Date: July 9, 2010 Time: 10:30 am – 1:00 pm Location: NC Hospital Association 2400 Weston Parkway,...

Date: July 9, 2010Time: 10:30 am – 1:00 pm

Location: NC Hospital Association 2400 Weston Parkway, Cary, NC 27513

Dial in: 1-866-922-3257 Participant Code: 654 032 36#

North Carolina Health Information Exchange

Legal/Policy Subcommittee Meeting

Discussion Document – Not Intended for Distribution 2

Agenda

Topic Leads Time

Roll Call and Housekeeping

Meeting Objectives

Updates from Other Workgroups

Co-Chairs & Brenda Pawlak

10:30 – 10:50

Additional Key Aspects of Consent Policies for HIE Under Pathway 1

Co-Chairs & Manatt

10:50– 12:45

Open Public Comment 12:45 – 1:00


New NC Health IT Website Launched

www.healthit.nc.gov

Discussion Document – Not Intended for Distribution

Meeting Schedule Revisions

July 2010SUNDAY MONDAY TUESDAY WEDNESDAY THURSDAY FRIDAY SATURDAY

4 5 6 7 8 Workgroups Location: NCHA 8:30a-11a Governance 11:30a – 2:00p Tech/Clin 4:00p-6:30p Finance

9 Legal/Policy Location: NCHA 10:30a-1:00p – Combined Legal and Policy Subcommittees

NO Security Subcmte

10

11 12 13 Board Location: NC IOM 1:00p – 3:30p Board Meeting

14 Legal/Policy Location: NCHA 10:30a-1:00p – Combined Legal and Policy Subcommittees

1:30p-3:30p – Security Subcommittee

15 Workgroup Location: NCHA 11:00a – 12:30p - Full Legal/Policy Workgroup

(CANCELLED)

16 17

18 19 20 21 Legal/Policy Location: NCHA 10:30a-1:00p – Combined Legal and Policy Subcommittees

NO Security Subcmte

22 Workgroups Location: NC IOM 8:30a-11a Governance 11:30a – 2:00p Tech/Clin 4:00p – 6:30p Finance

23 24

25 26 27 Legal/Policy Location: NCHA 10:30a-1:00p – Combined Legal and Policy Subcommittees

1:30p-3:30p – Security Subcommittee

28 29 Workgroup Location: NC IOM 11:00a – 1:30p - Full Legal/Policy Workgroup

30 31


Meeting Objectives

• Reach consensus on other key aspects of HIE Consent Policy under Pathway 1 (i.e., assuming compliance with existing law) including:

o Where and By Whom Consent Is Obtainedo Consent for Uploadingo Granularity of Patient Control Over Health

Informationo Durability and/or Revocability of Consentso Emergency Access to PHI Absent Consento Minors Consent


Stakeholder

Outreach

Operational PlanStrategic Plan

NC Statewide HIE Cooperative Agreement Timeline

State HIE

Grant App.

Letter of Intent Submitted

Sept Oct Nov 09 May 2010 Jun Jul Aug Sep

Strategic Plan Submitted to HHS

Biweekly+ Workgroup Meetings with Monthly Board Meetings

• Convene Advisory Board & Workgroups

• Draft Operational Plan

• Publish Draft Operational Plan for Review

• Engage and educate stakeholders

Submit Operational Plan to HHS

Workgroups Formed & Begin Meeting

Publish Draft Operational Plan for Review/ Comment

Funding Announcemen

t

LaunchPhase 2

NC HIE

Formed


Drafting of Operation

al Plan

Operational Plan Consensus Recommendations

NC Statewide HIE Operational Plan Development Timeline

Workgroups formed

May 2010 June July Aug Sept

May 14 – initial NC HIE Board Meeting

• Compile NC HIE Board & Workgroup recommendations and decisions

• Draft Operational Plan – iterative process with WG review

• Publish Draft Operational Plan for Public Review

Aug. 31: Submit Operational Plan

to HHS

Governance WG: Confirm governance model, advise on scope of governance, craft recommendations on bylaws and board structure for new entity; develop recommendation for consumer engagement plan approach

Clinical/Technical WG: Recommendations on technical architecture approach for statewide HE, begin prioritization of core and value-added services, begin landscape assessment

Legal/Policy WG: Conduct legal scan for NC laws related to consent for treatment purposes; draft legal principles; conduct legal scan for NC laws related to health information data security; develop recommendations on approach to 4As; develop initial consent approach recommendation under existing lawFinance WG: Develop financial model assumptions; data collection to inform financial models.

Master project planning, develop WG charters and workplans; stakeholder meetings, Legal/Policy WG meetings

Workgroups formed

Governance WG: Participation policies and enforcement mechanisms for the statewide HIE; develop recommendations on roles of State in public/private partnership processes for coordination with other ARRA funded programs in the state

Clinical/Technical WG: Development of clinical and business use cases, prioritization for core and value-added services, technical approach

Legal/Policy WG: Finalize consent approach recommendation under existing law; develop recommendations for an “ideal” consent policy not restricted by current law and approach to changing the law; develop recommendations on breach policy principles and role based access principles; develop security recommendations beyond access; review emerging consent policies in neighboring states and identify barriers.Finance WG: Develop 2-3 financial models based on modeling assumptions and develop process for sustainability planning.


Policy Subcommittee– June 28, 2010 Meeting

Discussion Develop recommendation on Opt-In vs. Opt-Out patient consent framework that assumes the following:

The framework is compliant with current NC law (i.e., Pathway 1) The framework addresses only disclosure of clinical data for treatment purposes

Key Decisions

For Pathway 1 (assuming no change to the existing law), The Subcommittee recommended that the NC HIE adopt an Opt-In Consent Policy for disclosure of clinical data for treatment purposes

The Subcommittee weighed the following considerations:

An Opt-In Model is preferable to a Mixed Model because it does not require that information be filtered out of the patient record.

An Opt-In Model is preferable to a Mixed Model because it allows for one consent policy for all participants, thereby streamlining the consent process and reducing confusion.

An Opt-In Model has the disadvantage of potentially restricting the free flow of patient information to the detriment of patient care.


Policy Subcommittee– June 28, 2010 Meeting (cont.)

Discussion Develop preliminary recommendations on who obtains consent or who owns Opt-Out process.

Preliminary Decisions

The Subcommittee began discussion of who obtains consent in the recommended Opt-In Model. Though consensus was not reached, the Subcommittee made a preliminary recommendation that 1) consent be obtained at the point of access and 2) that, if the NC HIE technical model includes a data repository, consent not be required to upload/disclose data to the repository, provided that the uploaded/disclosed information is not accessible to participants prior to a patient authorizing access.*

The Subcommittee began discussion of whether consent will be universal, or whether patients will have control over 1) which providers can access their data through the exchange on a provider-by-provider basis and 2) which portions of their medical record will be made available through the exchange. Though consensus was not reached, the Subcommittee expressed a preliminary preference that Opt-In consent be universal (if a patient opts-in, all of the patient’s information in the exchange will be available to all participating providers; if a patient does not opt-in no information will be made available to any participating providers).

*NC law requires consent for the disclosure of health information for treatment by certain types of providers (and may require consent for disclosure of communicable disease information). Before

serious consideration is given to a consent for access policy that allows providers to upload/disclose information without consent, the NC HIE may need to consult state agencies to determine they will consider such a policy a violation of NC law. New York adopted this type of model but only with the

express consent of the appropriate governing authorities.


Pathway 1: Where and By Whom Should Consent Be Obtained?

Should consent be obtained by the disclosing provider or the accessing provider?

Option Pros Cons

Disclosing Provider • Allows the patient to decide which providers’ records are available through the exchange, and to restrict records from certain providers without having to opt-out of all exchange.

•Limits the amount of information available when providers access the exchange at the point of care (e.g. only information from providers a patient has recently seen will be presumably be available).

Accessing Provider • Assures that information will be available when providers access the exchange.

• Limits the patient’s ability to control which providers’ records are available through the exchange, as patients are forced to grant providers access to the records of all providers participating in the exchange.

• Could limit the ability of NC providers to engage in interstate HIE (e.g. Consent to access information obtained by SC providers presumably would not absolve NC providers of their requirements to obtain consent for certain disclosures under NC law).

10


Pathway 1: Where and By Whom Should Consent Be Obtained?

Should consumers have ability to authorizes disclosure and/or access on a provider-by-provider basis?

Options

Patient given the ability to:

1. Authorize a single provider to disclose records to all participating providers.2. Authorize a single provider to disclose records to specific providers.

3. Authorize a single provider to access records from all participating providers.4. Authorize a single provider to access records from specific participating providers.

5. Authorize all participating providers to disclose and/or access records from all participating providers.

11

Subcommittee Discussion of Pathway 1 at June 28 Meeting:

• If HIE adopts a repository model, Subcommittee members tended to favor uploading data prior to consent with accessing provider responsible for obtaining consent.

•Subcommittee members tended to not favor of allowing patients to deny access on a provider-by-provider basis.


Pathway 1: Should Consent Be Required for Uploading?

Should consent be required prior to “uploading” data? -Or - prior to accessing data post-upload?

Option Pros Cons

Consent prior to upload

• Provides a more robust level of protection by protecting information for which patients have not granted consent from various risks (e.g. the risk of breach while being held by the exchange).

• The HIE will be “empty” on Day 1 (limits value of early participation).

• Could delay availability of health information to providers accessing the exchange at the point of care.

• Information not available for emergency access.

No consent to upload

• Information is prepared and available to accessing providers on Day 1.

• Information is available for emergency access.

• Higher risk that information for which patients have not granted consent for disclosure could be breached while being held by the exchange.


Pathway 1: How Granular a Level of Control Should Consumers Have Over Their Health Information?

Should consumers be able to restrict the exchange of distinct data elements and/or information from specific encounters?

Option Pros Cons

Granular control over distinct data elements and/or encounter

•Provides protection for and builds consumers’ trust, thereby facilitating their participation in the exchange.

• Excluding sensitive health information can compromise quality of care.• Excluding sensitive health information could also create financial and operational burdens for HIE participants.•Concerns exist about reliability and complexity of restricting information by discrete data elements.

No granular control over distinct data elements and/or encounter

•Reduces burden on accessing providers who can be sure of completeness of patient record available through the exchange.

• May serve as deterrent to patient participation.

13


Pathway 1: How Durable and/or Revocable Should Consents Be?

How long should consumer consent last?

Option Pros Cons

Unlimited • Reduces administrative burden by allowing a single consent to last indefinitely unless revoked.

• Does not provide patient’s with regular opportunity to re-evaluate participation based on changing medical condition or preference.• Does not provide providers with opportunity to ensure that consent reflects any changes in patient preference or in legal requirements related to consent.

Time limited • Increases complexity and administrative burden by requiring that consent be regularly reaffirmed.

• Provides patients’ with regular opportunity to re-evaluate participation based on changing medical condition or preference. • Assures providers that consent reflects any changes in patient preference or in legal requirements related to consent.

Are there triggers that require consent to be reaffirmed and if so, what are they?

• Mental health information*• Other types of information?

14

* Note that in a consent to access model, every health care provider would be required to renew their consents consistent with NC law governing mental health information because there would be no way of knowing whether

or not mental health information was in the exchange. Under a consent to disclose model, only mental health providers would have to renew their consents consistent with the law.


Pathway 1: Should Access to PHI Be Permitted in An Emergency Even Absent Patient Consent?

Should there be “break the glass” capacity?

Option Pros Cons

Capacity to “Break the Glass” in an Emergency*

• Patient information critical to treatment can be accessed in an emergency situation in which the patient is unconscious or otherwise unable to give consent.

• Risk that patient who would not otherwise consent to disclosure may have information disclosed without consent.

No Capacity to “Break the Glass” in an Emergency

• Ensures that no patient who would otherwise not consent to disclosure has their any of their information disclosed without consent.

• Patient information critical to treatment can not be accessed in an emergency situation in which the patient is unconscious or otherwise unable to give consent.

15

* Note that any decision about whether to allow for break the glass access should be informed by the opinion of NCHHS or other governing authorities as to whether such access would violate NC law, which requires consent for treatment by certain providers (and potentially requires consent for the disclosure of communicable disease

information.)


Pathway 1: How Should Services to Which Minors May Consent Be Handled?

Should NC HIE segregate or otherwise filter information on minors from the exchange to ensure that information on such services will not be disclosed to parents, either via a patient

portal or “downstream” provider, without patient consent?

Option Pros Cons

Segregate minors’ health information from exchange

• Ensures that information on minor’s consent services is not disclosed to the exchange without the minor’s consent where required, or that such information will be inadvertently disclosed to parents either via a patient portal or a “downstream” provider.

• Restricts volume of data available in the exchange. • Reduces value of HIE for pediatricians.• Excluding minor’s information can result in an incomplete patient record and negatively impact quality of care. .

Do not segregate minors’ health information from exchange

• More information available via the exchange. • Greater value for pediatricians participating in the exchange. • Reduces burden on accessing providers who can be sure of completeness of patient record available through the exchange.

•Risk that information on minor’s consent services will be disclosed to the exchange without minor’s consent, or that such information will be inadvertently disclosed to parents either via a patient portal or “downstream” provider.

16


Other Consent Issues for Future Consideration

• “Mechanics” of consent• Public health reporting• De-identified data• Improvement and evaluation of local/community HIO

operations• Disclosures to government agencies for health oversight• Requests for restrictions on disclosures to payer

organizations (new HITECH requirement)• Others?


Next Steps

• Upcoming Meetingso Board Meeting – July 13th o Next Legal/Policy Subcommittee Meeting and Security

Subcommittee Meeting – July 14th

• Questions or Comments? o Contact: [email protected]

Open Public Comment

ATTACHMENTS


Comparative Analysis of Select State Consent Policies

Policies Apply Statewide?

Health Records Available through HIE?

Utilizes Model Statewide Form?

How Were Policies Developed & How Are They Enforced?

VT • Yes. VT operates a statewide HIE called the VT Health Information Exchange (“VHIE”) operated by VT Info Tech Leaders (“VITL”). It is the only HIE in the state.

• All PHI as defined under HIPAA is eligible to be included.

• Currently exchange a standard CCD document

• Yes. VITL provides patient consent and withdrawal forms to physician practices and other HIE participants.

• Policies developed by VITL staff and board members.

• Participants must comply as a condition of participation in VHIE.

RI • Yes. RI operates a statewide HIE called “currentcare.” It is the only HIE in the state.

• currentcare currently includes lab and pharmacy data.

• Intent is for all information for which exchange standards exist to be available through the HIE.

• Yes.Currentcare provides form.

• Codified in state law (RI HIE Act of 2008).

• Participants must also comply with policies as a condition of participation in currentcare.

MA • No. Policies applied only to the 3 MAeHC pilot HIEs, which did not cover the entire state. The MAeHC pilot program has concluded. There are other HIEs in the state to which these policies did not apply.

• “Shared Health Summary,” which included: medication list, problem list, diagnosis, immunizations, allergies, smoking status, vital signs, procedures, lab results, & radiology results.

• Sensitive health information was included.

• No. • Policies developed and agreed to by the pilots through a collaborative process.

• Pilots agreed to comply with them as a condition of receiving grant funding under the MAeHC pilot program.

NY • Yes. Policies apply to all HIEs participating in the Statewide Health Information Network of NY (“SHIN-NY”) and receiving state grant funds under the HEAL-NY program.

• Depends on the HIE.• Statewide policies do not proscribe any

restrictions on the types of records that may be exchanged. Policies suggest that HIEs assess the legal risks of making records of federally assisted alcohol and substance abuse treatment centers (42 CFR Part 2) available through the exchange.

• Yes. Changes require approval of the Department of Health.

• Policies developed by stakeholders through a consensus-driven process.

• HIEs must comply with policies as a condition of receiving grant funding under the HEAL-NY program.



Policies Apply Statewide?

Health Records Available through HIE?

Utilizes Model Statewide Form?

How Were Policies Developed & How Are They Enforced?

MN • Yes. There are currently two operational HIEs in MN. The consent policy described here applies to/serves as a baseline for both.

• The state statute governing HIE defines health records as any information that relates to the past, present, or future physical or mental health or condition of a patient.

• HIEs are free to determine what records to include/exclude from exchange.

• No. • Codified in state law (MN Health Records Act)

• HIEs must comply with state law when developing their own consent policies.

ME • Yes. ME operates a statewide HIE called “HealthInfoNet.” It is the only HIE in the state.

• Labs, imaging reports, prescriptions, allergies, discharge summaries, operative and consultant reports, problem lists, office visit notes.

• Information from substance abuse treatment facilities (42 CFR Part 2) and mental health providers as well as HIV test results and psychotherapy notes are excluded.

• Yes. • HealthInfoNet

posts opt-out form on website.

• Providers may also provide forms to patients at provider sites.

• State law governing consent for disclosure of health records was amended to explicitly allow disclosure to a HIE for specified purposes without consent as long as patients could opt-out.

• Participants must comply with policies as a condition of participation in HealthInfoNet.

NE • Yes. NE operates a statewide HIE called “NeHII.” There is, however, another HIE in the state that is not subject to NEHII’s policies.

• Lab & x-rays, medication & immunization history, transcribed diagnostic & treatment records, allergies & drug interactions, & other transcribed clinical reports created after NeHII’s start date.

• Records related to alcohol & substance abuse treatment programs, emergency protective custody proceedings, genetic testing, HIV testing, and mental health treatment are excluded.

• NeHII maintains opt-out form on website.

• Forms may be provided by and returned to participant sites.

• Policies were developed by NeHII’s Privacy & Security Workgroup (a committee of the NeHII Board).

• Participants must comply with policies as a condition of participation in NeHII.



Opt-in or Opt-out?

Can Patients Control Whether & Which Providers May Make Records Available through the Exchange?

Can Patients Control What Types of Records Providers Make Available through the Exchange?

Can Patients Control Whether and Which Providers May Access Records through the Exchange?

Can Patients Control What Types of Records Providers May Access through the Exchange

VT In • Yes. Patient consent is required to enable data sharing between providers. Once opt-in given, any treating participating provider may make records available through the HIE.

• No. All of a provider’s records that fall within the scope of the information included in the exchange are made available.

• Yes. Patient consent is required to enable data sharing between providers. Once opt-in given, any treating participating provider may access records available through the HIE.

• No.

RI In • Yes. Patient consent is required before providers may make records available.

• By enrolling in currentcare, patients grant consent to all of their treating participating providers (at once) to make their information available.

• No. All of a provider’s records that fall within the scope of the information included in the exchange are made available.

• Yes. Patient consent is required before providers may access available records.

• Patients may grant this consent on a provider by provider basis.

• Patients may also grant consent to all treating providers only in an emergency.

• No.

MA In • Yes. Patient consent was required before providers could make records available.

• Patients were able to grant this consent on a provider by provider basis.

• All of a provider’s records that fell within the scope of the information included in the exchange (the “Shared Health Summary”) were made available. However, certain sensitive information (HIV and genetic test results) required a patient’s consent each time it was made available.

• No. All treating participating providers could access available records.

• No.



Opt-in or Opt-out?

Can Patients Control Whether & Which Providers May Make Records Available through the Exchange?

Can Patients Control What Types of Records Providers Make Available through the Exchange?

Can Patients Control Whether and Which Providers May Access Records through the Exchange?

Can Patients Control What Types of Records Providers May Access through the Exchange

NY In • No. • No. • Yes. Patient consent is required before providers may access available records.


• No.

MN Hybrid • No. If a patient’s identifying information is included in a RLS, the patient can’t control which providers may make their records available through the exchange. Patients may, however, opt-out of having their identifying information in a RLS, thereby opting out of the exchange entirely.

• Not required by the statute• Different HIEs free to set

policies at their discretion.

• Yes. Patient consent is required before providers may access available records (and before they may search for a patient in a RLS).


• Not required by the state statute.

• Different HIEs free to set policies at their discretion.

ME Out • No. • No. • No. • No.

NE Out • No. • No. • No. • No.



What Uses Are Permitted by Consent? If Additional Uses, What are the Attendant Requirements?

Duration/Revocation How is consent to make available and/or access records about services to which a minor consented on his/her own obtained?

Is Emergency Access (Break the Glass) Permitted?

VT • TPO as defined under HIPAA.

• “Quality Review” by health plans, insurers or other 3rd party payers with specific patient authorization.

• De-identified data may be used for research, QI and public health.

• Until revoked (if no expiration date).

• Consents for providers to release records covered by 42 CFR Part 2 must have an expiration date.

• Patients receive reminder every 5 years that they have right to withdraw consent.

• Under consideration. • N/A.

RI • Coordination of care and public health (broadly defined in statute)

• Until revoked. • Records for minors are made available and accessed based on parents’ consent.

• Yes.

MA • TPO• Quality improvement, and

business operations.

• Two years.• Consents can be revoked

at will.

• Records for minors between select ages were excluded from exchange.

• N/A.

NY • Level1: Treatment, quality improvement, care management, and insurance coverage reviews.

• Level 2: Any uses of PHI other than Level 1 uses, including but not limited to payment, research and marketing.

• Consent for Level 1 uses: until revoked.

• Consent for Level 2 uses: must be time-limited & expire no more than 2 years after execution unless a longer duration is required to complete a research protocol.

• Records for minors age 10 & over are excluded from exchange.

• Yes.



What Uses Are Permitted by Consent? If Additional Uses, What are the Attendant Requirements?

Duration/Revocation How is consent to make available and/or access records about services to which a minor consented on his/her own obtained?

Is Emergency Access (Break the Glass) Permitted?

MN • Not addressed by the statute.

• Different HIEs free to set policies at their discretion.

• Consent to access clinical information: 1 year unless a lesser period is specified in the consent or otherwise required by law.

• Consent to make patient identifying information available to RLS: No expiration

• Not addressed by the statute.• Different HIEs free to set

policies at their discretion.

• Yes. Providers may access a RLS and available clinical records without consent in an emergency. If a patient has opted-out of the RLS, however, there will be no records available to view in an emergency.

ME • Treatment. • N/A • Records for minors are included in the exchange unless the minor or his/her parent opts-out.

• N/A. If a patient has opted-out of the exchange, there will be no records available to view in an emergency.

NE • Treatment and payment. • N/A • Information about STD testing or treatment of minors consented to by the minor is excluded from exchange.

• No by choice. Information about patients who opt-out is available but not accessible.


Expectations of the NC HIE Workgroups

• Participants have been nominated and invited to participate by the NC HIE governing board co-chaired by Secretary Lanier Cansler and Dr. Charlie Sanders for your expertise in your field and your commitment to improving health care quality, access, and affordability for all North Carolinians.

• Workgroup members are asked to draw on their expertise and perspective from across industries sectors with an eye toward supporting the greater goal of a statewide resource for North Carolina.

• Workgroups are expected to be multi-stakeholder, nonpartisan and all discussions, meetings and decision-making processes to be fully transparent.

• Workgroups are asked to consider multiple stakeholder group perspectives when working toward solutions.

• Workgroups will be asked to make consensus-based recommendations to the NC HIE governing board. In cases where consensus is not reached, the workgroup is expected to put forth a balanced, fair consideration of the pros and cons of an issue.

• Workgroup members are expected to respect the opinions and input of others and to engage in fair meeting conduct to work toward consensus recommendations.

• Workgroup members are strongly encouraged to attend meetings in person whenever possible.

• Public stakeholder input is encouraged.

Date: July 9, 2010 Time: 10:30 am – 1:00 pm Location: NC Hospital Association 2400 Weston Parkway,...

Documents

Transcript of Date: July 9, 2010 Time: 10:30 am – 1:00 pm Location: NC Hospital Association 2400 Weston Parkway,...