North Carolina Health Information ExchangeGovernance Workgroup

Date: May 12, 2011Time: 9:00 am – 11:00 am

Location: NC Institute of Medicine630 Davis Drive, Morrisville, NC

Dial in: 1-866-922-3257; Participant Code: 654 032 36#

2

Agenda

Topic Leads Time

Welcome• Roll call• Review progress to date and today’s objectives

Co-Chairs 9:00 – 9:10

NC HIE Update NC HIE CEO 9:10 – 9:20

Recommendations for an Oversight and Enforcement Framework Co-Chairs & Manatt

9:20 – 10:45

Next Steps Co-Chairs & Manatt

10:45 – 10:50

Public Comment N/A 10:50 – 11:00

3

Statewide HIE Governance...Primary Tasks1. Who Will Participate in Statewide HIE Status1. Participation Model Board determined participation to be voluntary

Board determined that participation would be through “Qualified Organizations”

2. Definition of Qualified Organization Board approved definition of a Qualified Organization Board approved principles for Qualified Organizations

3. Candidates for Qualified Organizations Workgroup and Board identified candidate types of organizations4. Criteria for Qualified Organizations Workgroup developed recommendations for Qualified Organization

selection criteria QO selection recommendations to be presented to Board

2. Rules and Policies for Participation Status

1. Participation Mechanism Board determined that Qualified Organizations must sign a participation agreement with NC HIE

2. Terms and Conditions To be developed and informed by Governance, Legal/Policy and Clinical/Technical Operations Workgroups

3. Enforcement and Oversight Status1. Enforcement Approach Board determined that there will be a process and policies

established for ongoing oversight2. Enforcement and Oversight Roles and

ResponsibilitiesTo be developed

3. Enforcement and Oversight Mechanisms To be developed

4

NC HIE Update

5

Oversight and Enforcement Framework

6

Oversight and Enforcement: Key Questions

1. What are the source of oversight and enforcement authority for statewide HIE?

2. Who oversees and enforces participation requirements for QOs?

3. How are the rules established and what is the nature of the relationships between NC HIE, QOs, and QO Participants?

4. How should the NC HIE monitor compliance with its requirements?

5. What are the mechanisms for enforcement of statewide HIE requirements?

7

Source of Authority & Entity for Oversight and Enforcement

1. What is the source of oversight and enforcement authority for statewide HIE? Legislation Regulation Contract (Participation Agreement)

2. Who oversees and enforces participation requirements for QOs? State Agency NC HIE Other (Accreditation entity, etc.)

The Board has agreed that QOs participating in the statewide network be legally bound to comply with participation requirements (or “Statewide Policy Guidance”) via contracts.

The Governance WG has agreed that the NC HIE (and/or its third-party delegates) should oversee/enforce participation requirements for QOs

8

Framework for Oversight & Enforcement of Statewide HIE

Who sets the rules?NC HIE

The NC HIE creates a common and consistent set of rules

(“Statewide Policy Guidance”) for participants and contracts with Qualified OrganizationsContract between NC HIE and intermediary

(in this case Qualified Organizations)

Qualified Organizations: abide by and enforce the rules.

QOs allow participants (clinicians, authorized users, etc.) to use statewide system by requiring all local

users to abide by statewide rules through participation agreements or other such

mechanisms.

What if the QO breaks the rules?The NC HIE has enforcement authority

and would need to evaluate and determine whether to impose

sanctions.

What if a QO Participant breaks the rules?The QO is responsible for monitoring and

enforcing QO participants’ compliance with NC HIE participation requirements.

9

Mechanisms for Oversight of Statewide HIE (DRAFT Recommendation – FOR DISCUSSION ONLY)

The NC HIE could implement a range of oversight mechanisms, including:

• “Proactive” Oversight Mechanisms QO application process and conformance to criteria/requirements QO renewal of status NC HIE convene meetings with QOs (periodic or as needed) to identify

risks, discuss best practices, and engage in “self-policing” NC HIE conduct routine technical audits of Statewide HIE Network NC HIE conduct random audits of QO compliance

• “Reactive” Oversight Mechanisms QO reports violations committed by itself and/or QO participants Complaint and/or “whistleblower” process

10

Mechanisms for Enforcement of Statewide HIE Requirements(DRAFT Recommendation – FOR DISCUSSION ONLY)

The NC HIE should implement a range of enforcement actions that may include

NC HIE’s enforcement actions would depend upon the severity of the violations1. For actions meriting development of a corrective action plan or written notification of a violation,

NC HIE staff would initiate corrective action with the QO and escalate as necessary.

2. For actions meriting revocation or suspension of QO status, NC HIE staff would call upon the Board to take immediate action.

Development of Correction Action Plan

“Cease and Desist” Order/ Written Notification of

Violation

Suspension of QO Status

Revocation of QO Status

11

Suspension of QO Status(DRAFT Recommendation – FOR DISCUSSION ONLY)

A QO’s status may be suspended at the discretion of the NC HIE for:

• Any violation of NC HIE policies and procedures and/or the participation agreement that presents a material likelihood of the unauthorized disclosure of confidential health information

• Any violation of NC HIE policies and procedures and/or the participation agreement that presents a material likelihood of compromising the technical systems or networks of the NC HIE or any other participant in the NC HIE

• Failure to remedy any other violation of NC HIE policies and procedures and/or the participation agreement within 30 days of receipt of written notice

• Failure to pay any amount due under the participation agreement for more than 30 days after the date on which such amount was due

• Failure to maintain any required insurance coverage

Development of Correction Action Plan in

Consultation

“Cease and Desist” Order/ Written Notification of

Violation

Suspension of QO Status

Revocation of QO Status

The duration of the suspension period will be at the sole discretion of the NC HIE and should relate to the seriousness of the infraction and demonstration that the issue has been remedied.

12

Revocation of QO Status(DRAFT Recommendation – FOR DISCUSSION ONLY)

A QO’s status should be revoked at the discretion of the NC HIE for:

• Failure to submit and/or implement any required plan of correction by the applicable deadline

• Failure to pay amounts due under the participation agreement for more than 60 days after the date on which such an amount was due

• Failure to maintain any required coverage that lasts for more than 30 days

• Bankruptcy

• Fraud or other financial misconduct

Development of Correction Action Plan in

Consultation

“Cease and Desist” Order/ Written Notification of

Violation

Suspension of QO Status

Revocation of QO Status

13

Next Steps

14

Governance Workgroup – Next Steps

• Develop recommendations oversight and enforcement procedures for:– Board review of requests for suspension and termination– Dispute resolution– Organizations seeking to voluntarily rescind QO status

15

NC HIE Workgroups...Working Timelines

Jan Feb Mar Apr May Jun Jul

Develop Qualified Org CriteriaDevelop Qualified Org CriteriaQualified Organizations

Qualified Organizations

Participation Agreements

Participation Agreements

Develop Participation AgreementDevelop Participation Agreement

Tasks

Legal/Policy WorkstreamLegal/Policy Workstream

Finalize draft legislationFinalize draft legislation

2011

Enforcement and OversightEnforcement and Oversight

Define Oversight Roles and Enforcement Mechanisms

Define Oversight Roles and Enforcement Mechanisms

Develop RFPDevelop RFP Review, Negotiate, AwardReview, Negotiate, AwardCore ServicesCore Services Deploy Services Deploy Services

Develop Privacy and Security Policy and ProceduresDevelop Privacy and Security Policy and Procedures

16

Public Comment