Date : July 2, 2010 Time : 8:30 am – 9:30 am Location : NC Hospital Association

1. Date: July 2, 2010 Time: 8:30 am – 9:30 am Location: NC Hospital Association 2400 Weston Parkway, Cary, NC 27513 Dial in: 1-866-699-3239  Code:  668 808 510 Webinar Login:https://manattevents.webex.com/manattevents/onstage/g.php?t=a&d=668808510 Webinar Password: NCHIE

2. Agenda • Welcome/Introduction • ONC Requirements • Role of consent in HIE • Consent Policy Influencers • Legal Framework for Consent • Implications of NC Law for NC Consent Policy • Example Statewide HIE Consent Policy: NY • Key Info to Inform Future Consent Policy Decisions

3. ONC Requirements The ONC Statewide HIE Cooperative Agreement outlines specific requirements across five domains: • Governance, Legal & Policy, Business & Technical Operations, Technical Infrastructure and Finance. Legal & Policy Domain: • “The mechanisms and structures in this domain address legal and policy barriers and enablers related to the electronic use and exchange of health information. These mechanisms and structures include but are not limited to: policy frameworks, privacy and security requirements for system development and use, data sharing agreements, laws, regulations, and multi-state policy harmonization activities. The primary purpose of the legal/policy domain is to create a common set of rules to enable inter-organizational and eventually interstate health information exchange while protecting consumer interests.” One of the ONC program evaluation questions is, by the two-year mark: • Has the governance organization developed and implemented privacy policies and procedures consistent with state and federal requirements?

4. Consumer consent is the tool by which consumers control the exchange of their health information through a HIE. The NC statewide HIE collaboration process is tasked with determiningto what extent, and how, consumers should be able to control such exchange. Consent is but one of many privacy and security tools. Other features that should influence NC’s consent policy decision include: Uses of health information available through the exchange; Filtering of sensitive health information through the exchange; Whether and to what extent consumers may control what providers are allowed to share and/or access their information; Ability to “break the glass” to obtain health information in emergency situations where consumer consent has not been granted; Nature and breadth of consumer outreach and education efforts related to the consent decision; and Extent of security, enforcement, and remedies in place. The Role of Consent in HIE

5. Competing Influences on a State’s Consent Policy1 • Patients Want: • Meaningful control over and protection of their health information • Quality, well-coordinated care • Providers Want: • To deliver quality, well-coordinated care • Maximal quantity and quality (i.e., utility) of data • Protection against liability • Minimal administrative burden and cost • Payers Want: • Maximal patient and provider participation • Minimal burden and cost • Access to data • Exchanges Want: • Maximal patient and provider participation • Maximal flexibility to sustain the exchange • Minimal administrative / operational burden • Maximal ability to provide value to participants 1Melissa Goldstein and Alison Rein. “Consumer Consent Options for Electronic Health Information Exchange: Policy Considerations and Analysis.” Prepared for the Office of the National Coordinator for Health IT. March 23, 2010

6. Legal Framework for Consent • Federal and state laws regulating the disclosure of patient health information provide a framework for the development of a consent policy for statewide HIE in North Carolina.

7. Implications of NC Law for NC Consent Policy • Allowing exchange without affirmative consumer consent (through a pure opt-out or no consent model) appears infeasible absent a change in law. • Existing NC law requires consent for 1) disclosure by certain types of care providers and 2) disclosure of certain types of health information. • A “mixed” opt-in and opt-out or no consent model could conceivably be implemented provided: • Substance abuse treatment providers, mental health facilities, nursing homes and possibly home health agencies obtain affirmative consent before disclosing information through the HIE. • Providers obtain affirmative consent before disclosing information about reportable communicable diseases or such information is filtered out of the HIE.

8. Example Statewide Consent Policy: New York’s SHIN-NY (Opt-in) • RHIO Participants must obtain written patient consent before accessing a patient’s health information through a RHIO • Includes all of a patient’s information (e.g. Sensitive Health Information) • RHIOs and their Participants must use a standard consent form provided and/or approved by the State • RHIO Participants may upload or otherwise make available through an edge server or other means information to the RHIO without consent provided that: • The RHIO is serving as the Participant’s Business Associate; and • The RHIO does not make the information accessible to other RHIO Participants until written consent is obtained authorizing such access.

9. The health information of Maine residents is included in HealthInfoNet unless the consumer opts-out using the form pictured here. Under Maine law, no consent was required for health care providers and facilities to disclose information for TPO.2 Maine amended the law to explicitly allow disclosure to a HIE for TPO but statutorily required that consumers be allowed to opt-out.3 Example Statewide Consent Policy: Maine’s HealthInfoNet (Opt-out) 222 MRSA 1711-C. 3 SP 570, LD 1490. ME PL Chapter 387. June 12, 2009.

10. Status of Legal/Policy Workgroup Deliberations to Date • The Legal Subcommittee has conducted an initial scan of NC state laws that address consent to disclose patient information for treatment purposes to provide input to policy subcommittee, which is studying and discussing consent policy models. • Review of state laws suggests that existing NC law points toward a consent policy that would require patient consent to disclose via a HIE for treatment purposes, as existing NC law requires consent for 1) disclosure by certain types of care providers and 2) disclosure of certain types of health information. • The Policy Subcommittee has recommended a two-pathway approach to developing a consent policy: one that assumes existing NC law remains as is, and, if desirable, a second pathway that would provide a different consent policy for the HIE but might require changes to NC law. • The full Legal/Policy Workgroup will be reviewing the Policy Subcommittee’s recommendation on a consent model under existing law on July 2, 2010. • The Legal/Policy Workgroup will submit its recommendation for approach under existing law to the NC HIE Board at the July 13, 2010 board meeting.

11. Key Information to Inform Future Consent Policy Decisions • Both patient and provider participation are necessary to facilitate better care delivery and advance other societal goals (e.g., improved public health), as well as to ensure the viability of HIE. • Evidence shows that both opt in and opt-out consent models can generate sufficient patient and provider participation to achieve the critical mass necessary for system function and the realization of key goals.4 • Adoption of an appropriate consent model, coupled with responsible policies dictating the types of information included in the exchange, the nature and number of entities granted access to the information, the purposes for which the information can be used, the durability and revocability of consumer consent, and the extent of security, enforcement, and remedies in place, will help to build trust in North Carolina’s statewide HIE network while meeting clinical goals. 4Melissa Goldstein and Alison Rein. “Consumer Consent Options for Electronic Health Information Exchange: Policy Considerations and Analysis.” Prepared for the Office of the National Coordinator for Health IT. March 23, 2010

12. ATTACHMENTS

13. Common Consent Models • Consumer consent models for HIE include: • Opt-in: Typically requires affirmative authorization from the consumer, often through signing a standardized consent form, before a consumer’s health information may be exchanged through the network. • Opt-out: Typically requires that the consumer is given notice – through mailings, brochures, posted notices or other means - and allows a consumer’s health information to be exchanged through the network unless and until the consumer formally requested that it not be. • No-consent2: Consumers’ health information is automatically included in an exchange and the consumer is not given the express opportunity to opt-out. • A mixed model can be created as well. 2 The no consent model does not relieve covered entities from complying with provisions under HIPAA governing patient rights, including the patient’s right to make a request to restrict the disclosure of their PHI for TPO. HIPAA also outlines other situations in which PHI may not be disclosed without express consent.

14. Consent Model Options 14

15. 15