Legal Agreements and Policy Work Group Co-facilitators: Linda Attarian and Jill Moore Dial: Enter room#: * * (don’t forget the asterisks before and after the room #) 2:00 pm, November 16, 2009

Agenda Welcome/roll call Status Report of the NC Cooperative Agreement Initiative: (Vandana and Melanie) – Submission of Application/Strategic Plan on Oct. 16, 2009 – Operational Plan – Target Date: – Update on Work Groups and Current Activities of HWTF NC HIE Governance Entity – in progress (Vandana) Need for a “Statewide Collaborative Process for Privacy and Security” to guide NC HIE Operational Plan re Policy/Legal goals and tasks outlined in NC HIE Strategic Plan Proposed Alternative Workgroup Deliverables (Linda) – Develop recommendations to the NC HIE Governance Entity for a Statewide Collaborative Process for Privacy and Security Policy Making – Review and catalog NC privacy laws and identify laws that need to be updated, harmonized, repealed, etc. to advance intrastate and interstate HIE – Consent Matrix – limited to states with statewide HIE governance Next Steps Adjourn

Operational Plan Requirements Topic Area/DomainComponents General Guidance Coordinate with ARRA Programs (Regional Centers, etc.) Coordinate with other states Governance Ongoing development of governance and policy structures Finance Cost estimates and staffing plans Controls and reporting Technical Infrastructure Standards and certifications consistent with HHS adopted interoperability standards/certifications Technical architecture Business and Technical Operations Current HIE capacities State-level shared services and repositories Standard operating procedures for HIE Legal/Policy Establish policies/requirements for the statewide HIE Privacy and security harmonization Federal requirements

NC HIE Strategic Plan: Legal/Policy Goals and Tasks See Handout

Proposed Deliverable 1: Recommend a Statewide Collaborative Process for Privacy and Security Policy Making to NC HIE Governance Entity – Would NOT include recommended policies or guidelines governing privacy and security but would provide recommendations on the PROCESS for developing policies and enforcement mechanisms – Would address the how, who, and when of achieving each of the privacy and security tasks/goals in Strategic Plan – Would incorporate key principles and vision in Strategic Plan – Would include recommendations for privacy and security governance framework (i.e., committee charters) for developing, implementing, monitoring and enforcing policy requirement s to enable appropriate and secure HIE – Would include a description of how Statewide Collaborative Process will enable NC HIE to ensure statewide compliance with all applicable state and federal laws – Proposal would be submitted to NC HIE Goverance entity and would be used in drafting NC HIE’s Operational Plan

Proposed Deliverable #2: Update/Harmonization of NC Health Information Privacy Laws Conduct a thorough review of NC regulations, policies and laws pertaining to access, use, and disclosure of personal health information and identify and catalog provisions that : – Are outdated or inconsistent or subject to inconsistent interpretation – Pertain to consumer privacy (e.g., consent) – Pertain to provider/payer/other? concerns (e.g., liability, interstate licensure) – Pertain to accountability and compliance (e.g., regulatory authority, penalties) Analyze to identify gaps that need to be addressed and areas for reform to promote consumer and provider adoption of HIE and to facilitate intrastate and interstate interoperability Review recent state legislation ( ) updating state privacy laws Draft white paper to inform NC HIE stakeholders and NC HIE Governance Entity

Proposed Deliverable #3: Consent Matrix Compile information and develop a matrix of consumer consent policies states with statewide HIE governance structures Limit review to states that have addressed consumer consent in the context of statewide HIE Include description of how the polices were developed and how they are enforced

Next Steps Discussion