Date : May 12, 2011 Time : 9:00 am – 11:00 am Location : NC Institute of Medicine 630 Davis Drive, Morrisville, NC

1. Date: May 12, 2011 Time: 9:00 am – 11:00 am Location: NC Institute of Medicine 630 Davis Drive, Morrisville, NC Dial in: 1-866-922-3257; Participant Code: 654 032 36#

2. Agenda

3. Statewide HIE Governance...Primary Tasks

4. NC HIE Update

5. Oversight and Enforcement Framework

6. Oversight and Enforcement: Key Questions • What are the source of oversight and enforcement authority for statewide HIE? • Who oversees and enforces participation requirements for QOs? • How are the rules established and what is the nature of the relationships between NC HIE, QOs, and QO Participants? • How should the NC HIE monitor compliance with its requirements? • What are the mechanisms for enforcement of statewide HIE requirements?

7. Source of Authority & Entity for Oversight and Enforcement 1. What is the source of oversight and enforcement authority for statewide HIE? • Legislation • Regulation • Contract (Participation Agreement) 2. Who oversees and enforces participation requirements for QOs? • State Agency • NC HIE • Other (Accreditation entity, etc.) The Board has agreed that QOs participating in the statewide network be legally bound to comply with participation requirements (or “Statewide Policy Guidance”) via contracts. The Governance WG has agreed that the NC HIE (and/or its third-party delegates) should oversee/enforce participation requirements for QOs

8. Framework for Oversight & Enforcement of Statewide HIE Who sets the rules? NC HIE The NC HIE creates a common and consistent set of rules (“Statewide Policy Guidance”) for participants and contracts with Qualified Organizations Contract between NC HIE and intermediary (in this case Qualified Organizations) Qualified Organizations: abide by and enforce the rules. QOs allow participants (clinicians, authorized users, etc.) to use statewide system by requiring all local users to abide by statewide rules through participation agreements or other such mechanisms. What if the QO breaks the rules? The NC HIE has enforcement authority and would need to evaluate and determine whether to impose sanctions. What if a QO Participant breaks the rules? The QO is responsible for monitoring and enforcing QO participants’ compliance with NC HIE participation requirements.

9. Mechanisms for Oversight of Statewide HIE (DRAFT Recommendation – FOR DISCUSSION ONLY) The NC HIE could implement a range of oversight mechanisms, including: • “Proactive” Oversight Mechanisms • QO application process and conformance to criteria/requirements • QO renewal of status • NC HIE convene meetings with QOs (periodic or as needed) to identify risks, discuss best practices, and engage in “self-policing” • NC HIE conduct routine technical audits of Statewide HIE Network • NC HIE conduct random audits of QO compliance • “Reactive” Oversight Mechanisms • QO reports violations committed by itself and/or QO participants • Complaint and/or “whistleblower” process

10. Mechanisms for Enforcement of Statewide HIE Requirements(DRAFT Recommendation – FOR DISCUSSION ONLY) The NC HIE should implement a range of enforcement actions that may include NC HIE’s enforcement actions would depend upon the severity of the violations • For actions meriting development of a corrective action plan or written notification of a violation, NC HIE staff would initiate corrective action with the QO and escalate as necessary. • For actions meriting revocation or suspension of QO status, NC HIE staff would call upon the Board to take immediate action.

11. Suspension of QO Status(DRAFT Recommendation – FOR DISCUSSION ONLY) A QO’s status may be suspended at the discretion of the NC HIE for: • Any violation of NC HIE policies and procedures and/or the participation agreement that presents a material likelihood of the unauthorized disclosure of confidential health information • Any violation of NC HIE policies and procedures and/or the participation agreement that presents a material likelihood of compromising the technical systems or networks of the NC HIE or any other participant in the NC HIE • Failure to remedy any other violation of NC HIE policies and procedures and/or the participation agreement within 30 days of receipt of written notice • Failure to pay any amount due under the participation agreement for more than 30 days after the date on which such amount was due • Failure to maintain any required insurance coverage The duration of the suspension period will be at the sole discretion of the NC HIE and should relate to the seriousness of the infraction and demonstration that the issue has been remedied.

12. Revocation of QO Status(DRAFT Recommendation – FOR DISCUSSION ONLY) A QO’s status should be revoked at the discretion of the NC HIE for: • Failure to submit and/or implement any required plan of correction by the applicable deadline • Failure to pay amounts due under the participation agreement for more than 60 days after the date on which such an amount was due • Failure to maintain any required coverage that lasts for more than 30 days • Bankruptcy • Fraud or other financial misconduct

13. Next Steps

14. Governance Workgroup – Next Steps • Develop recommendations oversight and enforcement procedures for: • Board review of requests for suspension and termination • Dispute resolution • Organizations seeking to voluntarily rescind QO status

15. NC HIE Workgroups...Working Timelines Core Services Develop RFP Review, Negotiate, Award Deploy Services Legal/Policy Workstream Finalize draft legislation Develop Privacy and Security Policy and Procedures Qualified Organizations Develop Qualified Org Criteria Participation Agreements Develop Participation Agreement Enforcement and Oversight Define Oversight Roles and Enforcement Mechanisms

16. Public Comment