the algorithm fails. Records may stay in the existing system, or some or all of those records may be moved or copied into this service s storage. During implementation, various design patterns will be considered including: keeping records in their current location with the possible exception of limited demographic data, centralizing or developing master indexes, or distributing and synchronizing indexes. Specific design choices will be based on participant capabilities and enabling HIE functions. As the person/patient identities are being indexed specifically for HIE, a second capability enables requesting a list of patient information documents or clinical data locations using this index, either via a demographic attribute query (i.e., find all patient info for the patient with <name, date of birth, >) or via a direct index lookup if the querying system has the patient index available. The third capability enables requesting one or more of the documents listed from a query be transferred to the requester s system. The second and third functions described utilize the person/patient matching service and may be exposed as part of the clinical document exchange service described in the Value- Added Services section below. Master Facilities Index Service: This component is an index of facilities with which the clinician (or other user) registered in North Carolina has an affiliation/relationship. It processes additions, deletions, and updates to the facility index and processes requests for information from facilities index. Master Clinician Index Service: This component is an index containing all relevant information on all registered clinicians within North Carolina. It processes additions, deletions, and updates to relevant clinician information, and will process requests for relevant clinician information. Clinician is broadly defined to include all certified and licensed clinicians (e.g., physicians, nurse practitioners, nurses, certified nursing assistants, medical assistants). The Master Clinician Index Service will be an open and authoritative state level provider directory accessible to all Qualified Organizations in the state. NHIN Gateway: The NHIN Gateway provides for a single statewide implementation of the NHIN Connect gateway available as a web service for authorized users and entities. This service is the required standard for interoperability with federal agencies, and the proposed standard for the exchange of clinical information across the NHIN. Value-Added Services North Carolina s priority for developing statewide HIE services is to meet both the immediate needs of providers to satisfy meaningful use requirements and the longer term transformative vision for its health care system, moving toward patient-centered models supportive of robust Statewide HIE Operational Plan 87

96 coordinated care. Value-added services are built on core services and rely on the existence of core services in order to delivery functionality. In July and August 2010, the Clinical and Technical Operations Workgroup identified a list of candidate services to be offered as hosted shared services. The following were identified as candidates. Clinical Function HIE Service Description 1. Incorporate essential data from external systems 1.1 Lab ordering 1. Provider creates a lab order transaction set: 1. Lab Order 2. Test Information 3. Diagnosis 4. Patient Information 5. Insurance Information 6. Patient History (for pathology labs) 7. Copy To information 1.2 Lab result delivery 2. Provider sends order to HIE. 3. Specimens are received at the Lab. 4. The lab requests any orders from the HIE. 1. Lab creates a results transaction set: 1. Test Results 2. Comments 3. Normal Range (optional) 4. Pathology Data (optional) 5. Other Segments (optional) 6. Performing Lab Information 7. Copy To information 2. Lab sends results transaction set to HIE. 1.3 Lab normalization A service to transform laboratory order and result messages to conform to the format, coding, and transport requirements of the receiving EHR or public health agency. 1.4 Radiology results delivery 1.5 Radiology or other diagnostic image delivery 1.6 Access to immunization data Vocabulary services, including access to/mapping of LOINC, SNOMED, etc. could be a combination of local and central services. The role of the state HIE could be to negotiate preferred rates with companies that offer vocabulary services. A service that facilitates the transmission of radiology results to the appropriate location. A service that facilitates the transmission of radiology images or other diagnostic images to the appropriate location. A provider requests immunization data from the state registry. 1. Provider requests immunization data from the HIE. 2. The HIE submits request to the State Registry and receives the data. 3. The HIE forwards the data to the requesting provider. Statewide HIE Operational Plan 88

97 Clinical Function HIE Service Description 1.7 Med Hx Retrieves and aggregates a medication history including retrieval and aggregation of prescription (new, refills, etc.) information from identified sources (e.g., Surescripts, others) to medical providers, including pharmacists. 1. Patient presents for care. 2. As part of the intake process (regardless of setting), provider queries for medication history. 3. Provider reviews the information and identifies medications prescribed but not filled, potential interactions, medications to continue/discontinue, refills, etc. 4. Provider diagnoses and treats patient in appropriate manner. 2. Facilitate effective coordination of care 1.8 Procedural results delivery 2.1 Clinical messaging Delivery of additional value-added procedural tests (e.g., EKG, ECG). A provider creates a message and sends it to another provider. 2.2 Eligibility check A central access point for EHRs and practice management systems to retrieve insurance eligibility information via EDI transactions across various payers. This service would facilitate electronic eligibility checking and the fulfillment of the corresponding meaningful use criteria for the users and vendors of EHR systems, suggesting a revenue model for sustainability. In concert, the same access point may be used to enable web-based access to eligibility information for those eligible providers as yet unable to take advantage of EDI transactions (primarily small physician practices). Currently EHR creates an eligibility check request (X.12) and sends it to HIE, which will check against connected payers and get information back. 2.3 Prior authorization Typically a clearinghouse supports this or payers come together and agree to support through a clearinghouse. 1. Payers and PBMs publish specific authorization requirements using a specification. 2. Provider systems use prior authorization flags to alert authorization requirements. 3. Providers send needed information in the format of an electronic prior authorization request. 4. HIE submits electronic prior authorization requests to Payer/PBMs using the XI2 278 transaction, including appropriate patient information (diagnosis/conditions). 5. Payer/PBMs respond using the 278 response, and potentially note the authorization result in the claim adjudication system. Statewide HIE Operational Plan 89

98 Clinical Function HIE Service Description 2.4 Summary Record--CCD/CCR Exchange 2.5 Summary Record--CCD Translation 2.6 Consumer Empowerment This service is a specific implementation utilizing core services that enables organizations to exchange clinical summary documents in either Continuity of Care Document (CCD) or Continuity of Care Record (CCR). Organizations are responsible for being able to generate and receive the clinical content. The service may consider enabling several models of exchange. These include event-driven messaging patterns where a change in patient state such as a patient being admitted to a hospital results in an event handler then delivering the message to recipients who have message queues established to handle the notification. Alternatively, the exchange service may support a more traditional query/response interaction where authorized applications may query it for the patient document. This service will offer a centralized clearinghouse for transforming clinical summary documents among providers and patient-designated entities. This service would be analogous to the laboratory-routing clearinghouse, and would enable organizations that may lack standards-compliant EHR systems to also exchange clinical summary data. This service will allow for the clinical summary exchange for care coordination, capability and capacity for the translation of legacy messaging to standardized CCD and/or CCR. These use cases may be enabled or facilitated via health information exchange core services, in that core services are designed to be building blocks for new functions and applications. 3. Submit information for public health and quality improvement 3.1 Immunization reporting 1. Provider sends a clinical summary of an office visit to the patient/caregiver (via PHR). 2. Provider sends reminder for preventive or follow-up care to the patient/caregiver (via PHR). 3. Provide Advance Directives to requesting providers (via PHR). Provider EHRs would send immunization records to the HIE for transmittal to the appropriate registry: 1. Provider registers a patient s immunization information for sharing (make it or its source known). 2. Provider uses the HIE Service to locate a patient s immunization information. 3. Provider retrieves a patient s immunization information. 4. Provider recommends next immunizations. 5. Provider submits a patient s immunization information to the exchange through the EHR. Statewide HIE Operational Plan 90

99 Clinical Function HIE Service Description 3.2 Routing of lab results for required reporting This service will provide a centralized clearinghouse that will route laboratory reports to public health and other agencies as mandated by federal and state laws and in accordance with national standards and specifications. The centralized routing service is intended to replace the numerous, point-to-point connections among laboratories, EHRs and public health databases with a single routing hub connected to participating entities. 1. Lab creates the Public Health Lab Results Transaction Set in their LIS/HIS, which includes: 1. Test Results 2. Patient Demographic Data 3. Comments 4. Normal Range (optional) 5. Pathology Data (optional) 6. Other Segments (optional) 7. Performing Lab Information 2. Lab sends Public Health Lab Results transaction set to HIE. 3. Public Health receives results and incorporates them into their records. 3.3 Quality reporting Provider or hospital reports quality measures to CMS or State. 3.4 Disease surveillance reporting to local public health and state agencies 3.5 Disease surveillance reporting to CDC 1. Provider creates quality report from EHR system. 2. Provider's EHR sends quality report to the HIE. 3. HIE forwards Quality Report to appropriate receiving system at State or CMS. 4. State or CMS receiving system process the report and provide feedback directly to the provider. Note: Quality reports include PQRI, CQM, and others. A provider or hospital sends (i.e., reports) anonymized chief complaint data, including a problem list, to state or local public health as part of a syndromic surveillance program. 1. Hospital EHR systems collect data on patient chief complaints as part of regular provision of care. 2. The provider or hospital has made the determination that it is clinically and legally appropriate to send the chief complaint data to Public Health. 3. Patient chief complaint data is communicated to Public Health agency on a pre-determined schedule (with capability for ad-hoc transmissions also). State public health agency reports public health data to Centers for Disease Control (CDC). 1. State determines data set for identified conditions based on Nationally Notifiable Disease Condition reports to be reported to CDC. 2. Authorized personnel use HIE functionality to send information to CDC. Statewide HIE Operational Plan 91

100 Clinical Function HIE Service Description 4. Aggregate data for research purposes 5. Provide tools to enhance delivery of care 4.1 Access to aggregated data for authorized queries 5.1 Clinical Decision Support 5.2 Electronic Prescribing Access to individual patient care data and/or anonymized data for quality improvement, clinical research, recruitment for clinical trials, comparative effectiveness efforts, etc. Provide decision making around diagnosis (clinical prediction rules), prevention, and disease management (routine care reminders to doctors or patients) based on a comprehensive patient record from multiple sources. 1. Provider completes encounter in EHR. 2. Provider accesses e-prescribe service and sends prescription. 3. The e-prescribe service processes the prescription and sends it to the pharmacist (note: may be faxed or electronic). 4. The e-prescribe service sends the data to the HIE. From this list, the Clinical and Technical Operations Workgroup explored the viability of each service to provide specific functions needed for HIE that are not otherwise available to eligible providers and/or to the counterparties with whom they need to exchange health information. The Clinical and Technical Operations Workgroup assessed the fitness of each service as a potential hosted statewide HIE service based on the following criteria: Consistency with meaningful use or other federal/state requirements Alignment with identified clinical priorities Opportunity to provide economies of scale or to eliminate duplicative investments across participants Market prevalence (i.e., service exists in market or is likely to develop naturally without investment by state or coordinated market effort) Based on a thorough analysis of each candidate value-added service, the Clinical and Technical Operations Workgroup proposed a recommended sequence of implementation of hosted shared services. Candidate services were assigned to one of three categories: 1. Implement as a hosted, statewide service in Phase 1 ( ) 2. Implement as a hosted, statewide service in Phase 2 ( ) 3. The proposed service could be more effectively facilitated through existing exchange services or alternative policy, procurement, or incentives mechanisms rather than being offered as a hosted, statewide HIE service The Clinical and Technical Operations Workgroup s recommendations are provided in the table below A detailed description of each service and a summary of the Workgroup rationale for categorization are available online at Statewide HIE Operational Plan 92

101 Clinical Function HIE Service Recommended Phase 1. Incorporate essential 1.1 Lab ordering -- data from external 1.2 Lab result delivery Phase 1 systems 1.3 Lab normalization Phase 1 2. Facilitate effective coordination of care 3. Submit information for public health and quality improvement 4. Aggregate data for research purposes 1.4 Radiology results delivery Phase Radiology image delivery Phase Access to immunization data Phase Med Hx Phase Procedural results delivery Phase Clinical messaging Eligibility check Prior authorization Summary Record--CCD/CCR Exchange Phase Summary Record--CCD Translation Phase Consumer Empowerment Immunization reporting Phase Routing of lab results for required reporting Phase Quality reporting Phase Disease surveillance reporting to local public health and state agencies Phase Disease surveillance reporting to CDC Access to aggregated data for authorized queries Phase 2 5. Provide tools to 5.1 Clinical Decision Support Phase 2 enhance delivery of care 5.2 E-prescribing Alignment with NHIN As previously discussed in the Strategic Plan, one of the core principles of the NC HIE architecture is for it to serve as a gateway to the NHIN Exchange for all providers in the state. The NC HIE is closely following the developments with the NHIN Direct Implementation working group and will incorporate either NHIN Direct, or the more robust NHIN Connect where and when it s appropriate. These developments include NHIN Direct working group consensus development proposals or published standards that have gained industry acceptance. 23 The NC HIE strongly believes in empowering patients and their families to play a critical role in their own care through technology-enabled access to health information. There are many emerging mechanisms for providing consumers with timely access to their own health information including personal health record services, patient portals, etc. Many individual care providers as well as health insurers in North Carolina have started to offer such services to patients, and the NC HIE expects that many Qualified Organizations that link to the Statewide HIE will directly support consumer empowerment tools through their networks. While an NC HIE-controlled mechanism to provide direct patient access to health information through the exchange has not been slated as a Phase 1 core service offering, the Clinical and Technical Operations Workgroup will continue to monitor industry developments as well as services offered by NC HIE Qualified Organizations and evaluate phasing in consumer empowerment tools as the NC HIE becomes operational. Statewide HIE Operational Plan 93

102 6.7. Approach to Implementing Standards and Certification The statewide HIE services in North Carolina supported through the State HIE Cooperative Agreement will comply with all national standards as defined in the HITECH Act, and the final Standards and Certification Criteria established by ONC to support the Final Rule on Meaningful Use, including all specified content, vocabulary and privacy and security standards. In addition, the NC HIE will ensure it s HIE services conform to the requisite certification if and when a nationally accredited HIE certification program is offered. The North Carolina State Health IT Coordinator will provide leadership in establishing statewide standards and requirements for HIE based on the following national standards: Content: The data payload(s) will be exchanged within the NC HIE using the HL7 standards: the Clinical Document Architecture (CDA) Release 2 Continuity of Care Document (CCD), which will be implemented using the HITSP C32 CCD specification for purposes of exchanging clinical summaries; and HL7 2.5.x messaging standard, which will be used for purposes such as electronic lab results delivery, public health surveillance reporting (e.g., Public Health Information Network) as well as immunization registry functions. Vocabulary: North Carolina s hosted statewide HIE services will utilize standardized code sets and nomenclature such as: ICD-9/ICD-10 for indicated conditions, SNOMED-CT for clinical terminology, CPT-4 for procedures and anatomic pathology, LOINC for clinical pathology results, RxNorm for medications, and CVX for immunizations. Privacy and Security: Encryption: Based on existing HIE efforts, Transport Layer Security (TLS/SSL v3.0) using X.509 certificates will be utilized to encrypt data transmitted between the NC HIE and the end points. Other encryption will be layered on as and when needed (e.g. encryption of data at rest). As additional encryption standards are defined and specified by standards bodies, the NC HIE will analyze, decide and make appropriate IT infrastructure updates to support new algorithms or security processes. These standards include any Federal Information Processing Standards (FIPS) that are announced by the National Institute of Standards and Technology (NIST). It will be necessary to evaluate the capabilities and risks associated with various encryption approaches including the ability of the private sector to implement the proposed algorithms. For example, the TLS protocol using the SHA-1 algorithm should be avoided and replaced with the SHA-2 family for digital signatures as described in NIST s Policy on Hash Functions. It is expected that encryption and security standards will continue to evolve and that an ongoing function of the HIE will be to stay abreast of evolving privacy and security risks, standards and approaches. Auditing: Transactions in the NC HIE will be recorded when electronic health information is routed (source, destination, message ID, date and time) created, modified, accessed, and deleted to include which actions were completed, by Statewide HIE Operational Plan 94

103 whom (ID or username), when (date and time), and from where (host address/name). Data Integrity: The Secure Hash Algorithm (SHA-1), as specified by NIST, will be used to verify that electronic health information has not been altered in transit Next Steps Following the submission of the Operational Plan, the NC HIE supported by the Clinical and Technical Operations Workgroup will need to advance implementation of statewide HIE services incrementally. Within the next two to four months, stakeholders will: Complete landscape assessment and finalize gap fill-strategy by optimizing the mix of policy, procurement, and technical development; Gather technical requirements and develop specifications for Core and Phase 1 Value-Added Services; Develop cost estimates and adoption/use expectations; and Identify number, scope and timing of pilots. Within the next four to six months, stakeholders will: Develop and release a Request for Proposals (RFP) for Core Services that includes the following capabilities: Message routing, Audit/logging, Secure routing across Qualified Organizations, Authentication and secure transport, Provider entity registry, Provider directory, Record locator service, Patient matching service, Delivery acknowledgement, Secure routing with NHIN; and Determine the implementation sequence for Value-Added Services based on value proposition and cost/revenue estimates. Within the next six to nine months, stakeholders will: Award contract and begin implementation at pilot sites, and Develop and release RFPs for Phase 1 Value-Added Services. Statewide HIE Operational Plan 95

104 O.7. BUSINESS AND TECHNICAL OPERATIONS 7.1. Data and Services While coordination of statewide HIE in North Carolina will be achieved through a statewide process, the day-to-day operations of HIE will be the responsibility of multiple entities spanning the public and private sectors. Execution of the business and technical operations of the Statewide HIE will be conducted by NC HIE, state agencies, and other organizations as identified in accordance with statewide policies, organizational bylaws, and all applicable state and federal laws. In the near term, the HWTF will continue to serve as the State HIE Fiscal Agent and support federal reporting. North Carolina s State Health IT Coordinator will play a key leadership role in the business and technical operations of statewide HIE. The State Health IT Coordinator will participate in the NC HIE and will oversee technical implementation and coordination amongst the state agencies involved in and providing resources for statewide HIE activities. The technical solutions for Phase 1 in 2011 and 2012 will focus on the procurement of Core Services supporting Stage 1 Meaningful Use HIE requirements for e-prescribing, lab results delivery and summary of care exchange. It is anticipated that NC HIE will develop a RFP for Phase 1 services, lead the process for selection of vendor(s), and oversee deployment and operations for the Statewide HIE services. An illustration of the key relationships between Core Services and the high-priority transactions is provided below. While there may be instances or use cases within the high priority transactions that extend beyond those illustrated below, the diagram highlights the primary requirements to establish the initial functional requirements when mapped to the Phase 1 use cases. For example, to facilitate lab result delivery via a health information exchange, neither patient matching nor an NHIN gateway is necessarily utilized if the delivery service only utilizes the clinician information specified on the result to locate the routing mechanism of the ordering clinician. However, it is recognized that an alternative use case where the service may be defined as routing results to any physician related to the patient would create the need to also incorporate the patient index core service. Statewide HIE Operational Plan 96

105 Participating Organizations with gateways to access Core Services HIO HIO Hospital- Hospital- Provider Provider Clinic Clinic Network Network Fed Fed Agency Agency Core Services Service Access Layer: Transport, Orchestration, Audit, Reporting Security Security Services Services Patient Patient Matching Matching Master Master Facilities Facilities Index Index Master Master Clinician Clinician Index Index NHIN NHIN Gateway Gateway E-prescribing Lab Results Summary Care Record Figure 16. Illustration of Statewide Core Services and Targeted MU HIE Transactions for 2011 In Phase 1, and Phase 2 which will span , additional Value-Added Services will be developed based on ongoing analysis and prioritization recommendations from NC HIE. NC HIE will also assess the optimal location (i.e., at the organizational, regional, statewide, or cross-state level) and entities for hosting the Value-Added Services. An illustration of the staging of candidate Value-Added Services is provided below. Statewide HIE Operational Plan 97

106 Participating Organizations with gateways to access Core Services HIO HIO Hospital- Hospital- Provider Provider Clinic Clinic Network Network Fed Fed Agency Agency Core Services Service Access Layer: Transport, Orchestration, Audit, Reporting Security Security Services Services Patient Patient Matching Matching Master Master Facilities Facilities Index Index Master Master Clinician Clinician Index Index NHIN NHIN Gateway Gateway Candidate Value-Added Services Lab Lab Normalization Normalization Immunization Immunization Medication Medication Management Management Quality Quality Reporting Reporting Phase 1 Phase 2 Lab Results Lab Results Routing Routing for for Reporting Reporting Radiology Radiology Image Image Delivery Delivery Procedural Procedural Results Results Delivery Delivery CCD CCD Translation Translation Disease Disease Surveillance Surveillance Access to Access to Aggregated Aggregated Data Data Clinical Clinical Decision Decision Support Support Figure 17. Proposed Core Services and Phased Implementation of Value-Added Services 7.2. Staffing Plans for Statewide HIE The NC HIE has explored various staffing models ranging from a full outsourced model, to a lean employed staff combined with consulting services or outsourced support, to a robust employed staffing model. Both administrative and technical functions may be included in outsourcing arrangements. In the near term, the NC HIE plans to build a staffing structure in the middle of that continuum that employs core staff with targeted outsourced support for subject matter expertise. Systems integrators and management agreements will provide the bulk of statewide HIE s capacity in this startup phase. In years three and beyond, the Statewide HIE expects to transition toward regular employees to support the ongoing operations of the exchange. This strategy will allow the Statewide HIE to engage higher-caliber talent during the critical implementation period, without incurring the long-term expense of those resources when the HIE reaches sustainability Approach for Technical Assistance to HIOs The state and the NC HIE are committed to collaborating to implement technical assistance, guidance, and information on best practices to support and accelerate healthcare providers participation in HIOs. There is also a recognized need to provide detailed specifications and implementation guidelines for the HIOs and Qualified Organizations. As the NC HIE identifies and defines Statewide HIE Operational Plan 98

107 Qualified Organizations and the requirements for a Qualified Organization, additional technical assistance needs may be identified and will be incorporated into the broader technical assistance plan Standard Operating Procedures for HIE Standard operating procedures for statewide HIE will be required across the continuum of program activities. Policies and procedures will be needed within user healthcare organizations (e.g., physician offices, clinics, hospitals) to define acceptable use, patient consent, and workflow within the environment. Data providers and data requestors will be required to adhere to contractual agreements that will be translated into policies and procedures to ensure appropriate use and compliance. In addition, the NC HIE will have policies and procedures to define the day-to-day operations as well as compliance with and facilitation of the aforementioned activities. The NC HIE Board will work with the NC HIE Program Team to establish the necessary policies and procedures needed to operate the NC HIE business reliably and securely. In its support of HIE services, operators of hosted Core and Value-Added Services will follow and implement industry standard operational best practices to achieve a high level of availability, security and system integrity. These will include, but are not limited to implementing operational and management processes, systems and services for ensuring: fault tolerance (failover and system/network redundancy), data backup, offsite storage, and restoration, disaster recovery and business continuity planning, and intrusion prevention, detection, and breach response and mitigation. Finally, operators of hosted Core and Value-Added Services will develop Standard Operating Procedures and supporting documentation (e.g., users, management, and training guides) through a rigorous document authoring and approval process. Other Standard Operating Procedure (SOP) documents will be developed for participating providers and hubs, with networking, security and privacy policies through the statewide process maintained by the NC HIE. Approved documents will be branded, disseminated and stored in a shared document repository for member access. Updates for the SOP will be scheduled on a routine basis, or asneeded according to major changes in legal, policy or business/technical operating requirements Continuous Improvement The state, the NC HIE and its partners in statewide HIE are dedicated to continuous improvement. The State Health IT Coordinator will maintain a common project timeline that integrates deliverables and dependencies across state agencies and the NC HIE. The NC HIE will also have the ability to audit the exchange and ensure compliance, and when necessary, determine appropriate remediation. Statewide HIE Operational Plan 99

108 7.6. Use of NHIN Protocols/Standards and State Level Shared Services As referenced in the HIE Architecture and Standards section for NHIN, from a technology perspective, the NHIN Gateway is part of the Core Services of North Carolina s HIE infrastructure. The statewide HIE will connect according to the standards and specifications of NHIN, such as IHE and HL7, and the NC HIE will actively monitor developments related to the NHIN. Statewide HIE Operational Plan 100

109 O.8. LEGAL AND POLICY 8.1. Overview The NC HIE is committed to establishing comprehensive privacy and security policies that protect privacy, strengthen security, and allow clinicians and public health authorities to have critical access to health information when and where needed to improve health care delivery and health outcomes for all North Carolinians. The Statewide HIE must provide policy guidance addressing privacy and security needs for interoperable HIE among its participants, including: consent, authorization, authentication, access, audit, breach, confidentiality, data integrity and data availability Consent Approach for Statewide HIE Consumer or patient consent is the process by which consumers control the exchange of their health information through an HIE and can be a tool to allow health care providers access to more complete health information, thereby strengthening the provider s ability to provide informed care and improving care coordination amongst providers. The NC HIE Legal/Policy Workgroup was charged with determining to what extent, and how, consumers should be able to control such exchange, balancing privacy considerations with the overall vision of a statewide HIE and its potential impact on public health, the coordination of care, improved health care quality and ultimately, improved health outcomes as supported by better access to more robust patient data. The Workgroup weighed the competing influences on statewide consent policy 24 : Patients Want: Meaningful control over and protection of their health information Quality, well-coordinated care Providers Want: To deliver quality, well-coordinated care Maximal quantity and quality (i.e., utility) of data Protection against liability Minimal administrative burden and cost Payers Want: Maximal patient and provider participation Minimal burden and cost Access to data to support care coordination activities, to facilitate payment and reimbursement for services to both providers and patients and to inform quality improvement activities. Exchanges Want: 24 Melissa Goldstein and Alison Rein. Consumer Consent Options for Electronic Health Information Exchange: Policy Considerations and Analysis. Prepared for the Office of the National Coordinator for Health Information Technology, March 23, Statewide HIE Operational Plan 101

110 Maximal patient and provider participation Maximal flexibility to sustain the exchange Minimal administrative / operational burden Maximal ability to provide value to participants One of the key concerns raised by consumers related to the exchange of their personal health information among providers and others involved in the care delivery process is the privacy and security of mechanisms used to exchange or transmit that information. As such, the Workgroup considered that patient consent is but one of many privacy and security tools and also considered other factors in developing NC s statewide HIE consent policy recommendations, including: Uses of health information available through the exchange; Potential filtering of sensitive health information through the exchange; Whether and to what extent consumers may control which providers are allowed to share and/or access their information; Ability to break the glass to obtain health information in emergency situations where consumer consent has not been granted; Nature and breadth of consumer outreach and education efforts related to the consent decision; and Extent of security, enforcement, and remedies in place. Considerations in Determining Consent Framework In determining the best and most feasible framework for patient consent, the Workgroup considered four models for consumer consent to exchange personal health information through a statewide HIO and deliberated the pros and cons related to the potential impact on patient and provider participation: Option Name Opt-In Potential exchange of full medical record without data filtering Opt in consent for all providers Mixed Model Key Elements Advantages Disadvantages Exchange only a summary record of Highest level of patient control likely to lower risk of consumer mistrust and privacy concerns Fuller record set available for patients who do consent Limited technical obstacles No risk of ineffective filtering No need to change law Significant amount of data available for treatment and Limited amount of data available for treatment and care management at outset Level of patient participation over time unclear; HIE s utility may be undermined High administrative burden on all providers Data about all patients incomplete Statewide HIE Operational Plan 102

111 Option Name structured data that does not include medical record notes Filter communicable disease data Opt out consent for most providers Opt in consent for substance abuse treatment providers, mental health facilities, nursing homes and possibly home health agencies Opt-Out Would require change in NC law to permit exchange of all medical information through statewide HIE without patient consent as long as HIPAA standards are followed and patients have opt out right Potential exchange of full medical record without data filtering Opt out consent for all providers except substance abuse facilities No Consent Key Elements Advantages Disadvantages Would require change in NC law to permit exchange of all medical information through statewide HIE without patient consent as long as HIPAA standards are followed Potential exchange of full medical record without data filtering No opt out right for patients, except opt in consent for substance abuse facilities care management from outset Higher level of patient control over sensitive data may enhance consumer trust Low administrative burden on most providers No need to change law Full record set available for vast majority of patients for treatment and care management from outset Low administrative burden on all providers except substance abuse facilities Limited technical obstacles No risk of ineffective filtering Full record set available for all patients for treatment and care management from outset Low administrative burden on all providers except substance abuse facilities Limited technical obstacles No risk of ineffective filtering High administrative burden on some providers Technical obstacles to effectively filter, with related risk of legal liability Lower level of patient control may generate consumer mistrust and privacy concerns Requires change in law Lowest level of patient control may generate consumer mistrust and privacy concerns Requires change in law May raise questions about compliance with HIPAA s request for restrictions requirement Statewide HIE Operational Plan 103

112 8.3. Current North Carolina Law The current state of North Carolina law poses a significant challenge to the development of an effective statewide consent policy for HIE. At present, there are a multitude of state laws that affect whether and how patient consent must be obtained for a provider to use or disclose individually identifiable health information. Significant variations in the different laws have resulted in an inconsistent patchwork of consent requirements and practices. For example, consent requirements may vary by type of provider, by health care setting, or by category of health information. Further, the many provisions of state law vary in the extent to which they align with federal laws, including the HIPAA Privacy Rule. The HIPAA Privacy Rule provides relatively clear guidelines about when individual authorization is required before information can be disclosed and the form in which authorization must be obtained, but it also permits state laws to impose more stringent (i.e. privacy-protective) requirements 25. To determine how NC law affects choices for consent policy for the HIE, the NC HIE Legal Subcommittee conducted a scan of North Carolina laws addressing the need for providers to obtain patient consent to disclose health information. A summary of the legal scan and the Workgroup s resulting Key Legal Principles is included in Appendix As a result of the legal scan and subsequent discussion, the Legal/Policy Workgroup reached the following conclusions: 1. NC law permits the disclosure of most health care information to providers for treatment purposes without the patient s consent. 2. However, two types of state laws require the patient s consent to disclose information for treatment purposes: a. Certain categories of providers must obtain consent to disclose patient information for treatment purposes: mental health facilities, nursing homes, adult care homes, and perhaps home health agencies (ambiguity in the law). Statewide consent related to mental health providers may prove particularly challenging because exceptions have been carved out to permit information exchange with Community Care of North Carolina providers (Medicaid Medical Home program), but other providers across the state are subject to stricter rules. b. Providers are required to obtain consent to disclose information related to communicable diseases. The NC communicable disease law applies to 71 diseases and conditions and restricts the disclosure of not only test results, but also any information that may indicate that someone either has or may have one of those conditions. This type of information is interspersed throughout records potentially maintained by all provider types. The law allows some disclosures without consent for treatment purposes, but the scope of that provision is not well-defined and was the subject of much debate and differing interpretations among committee 25 The Health Insurance Portability and Accountability Act (HIPAA) of 1996, Public Law Additional information on HIPAA, including a link to the text of the legislation, may be accessed at The HIPAA privacy rule is not the only federal law that is important to understanding consent issues, but since it applies to most health care providers, it is a useful baseline for a consent analysis. Statewide HIE Operational Plan 104

113 members. The Workgroup concluded that ambiguity about scope of provision would not be tolerable in a statewide electronic HIE. 3. Although focus of the legal scan was on state laws, the Workgroup also took into account federal regulations and identified regulations requiring federally assisted substance abuse programs to obtain patient consent to disclose information to other providers for treatment purposes, except in emergencies. Implications of Legal Findings for Statewide HIE Consent Policy 1. Under current NC state law, most health care providers may disclose health information to another provider for treatment purposes without express patient consent, using the HIE. However, some provider types would need affirmative patient consent to disclose information for treatment purposes. 2. Given the ambiguity in the communicable disease law, providers would either need to obtain express patient consent to disclose communicable disease information through the HIE, even for treatment purposes, or such information would need to be filtered. 3. Many of the minor s consent services require consent for disclosure of information for treatment purposes, and the minors themselves are the individuals who must provide this consent. Because of the risk of disclosure of information to parents, either via a patient portal or a downstream provider who receives information from the HIE, minors either would need to consent to disclosure of information to their parents, or providers and the HIE would need to segregate minor consent information from other information to avoid improper disclosures. Additional Considerations The Legal/Policy Workgroup also took into account a number of other key considerations in developing a consent framework including the impact of the policy on both consumer and provider participation, the impact of the consent policy on the clinical value of the information, the technical feasibility and cost to implement and support the consent parameters, and the potential administrative burden on stakeholders. Additional Considerations Opt-In Implications Opt-Out or No Consent Implications Consumer Trust o Statewide HIE represents a paradigm shift in the way health information is shared o Consumer trust is paramount to engender public support for the Statewide HIE and ensure consumers interests are protected o o Depends on deployment approach Requiring consumers to physically sign a consent policy may increase the likelihood that their consent is meaningful o o Depends on deployment approach Making opt-out difficult for consumers or providing inadequate education and outreach can be detrimental Statewide HIE Operational Plan 105

114 Additional Considerations Opt-In Implications Opt-Out or No Consent Implications State & Federal Law Requirements o Federal law under HIPAA does not require patient consent to exchange personal health information (PHI) for treatment, payment or health care operations o NC law: While in many cases consent is not required for treatment purposes, there are existing laws that require consent for 1) disclosure by certain types of care providers or 2) disclosure of certain types of health information Clinical Value of Information o The Statewide HIE must include information necessary to provide effective treatment; without robust information, physicians will not participate and the HIE will not be sustainable Technical Feasibility & Cost o Generally the cost and technical complexity increase with requirements to exclude certain types of data and/or providers Administrative Burden & Implementation Cost o Deployment of consent policies require varying degrees of involvement, resources, and cost among providers and other HIE participants Conclusions o o o o o Provides maximum legal protection by recording patient consent to exchange PHI Allows maximum information sharing under current State law Technology models exist for both options Necessitates robust and comprehensive strategies to obtain patient consent Responsibility often lies with health care providers o o o o o o o o HIPAA does allow exchange of most data for treatment purposes without express patient consent. Does not meet state legal requirements for sharing information related to mental health or substance abuse with general providers. May not meet State requirements for exchange of communicable diseases information Requires exclusion of some types of sensitive health information under current State law May result in a thin system limited to data automatically eligible for exchange. Technology models exist for both options The need to exclude certain types of data and/or providers may increase costs Eliminates need to gather patient consent; there must still be efforts to ensure consumers are aware their PHI is being exchanged and have an opportunity to opt-out The NC HIE adopted a two pathway approach to developing a consent model for the HIE. Under Pathway One, the Legal/Policy Workgroup developed recommendations for a consent framework within the confines of existing North Carolina law. Under Pathway Two, the Workgroup developed recommendations for a consent framework that was not bound by the Statewide HIE Operational Plan 106

115 restrictions of current law and that would require a change in North Carolina law to be implemented. All recommendations were presented to the NC HIE Board for approval and adopted by the Board. The Legal/Policy Workgroup identified two possible options for a consent approach under current law (Pathway One), an opt-in model and a mixed opt-in/opt-out model, but was not satisfied that either option could sufficiently meet policy goals. As such, the Workgroup further developed recommendations related to the most desirable consent approach (Pathway Two) to lay out a consent policy framework that it believes represents good policy for North Carolina, understanding a significant change in law would be required. In order to arrive at a policy model that could be implemented as quickly as possible under existing North Carolina law and that is directionally in line with an ideal consent model, the Workgroup will outline recommendations that can be pursued in parallel: a. A consent model compliant with existing law; b. Technical revisions or tweaks that could be made through technical statutory changes, Attorney General s opinions, regulatory interpretations, or similar processes to lessen the barriers to electronic exchange of health information under existing North Carolina law; and c. Broader or more comprehensive legal change to facilitate the ideal policy framework to support health information exchange (with a goal of improving care coordination, reducing health care costs and improving health care quality) in North Carolina Pathway One (Consent Model Compliant With Existing North Carolina Law) While the NC HIE and its stakeholder groups strongly support fundamental change to current North Carolina law to remove barriers to the exchange of data among providers and others involved in the care process, including those directly supporting care coordination and collaborative care efforts, the organization realizes that the legislative process can be lengthy and is outside the control of the NC HIE. The NC HIE will pursue a coordinated, stakeholderdriven approach to drafting and proposing new legislation and is building its ideal consent framework assuming efforts to change the law will be successful. However, recognizing the goals of the HIE for the greater public good, the NC HIE is also committed to developing a consent approach that can be implemented under the existing law without delay. Through the workgroup process, the NC HIE has spent considerable time developing its preferred consent framework under Pathway Two, assuming a change in law. In order to develop a consent model under Pathway One (assuming no change to current state law), the Legal/Policy Workgroup is working to align the overall Pathway One consent framework as closely as possible with the preferred framework developed under Pathway Two. Statewide HIE Operational Plan 107

116 Summary Framework for Consent Under Current Law HIPAA CFR Part 2 27 Key NC State Laws Permits Covered Entities to use and disclose Protected Health Information without patient authorization for treatment, payment and health care operations. Prohibits federally-assisted alcohol or drug abuse treatment facilities or programs from using or disclosing any information about a patient for even treatment, payment or health care operations unless the patient has consented in writing, except in a medical emergency. Restrictions on Disclosure by Certain Providers NC law permits most health care providers to disclose medical information for treatment purposes without patient consent. However, certain types of providers must obtain consent before disclosing for treatment purposes: 1. Certain mental health facilities and programs 2. Nursing homes 3. Adult care homes 4. Home health agencies (possibly) Restrictions on Disclosure of Reportable Communicable Disease Information Although there is some uncertainty about how the law is interpreted, many health care providers believe the law prohibits the disclosure of information about reportable communicable diseases to outside entities without patient consent, even for treatment purposes. Approximately 70 communicable diseases are subject to this law. Restrictions on Disclosure of Data on Treatment of Minors in Certain Circumstances North Carolina law permits physicians to provide certain services to minors upon their own consent. When a minor receives services under the Minor s Consent Law, a physician is not permitted to notify parents about the treatment without the minor s permission, except in limited circumstances prescribed in the law. Pathway One: Consent Approach for Treatment Purposes The NC HIE will develop a consent policy based on a mixed model (Opt-Out for all data and provider types except those that expressly require affirmative patient consent to be exchanged for treatment purposes under current Federal and North Carolina law): Substance abuse treatment providers, mental health facilities, nursing homes and possibly home health agencies obtain affirmative consent before disclosing information through the HIE. Information about reportable communicable diseases or such information is filtered out of the HIE or providers obtain affirmative consent before disclosing. In cases where information is filtered out, records accessed by treating providers would contain a notification that the record may not be complete. 26 The Health Insurance Portability and Accountability Act (HIPAA) of 1996, Public Law Additional information on HIPAA, including a link to the text of the legislation, may be accessed at 27 Code of Federal Regulations Title 42 Public Health Chapter I Public Health Service Department of Health and Human Services, Part 2 Confidentiality of Alcohol and Drug Abuse Patient Records. Additional information specific to the relationship between 42 CFR Part 2 and health information exchanges may be accessed on the U.S. Department of Health and Human Services Substance Abuse and Mental Health Services Administration website: Statewide HIE Operational Plan 108

117 Next Steps for Pathway One It is expected the initial permissible use of data through the NC HIE will be limited to treatment purposes only. However, across the next 3-6 months, the Legal/Policy Workgroup will develop recommendations on consent approach under the confines of existing law for other uses of data such as to support payment by insurers or for research. The Workgroup will also further develop its recommendations on consent framework for emergency access to data and minors. In addition, the Workgroup will analyze possible technical corrections to current law that would make exchange of data for treatment purposes through the HIE easier absent a larger scale change in law Pathway Two (Assumes a Change in Current North Carolina Law and Full Compliance with Federal Law) The NC HIE firmly believes that robust health information exchange is a critical tool to improve quality and patient safety, increase efficiency, and ultimately improve outcomes and enhance patient satisfaction. Both patient and provider participation are necessary to facilitate better care delivery and advance other state goals, such as better coordination of care and improved public health, as well as to ensure the viability and utility of the exchange. As such, the NC HIE is developing a consent framework to support the boarder goals of the exchange, recognizing that change in current law will be required to actualize the consent model. Consent for Treatment Purposes The NC HIE will pursue an Opt-Out model for the exchange of patient health information through the NC HIE for treatment purposes that includes all available data from all provider types (i.e., a change in law that would allow data from mental health providers, nursing homes, adult care homes and home health agencies to be included) and that allows consumers to restrict disclosure of data to the exchange on a provider-by-provider basis 28. In cases where information is filtered out, records accessed by treating providers would contain a notification that the record may not be complete. The NC HIE will conduct further research on the pros and cons and feasibility of allowing more granular patient control over what information is disclosed to or accessed through the exchange, taking into account evolving technology and with an eye toward the impact that more granular patient control may have on both provider and patient participation in the HIE. Consent for Health Care Operations and Payment (as defined by HIPAA) for Providers Exchange and use of patient health information for health care operations, including providerbased quality improvement activities, and payment purposes (as defined by HIPAA) through the 28 The NC HIE recognizes that in some instances, patients may prefer information they consider sensitive be excluded from the exchange. While complete and accurate information about a patient's health and health history is crucial for providers to be able to give the best possible care, the NC HIE is committed to partnering with health care consumers and patients to engender trust and to develop an exchange that meets the needs of all stakeholder groups. As technology evolves, the NC HIE will continue to research and evaluate ways to provide more granular levels of patient control over what data is exchanged in this new health information exchange environment. As part of its work in the coming months, the Legal and Policy Workgroup will adopt a definition of provider for purposes of access to data through the NC HIE for treatment purposes and detail a specific opt-out policy and process. Statewide HIE Operational Plan 109

118 NC HIE will follow the same patient consent policy as treatment use, in compliance with state and federal regulations. (Note, this provision is not intended to place any restrictions on the exchange of de-identified data that may be exchanged using the technical architecture of the NC HIE.) Use of HIE for Public Health Purposes Pending technical architecture decisions, it is the policy position of the NC HIE that public health authorities and designees of public health authorities will be permitted to access data via the NC HIE for public health purposes, subject to restrictions of existing law. Use of HIE for Research Purposes Access to patient health information through the NC HIE for research purposes will follow the same patient consent policy as treatment use, in compliance with state and federal regulations. (Note, this provision is intended as a guiding principle for patient consent. Through the development of policy, a number of issues related to the mechanics of facilitating access to data for research purposes, including the potential development of a statewide IRB as well as robust oversight and security protocols, will have to be addressed.) Use of HIE by Payers The NC HIE supports extending to payers the same patient consent policy as treatment use, in compliance with state and federal regulations, for certain health care operations, such as care coordination, and payment activities allowed under HIPAA. The Workgroup will engage in additional discussion on parameters of HIPAA to finalize its recommended policy framework. Next Steps for Consent Policy Development under Pathway Two In the next three months, the Legal/Policy Workgroup will develop recommendations related to the durability and revocability of consent, exchange of minors health information, and emergency or break the glass access to data for Pathway Two, assuming a change in current law. Further, across Fall 2010, the Legal/Policy Workgroup will develop a strategy to propose changes to NC law related to the electronic exchange of data through the Statewide HIE, including working with the NC General Assembly to draft legislative language. There is extremely strong and broad stakeholder support for pursuing a change in law and the NC HIE will actively partner with a coalition of stakeholders to this end Security The NC HIE is committed to developing a robust set of security protocols that protect privacy, strengthen security and engender trust across all participants. Data security is, in effect, the flip side of the coin to patient consent. The NC HIE cannot be successful in gaining and keeping the trust of both patients and providers absent a systematic and comprehensive approach to data security. As such, the NC HIE conducted a scan of NC laws related to data security (see Appendix 13.6) and has developed a series of guiding principles to inform the development of security policies to ensure the security of data exchanged through the NC HIE. Statewide HIE Operational Plan 110

119 8.6.a. Authorization, Authentication, Access, and Audit The NC HIE must establish policy guidance relative to authorization, authentication, access, and audit (the Four A s) within the Statewide HIE network. The Four A s are critical to facilitating trust among participants in the Statewide HIE network that do not have direct relationships or contractual agreements at the individual organization level. Through adherence to a common set of policies and rules, participants in the Statewide HIE network may feel confident about the security and integrity of the information they send and receive through the HIE network. The NC HIE will adopt and comply with established national standards to the extent they exist and are applicable to the North Carolina statewide HIE network. The NC HIE will continue to evolve its privacy and security policies to ensure that the Statewide HIE network affords maximum protection to its participants and the information that flows through the network. Authorization Authorization is the process used to determine whether a particular individual has the right to access information through a specific network in this case, the North Carolina statewide HIE network. Authorization typically leverages role-based access standards that take into account an individual s job function (e.g. treating physician, office administrator) and the information required for his or her role. Authorization policies establish minimum requirements for Qualified Organizations and providers authorizing individuals to access information through the Statewide HIE network. The NC HIE will establish authorization policies and procedures for verifying the identity of all individuals accessing patient health information through the network. The ability of authorized users to access patient health information through the network will be based on a minimum set of role-based access standards that apply to all participants. The NC HIE s authorization policy will, at a minimum, include the following: A process for verifying the identity and credentials of individuals seeking authorization to access/exchange health information; A set of systems and processes to enable specific access permissions approved for the individual seeking access; and A process for providing individuals seeking authorization the information and mechanisms to be authorized when accessing/exchanging health information upon approval. The NC HIE s security policies and procedures will further require the use of role-based access standards, but with limitations on the number of roles and with the requirement that if someone changes position/role, role-based access must change accordingly and be verified via the audit process. Statewide HIE Operational Plan 111

120 NC HIE s Key Principles for Role-Based Access 1. The NC HIE will Establish and Implement Role-Based Access Standards The NC HIE will develop a policy to define a core set of user roles that encompass all anticipated user types and to define which rights (i.e., information access parameters, system functions) are permitted for each role. The policies and procedures developed will: a. Establish categories of Authorized Users. b. Define the purposes for which Authorized Users in those categories may access Protected Health Information via the Statewide HIE. c. Define the types of Protected Health Information that Authorized Users within such categories may access (e.g., demographic data only, clinical data). 2. Principles of User Access Permissions The NC HIE will maintain user access permission profiles to specify which system functions and protected health information may be accessed by authorized users according to the specific role classification to which they are assigned. Specific role classifications and related permissions should be directly tied to the job requirements of the authorized users. User access permission profiles are based upon two principles: First, that access to information must not be so restricted as to interfere with the quality or efficiency of patient care; and second, that access shall be sufficiently restricted to afford privacy and security to patients information. 3. Minimum Required Role-Based Access Categories At a minimum, the NC HIE must utilize the following role-based access standards to establish categories of authorized users for the purposes of accessing clinical data for treatment purposes: a. Practitioner with access to clinical information and Break the Glass authority; b. Practitioner with access to clinical information but no Break the Glass authority; c. Non-Practitioner with access to clinical information; d. Non-Practitioner with access to non-clinical information; e. HIE administrators with access to non-clinical information; and f. Technical support administrators who may have access to large amounts of information As a matter of policy, no single HIE-wide Administrator should have access to all data, and oversight mechanisms must be put in place for those administrators who have access to large volumes of data. As the NC HIE defines its consent policy related to uses of data beyond treatment purpose, additional role-based access standards will need to be developed to the extent there are permitted users who fall into access categories outside those already defined. Such categories of users may include public health, research, payers and patients with access to their own personal health information, among others. Statewide HIE Operational Plan 112

121 NC HIE s Key Principles for Role-Based Access 4. Special Policy Consideration for Disaster Situations The NC HIE will develop a policy that may allow for broader access to data in the event of a qualified emergency or disaster situation that requires all hands on deck to provide care resources. 5. Regular Monitoring and Updating Access privileges must be updated to reflect changes in user roles, employment or any other applicable user event. Appropriate security measures will be taken to minimize the possibility of unauthorized access to secure data by those who are no longer authorized to have access to that information, including regular audits of whether role-based access permissions should have changed. 6. Termination of Access If an Authorized User no longer requires system access, if user permissions change, or if system use audits demonstrate protracted inactivity or unauthorized activity in specific user accounts, modification or termination of access privileges will be processed in the HIE as soon as possible and coordinated with the appropriate entities. This also applies to termination of access to specific types of PHI and/or system functions when the status of any user no longer requires access to specific types of information. 7. Sanctions Should be Developed and Imposed for Violations of Role-Based Access Standards Authentication Authentication is the process for verifying that an individual or system that has been authorized and is requesting access to information or services through the Statewide HIE network is in fact who he or she claims to be. Authentication policies are an important technical security safeguard used to protect patient health information from unauthorized access; the policies establish minimum requirements that participants in the Statewide HIE network must follow prior to enabling access to an authenticated individual through the Statewide HIE network. The NC HIE will adopt and comply with national policies that require a minimum level of authentication for verifying the identity of all individuals accessing patients health information through the network. In establishing the appropriate authentication level, the policy will take into account: Technical considerations Operational considerations and barriers to adoption Costs From the authorized user s perspective, the authentication process should be the same regardless of which Qualified Organization s health information is being accessed. Statewide HIE Operational Plan 113

122 The NC HIE Legal/Policy Workgroup will review the Statewide HIE technical model and develop a recommendation for authentication, addressing key questions including: Access What should the policies and procedures established through the NC HIE require as the minimum authentication assurance level? o This question includes consideration of the authentication process and which user or system attributes to include as part of that process. As described in the Electronic Authentication Guideline document published by NIST, it will be necessary to define the level of authentication based on a risk assessment. The specific levels include which combination of user attributes to require, resulting in a determination of single or multi-factor authentication. Should the policies and procedures mandate use of minimum technologies to support those assurance levels? Should the policies and procedures established through the NC HIE require/allow use of more stringent authentication policies and procedures for sensitive information? Access policies establish minimum behavioral controls that the NC HIE will implement to ensure that access to patient health information is only granted for purposes consistent with a patient's consent and with any role-based access standards for which individual users have been authorized. All Qualified Organizations participating in the NC HIE will be required to follow: Training requirements for educating authorized users about the policies and procedures for accessing/exchanging patients health information through the Statewide HIE network that meet or exceed the Statewide HIE s basic requirements; Common sanction policies to address policy or procedural violations related to access to or the exchange of patient health information through the Statewide HIE network; Standard policies related to user names and passwords, failed-access attempts, periods of inactivity, and other activities to be identified by the Statewide HIE; and Standard policies related to de-provisioning and removal of accounts for departed users. The NC HIE will develop policies and procedures that require training for authorized users on use of the Statewide HIE and recommends that training is done by participants as part of HIPAA or other staff training. The NC HIE will explore the possibility of creating a website with training materials; and will consider whether to require attestation of completion of training (including possible consideration of testing for comprehension), and whether attestation should take electronic or paper form. Statewide HIE Operational Plan 114

123 Audit Audits are oversight tools for recording and examining access to information (e.g., who accessed what data and when) and are necessary for verifying compliance with access controls developed to prevent/limit inappropriate access to information. Audit policies establish minimum requirements that HIE participants must follow when logging and auditing access to health information through the NC HIE. The NC HIE will develop an audit policy that requires periodic audits and outlines procedures for audits related to: Data access Data integrity System performance Compliance with HIE policies Legal subpoena All Qualified Organizations participating in the NC HIE will be required to meet or exceed the NC HIE s minimum standards for routine auditing of individuals access to patient health information through the network. Minimum standards should address: What activity and information must be logged How long logs must be retained Frequency of audits and who must conduct them Minimum sample size for audits Public availability of audit results (e.g. will results be made available to consumers/public and, if so, how?) Minimum security of audit logs Audit policies should be sensitive to limited resources of smaller HIE participants, and may be made scalable (e.g. larger participants expected to implement more intensive activities than smaller participants) if appropriate. 8.6.b. Breach A breach is, generally, an impermissible use or disclosure under the HIPAA Privacy Rule that compromises the security or privacy of the protected health information such that the use or disclosure poses a significant risk of financial, reputational, or other harm to the affected individual. The success of the NC HIE is dependant on participants trust that the exchange is secure and that personal health information will be protected. The NC HIE is committed to establishing Statewide HIE Operational Plan 115

124 policies, procedures and security standards to prevent security breaches from happening in the first place but if a breach or suspected breach does occur, the NC HIE is equally committed to adopting a set of policies and procedures for both the NC HIE itself and participating Qualified Organizations to facilitate swift resolution. NC HIE s Key Principles on Breach 1. Compliance with the Law The NC HIE shall abide by all applicable federal and state laws and regulations (including HIPAA) pertaining to the security of protected health information. 2. Need for Accountability While consent, authorization, authentication, access and audit policies will be designed to protect patients from privacy breaches, they have little weight if the NC HIE and its Participants are not held accountable to certain behavioral standards when privacy violations occur. 3. Commitment to Preventing Breaches The NC HIE shall implement policies, standards and procedures to prevent breaches electronically or otherwise to protect the confidentiality, integrity and availability of protected health information. 4. Implementation of a Breach Notification Policy and Breach Plan by the NC HIE The NC HIE shall implement a breach notification policy that includes a breach plan that outlines the process by which the NC HIE will investigate, confirm and respond to a breach of security and/or confidentiality of protected health information, including defining when and how to notify Participants (both organizational and individual) regarding a breach. 5. Implementation of a Breach Plan by Participants in the NC HIE Participants in the NC HIE shall be required to implement a breach plan as part of their policies and procedures that aligns with the NC HIE breach plan and meets a minimum set of requirements established by the NC HIE regarding, among other things, investigation, mitigation and notification. 6. Obligation of Participants to Report Actual and Suspected Breaches Participants in the NC HIE shall notify the NC HIE in the event that the Participants or their business associates become aware of any actual or suspected breach of protected health information that materially involves the Statewide HIE. 7. Minimize Burden on Participants The NC HIE shall make every effort to simplify its policies and procedures to ensure that they do not inadvertently serve as a deterrent to participation in the statewide exchange. Statewide HIE Operational Plan 116

125 8.6.c. Confidentiality, Integrity and Availability (CIA) In addition to its focus on policies and procedures related to the 4A s and Breach, the NC HIE believes that individually identifiable health information should be collected, used, and/or disclosed only to the extent necessary, that data quality and integrity should be reasonably protected, and that individually identifiable health information should be protected with reasonable administrative, technical, and physical safeguards to ensure its confidentiality, integrity, and availability and to prevent unauthorized or inappropriate access, use, or disclosure. The CIA framework is a widely used benchmark for evaluation of information systems security, focusing on the three core goals of confidentiality, integrity and availability of information: Confidentiality Protection of information from being viewed or read by individuals who should not access it. Loss of confidentiality can happen physically (for example, theft) or electronically (for example, lack of encryption or lack of protection against spyware). Integrity Protection of information from being modified without the modification being authorized. Unauthorized modification of information can be intentional or accidental. In addition to human error or malicious intent, accidental integrity loss can happen at a system level (for example, file deletions caused by a computer virus). Availability Assurance that information is available to be accessed when a user attempts to access it. To support its commitment to the principles of CIA, the NC HIE will: Develop a policy/approach, in partnership with the Clinical/Technical Workgroup and in alignment with its breach policy, regarding data encryption. Develop a policy on data integrity, including defining the NC HIE s role in protecting data integrity and specifying a set of expectations for participants in the NC HIE related to implementing data corrections once misinformation is identified. Develop a set of requirements for participating organizations in the Statewide HIE related to ensuring availability of data, including expectations for organizations from whom data will be sought (depending on the adopted NC HIE technical model) and timeframes for availability, response times, and scheduled down times for maintenance. Statewide HIE Operational Plan 117

126 8.7. Next Steps Following the submission of the Operational Plan, the NC HIE supported by the Legal/Policy Workgroup will need to: Address a number of important privacy issues, including the protection of information relating to services provided to minors without parental consent and the right of emergency providers to access information about individuals who have otherwise denied consent for the exchange of their records through the HIE. Based on the guiding privacy and security principles adopted by the NC HIE Board of Directors, draft specific policies that provide direction to HIE participants on how to ensure the confidentiality of information exchanged through the HIE on a day-to-day basis. These policies will have to address the process for obtaining patient consent when required, the administration of the opt out consent system, the permissible uses of information, user training, auditing of system access, breach identification and notification, access controls, user authentication and a variety of other privacy and security issues. Policies addressing these issues will have to be developed before the HIE can become operational. As the NC HIE is pursuing a two pathway approach to patient consent for the exchange of information through the HIE, including a plan to propose a change in law, identify the precise nature of the legislative changes necessary to implement Pathway Two, draft bill language and shepherd the proposal through the North Carolina Legislature. Review and update as needed the NC NHIN Data Use and Reciprocal Support Agreement (DURSA). In partnership with the NC Office of Health Information Technology, pursue discussions with bordering states to mitigate obstacles to cross-border health information exchange in key medical trading areas. Statewide HIE Operational Plan 118

127 O.9. FINANCE 9.1. Overview Historically, the HIE marketplace has been challenged with obtaining upfront financing and establishing sustainable business models, but the passage of ARRA and the HITECH Act has promised a market for products and services to enable HIE, resulting in a competitive marketplace for HIE services. 29 In this new environment and in pursuit of satisfying requirements for the HIE Cooperative Agreement Program, North Carolina has endeavored to develop a financing model to support the initial operations of a statewide HIE organization and network, as well as the transition to a self-sustaining organization. Over the last few months, North Carolina has convened a multi-stakeholder workgroup to consider various financing and sustainability models and approaches, debate the models respective applicability, relevance, and likelihood of success in North Carolina, and ultimately develop a plan to ensure sustainability of statewide HIE Financing Model & Approach to Sustainability The Finance Workgroup was tasked with the development of a financing model and approach to sustainability over the course of the Summer. The Workgroup convened to develop the financing model s underlying assumptions and undergo a significant data collection effort to create the most accurate picture possible of the North Carolina health care landscape. As part of the data collection effort, the Workgroup actively sought out information on the state s providers, payer, labs, pharmacies, and other health care providers. Utilizing the information obtained in the data collection effort, the Workgroup segued into the review and debate of various cost and revenue models. Ultimately the Workgroup was called upon to review the decisions and assumptions of the four Workgroups operating in parallel to harmonize individual Workgroup budgets with the Strategic and Operational Plans and HIE Cooperative Agreement Program requirements. The timeline below depicts the Finance Workgroup s overall workplan during the Summer of Please note that the Workgroup met in conjunction with and in parallel to the other four HIE Workgroups and the NC HIE Board of Directors. All recommendations proposed by the Finance Workgroup were subsequently discussed and evaluated by the NC HIE Board of Directors. Step 1: HIE Modeling Approach and Key Assumptions Step 2: Environment Data Collection Step 3: Initial Cost and Revenue Models Step 4: Harmonize Model with Strategic Plan and Operational Plan Draft Step 5: Iterate Model with Operational Planning Activities 29 American Recovery and Reinvestment Act of 2009, Title XIII The Health Information Technology, Subtitle B Incentives for the use of Health Information Technology, Section 3013, State Grants to Promote Health Information Technology. State Health Information Exchange Cooperative Agreement Program. Office of the National Coordinator for Health Information Technology, Department of Health and Human Services p. 9. Statewide HIE Operational Plan 119

128 9.3. Key Assumptions The Finance Workgroup s first major undertaking was the development of key assumptions that would ground its financing model and approach to sustainability. The Workgroup discussed potential assumptions, concluding that the following statements represented consensus-based conclusions that would guide their work. These conclusions include: Governance and operations costs will take into account only those costs associated with the Statewide HIE network and not the governance and operations associated with regional health information organizations (RHIOs or local HIEs). Costs for participants connectivity to the Statewide HIE network will be based on adoption curves by participant type. The financing model will generally not take into account individual participant or organizational costs to implement new EHRs or remediate existing EHRs and clinical information systems (CIS), with the exception of: Medicaid system implementation or remediation required for HIE Estimated costs for a subset of providers to connect to the Statewide HIE network using an HIE provided, low-cost EHR lite. The Workgroup s financing model and sustainability approach is intended to be flexible; the assumptions described above may be adjusted to reflect future conclusions or recommendations of the NC HIE. It is also important to note that the initial financing model identifies core services, but does not explicitly identify value-added HIE products or services that may help drive revenue for the Statewide HIE network, or the costs to stand up and deliver such services Environmental Data Collection Creating an overall accurate picture of the health care landscape is critical when trying to accurately estimate both costs and revenue. As described in section 9.2 above, the Finance Workgroup was charged with this important task of gathering information to create a picture of North Carolina s health care landscape. In its attempt to obtain the most accurate depiction of North Carolina s health care landscape possible, the Finance Workgroup staff and participants reached out to multiple organizations and stakeholders including: General Information The Finance Workgroup consulted the US Census Bureau (2009) as well as the Kaiser Family Foundation (2009) to obtain information about North Carolina s total population, population density, distribution of urban and rural counties, and Medicaid and Medicare populations. Approximately 3.2 million people are enrolled in Medicaid or Medicare programs, representing 34% of North Carolina s total population (9.4 million). Physicians Several sources were consulted when gathering information on North Carolina s physicians including the US Census Bureau (2009), CareNet, Blue Cross Blue Shield, and the North Carolina Medical Society. It is estimated that there are approximately 22,000 physicians licensed in the state of North Carolina, representing Statewide HIE Operational Plan 120

129 approximately 3,900 physician offices. It is estimated that 29% of providers practice in small or solo practices (between one and five physicians), followed by 21% of physicians practicing in large practices (over 100 physicians). Hospitals The North Carolina Hospital Association provided information on the state s hospitals. There are 162 hospitals in 84 counties; 78 hospitals are in rural areas and 84 hospitals are in urban areas. The majority of hospitals in both rural and urban areas are medium-size general acute care hospitals with between 51 and 200 beds. Of the state s 162 hospitals, it is important to note that 118 hospitals are affiliated with 33 hospital systems, representing over 70% of the state s hospitals. Federally Qualified Health Centers (FQHCs) There are 26 FQHCs and two FQHC look-alikes in North Carolina, representing 155 physicians across 142 locations. In 2008 North Carolina s FQHCs served approximately 390,000 patients, representing 192,301 uninsured patients and 82,126 Medicaid patients. 30 Rural Health Clinics According to the Rural Assistance Center, North Carolina Rural Health Research and Policy Analysis Center, there are 86 rural health clinics in the state. Free Health Clinics North Carolina has 45 free health clinics. According to Care Net data, the clinics represent 57 total sites 20 small sites, 27 medium sites, and 10 large sites. For purposes of the financial modeling exercise, a clinic with up to 510 patients annually is considered small; patients is considered medium, and more than 1,495 patients is considered large. Local Health Departments According to the North Carolina Division of Public Health, the state has 85 Local Health Departments which serve all 100 counties in North Carolina. Pharmacies North Carolina is leading the way for e-prescribing in the nation with 96% of community pharmacies connected to the Surescripts network and accepting electronic scripts. In 2009 approximately 8.6 million scripts were routed electronically and 3,432 physicians were routing prescriptions at year end. Labs - In addition to the State Laboratory of Public Health, there are 72 independent lab organizations, according to CMS Clinical Laboratory Improvement Amendments (CLIA) data. These 72 organizations consist of 154 sites across the state. Radiology Centers According to Blue Cross Blue Shield, North Carolina has 73 free standing centers in 293 locations. The figure below represents a summary view of the health care landscape in North Carolina. There are accompanying details and additional information in Appendix The cells that are highlighted (shaded) represent assumptions reviewed by the Finance Workgroup; for example, where the breakdown of sites for Rural Health Centers or FQHCs was unknown, the Workgroup suggested that the sites be evenly divided among large, medium, and small sites. These numbers will be further refined in future research and outreach to providers. 30 Source: North Carolina Community Health Center Association Statewide HIE Operational Plan 121

130 Provider Type Organizations Sites Non-Phys Providers Prescriber Large Medium Small Total (NP, PA) Hospital Systems ,415 Unknown Hospitals Unknown Rural Health Centers FQHCs Provider Offices Unknown ,024 10,928 18,573 1,900 Free Health Clinics Unknown Unknown Labs (excl Hosp & Clinic based) Pharmacies (Chain) 1,199 1,199 Pharmacies (Independent) EHR Adoption Assumption Total Providers Figure 18: Healthcare Landscape There is limited knowledge about the state of EHR adoption among North Carolina s physicians. The Workgroup reviewed several state and national studies (described below), providing estimates of provider EHR implementation and adoption. Following review of these studies, the Workgroup recommended using a conservative estimate of 16% adoption among the state s physicians for the purposes of financial modeling. A brief overview of the statewide EHR adoption studies the Workgroup reviewed are below. In 2009, North Carolina s Department of Health and Human Services conducted a survey of hospitals to understand the status of EHR adoption. Of the 125 hospital respondents, over half reported some use of EHRs. Approximately half (49%) reported using a combination of both paper and electronic records and 15% reported the exclusive use of EHRs. North Carolina s FQHCs and rural health centers have reported a relatively low rate of EHR adoption. According to the North Carolina Rural Health Research & Policy Analysis Center, 32% of both state funded rural health clinics and federally funded health centers have implemented EHRs as of Thirty-two percent equates to eight (of 25) rural health clinics, and nine (of 28) federally-funded health centers. North Carolina s Academy of Family Physicians conducted a survey of the state s physicians in 2006 and reported that 22% of physicians had adopted EHRs and 30% were actively considering the implementation of an EHR system. It is unclear whether those surveyed are using a common definition of an EHR system Cost and Adoption Models The Finance Workgroup began to develop an initial model for total costs to develop and operate a statewide HIE network over four years. Costs were estimated on consensus-based assumptions regarding the on-ramping of Qualified Organizations to the Statewide HIE network over the four year project timeline. The Workgroup estimated that approximately 25 Qualified Organizations would emerge to aggregate and connect the state s providers to the Statewide Statewide HIE Operational Plan 122

131 HIE network; this number may be refined through market outreach efforts to better understand organizations interest, willingness, and ability to be Qualified Organizations. Estimated costs will be refined as the technical approach is confirmed and an RFP process is completed in late The figure below summarizes anticipated connectivity to the Statewide HIE network by provider types and cumulative qualified organizations over four years Q1 Q2 Q3 Q4 Q1 Q2 Q3 Q4 Q1 Q2 Q3 Q4 Q1 Q2 Q3 Q4 Hospital Systems Stand-alone Hospitals Rural Health Centers FQHCs Provider Offices Qualified Organizations Figure 19: Number of Qualified Organizations, by Provider Types Statewide HIE Operational Plan 123

132 The figure below depicts the provider connectivity via Qualified Organizations summarized above as a percentage of total providers in the state over the course of the project. 8 HIE Connectivity 35% 7 30% 6 25% QOs % 15% % Connectivity 2 10% 1 5% 0 Q1 Q2 Q3 Q4 Q1 Q2 Q3 Q4 Q1 Q2 Q3 Q4 Q1 Q2 Q3 Q QOs Hospital Systems Stand-alone Hospitals Rural Health Centers FQHCs Provider Offices 0% Figure 20: HIE Connectivity Together, Figures 19 and 20 provide a cumulative view of Qualified Organization connectivity to the statewide HIO between 2011 and The model assumes that HIE connectivity will reach a peak of 65% by Using this assumption, by the second quarter of 2011, two Qualified Organizations will be connected to the statewide HIO, representing a respective percentage of hospital systems (in orange), stand-alone hospitals (dark red), rural health centers (green), FQHCs (red), and provider offices (blue). Over the course of four years, the total number of Qualified Organizations will increase to 25. This represents 30% of hospital systems, 25% of stand-alone hospitals, and 14% of provider offices. 31 Please note that this is a hypothetical scenario which is under development and is intended to illustrate anticipated connectivity to the Statewide HIO among Qualified Organizations and respective provider coverage. HIE connectivity rates will be revised and updated as this scenario continues to be refined, and alternative scenarios are developed. Various costs are associated with participation in the Statewide HIE. To create and support a self sustaining statewide HIE network, the NC HIE will need to charge Qualified Organizations for its services. Potential costs that Qualified Organizations may incur when participating in the 31 Providers associated with stand-alone hospitals and hospital systems include only those working in inpatient settings (e.g., hospitalists, anesthesiologists, etc.). Provider offices encompass outpatient providers that don t work in any of the above settings. Statewide HIE Operational Plan 124

133 Statewide HIE network include: connectivity costs; participation fees; and costs to access valueadded services. The Finance Workgroup considered two ranges of cost assumptions when designing the finance model a low band and a high band. The cost assumptions were informed by RFIs and RFPs from other states regarding statewide HIE services as well as general industry knowledge. Using average vendor cost estimates, the Finance Workgroup estimates that, after initial startup costs, the NC HIE will have an annual operating budget between $2M and $5.5M. These figures are working estimates only and will need to be continuously evaluated and adjusted based on vendor pricing and market rates Revenue Mechanisms The Workgroup considered several mechanisms for ongoing revenue including: assessment(s); membership or subscription fees; usage fees; and cost sharing. Each of the mechanisms is described briefly below, along with the Workgroup s overall conclusion relative to the applicability and likelihood of success in the North Carolina marketplace. Assessment(s): An assessment or tax has been applied successfully to support HIE in limited markets (e.g. Vermont), and widely in non-healthcare related matters (e.g. sin taxes). The Workgroup felt that an assessment may be a necessary means to support the development of statewide HIE and discussed several innovative types of assessments (e.g. assessment on certificate of need). The Workgroup concluded that if implemented the assessment should be directly related to HIE and those benefiting from the exchange. Membership and Subscription Fees: Membership and subscription fees are common in today s society and are relatively easy to understand and administer. An upfront fee is often charged upon application or implementation, and an ongoing subscription fee may be charged on a regular basis (e.g. annual or monthly). Payments may vary based on organization type and size, promoting an equitable distribution of costs across the spectrum of users. The Workgroup favored this revenue mechanism for purposes of funding statewide HIE. Usage Fees: Usage fees are typically based on the amount and type of information being exchanged; in the health care marketplace it is often feared that this revenue mechanism will ultimately discourage participation in HIE, especially at the outset when physicians are only beginning to realize the system s value. The Workgroup felt that a usage fee would likely stifle adoption at the outset of the network s development, having a negative impact on the ability to develop and offer services broadly. Accordingly, this may be considered in the future as a means to fund valueadded services. Cost Saving/Sharing: In a cost saving/sharing model, fees are charged to the stakeholders who are anticipated to be the major beneficiaries of the cost savings resulting from HIE implementation and utilization; typically these fees are levied on payers and employers. The Workgroup felt that a cost saving model would be more appropriate for consideration once a robust HIE model is in place, rather than at the outset of the HIE s development. Statewide HIE Operational Plan 125

134 Following its recommendation that a membership/subscription fee model would likely be the ideal initial revenue mechanism to support statewide HIE in North Carolina, the Workgroup identified six guiding principles for the development of membership and subscription fees in the future. Among these principles, the workgroup recommended that fees should: Be high enough to cover costs and promote sustainability, but low enough to encourage broad participation. Be directly related to the exchange of health information, health care delivery and health improvement initiatives. Avoid transaction and usage fees which may discourage use/ access to health information for treatment purposes. Be paid for by all participants and beneficiaries of health information exchange, including the state, in a fair and equitable manner. May be paid through a Qualified Organization (QO) pass-through. Support a commitment to providing services at minimal cost to FQHCs, free clinics and HPSA providers through actively identifying philanthropic organizations to offset a portion of their costs. Identify of initial charter members that are able to provide additional funding earlier in the project in exchange for longer term benefits. Support development of an evolving fee schedule for non-charter members that starts low and increases over time as value of exchange increases to encourage early adoption. The figure below depicts the flow of funds in a membership/subscription fee model between the participants (providers and facilities), Qualified Organizations, and the Statewide HIO. Facilities may include hospitals, regional HIOs, laboratories, pharmacies, etc. Statewide HIE Operational Plan 126

135 9.7. Approach to Sustainability Figure 21: Flow of Funds The Finance Workgroup and the NC HIE recognize that sustainability is critical to the success of statewide HIE, and ONC has also and on many occasions addressed the importance of sustainability to statewide HIE planning. Therefore, the NC HIE is committed to continuing activities beyond the current Workgroup to ensure the development of a sustainability plan by mid-2011 as required under the State HIE Cooperative Agreement Program. The NC HIE and its stakeholders recognize that sustainability planning is much like unchartered territory and will present a challenge in the months ahead. The NC HIE plans to leverage available federal and state resources and to build upon the learnings of other state and local HIE initiatives that have endeavored on a similar path Controls and Reporting As a recipient under the State HIE Cooperative Agreement Program, NC HIE will be responsible for compliance with ARRA reporting requirements and the implementation of financial policies, procedures, and controls. As a recipient under the State HIE Cooperative Agreement Program, NC HIE will be responsible for compliance with ARRA reporting requirements and the implementation of financial policies, procedures, and controls. The NC HIE will work with the North Carolina HWTF and the State of North Carolina Office of Economic Recovery and Investment (OERI) to submit progress and spending reports specific to the State HIE Cooperative Agreement grant money as required by ONC. The team is familiar with relevant OMB Circulars A-21, A-87, A-122, and A-133, as well as with ONC recipient roles and reporting responsibilities. The team will work collaboratively with ONC Statewide HIE Operational Plan 127

136 and the NC HIE to ensure proper accounting of allowable expenditures, direct and indirect costs, and program income. There will be processes and protocols in place, as there are with other ARRA-funded projects in North Carolina, to ensure all reporting is done in a timely manner. The NC HIE is expected to enter into a contract with the state upon approval of the Operational Plan to administer federal HITECH funds. The Board will develop and approve an interim budget or spend plan of funds it anticipates receiving from the state or from other sources. Also, the Board should consider and may find it advisable to proceed with contracts for specific critical business functions (i.e. payroll) in advance of hiring a President and other professional staff. The Board with work with the state in setting interim financial procedures with sound internal controls. The NC HIE CEO will advise the Board on the adoption of personnel policies governing compensation, leave and benefits, conflicts of interest, nondiscrimination, etc. After hiring the professional who will serve as the NC HIE s comptroller, the CEO and comptroller will establish financial policies and procedures concerning receipts and accounts receivable, disbursements and accounts payable, fixed assets, purchasing, payroll, budget, cost allocation and reporting. The NC HIE will work with the state to ensure the NC HIE s financial policies adequately address requirements of entities receiving federal funds (e.g., contractor debarment, lobbying, whistleblower protections, etc.). These procedures will form the NC HIE s Internal Control Plan, which will ensure that fiscal responsibilities are appropriately segregated and monitored and that financial transactions are properly documented, reconciled and reported in accordance with Generally Accepted Accounting Principles (GAAP). The state, through the HWTF and the OERI, will help ensure the NC HIE s accounting systems satisfy audit and reporting requirements for subrecipients of federal funds. The Board will incorporate levels of compliance management which extend beyond normal practices, including separate accounting for use of Recovery funds, ensuring higher levels of competitive procurement, record keeping during the project, and avoidance of fraud and waste. OERI Management Directives will serve as the guide for stewardship efforts. Special emphasis will apply to: No comingling of ARRA funds with other funds. Resolving outstanding audit questions. New competitive bids to the maximum extent possible. Posting positions with Employment Security Commission and requiring contractors to do the same. Employing best efforts to notify Historically Underutilized Businesses (HUB) of the opportunity to participate. The Board will submit reports required under Section 1512 of the ARRA, providing information on projects and activities. These reports will provide the public with transparency and accountability on how funds are spent. Statewide HIE Operational Plan 128

137 Prior to the end of the its first fiscal year, the Board will need to secure the services of an independent CPA firm to review and comment on the NC HIE s Internal Control Plan, audit the its financial statements and records, and audit the NC HIE s use of federal HITECH funds in accordance with requirements of OMB Circular A-133. This firm could also prepare the entity s required IRS filing (Form 990) Next Steps As described above, the NC HIE recognizes that the development of a financial model and approach to sustainability are only the beginning of much work that lies ahead. Following the approval of North Carolina s Strategic and Operational Plans and the release of implementation funding, the NC HIE will continue the efforts of the Finance Workgroup to more closely evaluate financing and revenue mechanisms as the technology approach is solidified and an RFP process is initiated. A sustainability model will also be discussed in the coming months. The NC HIE plans to address in greater detail: Funding mechanisms, both upfront and ongoing, as well as pricing to sustain core infrastructure and services that is acceptable to the marketplace; Procedures and protocols necessary to satisfy compliance with ARRA and state reporting requirements; and Financing model and approach to sustainability. In addition there will be annual reporting requirements and budget updates that the NC HIE will need to address. It is anticipated that the organization will hire staff and institute a committee to oversee the organization s finances and ensure proper reporting protocols are in place. Statewide HIE Operational Plan 129

138 O.10. COORDINATION Overview The NC HIE is committed to a spirit of collaboration and fostering coordination among the many stakeholders and organizations undertaking health IT and HIE projects in the state. In particular, the NC HIE intends to support collaboration with Medicaid, public health and relevant ARRA programs and, as infrastructure develops, border states with a goal of sharing resources where applicable to maximize impact and avoid duplication of efforts and waste. There are multiple well established entities and stakeholder organizations in North Carolina actively committed to supporting the NC HIE and its efforts to collaborate with state and federal programs by facilitating information sharing and relationship building including, among others: Area Health Education Centers of North Carolina (serves as the state s Regional Extension Center) Mental Health Association of North Carolina Microelectronic Center of North Carolina (MCNC) North Carolina Medical Society North Carolina Nurses Association North Carolina Hospital Association North Carolina Association of Local Health Directors North Carolina Health Quality Alliance North Carolina Center for Public Health Quality North Carolina Center for Hospital Quality and Patient Safety NCHICA North Carolina Department of Health and Human Resources: Division of Public Health; Division of Medical Assistance (Medicaid); Division of Mental Health, Developmental Disabilities, and Substance Abuse Services; Division of Rural Health and Community Care; Office of the Secretary Regional Health Information Exchanges: Western NC Datalink, Coastal Carolinas, NCHEX and others Academic Medical Centers: Duke University Health System, University Health Systems of East Carolina, University of North Carolina Health System, Wake Forest University Health Sciences Hospital Systems: Carolinas Healthcare System, Mission Health Systems, Moses H. Cone Memorial Hospital, and Wake Med Health and Hospitals Statewide HIE Operational Plan 130

139 Healthcare Payers: State Health Plan, Blue Cross Blue Shield of North Carolina State Health IT Coordinator The State Health IT Coordinator plays an essential role in coordinating and aligning health IT and HIE efforts across the state, including Medicaid and Public Health. North Carolina DHHS Secretary Lanier Cansler established and Office of Health Information Technology and the new position of Assistant Secretary for Health Information Technology. Dr. Steve Cline accepted the position to lead the Office of Health Information Technology effective June 1, Dr. Cline was formerly the Deputy State Health Director in the North Carolina Division of Public Health. He comes to this position with more than 26 years of state and local pubic health experience. In addition, Dr. Cline served as the Chair of the Governor s Health Information Technology Strategic Planning Task Force in the spring of The goal of the North Carolina Health Information Technology Program is to facilitate the development of statewide interoperable health information systems that will ultimately improve health and healthcare in North Carolina. Better use of health IT is critical to the success of those in need of health care. Dr. Cline is charged with coordinating health IT efforts across state government and other key stakeholders across the state, as well as ensuring consistency with federal policy and initiatives. Examples of health IT efforts that the Office of Health Information Technology will be addressing include: Sharing of clinical data between healthcare providers involved in the care of an individual patients. Assuring the privacy and security of personal health information. Coordinating planning and implementation of state level health information exchanges, including Medicaid, that enable healthcare providers to achieve meaningful use of EHRs. Promoting EHR adoption toward the goal of every person having an EHR by Establishing public health reporting of health information for the purpose of improving population health. Improving the quality and efficiency of healthcare delivery. Facilitating strategic planning to guide the development of health IT statewide. Statewide HIE Operational Plan 131

140 Stakeholder Communication Figure 22: Office of Health Information Technology The North Carolina Office of the Health Information Technology is dedicated to helping North Carolina achieve its full potential in regards to health IT through collaboration and innovation. In order to advance its goals to accelerate health IT adoption in the state, the NC Office of Health Information Technology believes that open and transparent communication is crucial and has launched a one-stop website ( providing information on and tracking of all the ARRA-funded and other health IT projects in the state, including: Beacon Community Broadband Access Initiative Community College Consortia to Educate Health IT Professionals Program / Curriculum Development Centers Program Comparative Effectiveness Research Health Information Technology Loan Program Statewide HIE Operational Plan 132

141 Medicaid Meaningful Use Incentive Program State Medicaid Health Information Technology Plan NC HIE NC Telehealth Network Regional Extension Center In addition, the Assistant Secretary for Health Information Technology produces a quarterly report on health IT efforts in the state to the NC legislature. The most recent report can be accessed at Medicaid & Public Health Medicaid The NC HIE is committed to coordinating and integrating efforts with the NC Medicaid program, particularly as it relates to planning and implementation of the state s incentive program for the meaningful use of certified EHR technology. Approximately 18% of North Carolina s residents are currently Medicaid beneficiaries and Medicaid coverage is expected to increase under health care reform. Both the NC HIE and NC Medicaid understand the critical importance of connecting providers who care for Medicaid beneficiaries to EHR technologies and facilitating their ready access to more robust sets of health information through HIE. In order to ensure that the two programs are closely aligned, the Secretary of DHHS has been named a co-chair of the NC HIE Board and NC Medicaid Director Dr. Craigan Gray has been appointed as an ex-officio board member and serves as a member of the NC HIE Governance Workgroup. Additionally, NC Medicaid Chief Business Operations Officer Steve Owen is a member of the NC HIE Finance Workgroup and Curt Martin, Privacy Officer with the Division of Medical Assistance, is a member of the Legal/Policy Workgroup. In particular, the NC HIE has identified the following Medicaid-sponsored or supported initiatives as key opportunities for synergy: State Medicaid HIT Plan (SMHP) The NC Office of Medicaid Management Information Systems Services (OMMISS) is leading the creation of the State Medicaid HIT Plan (SMHP), in collaboration with the Department of Medical Assistance (DMA), the HWTF, the NC HIE, the Health Information Technology Regional Extension Center (REC) and other stakeholders. Medicaid Incentive Payment System (MIPS) The NC Medicaid is operating under a Planning-Advance Planning Document grant from the CMS to plan and implement a system to pay eligible providers and hospitals for successfully adopting, implementing, or upgrading EHRs in their practice. To be eligible for the full incentive payment they must demonstrate meaningful use of EHRs over the next 4-10 years. NC Medicaid was selected to be the first state in the nation to build and test the necessary interfaces with the National Level Repository (NLR) at CMS. Statewide HIE Operational Plan 133

142 Public Health Every state and every provider who will receive incentive payments will be required to register with the NLR. Community Care of North Carolina Under the Community Care program, North Carolina is building community health networks that are organized and operated by community physicians, hospitals, health departments and departments of social services. Fourteen networks with more than 1,380 practices across North Carolina are working with their local health departments, hospitals, and social service agencies to better manage the care of 970,558 Medicaid and NCHC Enrollees. The program is sponsored by the Office of the Secretary, the Division of Medical Assistance and the N.C. Foundation for Advanced Health Programs, Inc. Program direction, administration and technical assistance is provided by the Office of Rural Health and Community Care. North Carolina Community Care Networks, Inc. The private non-profit arm of the Community Care of North Carolina enhanced medical home model Medicaid program. NCCCN is operating an Informatics Center to collect and report valuable health information to improve the quality and to control costs for NC Medicaid. Developing opportunities to support public health is a fundamental goal of the NC HIE. The NC HIE evaluated the state s public health IT resources as part of its environmental scan (see NC HIE Strategic Plan) and as the NC HIE develops its core and value added service structure over the coming months, it will work with the Secretary of DHHS and the State Health IT Coordinator to meet with public health leaders and map out a strategy to coordinate and align HIE, data access and public health reporting efforts. Members of state public health agencies and those who represent the needs of underserved populations play an active role in the NC HIE collaborative workgroup and governance process: Clinical & Technical Operations Workgroup Dr. Allen Dobson (Board member and Workgroup co-chair) Community Care of NC Angela Taylor, NC DHHS Division of Information Resource Management John Graham, UNC Institute for Public Health Finance Workgroup Steve Owen, NC Medicaid Dr. Phred Pilkington, Public Health Authority of Cabarrus County Dr. Brian Harris, Rural Health Group Mark Bell, NC Hospital Association (NCHESS emergency surveillance program) Governance Workgroup Ben Money, (Board member and Workgroup co-chair) NC Community Health Center Association Craigan Gray, NC Medicaid Legal/Policy Workgroup Linda Attarian (co-chair), Office of Health Information Technology, NC DHHS Kim D Arruda, NC Department of Justice Chris Hoke, NC DHHS Division of Public Health Statewide HIE Operational Plan 134

143 Chris Huwe, NC Community Care Network Dr. Warren Newton (Board member), NC Health Quality Alliance Curt Martin, NC DHHS Division of Medical Assistance Ann Shotton, NC Community Care Network Dr. Troy Trygstad, Community Care of NC Chris Wilson, NC Department of Justice Ongoing communication between the NC HIE and public health is further supported by the DHHS Health IT Workgroup. Founded by the Secretary of DHHS to coordinate the Department s work around health IT and to collaborate with the NC HIE Workgroups, the DHHS HIT Workgroup includes: Members: Dr. Steve Cline, Assistant Secretary for Health Information Technology, Chair Sandra Trivett, Office of the Secretary (OSP) Jim Hazelrigs, Division of Medical Assistance (DMA) Michael Bacon, Division of Medical Assistance (DMA) Dr. Annette DuBard, Community Care of North Carolina (CCNC) Angie Sligh, Office of Medicaid Management Information System (OMMIS) Gary Imes, Division of Mental Health and Substance Abuse Services (DMSSAS) Matt Womble, Office of Rural Health and Community Care (ORHCC) Linda Attarian, Office of Health Information Technology, NC DHHS Jim Williams, Office of the Secretary, (OSP) Affiliated: Anita Massey, NC Health and Wellness Trust Fund (HWTF) and Project Manager NC HIE Alan Hirsch, Interim CEO, NC HIE Holt Anderson, NC Healthcare Information and Communications Alliance (NCHICA) Andrew Weniger, NC Healthcare Information and Communications Alliance (NCHICA) Ex Officio: Lanier Cansler, Secretary, DHHS Allen Feezor, Deputy Secretary DHHS Dr. Craigan Gray, Director, DHHS, Division of Medical Assistance In addition, the Division of Public Health has formed a Public Health Information Technology Steering Committee (PHITSC). The PHITSC was established jointly by the State Health Director and by the president of the North Carolina Association of Local Health Directors to represent North Carolina s public health agencies with regards to HITECH activities. It is composed of co-chairs from the Division of Public Health and from the NC Association of Local Health Directors, four representatives from the Division, and four local health directors. The PHITSC also has established a workgroup that staffs its work. The PHITSC workgroup is working actively with state-level HITECH lead organizations, including the Office of Health Information Technology, to assure public health s participation in the larger statewide health IT initiatives and proposal development. Statewide HIE Operational Plan 135

144 10.4. ARRA Programs Regional Extension Center The NC Area Health Education Centers (AHEC) Program at the University of North Carolina, Chapel Hill received a notice of grant award dated February 8, 2010 to perform the function of the North Carolina Regional Extension Center (NC REC) for health IT. The award was for $13.6 million dollars over 2 years which will allow NC AHEC to reach at least 3,465 priority primary care physicians and assist with practice assessment, workflow redesign, selection and implementation of electronic health records (EHR) to achieve meaningful use of the technology and improve health outcomes throughout the state of North Carolina. NC AHEC will expand its consulting workforce throughout the nine regions of the state to help practices implement technology and/or use previously existing technology to meet the federal standards of meaningful use to achieve incentive payments from the Centers for Medicare & Medicaid Services between 2011 and NC AHEC is working closely with the NC HIE, the Beacon Communities grant at Southern Piedmont Community Care Plan and the Division of Medical Assistance to help ensure that the efforts of the Regional Extension Center are aligned with all health IT initiatives in the state, and has launched a website to allow practices to apply for these services online at Involvement in the NC HIE AHEC Program Director Dr. Tom Bacon serves as co-chair of the NC HIE Governance Workgroup and Dr. Sam Cykert, Associate Professor of Medicine at UNC and Program Director for Internal Medicine at Moses Cone Hospital and Greensboro AHEC, is an NC HIE Board member and serves on the Clinical & Technical Operations Workgroup. Ann Lefebvre, AHEC Associate Director for Statewide Quality Improvement and Executive Director for the REC as served as a strong partner for the NC HIE operational planning process and will continue to work with the NC HIE as both programs move into implementation. Beacon Community Program The Southern Piedmont Community Care Plan (SPCCP) was selected by the ONC Beacon Community Program as one of the 15 award recipients and will receive more than $15 million to build and strengthen health IT infrastructure and HIE capabilities in its area of operation to enhance quality of patient care and cost efficiency. SPCCP will incorporate health IT to advance community level care coordination in areas including hypertension, diabetes, blood pressure control, asthma, medication reconciliation, non-emergent ED visits and preventable readmissions. The SPCCP collaborated with nearly 400 health care providers within the community to establish priorities as a Beacon Community. The group considered priorities identified by recent public community health assessments for the three counties (Cabarrus, Rowan, and Stanly), the goals of the North Carolina Community Care Network s (NCCCN) Medicare Modernization Act 646 program, other SPCCP initiatives such as asthma management, alignment with meaningful use objectives, and alignment with the State HIE and regional extension center plans. Statewide HIE Operational Plan 136

145 Involvement in the NC HIE Dr. Phred Pilkington, Public Health Authority of Cabarrus County and Board Chair of the SPCCP also serves on the NC HIE Finance Workgroup and Kevin McNeice, Southern Piedmont Beacon Community Steering Committee Chair, serves on the NC HIE Clinical and Technical Operations Workgroup. The NC HIE has met with and is committed to continuing to work with the SPCCP Beacon Community to identify opportunities for collaboration and to leverage shared resources as both entities finalize plans and move forward with implementation. Broadband Access MCNC is a non-profit organization incubated by the State of North Carolina General Assembly in One of MCNCs main activities is to operate the North Carolina Research and Education Network (NCREN). NCREN provides broadband communications technology services and support to all 115 K-12 school districts, 20 of 58 North Carolina Community Colleges, all University of North Carolina system institutions, 24 of 36 of North Carolina s Private Colleges and Universities and public health facilities across the state. On January 20, 2010, the NTIA announced that MCNC had been awarded $28.2M (BTOP infrastructure) in middle mile broadband recovery funds. MCNC s funded proposal includes the construction of 500 new miles of fiber in 37 counties in the rural southeastern and western part of the state. Both MCNC and the NC HIE recognize the value and import of broadband access by providers to support more widespread EHR adoption and the advancement of HIE efforts and will explore opportunities for collaboration. Workforce Development Community College Consortia to Educate Health IT Professionals Program In March 2010, Pitt Community College was named one of five institutions across the country to lead a regional consortium of community colleges to train thousands of new health IT professionals. The PCC led consortium received a $10.9 million cooperative agreement from the U.S. Department of HHS for the first year. Additional funding, to bring the total award to over $21.1 million is available for a second year after successful completion of a mid-project evaluation. The grant provides assistance for PCC to set up the consortium of 21 community colleges, including Central Piedmont Community College and Catawba Valley Community College, across a 13-state region that stretches through the southeast to New Mexico and includes almost one-third of the nation's population. Each community college will create non-degree training programs designed to be completed in six months or less. Health IT professionals, among other capabilities, support the implementation and maintenance of EHRs that make information exchanges possible between health care providers and public health authorities and thereby improve the quality and efficiency of medical care. Training is expected to begin by September 30, 2010 in six health/it priority workforce roles, including: practice workflow and information management redesign specialists; clinician/practitioner consultants; implementation support specialists; implementation managers; and technical/software support staff and trainers. Statewide HIE Operational Plan 137

146 University-Based Training Program Duke University and the University of North Carolina have partnered to develop a program that will produce trained professionals for vital, highly specialized health IT roles. Trainees in this program will complete intensive courses in 12 months or less and receive a Management Masters in Clinical Informatics, awarded by the Duke Fuqua School of Business, or a postmasters certificate awarded by the Duke School of Nursing. Plans are underway to offer a broader certificate program. Other trainees supported by these grants will receive masters degrees requiring up to two years of education and the completion of a thesis or equivalent research project on a health IT topic. The UBT award is shared with the University of North Carolina. The focus of the training at UNC is in the Department of Public Health and the Department of Information and Library Science. Together, Duke and UNC will train 83 one-year students and 9 two-year students. Students will be able to enroll in the new programs immediately for the fall semester. Curriculum Development Centers Program Duke University s Center for Health Informatics (DCHI) won a grant to develop curriculum materials to be used by community colleges throughout the United States. Duke will work with Durham Technical Community College, Pitt Community College, and Rowan-Cabarrus Community College to develop four curriculum components: Health Management Information Systems Installation and Maintenance of Health IT Systems Networking and HIE Fundamentals of Health Workflow Process Analysis and Redesign Several NC HIE board members and Workgroup participants are involved with the ARRArelated workforce development programs and the State Health IT Coordinator meets regularly with all health IT-related ARRA recipients. The Office of Health Information Technology will maintain responsibility for regularly convening key stakeholders and the NC HIE will explore opportunities to partner with these organizations both in terms of job creation and training resources Federal Care Delivery Networks The VA Mid-Atlantic Health Care Network (VISN 6), one of 21 Veterans Integrated Service Networks (VISNs) is based in Durham, NC. Of VISN 6 s eight VA Medical Centers, four are located in North Carolina as well as four VA outpatient clinics and eight VA community-based outpatient clinics. Over the next two years, VISN 6 will add four additional outpatient sites of care in the state of North Carolina and greatly expand outpatient services to veterans in the Charlotte, Winston- Salem, and Fayetteville, NC areas. The NC HIE will explore opportunities to collaborate with VISN 6 and its North Carolina-based health care facilities. In addition, the NC HIE plans to monitor and learn from a current NHIN Gateway pilot project designed to enable clinical data exchange between the Western North Statewide HIE Operational Plan 138

147 Carolina Health Network (WNCHN), in partnership with NCHICA, and the Asheville VA Medical Center. WNCHN is a collaboration of 16 hospitals and founder of Western North Carolina (WNC) Data Link. WNC Data Link connects WNCHN hospitals by allowing authorized physicians and clinicians to view electronic patient records across all WNCHN hospital systems. Due to their close proximity to one another, the Asheville VA Medical Center and WNCHN hospitals share significant patient overlap in one 12-month period, there were 1,913 veteran visits to a WNCHN hospital. NCHICA is starting the process of NHIN Onboarding, whereby an organization must pass conformance and interoperability testing to be granted NHIN membership. The NHIN Gateway is expected to be in production by late summer Other States North Carolina borders four states: Virginia, Tennessee, Georgia and South Carolina. It shares significant medical trading areas on the border of Virginia and South Carolina. As North Carolina develops its health data exchange policies and technical services, it will consider alignment opportunities with neighboring states driven by: Data exchanges that naturally flow across state borders; Opportunities for shared HIE infrastructure design and development; Cross-border provider Medicaid incentive determinations; and Approaches to provider adoption of EHRs. North Carolina supports and has valued from partnering with other states around health information technology and exchange. Most recently: In April 2010, the States of Tennessee and Alabama formed the Southeast Regional Health IT-HIE Collaboration ( SERCH ) to serve as a forum for discussion among bordering states. Along with Alabama and North Carolina, participation includes Arkansas, Florida, Georgia, Kentucky, Louisiana, Mississippi, South Carolina, Tennessee and Virginia. Through SERCH, representatives from each state s Medicaid Agency, State Health IT Offices, and RECs participate in weekly conference calls to discuss topics which the group determines to be of critical importance for advancing HIE and health IT. In June 2010, North Carolina participated in a multi-state collaborative (Alabama, California, Colorado, Georgia, Maine, Missouri, New York, North Carolina, South Carolina and Tennessee) that developed and released a RFI from vendors regarding enterprise medication management services. North Carolina is a member of the Statewide HIE Coalition. Through NCHICA, North Carolina has also participated in Health Information Security and Privacy Collaborative and NHIN activities. Statewide HIE Operational Plan 139

148 As with other points of coordination, the NC HIE recognizes that collaborative activities occur most effectively when supported. Therefore, the State Health IT Coordinator will serve as the main point of collaboration between North Carolina and its neighboring states. Statewide HIE Operational Plan 140

149 O.11. RISK ASSESSMENT Description of Risk Probability Impact Prevention/Mitigation Strategies Legal restraints on the exchange of protected health information for treatment purposes High High NC has developed a two pathway approach for consent model. The NC HIE with its stakeholder partners will work with the state legislature to recommend statutory changes that clarify and streamline consent issues wherever possible. The NC HIE will pursue a series of technical corrections and other approaches should a change in law not be possible in a timely manner. Implementation costs too high High High Given limited resources, the NC HIE engaged in a structured stakeholder-led process to prioritize services and is also carefully evaluating cost and value. The NC HIE will also establish a competitive bidding process. Implementation delays / Cost overruns Insufficient funding to ensure future sustainability Stakeholder willingness to pay participation fees Moderate High The NC HIE will adopt an incremental, phased approach to designing and building the Statewide HIE. Implementation will be rigorously and continually evaluated to identify problems and remediate potential problems, and the NC HIE stakeholders will be continuously informed of status. High Moderate Funding for even basic infrastructure and establishment of a public instrumentality exceeds Federal award and available state funding. Therefore sustainability model will depend heavily on outside sources of revenue or funding. The NC HIE will develop strategies for securing outside funding sources and contributions and evaluate revenue generation models to determine alternate sources of revenue. High Moderate It is incumbent on the NC HIE and its stakeholder workgroups to create a service offering (or suite of service offerings) that provides value to its participants and to continue to work with all types of participants to build a public utility. Statewide HIE Operational Plan 141

150 Description of Risk Probability Impact Prevention/Mitigation Strategies Too few Qualified Organizations with technical capability to connect into HIE Lack of provider use / lack of provider participation Moderate Moderate The NC HIE will identify initial Qualified Organizations to participate in a pilot and work with those Qualified Organizations to refine requirements. Further, the NC HIE plans to establish a Qualified Organization user group or workgroup to inform the continuing operations of the NC HIE. Moderate High The NC HIE will develop a plan utilizing stakeholder representatives to educate providers on value proposition and to garner support. The NC HIE will partner with the REC where possible and is also exploring offering a web-based portal as an alternate pathway for physicians to connect into the HIE. Low EHR adoption rates Moderate Moderate The adoption of EHRs by providers is an important component of the success of any HIE. In North Carolina, provider adoption of EHRs has been steadily increasing and the NC HIE is working in partnership with several entities supporting the more widespread adoption of EHRs, including the REC and Medicaid, and will work in close collaboration with regional HIOs as the Statewide HIE develops. Lack of consumer trust Moderate High Consumer education efforts can help consumers better understand the benefits of HIE, how health information exchanges protect health information, and health information privacy rights. The NC HIE will convene a Consumer Advisory Council to develop a consumer communication and engagement plan. Security breaches High High Security breaches could undermine consumer and provider confidence and trust in the HIE. The NC HIE is developing extensive privacy and security policies and technology requirements with broad stakeholder representation. Statewide HIE Operational Plan 142

151 Description of Risk Probability Impact Prevention/Mitigation Strategies Lack of consensus or agreement on key/crux issues Moderate Moderate The NC HIE has adopted an open and transparent, consensus-based recommendation and decision process. In cases where consensus cannot be met, all sides of an issue and the differing viewpoints are to be clearly laid out for the NC HIE Board of Directors. Loss of stakeholder support Moderate High Strong stakeholder engagement and continuing support is critical to the success of the HIE. The NC HIE has adopted an open, transparent decision-making process and established a multidisciplinary stakeholder governing board supported by stakeholder workgroups. The NC HIE is committed to continuing to evaluate and establish strategies that will allow all who wish to participate a way to do so. Challenge of HIE across state lines High Moderate Interstate exchange of health information remains a challenge for all states. North Carolina is participating in two multi-state collaboratives to share best practices and facilitate learning and collaboration. Regional efforts in the state centered on cross-border medical trading areas provide another source of learning and pilot opportunity. The establishment of a NC Office of Health Information Technology provides a lead for coordinating efforts. Statewide HIE Operational Plan 143

152 O.12. PROJECT MANAGEMENT PLAN Governance Task Activities Start Date End Date Adopt Bylaws Draft and adopt bylaws, with the assistance of legal 9/1/ /31/2010 counsel Conduct an Executive Search Draft job description 8/15/2010 9/1/2010 Identify and engage executive recruiting firm 8/15/2010 9/15/2010 Identify, interview and evaluate candidates 9/15/ /31/2010 Conduct Key Staff Search Conduct key staff search 11/1/2010 1/31/2011 Develop Contract for the State and the NC HIE Draft and enter into contract with State, with the assistance of legal counsel 9/1/2010 9/30/2010 Develop Plan for Transition into Next Phase of NC HIE Work Develop Participation Agreement Appoint Consumer Advisory Council Develop Stakeholder Engagement & Communication Plan Establish Clear and Measurable Goals for the NC HIE Develop ARRA, Federal and State Program Coordination Strategy Evaluate Governance Structure Update Operational Plan Reconvene NC HIE Workgroups 9/15/2010 9/30/2011 Convene advisory councils or additional workgroups, 10/1/2010 9/30/2011 as necessary Further define requirements of Qualified 9/1/ /31/2010 Organizations Draft a participation agreement, with the assistance 11/1/2010 1/15/2011 of legal counsel Identify and evaluate nominees 9/1/ /15/2010 Work with Board to appoint members to the Council 10/15/ /15/2010 Provide guidance and input into the development of 11/15/2010 3/31/2011 a stakeholder engagement and communication plan Establish clear and measurable goals for the NC 11/1/2010 1/31/2011 HIE Develop a formal evaluation process to evaluate and 1/31/2011 3/31/2011 document progress against those goals Identify and develop mechanisms for continued Ongoing coordination with Medicaid, other relevant state agencies (e.g. Division of Public Health), the North Carolina Regional Extension Center, and other federally-funded state programs Evaluate staff and support needs to meet NC HIE goals and milestones Update Operational Plan on an annual basis for submission to ONC Ongoing Ongoing 12/31/2014 Technical/Clinical Operations Task Activities Start Date End Date Coordinate with Medicaid, state services Schedule and arrange reoccurring meetings with technical representatives from NC Medicaid, State Health IT Coordinator staff, and NC HIE. 8/23/2010 Ongoing Develop Interstate, NHIN Plan Detailed Design for Statewide HIE Review opportunities to participate in NHIN Direct and Exchange activities. Identify core team to draft detailed statewide HIE design specifications Conduct needs assessment of stakeholders (HIOs, hospitals, state agencies, payers, candidate Qualified Organizations, etc) 8/23/2010 Ongoing 9/1/2010 9/15/2010 9/17/2010 9/27/2010 Statewide HIE Operational Plan 144

153 Detailed Implementation Plan for Statewide HIE Request for Proposal for Core Infrastructure and Services Core Infrastructure and Services Vendor Contract Identify Qualified Organization Pilot Sites Phase 1 Implementation of Core Infrastructure and Services Additional Connectivity to Core Infrastructure and Services Phase 1 Value-Added Service Planning Phase 1 Implementation of Value- Added Services Develop Design Document Version 1.0 for review 9/27/ /15/2010 and approval by NC HIE Identify core team to draft implementation plan 9/1/2010 9/15/2010 Review implementation models from comparable states; 9/17/2010 9/27/2010 Develop Design Document Version 1.0 for review 9/17/ /15/2010 and approval by NC HIE that includes criteria for pilot sites; identifies entities and responsibilities for implementation oversight and support; defines timelines, deliverables, dependencies and risks. Identify core team for development of RFP 9/17/2010 9/27/2010 Develop technical requirements for Core Services 10/15/ /31/2010 Develop detailed review process and procedures for 10/15/ /31/2010 RFP Review and vendor selection Write RFP 11/1/ /15/2010 Release RFP 11/15/ /15/2010 Deadline for RFP Responses 12/15/ /15/2010 Review, negotiate, select and award contract for 12/15/2010 2/1/2011 Statewide HIE Core Services Using criteria from implementation plan, identify 10/15/ /30/2010 candidate Qualified Organization pilot sites; develop selection criteria and process Negotiate policies and contractual requirements with candidate sites 11/15/ /30/2010 Select candidate pilot sites 1/15/2011 1/15/2011 Obtain network participation agreement from pilot 2/15/2011 2/28/2011 sites Finalize interface requirements at pilot sites; develop 2/15/2011 2/28/2011 interfaces Install necessary hardware and software 3/1/2011 5/1/2011 Train users; Go Live 5/1/2011 6/1/2011 Obtain network participation agreement from pilot 7/1/2011 Ongoing sites Finalize interface requirements at pilot sites; develop 8/1/2011 Ongoing interfaces Install necessary hardware and software 9/1/2011 Ongoing Train users; Go Live 12/1/2011 Ongoing Identify core team for development of RFP 2/1/2011 2/15/2011 Develop technical requirements for Candidate 2/15/2011 2/28/2011 Value-Added Services Develop detailed review process and procedures for 2/15/2011 2/28/2011 RFP Review and vendor selection Write RFP 3/1/2011 3/15/2011 Release RFP 3/15/2011 3/15/2011 Deadline for RFP Responses 4/15/2011 4/15/2011 Review, negotiate, select and award contract for 4/15/2011 6/1/2011 Value-Added Services Obtain network participation agreement from pilot 6/15/2011 6/30/2011 sites Statewide HIE Operational Plan 145

154 Phase 2 Implementation Additional Value-Added Services Finalize interface requirements at pilot sites; develop 7/15/2011 7/28/2011 interfaces Install necessary hardware and software 8/1/2011 9/1/2011 Train users; Go Live 10/1/ /1/2011 Develop technical requirements for Candidate 6/15/2012 6/28/2012 Value-Added Services Develop detailed review process and procedures for 6/15/2012 6/28/2012 RFP Review and vendor selection Write RFP 7/1/2012 7/15/2012 Release RFP 7/15/2012 7/15/2012 Deadline for RFP Responses 8/15/2012 8/15/2012 Review, negotiate, select and award contract for 8/15/ /1/2012 Value-Added Services Legal/Policy Task Activities Start Date End Date Address Outstanding Issues Related to Pathway One 9/15/10 10/31/10 Address Outstanding Issues Related to Pathway Two Develop Plan to Pursue Pathway Two Pursue Technical Corrections to support Pathway One Draft Privacy and Security Policies Develop Consent Form Develop Patient Education Materials Facilitate Necessary Updates to the NHIN DURSA Develop Security Policies For Pathway One, address consent model for uses other than treatment purposes, as well as other privacy/security issues (e.g., emergency access to data, minors' consent, durability and revocability of consent) For Pathway Two, address privacy/security issues related to emergency access to data, minors' consent, etc.) Specify precise changes to statute necessary to implement Pathway Two 9/15/10 10/31/10 11/1/10 2/28/11 Identify opportunities for technical corrections in 11/1/10 2/28/11 parallel with Pathway Two legislative change efforts; pursuit of technical corrections dependent on legislative path Develop specific and detailed privacy and security policy and procedures 1/1/11 3/31/11 Review with counsel from participating Qualified 4/1/11 4/30/11 Organizations Develop Consent Form, with assistance of legal 4/1/11 5/31/11 counsel Coordinate with Consumer Advisory Council to 4/1/11 6/30/11 develop, test and widely distribute patient education materials. Update the NHIN DURSA, as necessary. 1/1/11 Ongoing Draft, with counsel, written security policies in partnership with the Clinical/Technical Operations Workgroup Develop mechanism and ensure continued evaluation of privacy and security policies 1/1/11 5/31/11 Develop Mechanism for Continued Ongoing Evaluation of Privacy and Security Policies Revise policies as needed Ongoing Address Interstate HIE Privacy and Security Issues Analyze and develop strategies to remove barriers to interstate HIE privacy and security issues with border states Participate in national development of privacy and security policies and agreements (e.g. interstate compact) 12/1/10 6/30/11 Statewide HIE Operational Plan 146 Ongoing

155 Finance Task Activities Start Date End Date Funding Mechanisms Define upfront funding sources and mechanisms 9/1/ /31/2010 Define ongoing funding sources and mechanisms 9/1/ /31/2010 Determine minimum pricing to sustain initial core 9/1/ /31/2010 infrastructure and services Assess funding mechanisms and pricing 11/1/ /30/2010 Market test pricing with workgroup participants 12/1/2010 6/15/2011 Procedures and Protocols Create procedures and protocols necessary to 9/1/ /31/2010 satisfy compliance with ARRA and state reporting requirements Set up accounting procedures, protocols, signature 9/1/ /31/2010 authorities, etc. Hire staff-level accountant or procure outsource services 9/1/ /31/2010 Procure auditor 9/1/ /31/2010 Update Financial Business Model Harmonize core and value-added services timing 9/1/ /31/2010 and Sustainability Plan Harmonize connectivity assumptions based on 9/1/ /31/2010 Qualified Organizations Letter of Intent response Harmonize pricing estimates based on RFP 9/1/ /31/2010 responses Assess impact on pricing and sustainability 11/1/ /30/2010 Provide feedback on prioritization of core and valueadded services and timing 12/1/ /15/2010 Finalize 2010 Financial Business Model and 12/15/ /31/2010 Sustainability Plan Finalize Financial Business Model and Sustainability Plan Harmonize core and value-added services timing with implementation progress as well as emerging priorities of Technical/Clinical Operations Workgroup 1/1/2011 6/15/2011 Annual Reporting Annual Budget Updates Harmonize connectivity assumptions based on 1/1/2011 6/15/2011 Qualified Organizations connectivity progress and roll-out plan Harmonize pricing estimates based on cost 1/1/2011 6/15/2011 modifications and accounting information Assess impacts on pricing and sustainability 1/1/2011 6/15/2011 Provide feedback on prioritization of core and valueadded services and timing 1/1/2011 6/15/2011 Finalize Financial Business Model and Sustainability 1/1/2011 6/15/2011 Plan for Submission to ONC GAAP OMB Circulars State and ONC Harmonize budget with operational plan updates Finalize annual budget Work with ONC for approval Statewide HIE Operational Plan 147

156 O.13. APPENDICES Definition of Terms American Recovery and Reinvestment Act of 2009 (ARRA): is a $787.2 billion stimulus measure, signed by President Obama on February 17, 2009, that provides aid to states and cities, funding for transportation and infrastructure projects, expansion of the Medicaid program to cover more unemployed workers, health IT funding, and personal and business tax breaks, among other provisions designed to stimulate the economy. Centers for Medicare and Medicaid Services (CMS): is a federal agency within the United States Department of Health and Human Services that administers the Medicare program and works in partnership with state governments to administer Medicaid, the State Children s Health Insurance Program (SCHIP), and health insurance portability standards. Certification Commission for Healthcare IT (CCHIT): is a recognized certification body (RCB) for electronic health records and their networks. It is an independent, voluntary, privatesector initiative, established by the American Health Information Management Association (AHIMA), the Healthcare Information and Management Systems Society (HIMSS), and The National Alliance for Health Information Technology. Consent: The Health Insurance Portability and Accountability Act Privacy Rule sets out two types of permission that are used to permit a covered entity to use or disclose protected health information: consent and authorization. A written authorization is required in certain circumstances, including for most disclosures of psychotherapy notes; to disclose health information for marketing ; and for uses and disclosures that are not otherwise required or permitted by the privacy regulation. The Privacy Rule, however, generally permits a covered entity to use and disclose protected health information without an individual s authorization for treatment, payment and health care operations, and certain other specified purposes. The Privacy Rule includes detailed requirements for the authorization form that must be used to obtain authorization when required. All authorization forms must contain certain core elements, including: A specific description of the information to be used or disclosed and the purposes of the use or disclosure; The identity of the person or class of persons authorized to make the requested use or disclosure; The identity of the person or class of persons to whom the covered entity may make the requested use or disclosure; A statement of the person s right to revoke the authorization; and The signature and date of the authorization. A general consent is permitted but not required for use or disclosure of information for treatment, payment, and health care operations. Covered entities that choose to obtain a patient s consent for use or disclosure of information for treatment, payment, and health care operations have complete discretion in designing their consent form and process. The Statewide HIE Operational Plan 148

157 regulation does not define the term consent and does not specify any requirements for the content of consent forms. Electronic Health Record (EHR): As defined in the ARRA, an Electronic Health Record (EHR) means an electronic record of health-related information on an individual that includes patient demographic and clinical health information, such as medical histories and problem lists; and has the capacity to provide clinical decision support; to support physician order entry; to capture and query information relevant to health care quality; and to exchange electronic health information with, and integrate such information from other sources. Electronic Prescribing (E-Prescribing): A type of computer technology whereby physicians use handheld or personal computer devices to review drug and formulary coverage and to transmit prescriptions to a printer or to a local pharmacy. E-prescribing software can be integrated into existing clinical information systems to allow physician access to patient-specific information to screen for drug interactions and allergies. Federal Communications Commission (FCC): is the United States government agency charged with regulating interstate and international communications by radio, television, wire, satellite and cable. Federally-Qualified Health Centers (FQHCs): are "safety net" providers serving communities, migrant and homeless populations, and public housing residents. FQHCs are governed by consumer-majority boards and provide services to all persons regardless of ability to pay. They charge for services according to a sliding-fee scale based on patients' family income and size. FQHCs are funded by the federal government under Section 330 of the Public Health Service Act. Health Information Exchange (HIE): As defined by the Office of the National Coordinator and the National Alliance for Health Information Technology (NAHIT), Health Information Exchange means the electronic movement of health-related information among organizations according to nationally recognized standards. Health Information Technology (Health IT): As defined in the ARRA, Health Information Technology means hardware, software, integrated technologies or related licenses, intellectual property, upgrades, or packaged solutions sold as services that are designed for or support the use by health care entities or patients for the electronic creation, maintenance, access, or exchange of health information. Health Information for Economic and Clinical Health (HITECH) Act: collectively refers to the health information technology provisions included at Title XIII of Division A and Title IV of Division B of the ARRA. Health Insurance Portability and Accountability Act (HIPAA): was enacted by Congress in Title I of HIPAA protects health insurance coverage for workers and their families when they change or lose their jobs. Title II of HIPAA, known as the Administrative Simplification (AS) provisions, requires the establishment of national standards for electronic health care transactions and national identifiers for providers, health insurance plans, and employers. The Administration Simplification provisions also address the security and privacy of health data. The standards are meant to improve the efficiency and effectiveness of the nation s health care system by encouraging the widespread use of electronic data interchange in the U.S. health care system. Statewide HIE Operational Plan 149

158 Health Information Organization (HIO): An organization that oversees and governs the exchange of health-related information among organizations according to nationally recognized standards. Healthcare Information Technology Standards Panel (HITSP): A multi-stakeholder coordinating body designed to provide the process within which stakeholders identify, select, and harmonize standards for communicating and encouraging broad deployment and exchange of healthcare information throughout the healthcare spectrum. The Panel s processes are business process and use-case driven, with decision making based on the needs of all NHIN stakeholders. The Panel s activities are led by the American National Standards Institute (ANSI), a not-for-profit organization that has been coordinating the U.S. voluntary standardization system since Interface: A means of interaction between two devices or systems that handle data. Interoperability: Interoperability means the ability of health information systems to work together within and across organizational boundaries in order to advance the effective delivery of healthcare for individuals and communities. Meaningful EHR User: As set out in the ARRA, a Meaningful EHR user meets the following requirements: (i) use of a certified EHR technology in a meaningful manner, which includes the use of electronic prescribing; (ii) use of a certified EHR technology that is connected in a manner that provides for the electronic exchange of health information to improve the quality of health care; and (iii) use of a certified EHR technology to submit information on clinical quality and other measures as selected by the Secretary of HHS. Nationwide Health Information Network (NHIN): A national effort to establish a network to improve the quality and safety of care, reduce errors, increase the speed and accuracy of treatment, improve efficiency, and reduce healthcare costs. Notification: While the term notification is not directly contemplated in Health Insurance Portability and Accountability Act, the concept of providing notice of privacy practices is. The Privacy Rule requires a covered entity to provide individuals with a written notice describing the entity s privacy practices. Health plans are required to give notice at enrollment and to notify individuals every three years that the privacy practices notice is available. Providers that have a direct treatment relationship with an individual are only required to give notice at the date of the first service delivery; and except in emergency circumstances, must make a good faith effort to obtain a written acknowledgment from the individual of receipt of the notice. Providers must also have notice posted on the premises. Both plans and providers have special notice requirements if their privacy practices change. Clearinghouses acting as business associates of another covered entity are not required to give notice to patients. The notice must include: A description of an individual s rights with respect to protected health information and how the individual may exercise those rights; The legal duties of the covered entity; A description of the types of uses and disclosures of information that are permitted, including those that are permitted or required without the individual s written authorization; Statewide HIE Operational Plan 150

159 How an individual can file complaints with the covered entity and the Secretary of HHS; How the covered entity will provide the individual with a revised notice if the notice is changed; A contact person for additional information; and The date on which the notice is in effect. Office of the National Coordinator (ONC): serves as principal advisor to the Secretary of HHS on the development, application, and use of health information technology; coordinates HHS s health information technology policies and programs internally and with other relevant executive branch agencies; develops, maintains, and directs the implementation of HHS strategic plan to guide the nationwide implementation of interoperable health information technology in both the public and private health care sectors, to the extent permitted by law; and provides comments and advice at the request of OMB regarding specific Federal health information technology programs. ONC was established within the Office of the Secretary of HHS in 2004 by Executive Order Privacy: In December 2008, the Office of the National Coordinator for Health IT released its Nationwide Privacy and Security Framework For Electronic Exchange of Individually Identifiable Health Information, ( Framework ) in which it defined privacy as, An individual s interest in protecting his or her individually identifiable health information and the corresponding obligation of those persons and entities that participate in a network for the purposes of electronic exchange of such information, to respect those interests through fair information practices. This language contrasts with the definition of privacy included in the National Committee on Vital and Health Statistics ( NCVHS ) June 2006 report, entitled, Privacy and Confidentiality in the Nationwide Health Information Network. In its report, NCVHS recommended the following definition for privacy : Health information privacy is an individual s right to control the acquisition, uses, or disclosures of his or her identifiable health data. Regional Health Information Organization (RHIO): A health information organization that brings together healthcare stakeholders within a defined geographic area and governs health information exchange among them for the purpose of improving health and care in that community. Regional Centers (RCs): As set out in the ARRA, Regional Centers will be established and may qualify for funding under ARRA to provide technical assistance and disseminate best practices and other information learned from the Health Information Technology Research Center to aid health care providers with the adoption of health information technology. State-Designated Entities (SDEs): As defined in the ARRA, State-Designated Entities (SDEs) may be designated by a State as eligible to receive grants under Section 3013 of the ARRA. To qualify as an SDE, an entity must be a not-for-profit entity with broad stakeholder representation on its governing board; demonstrate that one of its principal goals is to use information technology to improve health care quality and efficiency through the authorized and secure electronic exchange and use of health information; adopt nondiscrimination and conflict of interest policies that demonstrate a commitment to open, fair, and nondiscriminatory participation by stakeholders; and conform to other requirements as specified by HHS. Statewide HIE Operational Plan 151

160 Security: The Health Insurance Portability and Accountability Act Security rule defines Security or Security measures as encompass[ing] all of the administrative, physical, and technical safeguards in an information system. U.S. Department of Health and Human Services (HHS): is the federal government agency responsible for protecting the health of all Americans and providing essential human services. HHS, through CMS, administers the Medicare (health insurance for elderly and disabled Americans) and Medicaid (health insurance for low-income people) programs, among others. Statewide HIE Operational Plan 152

161 Statewide HIE Operational Plan 153

162 Statewide HIE Operational Plan 154

163 Statewide HIE Operational Plan 155

164 13.3. NC HIE Board of Directors NC HIE BOARD OF DIRECTORS Name Cansler, Lanier - Co-Chair Sanders, Charles, M.D. - Co-Chair Atkinson, Bill, Ph.D. Bridges, Thomas Callaway, Hadley, M.D. Civello, Anthony Cykert, Samuel "Sam", M.D. Dobson, Alan, M.D. Frelix, Gloria, M.D. King, David Kitzmiller, Rebecca "Becky" Money, Benjamin "Ben" Newton, Warren, M.D. Richter, John Roper, Bill, M.D. Saunders, George, M.D. Spicer, Sam, M.D. Stein, Josh (Senator) Tayloe, Dave, M.D. Tillis, Thom (Representative) Wilson, J. Bradley "Brad" Organization Representing North Carolina Department of Health and Human Services Various North Carolina Hospital Association Local Health Directors North Carolina Medical Society Pharmacy Interests Area Health Education Centers Community Care of North Carolina Old North State Medical Society Laboratory Interests Nurses Association North Carolina Community Health Center Association North Carolina Health Quality Alliance Nursing Home Industry Academic Medical Center North Carolina Medical Board North Carolina Healthcare Information and Communications Alliance, Inc. (NCHICA) North Carolina State Senator and Representative of Consumers American Academy of Pediatrics North Carolina State Representative Blue Cross Blue Shield of North Carolina (BCBSNC) Ex Officio Members: Cline, Steve, DDS Fralick, Jerry Gray, Craigan, M.D. North Carolina Department of Health and Human Services, Assistant Secretary Office of Health Information Technology North Carolina State Chief Information Officer North Carolina Department of Health and Human Services, State Medicaid Director Statewide HIE Operational Plan 156

165 13.4. NC HIE Workgroup Participants NC HIE CLINICAL & TECHNICAL OPERATIONS WORKGROUP Name Dobson, Allen*- Co-Chair Kichak, J.P. - Co-Chair Aldridge, Deborah Alexander, Ben Cykert, Sam* Fenton, Michael Graham, John Helm-Murtagh, Susan Jennings, Arlo Leister, Bill McNeice, Keith McNeill, John A. (Sandy) Spencer, Don Taylor, Angela Tcheng, James Torontow, John Organization Community Care of North Carolina UNC Hospital Stanly Medical Services WakeMed Area Health Education Centers State CIO s Office, Enterprise Architect UNC Institute for Public Health Blue Cross Blue Shield of North Carolina (BCBSNC) Mission Hospitals LabCorp Carolinas Healthcare System North Carolina Health Care Facilities Association UNC Healthcare Division of Information Resource Management, NC DHHS Duke University, DTMI Biomedical Informatics Core Piedmont Health Services NC HIE FINANCE WORKGROUP Name O'Connor, Maureen - Co-Chair Tayloe, Dave* - Co Chair Bell, Mark Harris, Brian Hughes, Yvonne Miller, Mark Minnich, John Owen, Steve Pilkington, Phred Sangvai, Devdutta, MD, MBA Organization BCBSNC Goldsboro Pediatrics, American Academy of Pediatrics North Carolina Hospital Association Rural Health Group, Inc. Coastal Carolinas Health Alliance Novant Health Computer Sciences Corporation Division of Medical Assistance, NC DHHS Cabarrus County Health Department North Carolina Medical Society NC HIE GOVERNANCE WORKGROUP Name Bacon, Tom - Co-Chair Money, Ben* - Co-Chair Bishop, Connie Boyden, Jacquelyn Curtis, Janis Gibson, Dana Gray, Craigan Organization AHEC, UNC School of Medicine NC Community Health Center Association NCNA - Council on Nursing Informatics Kalish Consulting Group Duke Health System WNC Health Network Division of Medical Assistance, NC DHHS Statewide HIE Operational Plan 157

166 Name Gregory, Mark Horton, Don Menscer, Darlyne Reynolds, Harry Richardville, Craig Silberman, Pam Souza, Craig Spicer, Sam* Organization Kerr Drugs LabCorp Carolinas Healthcare System IBM, Health Plan Transformation Carolinas Healthcare System NC Institute of Medicine NC Healthcare Facilities Association New Hanover Regional Medical Center LEGAL & POLICY WORKGROUP Name Organization Sub-Committee Attarian, Linda - Co-Chair North Carolina Department of Health & Human Services Moore, Jill - Co-Chair UNC School of Government Botts, Mark UNC School of Government Legal D'Arruda, Kim North Carolina Department of Justice Legal Gilleskie, Alicia Smith, Anderson, Blount, Dorsett, Mitchell & Jernigan, LLP Legal Hewitt, Clyde Security Management and Compliance Practice Legal Hoke, Chris Division of Public Health, NC DHHS Legal Holloman, Sissy Laboratory Corporation of America Holdings Legal Jones, Linwood NC Hospital Association Legal Kung, Derek W.H. Williams Mullen Legal Markus, Trish Smith Moore Leatherwood Legal Roper, Leighton Duke University Health System Legal Wilson, Chris North Carolina Department of Justice Legal Beach, Judith E. Quintiles Policy Forrest, Brian Access Healthcare Policy Gudaitis, Christy M. Duke University Health System Policy Horton, Donald E., Jr. Laboratory Corporation of America Holdings Policy Huff, Kristy North Carolina Health Care Facilities Association Policy Martin, Curt Division of Medical Assistance, NC DHHS Policy Morales-Burke, Barbara BCBSNC Policy Newton, Warren* NC Health Quality Alliance Policy Phelps, Melanie NC Medical Society Policy Rounds, Carson Village Family Care of Wake Forest Policy Shireman, Chris Wake Internal Medicine Consultants Policy Stein, Josh* (Senator) Representative of Consumers Policy Trygstad, Troy Community Care of North Carolina Policy Wilson, Bill AARP Policy Wright, Robin NCHICA Consumer Advisory Council Policy Carey, Tim Sheps Center for Health Services Research, UNC Security Carpenter, Bill Sheps Center for Health Services Research, UNC Security Statewide HIE Operational Plan 158

167 Name Organization Sub-Committee Dildy, Kenneth University Health Systems of Eastern Carolina Security Hansley, William Duke University Health System Security Huwe, Chris North Carolina Community Care Networks, Inc. Security Kirby, J. David Kirby Information Management Consulting, LLC Security Romello, Miles High Point Regional Health System Security Santiago, Angie M. 3D Consulting & Disaster Management Services Security Shotton, Ann North Carolina Community Care Networks, Inc. Security Smith, Doug Greene County Health Care Security * NC HIE Board of Directors Statewide HIE Operational Plan 159

168 13.5. NC HIE Workgroup Suggested Reading List Overview Documents North Carolina HIE Strategic Plan. October Available online at: North Carolina HIT Task Force Report. June Available online at: State HIE Cooperative Agreement Funding Opportunity Announcement. Available online at: Legal/Policy Workgroup George Washington University. Consumer Consent Options for Electronic Health Information Exchange: Policy Considerations and Analysis. Prepared for the Office of the National Coordinator for Health IT (ONC). March Available online at: New York Statewide Collaboration Process and NY HISPC. Recommendations for Standardized Consumer Consent Policies and Procedures for RHIOs in New York. November Available online at: ONC. HHS Nationwide Privacy and Security Framework for Electronic Exchange of Individually Identifiable Health Information. December 15, Available online at: Governance Workgroup State-Level HIE Consensus Project. State-Level Health Information Exchange: Roles in Ensuring Governance and Advancing Interoperability. March Available online at: National Governors Association. Public Governance Models for a Sustainable Health Information Exchange Industry Available online at: Finance Workgroup State-Level HIE Consensus Project. Realizing State-level HIE Value and Sustainability: Advancing Effective State-level Approaches to Interoperability in the New Federal Context. May Available online at: Statewide HIE Operational Plan 160

169 Technical/Clinical Operations Workgroup State-level HIE Consensus Project. "Advancing Effective State-level Approaches to Interoperability in the New Federal Context. May 15, Available online at: Gartner. "Summary of the NHIN Prototype Architecture: A Report for the Office of the National Coordinator for Health IT. May 31, Available online: Montgomery County HIE Collaborative. "Technical Considerations for Statewide HIE: Version 1.0. February 14, Not available online (please see distributed workgroup materials). Statewide HIE Operational Plan 161

170 13.6. North Carolina Legal/Policy Workgroup Legal Scan Documents 13.6.a. Key Principles: North Carolina Health Information Privacy Laws Disclosure for Treatment Purposes North Carolina law permits the disclosure of most health care information to providers for treatment purposes without the patient s consent. There are certain types of providers that appear to be subject to more stringent laws that require patient consent for disclosures for treatment purposes. These providers include certain mental health facilities or programs (which may disclose only to certain other mental health facilities or programs), nursing homes (which may disclose only in connection with the transfer of a patient), and adult care homes (which may disclose only to a subset of health care providers). There is also a law applicable to home health agencies that could be interpreted as requiring consent for disclosures for treatment purposes. Absent a change in law, mental health facilities, nursing homes, adult care homes, and possibly home health agencies, would be able to make records available through the HIE only with patient consent. A North Carolina law governing the confidentiality of individually identifiable information about reportable communicable diseases makes such information strictly confidential and provides for limited exceptions. One of the exceptions allows release of information to health care personnel providing medical care to the individual. The legal subcommittee has had extensive discussion of this provision and members have disagreed on its interpretation. Some members believe it permits disclosure to any provider treating the patient, while others believe it permits information-sharing only among personnel within the facility maintaining the record. Under the first interpretation, this law would not appear to require patient consent for disclosures of communicable disease information for treatment purposes through an HIE, but under the second interpretation, consent would be required for such disclosures. The law is also unclear about whether disclosure for medical care (an undefined term) includes all treatment activity. Again, different interpretations could lead to different conclusions about whether consent is required to exchange communicable disease information for treatment purposes through an HIE. Although the law addresses only information about reportable communicable diseases, because information about communicable diseases is interspersed throughout patient records, an interpretation that consent is required to disclose such information would result in consent being required for all information disclosed through the HIE unless only a limited set of structured data is exchanged and all communicable disease information can be effectively filtered. Most experts believe filtering of even a structured data set is unlikely to be effective 100% of the time. North Carolina law permits physicians to provide certain services to minors upon their own consent. Ordinarily parents have a right of access to information in their unemancipated minor children s medical records. However, when a minor receives services under the minor s consent law, the physician is not permitted to notify parents about the treatment without the minor s permission, except in limited circumstances prescribed in the law. Whether a physician needs the minor s consent to disclose information about the services to another health care provider for treatment purposes is governed by other laws (including the mental health and communicable disease laws described above). This is true for one-to-one Statewide HIE Operational Plan 162

171 disclosures as well as disclosures made via a HIE. However, if information about minor s consent services is included in a HIE, there may be a heightened risk that the information will be improperly disclosed to parents without minors permission. This could occur if there is a patient portal to which parents have access, or it could occur if a provider who receives information about the minor s treatment through the HIE is unaware that the minor consented to the treatment and subsequently discloses information to the parent without the minor s permission. These concerns raise two issues for the consent policy: 1) Many of the minor s consent services require consent for disclosure of information for treatment purposes, and the minors themselves are the individuals who must provide this consent. 2) Because of the risk of disclosure of information to parents, either via a patient portal or a downstream provider who receives information from the HIE, minors either would need to consent to disclosure of information to their parents, or providers and the HIE would need to segregate minor consent information from other information to avoid improper disclosures. Records of federally assisted alcohol and drug abuse treatment programs cannot be exchanged for treatment purposes without patient consent except in a medical emergency. There are thus laws in North Carolina that require certain providers (such as mental health facilities) to obtain consent for some disclosures for treatment purposes. There are also ambiguities in North Carolina law pertaining to disclosures by certain types of providers (such as home health) and certain types of information (such as communicable disease). While ambiguity in the law may be tolerated for the type of one-to-one exchanges that occur currently in the health care system, providers require greater legal certainty when disclosing information widely through a state HIE. As a result, current North Carolina law points toward a consent policy for the HIE that is either opt-in or a mixed model (with opt-out consent for a limited data set that filters information that has heightened protection under existing laws, and opt-in for providers subject to laws that that prohibit disclosure without consent). If it is determined that another type of consent model for the HIE is preferable, it will be necessary for the NC General Assembly to change the North Carolina laws that require (or appear to require) consent, or at least establish an exemption from the laws for exchanges occurring through the Statewide HIE. Statewide HIE Operational Plan 163

172 13.6.b. Table: NC Statutes Addressing Consent to Disclose Health or Medical Information for Purposes of Treatment, Payment, or Health Care Operations (Draft July 12, 2010) Analyses drafted by Jill Moore, Linda Attarian, Mark Botts, Chris Wilson Response options for consent: Y = yes, consent required (may be some exceptions), N = no, consent not required (some info may still be subject to other laws prohibiting disclosure without consent), O = whether consent is required is determined by other laws, U = unclear whether consent required. Statute Entities covered Consent Information required covered T P O Exceptions to consent related to TPO Consent form Comments Similar privilege statutes for psychologists (8-53.3), social workers (8-53.7), counselors (8-53.8), optometrists (8-53.9), nurses ( ). Optometrists and nurses are captured in the definition of health care provider in GS B Physicianpatient privilege (JM) Physicians, surgeons, and health care providers working under their supervision Information acquired in attending a patient and necessary for treatment; confidential information obtained in medical records O O O Treatment, payment & operations This statute provides that confidential information obtained [sic] in medical records shall be furnished only on the authorization of the patient, but another law (8-53.1) expressly permits TPO disclosures that are permitted by GS B, which applies to most health care providers. DHHS and local health departments are covered by GS 130A-12, which permits disclosures for TPO notwithstanding GS Authorization. Form not specified. Statewide HIE Operational Plan 164

173 Statute Insurance (JM) HMOs (JM) Entities covered Insurance institutions, agents, and insurancesupport organizations (definitions capture HMOs and other health insurers) HMOs, defined as any person who undertakes to provide or arrange for the delivery of health care services to enrollees on a prepaid basis. GS (e). Consent Information required covered T P O Personal or privileged information about an individual collected or received in connection with an insurance transaction Data or information pertaining to the diagnosis, treatment, or health of an HMO enrollee or applicant obtained from the person or a HCP Exceptions to consent related to TPO Consent form Comments N O O Subsection (4) permits disclosure to a medical care institution or a medical professional for purposes that may include informing an individual of a medical problem of which the individual may not be aware. Subsection (7) permits disclosures otherwise permitted or required by law. U U U Treatment, payment and operations Information may be disclosed upon the express consent of the enrollee or applicant. May be disclosed without consent to extent necessary to carry out the purposes of GS Ch. 58 Art. 67. Express consent. Form not specified. Whether consent required for TPO disclosures likely depends on interpretation of to the extent necessary to carry out the purposes of the Article. Statewide HIE Operational Plan 165

174 Statute Entities covered Consent Information required covered T P O Exceptions to consent related to TPO Consent form Comments (b) Unemancipat ed minors (JM) Physicians treating minors pursuant to (minors consent law) Notification to parents of services provided O O O Treatment, payment, and operations TPO disclosures not expressly addressed. Law permits a physician who has treated minor on minor s own consent to notify parents with minor s permission, or without permission if essential to life or health of minor, or if parent contacts physician and inquires about treatment. N/A Section addresses consent to notify parents, not consent to disclose for TPO purposes. Whether information could be disclosed for those purposes would depend on other laws applicable to provider and/or care received. GS permits minors to consent to services pertaining to venereal diseases, reportable communicable diseases, prevention, diagnosis or treatment of pregnancy (except sterilization or abortion), mental health, or substance abuse services B Disclosures by HCPs for TPO & to law enforcement (JM) Pharmacists (JM) Health care providers as defined in GS Pharmacists employed by health care facilities Protected health information (undefined, likely interpreted to mean as defined in HIPAA) Patient records maintained by health care facilities N N N Treatment, payment, and operations Generally permits disclosures without consent for purposes of TPO to extent disclosure is permitted under 45 CFR , but does not permit disclosures that are specifically prohibited by other state or federal law. N/A Disclosures specifically prohibited by other laws include information about reportable communicable diseases, mental health, and substance abuse. N O O N/A Provides that pharmacists employed in HC facilities shall have access to facility s patient records when necessary for pharmacist to provide pharmaceutical services. Disclosures for purposes of payment or health care operations not addressed. 32 Definition includes (1) persons licensed, certified, or registered under NC law to practice or perform duties associated with medicine, surgery, dentistry, pharmacy, optometry, midwifery, osteopathy, podiatry, chiropractic, radiology, nursing, physiotherapy, pathology, anesthesiology, anesthesia, laboratory analysis, rendering assistance to a physician, dental hygiene, psychiatry, or psychology; (2) hospitals or nursing homes; (3) persons legally responsible for the negligence of those listed in categories (1) & (2); (4) persons acting at the direction or under the supervision of those in categories (1) & (2) Statewide HIE Operational Plan 166

175 Statute Entities covered Consent Information required covered T P O Exceptions to consent related to TPO Consent form Comments -Disclosures for treatment: Licensed practitioner is undefined; use of term licensed suggests it may not permit disclosure to as wide a range of providers as allowed by HIPAA. Treating also undefined, unclear if it is as broad in scope as HIPAA definition of treatment. -Disclosures for payment: Although law clearly allows disclosure for some payment purposes, unclear whether it allows disclosure for full range of payment purposes allowed under HIPAA, since it is limited to entities obliged to provide or pay for the patient s care. Payment purposes under HIPAA may include disclosures to collection agencies, consumer reporting agencies, etc. -Disclosures for health care operations: Provisions allowing disclosures to licensed practitioners and to pharmacy owner or agent is permitted do not specify purpose of those disclosures seems reasonable it would include at least some health care operations purposes Pharmacists (JM) A pharmacy or other place where prescriptions are dispensed; any person having custody of or access to prescription orders Written prescription orders Y U U Treatment Generally requires written authorization but information may be disclosed to the following HCPs without authorization: -Licensed practitioner who issued prescription order -Licensed practitioner who is treating the patient for whom order issued -Pharmacist providing pharmacy services to patient for whom order issued -Owner of pharmacy maintaining order (or authorized agent) Payment Information may be disclosed without authorization to any firm, association, partnership, business trust, corporation or company charged by law or by contract with providing for or paying for medical care for the patient. Operations Information may be disclosed without authorization to: -licensed practitioner who issued the prescription. -licensed practitioner treating the patient for whom the prescription issued. -the person owning the pharmacy or his authorized agent. Written authorization. Form not specified. Statewide HIE Operational Plan 167

176 Statute Entities covered Consent Information required covered T P O Exceptions to consent related to TPO Consent form Comments -Generally provides that information may be used only for investigative or evidentiary purposes related to state or federal law or regulatory activities, but permits disclosures to named persons and entities. In some cases specifies purpose for which disclosure may be made. Does not address patient consent or authorization; appears that when disclosure is permitted consent is not required. -Disclosures for treatment purposes limited to specified providers; unclear whether disclosure could be made to other providers with patient consent. -Unclear if disclosures are permitted for payment or health care operations, but it so, limited to Medicaid Controlled substances (JM) NC DHHS controlled substances reporting system Data in the controlled substances reporting system U U U Treatment Data may be released to persons authorized to prescribe or dispense controlled substances for the purpose of providing medical or pharmaceutical care for their patients. Nothing in the Article establishing the system prohibits a person authorized to prescribe or dispense controlled substances from disclosing or disseminating data obtained from the system to another person authorized to prescribe or dispense and authorized to obtain the same data from the system while this is not a provision authorizing provider-toprovider disclosure for treatment purposes, it suggests this law is not a barrier to such a disclosure. Payment and Operations Disclosure may be made to DMA for purposes of administering Medicaid program; unclear whether that is for purposes of payment or health care operations. N/A Statewide HIE Operational Plan 168

177 Statute Entities covered Consent Information required covered T P O Exceptions to consent related to TPO Consent form Comments Electronic medical records (JM) Health care providers or facilities licensed, certified or registered in NC; any unit of state or local government Electronic medical records. Medical records is defined in GS to mean personal information that relates to an individual s physical or mental condition, medical history, or medical treatment, excluding X rays and fetal monitor records. (emphasis added). O O O Treatment, payment, and operations See comments. N/A Authorizes use of electronic medical records. Does not specifically address consent for disclosures, but provides that legal rights and responsibilities of patients, providers, facilities, and governmental units apply to electronic medical records the same as to paper records, including those relating to security, confidentiality, accuracy, integrity, access to, and disclosure of medical records. Statewide HIE Operational Plan 169

178 Statute Entities covered Consent Information required covered T P O Exceptions to consent related to TPO Consent form Comments 108A-80 Any person Any list of O O O No There is no Federal ruling on the Public names or relationship between Medicaid and assistance other HIPAA privacy standards. The federal records, information Medicaid privacy statute (42 USC including concerning 1396(a)(7) specifies that State plans Medicaid persons for medical assistance must provide (LA) applying for safeguards which restrict the use or or receiving disclosure of information concerning public applicants and recipient to purposes assistance directly connected with the that may be administration of the state plan. indirectly or Implementing regulations (42 CFR directly , 2004), define purposes derived from directly related to state plan the records, administration to cover: (1) establishing files, or eligibility; (2) determining the amount of communicati medical assistance; (3) providing ons of the services for recipients; and (4) Department conducting or assisting an investigation, or acquired in prosecution, or civil or criminal the course of proceeding related to the administration performing of a plan. official duties. Does not The North Carolina Administrative Code include requires the Division of Medical information Assistance to abide by the statute or obtained or regulation which provides more generated for protection for the client whenever there the purposes is an inconsistency between federal or directly state statutes or regulations specifically connected addressing confidentiality issues. See with the 10A NCAC 26A administratio n of the public assistance programs in accordance Statewide HIE Operational Plan with federal 170 law, rules and regulations and the rules

179 Statute Entities covered Consent Information required covered T P O Exceptions to consent related to TPO Consent form Comments Area facilities may share client information for treatment and payment purposes without client consent in the same way that health care providers may share PHI under HIPAA. Other MH/DD/SA facilities generally must obtain client consent to disclose client information for TPO, whether the disclosure is to another MH/DD/SA facility or to any other health care provider. 122C-55 Mental health, development al disabilities & substance abuse (MH/DD/SA) (MB) Any individual, partnership, or agency whose primary purpose is to provide mental health, development al disability, or substance abuse services ( facility ) 122C-3(14) Any information relating to an individual served by a covered facility that was received in connection with the performance of any function of the facility. Y Y Y Treatment A subset of covered facilities (public mental health authorities and their contract service providers area facilities ) may share confidential information for treatment (defined as the provision, coordination, or management of MH/DD/SA services by one or more facilities). Any covered facility may share client information with DHHS, and DHHS may share client information with any facility, when necessary for treatment activities. DHHS includes primary care case management programs that contract with DHHS to provide primary care case management for recipients of publicly funded health and related services (inc. Medicaid) When necessary to coordinate treatment, a DHHS primary care case management program may disclose MH/DD/SA information received pursuant to GS 122C-55 to a health care provider or other entity that participates in the case management program. Such providers or other entities must follow GS 122C with respect to the information received. The statute also provides for other narrowly defined treatment related disclosures (facilities and DHHS may disclose to particular entities in specifically defined circumstances). Payment Area and state facilities may disclose For area facilities and state-operated facilities, the form and content of client consent is specified in 10A NCAC 26B Consent is valid only for one year. For other covered facilities, no form specified. Statewide HIE Operational Plan 171

180 Statute Entities covered Consent Information required covered T P O Exceptions to consent related to TPO confidential information to a DHHS benefits program (Medicaid and the state-funded target population program) for payment purposes. Disclosures to private health plans require client consent. All other MH/DD/SA programs must obtain client consent to disclose for any payment purposes. Area facilities may share confidential information with each other for payment when necessary to conduct payment activities relating to an individual served by the facility. Payment activities are activities undertaken by a facility to obtain or provide reimbursement for the provision of services and may include, but are not limited to, determinations of eligibility or coverage, coordination of benefits, determinations of cost-sharing amounts, claims management, claims processing, claims adjudication, claims appeals, billing and collection activities, medical necessity reviews, utilization management and review, precertification and preauthorization of services, concurrent and retrospective review of services, and appeals related to utilization management and review. Operations Any covered facility may share client information with DHHS, and DHHS may share client information with any Consent form Comments Statewide HIE Operational Plan 172

181 Statute Entities covered Consent Information required covered T P O Exceptions to consent related to TPO facility, when necessary for quality assessment and improvement activities. DHHS includes primary care case management programs for recipients of publicly funded health and related services (inc. Medicaid) When necessary to conduct quality assessment and improvement activities, a DHHS primary care case management program may disclose MH/DD/SA information received pursuant to GS 122C-55 to a health care provider or other entity that participates in the case management program. Such providers or other entities must follow GS 122C with respect to the information received. Area authorities and their contract providers may share confidential information regarding their clients when the area authority determines the disclosure is necessary to develop, manage, monitor, or evaluate the area authority's providers. The purposes or activities for which confidential information may be disclosed include, but are not limited to, quality assessment and improvement activities, provider accreditation and staff credentialing, developing contracts and negotiating rates, investigating and responding to client grievances and complaints, evaluating practitioner and provider performance, auditing functions, on-site monitoring, conducting Consent form Comments Statewide HIE Operational Plan 173

182 Statute Entities covered Consent Information required covered T P O Exceptions to consent related to TPO consumer satisfaction studies, and collecting and analyzing performance data. Consent form Comments 130A-12 State & local public health agency records (JM) 130A-143 Communicab le disease (JM) NC DHHS, NC DENR, local health departments 33 Any person/entity with covered information or records Privileged patient medical information, PHI as defined in HIPAA, & information pertaining to child lead program All information or records that identify a person who has or may have a reportable communicabl e disease or condition N N N Treatment, payment, and operations Expressly permits disclosure for TPO of privileged information and information subject to GS 130A- 143(reportable communicable diseases). 34 Does not permit disclosure for TPO of information protected by other laws (such as mental health or substance abuse). U Y Y Treatment Most disclosures require written consent, but information may be released without consent: -To health care personnel providing medical care to the person. -If release is necessary to protect public health and is made according to state communicable disease rules (this sometimes involves disclosures to attending physicians for treatment purposes). Payment and Operations No provision permits disclosure for payment or health care operations purposes without consent. N/A Written consent. Form not specified. -Differs from GS B (the provision addressing TPO for most HCPs) in that it permits disclosure of reportable communicable disease information for treatment purposes in accordance with HIPAA. - See also GS 130A-45.8 (medical records compiled and maintained by public health authorities are not public records). -Applies to all CDs declared reportable in NC--presently 71 (10A NCAC 41A.0101). -Provision permitting disclosure to health care personnel providing medical care ; both terms undefined. Medical care may be narrower in scope than the definition of treatment in HIPAA. Unclear whether this provision authorizes only the sharing of information among health care personnel within a facility. 33 Local health departments is defined to include district health departments, county health departments, consolidated human services agencies, and public health authorities organized pursuant to GS Ch. 130A Ar. 2 Part 1B. 34 Subject to a limited regulatory exception: a local health department may release info about HIV only when it has provided direct medical care to the person and refers the person to or consults with the HCP to whom the info is released. 10A NCAC 41A.0202(11). Statewide HIE Operational Plan 174

183 Statute Entities covered Consent Information required covered T P O Exceptions to consent related to TPO Consent form Comments 131D-21 & associated regulations (see next three rows) Adult care homes (CW) Regulation: 10A NCAC 13D.2402(f) Adult care homes licensed under GS 131D-2.4 Adult Care Home Beds within a Combination Facility that is part Nursing Home and part Adult Care Home Personal and medical records Medical records Y Y Y Treatment -Treating physician may have access to medical records unless individual objects in writing. -No consent required to disclose to providers of emergency medical services, but disclosure must be limited to that necessary to meet emergency. Payment Consent required. (Probably routinely obtained through third party contract in accordance with subsection (6).) Operations Consent required, except disclosure to private peer review committees pursuant to NCGS 131D Y Y Y Treatment Authorized personnel (not defined) Payment Authorized personnel Operations Authorized personnel Written consent. Form not specified. Signed authorization forms required. Form not specified. Part of a declaration of patients rights. Range of HCPs to whom info may be disclosed narrower than that in HIPAA. Minimum necessary requirement for EMS treatment more stringent than HIPAA. Consent is presumably required in manner consistent with NCGS 131D- 21. Statewide HIE Operational Plan 175

184 Statute Regulation: 10A NCAC 13F.1410 (Resident rights) Entities covered Adult care home special care units licensed under G.S. 131D-4.6 Consent Information required covered T P O Exceptions to consent related to TPO Consent form Yes, see NCAC 27B.0202 Comments Special care units provide services to residents with Alzheimer s disease or other dementias, mental health disabilities, or other special care needs disease or conditions. Regulation: 10A NCAC 13H.0407 (Client rights) Assisted Living Residences for Development ally Disabled Adults (A type of adult care home ) All records compiled and maintained by adult care home special care units licensed under G.S. 131D-4.6 All records compiled and maintained by the home Y Y Y In addition to the confidentiality protections provided to residents of adult care homes under G.S. 131D- 21, this rule incorporates by reference all MH/DD/SAS confidentiality provisions in G.S. 122C, essentially deeming Special Care Units as facilities defined by 122C-3. See also 10A NCAC 13F.1405, applying G.S. 122C-55(f), prohibiting redisclosure without consent Y Y Y Assisted Living Residences are included in the definition of adult care home; Residences for Developmentally Disabled Adults are licensed under G.S. 131D, however, this rule provides that with respect to G.S. 131D-21, the facility must only comply with G.S. 131D-21(6) confidentiality protections. Not specified in rule 131D-21(6) requires the facility to obtain the resident s written consent to disclose personal or medical records ; consent must be specific as to whom the disclosure may be made; exceptions include disclosures to treating provider unless the resident objects in writing, disclosures to individuals and entities providing emergency care, and when required by law Statewide HIE Operational Plan 176

185 Statute 131E-97 Hospitals (JM) 131E-117 Nursing homes (JM) 131E Home health (JM) Entities covered Health care facilities, undefined but the section is in the Hospital Licensure Act (GS Ch. 131E, Art. 5) Nursing homes Home care agencies Consent Information required covered T P O Medical records and personal financial records compiled and maintained in connection with the admission, treatment, and discharge of individual patients Patients personal and medical records Clients personal and medical records Exceptions to consent related to TPO Consent form Comments O O O N/A N/A Provides that the covered records are not public records. Whether information could be disclosed for TPO purposes appears to depend on other laws. Y U Y Treatment Written consent required for release except as needed in case of the patient s transfer to another health care institution. Payment Written consent required for release except as required by law or third party payment contract. Operations General rule is written consent for release; no provision specifically addressing activities falling under health care operations. Y Y Y Treatment, payment and operations Clients have right to have records kept confidential and not disclosed without appropriate written consent. No exceptions stated. Written consent. Form not specified. Appropriate written consent. Form not specified. Part of a declaration of patients rights. -Range of HCPs to whom info may be disclosed for treatment purposes is narrower than that in HIPAA. -Scope of disclosure for payment purposes may be narrower as well; unclear whether it allows disclosure for full range of payment purposes allowed under HIPAA, since it is limited to disclosures required by law or thirdparty payment contracts. Part of a declaration of clients rights. No exceptions to written consent stated in this section, but another section (131E-144.7) permits DHHS to inspect medical records when necessary to investigate alleged violations. Statewide HIE Operational Plan 177

186 Statute Entities covered Consent Information required covered T P O Exceptions to consent related to TPO Consent form Comments Government agencies may collect SSNs only if (1) authorized by law to do so, or (2) collection is imperative for performance of agency s legally prescribed duties. -Agencies must segregate SSN on a separate page of a record and must not use SSN for any purpose other than purpose stated. -Prohibits intentionally communicating SSN and other identifying information (defined, pertains to financial information) to the general public; makes such information confidential & not a public record. -Also prohibits (with limited exceptions) printing or imbedding SSN on card required to access services, requiring transmission of SSN over Internet unless connection secure or SSN encrypted, requiring an individual to use SSN to access a website unless other authentication device also required, or print an SSN on materials mailed to an individual. There are similar prohibitions in GS for businesses (including HCPs). -Other laws determine whether SSN may be used for TPO purposes. For ex, GS 105A-3 authorizes government agencies to collect and use SSNs in the debt set-off program, a payment purpose SSN protection State and local government agencies and employees SSN O O O See comments. No provision for person to consent to any use of SSN that is not permitted by statute (see comments). Statewide HIE Operational Plan 178

187 Statute Entities covered Consent Information required covered T P O Exceptions to consent related to TPO Consent form Comments -Disclosure permitted to health care personnel providing medical care ; both terms undefined. Medical care may be narrower in scope than the definition of treatment in HIPAA. - Statute contains a provision that states these records may contain patient identifiable data which will allow linkage to other health care-based data systems for the purposes of quality management, peer review, and public health initiatives EMS (JM) NC DHHS, hospitals in statewide trauma system, EMS providers Medical records compiled or maintained in connection with dispatch, response, treatment, or transport of individual patients or in connection with the statewide trauma system U N N Treatment May release without consent to health care personnel providing medical care to patient. Payment May release without consent pursuant to any other law. This probably authorizes disclosures for payment purposes pursuant to GS B. Operations May release without consent pursuant to any other law. This probably authorizes disclosures for health care operations purposes pursuant to GS B. Written consent. Form not specified. Statewide HIE Operational Plan 179

188 13.6.c. List of NC Reportable Diseases and Conditions CHAPTER 41 HEALTH: EPIDEMIOLOGY SUBCHAPTER 41A COMMUNICABLE DISEASE CONTROL SECTION.0100 REPORTING OF COMMUNICABLE DISEASES 10A NCAC 41A.0101 REPORTABLE DISEASES AND CONDITIONS (a) The following named diseases and conditions are declared to be dangerous to the public health and are hereby made reportable within the time period specified after the disease or condition is reasonably suspected to exist: (1) acquired immune deficiency syndrome (AIDS) - 24 hours; (2) anthrax - immediately; (3) botulism - immediately; (4) brucellosis - 7 days; (5) campylobacter infection - 24 hours; (6) chancroid - 24 hours; (7) chlamydial infection (laboratory confirmed) - 7 days; (8) cholera - 24 hours; (9) Creutzfeldt-Jakob disease 7 days; (10) cryptosporidiosis - 24 hours; (11) cyclosporiasis - 24 hours; (12) dengue - 7 days; (13) diphtheria - 24 hours; (14) Escherichia coli, shiga toxin-producing - 24 hours; (15) ehrlichiosis - 7 days; (16) encephalitis, arboviral - 7 days; (17) foodborne disease, including Clostridium perfringens, staphylococcal, Bacillus cereus, and other and unknown causes - 24 hours; (18) gonorrhea - 24 hours; (19) granuloma inguinale - 24 hours; (20) Haemophilus influenzae, invasive disease - 24 hours; (21) Hantavirus infection 7 days; (22) Hemolytic-uremic syndrome 24 hours; (23) Hemorrhagic fever virus infection immediately; (24) hepatitis A - 24 hours; (25) hepatitis B - 24 hours; (26) hepatitis B carriage - 7 days; (27) hepatitis C, acute - 7 days; (28) human immunodeficiency virus (HIV) infection confirmed - 24 hours; (29) influenza virus infection causing death 24 hours; (30) legionellosis - 7 days; (31) leprosy 7 days; (32) leptospirosis - 7 days; (33) listeriosis 24 hours; (34) Lyme disease - 7 days; (35) lymphogranuloma venereum - 7 days; (36) malaria - 7 days; (37) measles (rubeola) - 24 hours; Statewide HIE Operational Plan 180 August 31, 2010

189 (38) meningitis, pneumococcal - 7 days; (39) meningococcal disease - 24 hours; (40) monkeypox 24 hours; (41) mumps - 7 days; (42) nongonococcal urethritis - 7 days; (43) novel influenza virus infection immediately; (44) plague - immediately; (45) paralytic poliomyelitis - 24 hours; (46) pelvic inflammatory disease 7 days; (47) psittacosis - 7 days; (48) Q fever - 7 days; (49) rabies, human - 24 hours; (50) Rocky Mountain spotted fever - 7 days; (51) rubella - 24 hours; (52) rubella congenital syndrome - 7 days; (53) salmonellosis - 24 hours; (54) severe acute respiratory syndrome (SARS) 24 hours; (55) shigellosis - 24 hours; (56) smallpox immediately; (57) Staphylococcus aureus with reduced susceptibility to vancomycin 24 hours; (58) streptococcal infection, Group A, invasive disease - 7 days; (59) syphilis - 24 hours; (60) tetanus - 7 days; (61) toxic shock syndrome - 7 days; (62) trichinosis - 7 days; (63) tuberculosis - 24 hours; (64) tularemia - immediately; (65) typhoid - 24 hours; (66) typhoid carriage (Salmonella typhi) - 7 days; (67) typhus, epidemic (louse-borne) - 7 days; (68) vaccinia 24 hours; (69) vibrio infection (other than cholera) - 24 hours; (70) whooping cough - 24 hours; (71) yellow fever - 7 days. (b) For purposes of reporting confirmed human immunodeficiency virus (HIV) infection is defined as a positive virus culture, repeatedly reactive EIA antibody test confirmed by western blot or indirect immunofluorescent antibody test, positive nucleic acid detection (NAT) test, or other confirmed testing method approved by the Director of the State Public Health Laboratory conducted on or after February 1, In selecting additional tests for approval, the Director of the State Public Health Laboratory shall consider whether such tests have been approved by the federal Food and Drug Administration, recommended by the federal Centers for Disease Control and Prevention, and endorsed by the Association of Public Health Laboratories. (c) In addition to the laboratory reports for Mycobacterium tuberculosis, Neisseria gonorrhoeae, and syphilis specified in G.S. 130A-139, laboratories shall report: (1) Isolation or other specific identification of the following organisms or their products from human clinical specimens: (A) Any hantavirus or hemorrhagic fever virus. Statewide HIE Operational Plan 181

190 (B) (C) (D) (E) (F) (G) (H) (I) (J) (K) (L) (M) (N) (O) (P) (Q) (R) (S) (T) (U) (V) (W) (X) (Y) (Z) (AA) (BB) (CC) (DD) (EE) (FF) (GG) (HH) (II) (JJ) (KK) (LL) Arthropod-borne virus (any type). Bacillus anthracis, the cause of anthrax. Bordetella pertussis, the cause of whooping cough (pertussis). Borrelia burgdorferi, the cause of Lyme disease (confirmed tests). Brucella spp., the causes of brucellosis. Campylobacter spp., the causes of campylobacteriosis. Chlamydia trachomatis, the cause of genital chlamydial infection, conjunctivitis (adult and newborn) and pneumonia of newborns. Clostridium botulinum, a cause of botulism. Clostridium tetani, the cause of tetanus. Corynebacterium diphtheriae, the cause of diphtheria. Coxiella burnetii, the cause of Q fever. Cryptosporidium parvum, the cause of human cryptosporidiosis. Cyclospora cayetanesis, the cause of cyclosporiasis. Ehrlichia spp., the causes of ehrlichiosis. Shiga toxin-producing Escherichia coli, a cause of hemorrhagic colitis, hemolytic uremic syndrome, and thrombotic thrombocytopenic purpura. Francisella tularensis, the cause of tularemia. Hepatitis B virus or any component thereof, such as hepatitis B surface antigen. Human Immunodeficiency Virus, the cause of AIDS. Legionella spp., the causes of legionellosis. Leptospira spp., the causes of leptospirosis. Listeria monocytogenes, the cause of listeriosis. Monkeypox. Mycobacterium leprae, the cause of leprosy. Plasmodium falciparum, P. malariae, P. ovale, and P. vivax, the causes of malaria in humans. Poliovirus (any), the cause of poliomyelitis. Rabies virus. Rickettsia rickettsii, the cause of Rocky Mountain spotted fever. Rubella virus. Salmonella spp., the causes of salmonellosis. Shigella spp., the causes of shigellosis. Smallpox virus, the cause of smallpox. Staphylococcus aureus with reduced susceptibility to vanomycin. Trichinella spiralis, the cause of trichinosis. Vaccinia virus. Vibrio spp., the causes of cholera and other vibrioses. Yellow fever virus. Yersinia pestis, the cause of plague. (2) Isolation or other specific identification of the following organisms from normally sterile human body sites: (A) Group A Streptococcus pyogenes (group A streptococci). (B) Haemophilus influenzae, serotype b. (C) Neisseria meningitidis, the cause of meningococcal disease. (3) Positive serologic test results, as specified, for the following infections: Statewide HIE Operational Plan 182

191 (A) Fourfold or greater changes or equivalent changes in serum antibody titers to: (i) (ii) (iii) (iv) (v) (vi) (vii) (viii) (ix) (x) (xi) Any arthropod-borne viruses associated with meningitis or encephalitis in a human. Any hantavirus or hemorrhagic fever virus. Chlamydia psittaci, the cause of psittacosis. Coxiella burnetii, the cause of Q fever. Dengue virus. Ehrlichia spp., the causes of ehrlichiosis. Measles (rubeola) virus. Mumps virus. Rickettsia rickettsii, the cause of Rocky Mountain spotted fever. Rubella virus. Yellow fever virus. (B) The presence of IgM serum antibodies to: (i) (ii) (iii) (iv) (v) (vi) Chlamydia psittaci Hepatitis A virus. Hepatitis B virus core antigen. Rubella virus. Rubeola (measles) virus. Yellow fever virus. (4) Laboratory results from tests to determine the absolute and relative counts for the T-helper (CD4) subset of lymphocytes that have a level below that specified by the Centers for Disease Control and Prevention as the criteria used to define an AIDS diagnosis. History Note: Authority G.S. 130A-134; 130A-135; 130A-139; 130A-141; Temporary Rule Eff. February 1, 1988, for a period of 180 days to expire on July 29, 1988; Eff. March 1, 1988; Amended Eff. October 1, 1994; February 1, 1990; Temporary Amendment Eff. July 1, 1997; Amended Eff. August 1, 1998; Temporary Amendment Eff. February 13, 2003; October 1, 2002; February 18, 2002; June 1, 2001; Amended Eff. April 1, 2003; Temporary Amendment Eff. November 1, 2003; May 16, 2003; Amended Eff. January 1, 2005; April 1, 2004; Temporary Amendment Eff. June 1, 2006; Amended Eff. April 1, 2008; November 1, 2007; October 1, 2006; Temporary Amendment Eff. January 1, Statewide HIE Operational Plan 183

192 13.6.d. NC State Law Provisions Related to Minor s Consent Responsibility, liability and immunity of physicians. (a) Any physician licensed to practice medicine in North Carolina providing health services to a minor under the terms, conditions and circumstances of this Article shall not be held liable in any civil or criminal action for providing such services without having obtained permission from the minor's parent, legal guardian, person standing in loco parentis, or a legal custodian other than a parent when granted specific authority in a custody order to consent to medical or psychiatric treatment. The physician shall not be relieved on the basis of this Article from liability for negligence in the diagnosis and treatment of a minor. (b) The physician shall not notify a parent, legal guardian, person standing in loco parentis, or a legal custodian other than a parent when granted specific authority in a custody order to consent to medical or psychiatric treatment, without the permission of the minor, concerning the medical health services set out in G.S (a), unless the situation in the opinion of the attending physician indicates that notification is essential to the life or health of the minor. If a parent, legal guardian[,] person standing in loco parentis, or a legal custodian other than a parent when granted specific authority in a custody order to consent to medical or psychiatric treatment contacts the physician concerning the treatment or medical services being provided to the minor, the physician may give information. (1965, c. 810, s. 4; 1977, c. 582, s. 1; 1985, c. 589, s. 30.) Minor's consent sufficient for certain medical health services. (a) Any minor may give effective consent to a physician licensed to practice medicine in North Carolina for medical health services for the prevention, diagnosis and treatment of (i) venereal disease and other diseases reportable under G.S. 130A-135, (ii) pregnancy, (iii) abuse of controlled substances or alcohol, and (iv) emotional disturbance. This section does not authorize the inducing of an abortion, performance of a sterilization operation, or admission to a 24-hour facility licensed under Article 2 of Chapter 122C of the General Statutes except as provided in G.S. 122C-223. This section does not prohibit the admission of a minor to a treatment facility upon his own written application in an emergency situation as authorized by G.S. 122C-223. (b) Any minor who is emancipated may consent to any medical treatment, dental and health services for himself or for his child. (1971, c. 35; 1977, c. 582, s. 2; 1983, c. 302, s. 2; 1985, c. 589, s. 31; 1985 (Reg. Sess., 1986), c. 863, s. 4; , s. 10.) Statewide HIE Operational Plan 184

193 13.6.e. Inventory of NC Laws Relevant to Electronic Health Information Exchange Laws Pertaining to Consent to Disclose Individually Identifiable Health Information for Purposes of Treatment, Payment, or Health Care Operations N.C. General Statutes Citation Subject of law Comments G.S Physician-patient privilege Analyzed in TPO table. G.S Privilege not a bar to disclosing per B Not analyzed separately in TPO table, but addressed in association with GS G.S Psychologist privilege Not analyzed separately in TPO table, but mentioned in association with GS G.S Social worker privilege Not analyzed separately in TPO table, but mentioned in association with GS G.S Counselor privilege Not analyzed separately in TPO table, but mentioned in association with GS G.S Optometrist privilege Not analyzed separately in TPO table, but mentioned in association with GS G.S Nurse privilege Not analyzed separately in TPO table, but addressed in association with GS G.S Insurance Analyzed in TPO table. G.S HMOs Analyzed in TPO table. G.S (b) Unemancipated minors Analyzed in TPO table. G.S B Disclosures for TPO & to law enforcement TPO provisions analyzed in TPO table. G.S Pharmacists Analyzed in TPO table. G.S Pharmacies Analyzed in TPO table. G.S Controlled substances reporting system Analyzed in TPO table. G.S Electronic medical records Analyzed in TPO table. Included in inventory of NC data security laws. G.S. 122C-52 MH/DD/SA Analyzed in TPO table. G.S. 122C-53 MH/DD/SA Analyzed in TPO table. G.S. 122C-54 MH/DD/SA Analyzed in TPO table. G.S. 122C-55 MH/DD/SA Analyzed in TPO table. G.S. 122C-56 MH/DD/SA Analyzed in TPO table. G.S. 122C-191 MH/DD/SA Analyzed in TPO table. G.S. 122C-192 MH/DD/SA Analyzed in TPO table. G.S. 130A-12 Public health agency records Analyzed in TPO table. Statewide HIE Operational Plan 185

194 Laws Pertaining to Consent to Disclose Individually Identifiable Health Information for Purposes of Treatment, Payment, or Health Care Operations N.C. General Statutes Citation Subject of law Comments G.S. 130A G.S. 130A-143 Public health authorities Reportable communicable diseases Not analyzed separately in TPO table, but addressed in association with GS 130A-12. Analyzed in TPO table. G.S. 131D-21 Adult care homes Analyzed in TPO table. G.S. 131D Adult care homes Analyzed in TPO table. G.S. 131E-97 Hospitals Analyzed in TPO table. G.S. 131E-98 State prison inmates Not analyzed in TPO table. Authorizes hospitals to disclose to the Department of Correction (DOC) medical records pertaining to hospital s treatment of inmates in the custody of DOC. Purpose not stated but likely includes treatment. Does not appear to authorize hospitals to disclose records of inmates of local jails who are not in the custody of DOC. G.S. 131E-108 Nursing homes Not analyzed in TPO table. Permits disclosures to private peer review committees. G.S. 131E-117 Nursing homes Analyzed in TPO table. G.S. 131E Home health Analyzed in TPO table. G.S G.S G.S. 153A- 225(b1) Protection of SSN (governmental entities) Emergency medical services Local jail medical records Analyzed in TPO table. Included in inventory of NC data security laws. Analyzed in TPO table. Not analyzed in TPO table. Requires jails to send medical records with inmates transferred to other jails. Purpose of provision not stated but likely includes treatment purposes. Statewide HIE Operational Plan 186

195 13.6.f. NC General Statutes Addressing Security of Health Information July 15, 2010 GS Subject of law Summary of Pertinent Parts Ch. 14, Art. 60 Ch. 58, Art. 39 Ch. 66, Art. 40 Computer-related crime Insurance Information & Privacy Protection Uniform Electronic Transactions Act Identity theft protection - definitions This Article criminalizes hacking and other types of computer mischief. E.g., various sections address accessing a computer, program, system, or network for a fraudulent purpose; altering or destroying computers or systems (not limited to but including via malware), computer trespass for purposes of destruction or fraud, etc. Of potential interest is GS : Any person who willfully and without authorization denies or causes the denial of computer, computer program, computer system, or computer network services is guilty of a Class 1 misdemeanor. This includes, but does not appear to be limited to, denying services by introducing malware addresses the same issues for government computers, but in that case it s a Class H felony. This Article establishes standards for the collection, use and disclosure of information gathered by various types of insurers (including health insurers). Part 3 addresses standards for administrative, technical and physical safeguards to protect the security, confidentiality and integrity of customer information as required by Gramm- Leach-Bliley, and to protect the privacy and security of medical records to a degree meeting or exceeding federal requirements. Requires a licensee (defined to include insurers) to implement a written information security program that includes administrative, technical and physical safeguards designed to ensure security and confidentiality of customer information, protect against anticipated threats to security or integrity of information, and protect against unauthorized access to or use of information that could result in substantial harm or inconvenience to any customer. Authorizes Insurance Commissioner to adopt rules to carry out purposes of the Part. Applies to electronic records relating to a transaction, defined as an action or set of actions between two or more persons relating to the conduct of consumer, business, commercial, or governmental affairs (with some exclusions), when the parties have agreed to conduct transactions electronically. Provisions do not appear to address data security. Defines security breach, personal information, and other terms used in the provisions of GS Ch. 75 noted below Identity theft protection Restricts how businesses may use or communicate Statewide HIE Operational Plan 187

196 GS Subject of law Summary of Pertinent Parts - SSN protection SSNs. Business is defined to exclude government agencies. A separate statute, GS , restricts government agencies collection and use of SSNs more stringently Identity theft protection - Destruction of records containing personal information Identity theft protection - Security breaches Electronic medical records Disposition of records held by government agencies Subsection (e)(2) provides that this section does not apply to any health insurer or health care facility that is subject to and in compliance with HIPAA privacy and security standards. Applicable to any business, defined to exclude government agencies. A separate statute, G.S (c1), requires government agencies that experience a security breach to comply with this statute. For more detail about this statute, see the document Security Breaches: Comparison of Federal and NC Law, distributed to Legal/Policy Workgroup in June Authorizes creation and maintenance of medical records in electronic format. Requires EMRs to be maintained in a legible and retrievable form with adequate data backup. Permits electronic signatures to authenticate orders and other entries in records. Provides that the legal rights and responsibilities of patients, health care providers, facilities, and governmental units apply to EMRs to same extent as to paper medical records, including with respect to security, confidentiality, accuracy, integrity, access to, and disclosure of medical records. For purposes of this section medical records means personal information that relates to an individual s physical or mental condition, medical history, or medical treatment, excluding x-rays and fetal monitor records (see GS , Definitions). Applies to government agencies, including those that are health care providers (such as local health departments). Prohibits the destruction or other disposition of public records without the consent of the Department of Cultural Resources. For purposes of this law, public records is defined to include records (including electronic records) made or received in connection with the transaction of business by any government agency. See GS This includes confidential medical records the definition of public record in Ch. 121 is distinct from the definition of public record in GS Ch. 132, the law that addresses the public s right to access and review public records. This law does not authorize public access to records but merely regulates their disposition). The Department of Cultural Resources, Office of Archives & History, Government Records Branch has adopted record retention schedules for public agencies and also has published guidelines for Statewide HIE Operational Plan 188

197 GS Subject of law Summary of Pertinent Parts electronic records that address some security issues. GS establishes penalties for noncompliance with this section. 130A-374 State Center for Health Statistics 130A-480 Emergency department data reporting SSNs and other personal identifying info maintained by government agencies Ch. 147, Art. 3D State Information Technology Services Requires State Center for Health Statistics to take appropriate measures to protect security of health data it collects, including limiting access to data to authorized individuals who have received training, designating a person to be responsible for physical security, and developing and implementing a system for monitoring security. Requires hospitals with emergency departments (except psychiatric hospitals) to submit specified data to state for purpose of public health syndromic surveillance. Contains provision requiring State Health Director to ensure that adequate measures are taken to provide system security for all data and information. Restricts government agencies collection and use of SSNs. Subsection (c1) requires government agencies that experience a security breach as defined in GS to comply with the security breach requirements in GS Applies to State information technology projects. Requires State CIO to establish statewide standards for IT security to maximize the functionality, security, and interoperability of the State s IT assets. Provides that all IT security purchased using State funds or for use by a State agency or in a State facility shall be subject to approval by the State CIO. Requires State CIO approval before a State agency may enter into a contract with another party for an assessment of network vulnerability. This Article may not be relevant to the HIE itself but it appears it may be relevant to State agencies that interact with the HIE. Statewide HIE Operational Plan 189

198 13.7. NC HIE Finance Workgroup Environmental Data Collection Provider Organizations: A summary of information gathered through the environmental data collection is provided below. This summary represents the current best understanding of the North Carolina health care landscape based on the information received to data. There are 33 hospital systems in the state, representing 118 hospital sites and 2,415 employed in-patient providers. Those areas highlighted in yellow are currently unknown. Additional detail is provided for each category in the following sections. Provider Type Organizations Sites Non-Phys Providers Prescriber Large Medium Small Total (NP, PA) Hospital Systems ,415 Unknown Hospitals Unknown Rural Health Centers FQHCs Provider Offices Unknown ,024 10,928 18,573 1,900 Free Health Clinics Unknown Unknown Labs (excl Hosp & Clinic based) Pharmacies (Chain) 1,199 1,199 Pharmacies (Independent) Assumption Total Providers Figure A1. Healthcare Landscape Providers: The information below was gathered from the North Carolina Medical Society and Blue Cross Blue Shield. To arrive at the assumptions detailed in the table below, the distribution of providers across the six different office sizes and the total number of physicians in the state were used to estimate the number of physicians for each office size. According to this information, the majority of physicians (29%) work in a small office size of between 1 and 5 physicians and approximately 21% of physicians work in large practices of more than 100 physicians. Office Size Number of Physician Offices Number of physicians % of all providers Average providers per office 1-5 3,163 6,440 29% ,872 13% ,455 11% ,274 15% ,386 11% ,709 21% 416 Grand Total 3,863 22, % 6 Figure A2. Provider Landscape Statewide HIE Operational Plan 190

199 Hospitals and Hospital Systems: The table below displays the distribution of hospital and hospital system sites by size in North Carolina. There are 162 hospitals in the state: 78 are in rural areas and 84 are in urban areas. There are a total of 33 hospitals systems, consisting of 118 hospitals; the remaining hospitals are independently-owned. For purposes of the financial modeling exercise, a hospital with licensed beds is considered small; beds is considered medium, and more than 300 beds is considered large. Using this assumption, the majority of hospital sites are classified medium, and small sites make up the smallest number of hospitals. Sites Provider Type Large Medium Small Total Hospital Systems Hospitals Total Figure A3. Hospital and Hospital Systems Rural Health Clinics and Federally Qualified Health Centers: There are 86 rural health clinics (RHCs) and 28 Federally Qualified Health Centers (FQHCs) in the state. Of the 28 FQHCs, 26 are health center grantees and represent 136 locations. Two are Federally Qualified Health Center Look-Alike organizations that represent six locations. Within the RHC and FQHC network, there are 155 physicians; 101 nurse practitioners/physician assistants/certified nurse midwives; 434 nurses and other medical personnel; and 51 dentists. In 2008, North Carolina s network of FQHCs and RHCs served 389,841 patients, of which 49% of patients were uninsured (192,301) and 21% received Medicaid (82,126). Free Health Clinics: According to information from the CareNet Foundation, an organization that supports the distribution of donated medicine to community pharmacies and patients in need, North Carolina has a total of 45 free health organizations. These 45 organizations consist of 57 sites, of which 20 are small, 27 are medium, and 10 are large. The table below shows free health organizations with more than one site. Community Care of North Carolina has the largest presence of sites in the state. Organization Name Total Sites Community Care 6 Free Clinic of NC 3 Good Samaritan 3 Open Door Clinic 2 Helping Hands 2 Community Clinic 2 Figure A4. Most Prevalent Free Health Clinics (with more than one site) Statewide HIE Operational Plan 191

200 Pharmacies: There are approximately 2,000 pharmacies in North Carolina, and the majority (1,200) are retail chain pharmacies. Approximately 600 are independent retail pharmacies and 200 are hospitalbased pharmacies. Most of North Carolina s community pharmacies (96%) have the ability to receive electronic prescriptions and refill requests; the national average is 85%. There were 3,432 physicians routing prescriptions by year-end of Below are three graphics from Surescripts that illustrating this data Physicians Routing Prescriptions at Year End 1,275 3,283 3,432 Community Pharmacies Activated for E- Prescribing at Year-End 3 1,288 1,568 1,777 Figure A5. E-Prescribing Adoption Metrics from Figure A6. E-Prescribing Adoption Percentages from Figure A7. E-Prescribing Utilization Percentages from Statewide HIE Operational Plan 192