1. North Carolina Health Information Exchange Governance Workgroup Date: May 12, 2011 Time: 9:00 am – 11:00 am Location: NC Institute of Medicine 630 Davis Drive, Morrisville, NC Dial in: 1-866-922-3257; Participant Code: 654 032 36#

2. 2 Agenda TopicLeadsTime Welcome Roll call Review progress to date and today’s objectives Co-Chairs9:00 – 9:10 NC HIE UpdateNC HIE CEO9:10 – 9:20 Recommendations for an Oversight and Enforcement FrameworkCo-Chairs & Manatt 9:20 – 10:45 Next StepsCo-Chairs & Manatt 10:45 – 10:50 Public CommentN/A10:50 – 11:00

3. 3 Statewide HIE Governance...Primary Tasks 1. Who Will Participate in Statewide HIEStatus 1. Participation Model Board determined participation to be voluntary Board determined that participation would be through “Qualified Organizations” 2. Definition of Qualified Organization Board approved definition of a Qualified Organization Board approved principles for Qualified Organizations 3. Candidates for Qualified Organizations Workgroup and Board identified candidate types of organizations 4. Criteria for Qualified Organizations Workgroup developed recommendations for Qualified Organization selection criteria  QO selection recommendations to be presented to Board 2. Rules and Policies for ParticipationStatus 1. Participation Mechanism Board determined that Qualified Organizations must sign a participation agreement with NC HIE 2. Terms and Conditions  To be developed and informed by Governance, Legal/Policy and Clinical/Technical Operations Workgroups 3. Enforcement and OversightStatus 1. Enforcement Approach Board determined that there will be a process and policies established for ongoing oversight 2. Enforcement and Oversight Roles and Responsibilities  To be developed 3. Enforcement and Oversight Mechanisms  To be developed

4. 4 NC HIE Update

5. 5 Oversight and Enforcement Framework

6. 6 Oversight and Enforcement: Key Questions 1.What are the source of oversight and enforcement authority for statewide HIE? 2.Who oversees and enforces participation requirements for QOs? 3.How are the rules established and what is the nature of the relationships between NC HIE, QOs, and QO Participants? 4.How should the NC HIE monitor compliance with its requirements? 5.What are the mechanisms for enforcement of statewide HIE requirements?

7. 7 Source of Authority & Entity for Oversight and Enforcement 1. What is the source of oversight and enforcement authority for statewide HIE?  Legislation  Regulation  Contract (Participation Agreement) 2. Who oversees and enforces participation requirements for QOs?  State Agency  NC HIE  Other (Accreditation entity, etc.) The Board has agreed that QOs participating in the statewide network be legally bound to comply with participation requirements (or “Statewide Policy Guidance”) via contracts. The Governance WG has agreed that the NC HIE (and/or its third-party delegates) should oversee/enforce participation requirements for QOs

8. 8 Framework for Oversight & Enforcement of Statewide HIE Who sets the rules? NC HIE The NC HIE creates a common and consistent set of rules (“Statewide Policy Guidance”) for participants and contracts with Qualified Organizations Contract between NC HIE and intermediary (in this case Qualified Organizations) Qualified Organizations: abide by and enforce the rules. QOs allow participants (clinicians, authorized users, etc.) to use statewide system by requiring all local users to abide by statewide rules through participation agreements or other such mechanisms. What if the QO breaks the rules? The NC HIE has enforcement authority and would need to evaluate and determine whether to impose sanctions. What if a QO Participant breaks the rules? The QO is responsible for monitoring and enforcing QO participants’ compliance with NC HIE participation requirements.

9. 9 Mechanisms for Oversight of Statewide HIE ( DRAFT Recommendation – FOR DISCUSSION ONLY) The NC HIE could implement a range of oversight mechanisms, including: “Proactive” Oversight Mechanisms  QO application process and conformance to criteria/requirements  QO renewal of status  NC HIE convene meetings with QOs (periodic or as needed) to identify risks, discuss best practices, and engage in “self-policing”  NC HIE conduct routine technical audits of Statewide HIE Network  NC HIE conduct random audits of QO compliance “Reactive” Oversight Mechanisms  QO reports violations committed by itself and/or QO participants  Complaint and/or “whistleblower” process

10. 10 Mechanisms for Enforcement of Statewide HIE Requirements (DRAFT Recommendation – FOR DISCUSSION ONLY) The NC HIE should implement a range of enforcement actions that may include NC HIE’s enforcement actions would depend upon the severity of the violations 1.For actions meriting development of a corrective action plan or written notification of a violation, NC HIE staff would initiate corrective action with the QO and escalate as necessary. 2.For actions meriting revocation or suspension of QO status, NC HIE staff would call upon the Board to take immediate action. Development of Correction Action Plan “Cease and Desist” Order/ Written Notification of Violation Suspension of QO Status Revocation of QO Status

11. 11 Suspension of QO Status (DRAFT Recommendation – FOR DISCUSSION ONLY) A QO’s status may be suspended at the discretion of the NC HIE for: Any violation of NC HIE policies and procedures and/or the participation agreement that presents a material likelihood of the unauthorized disclosure of confidential health information Any violation of NC HIE policies and procedures and/or the participation agreement that presents a material likelihood of compromising the technical systems or networks of the NC HIE or any other participant in the NC HIE Failure to remedy any other violation of NC HIE policies and procedures and/or the participation agreement within 30 days of receipt of written notice Failure to pay any amount due under the participation agreement for more than 30 days after the date on which such amount was due Failure to maintain any required insurance coverage Development of Correction Action Plan in Consultation “Cease and Desist” Order/ Written Notification of Violation Suspension of QO Status Revocation of QO Status The duration of the suspension period will be at the sole discretion of the NC HIE and should relate to the seriousness of the infraction and demonstration that the issue has been remedied.

12. 12 Revocation of QO Status (DRAFT Recommendation – FOR DISCUSSION ONLY) A QO’s status should be revoked at the discretion of the NC HIE for: Failure to submit and/or implement any required plan of correction by the applicable deadline Failure to pay amounts due under the participation agreement for more than 60 days after the date on which such an amount was due Failure to maintain any required coverage that lasts for more than 30 days Bankruptcy Fraud or other financial misconduct Development of Correction Action Plan in Consultation “Cease and Desist” Order/ Written Notification of Violation Suspension of QO Status Revocation of QO Status

13. 13 Next Steps

14. 14 Governance Workgroup – Next Steps Develop recommendations oversight and enforcement procedures for: –Board review of requests for suspension and termination –Dispute resolution –Organizations seeking to voluntarily rescind QO status

15. 15 NC HIE Workgroups...Working Timelines JanFebMarAprMayJunJul Develop Qualified Org Criteria Qualified Organizations Participation Agreements Develop Participation Agreement Tasks Legal/Policy Workstream Finalize draft legislation 2011 Enforcement and Oversight Define Oversight Roles and Enforcement Mechanisms Develop RFPReview, Negotiate, Award Core Services Deploy Services Develop Privacy and Security Policy and Procedures

16. 16 Public Comment