1. 781-890-7446 Health Delivery Services May 29, 20090 Eastern Massachusetts Healthcare Initiative Policy Work Group Session 2 May 29, 2009

2. 781-890-7446 Health Delivery Services May 29, 20091 Agenda Progress and Remaining Activities Resolution of Previous Issues New Questions and Issues Policy Framework Document Next Steps

3. 781-890-7446 Health Delivery Services May 29, 20092 Policy Group Work Session Plan PeriodAgendaPreparation Thru May 8 Complete Obtain agreement on approach, schedule, and work group membership Obtain agreement on scope Review general principles Review policy document outline Review example policies Review open questions/issues Request existing policies from work group members and other groups Research policies from NEHEN/MA- SHARE and other sources Document principles Develop policy document outline Develop example policies Document open questions/issues May 29Hold Policy Work Group Meeting: Review draft policies Review open questions and issues Assign follow-up responsibilities Develop additional policies June 5Distribute interim work products to Advisory Group Prepare presentation outlining framework, content, open questions/issues June 12Send policy framework to other EMHI members for review Update framework Prepare summary presentation June 19Hold Policy Work Group Meeting: Review final framework/policies Review open questions and issues Assign follow-up responsibilities Develop/update policies Finalize policy document Draft plan for maintaining policies Draft communication plan June 26Present framework to Advisory GroupPrepare presentation outlining framework, content, open questions/issues

4. 781-890-7446 Health Delivery Services May 29, 20093 Policy Guiding Principles General –Decisions Based on Guiding Principles –Openness and Transparency –Patients’ Rights –Patient Access and Participation –Data Collection and Use Limitation –Privacy and Security Policy Compliance –Coordinated Decentralization –Broad Adoptability –Anticipation of Change Technical –Open Standards –Federated Data Architecture –Flexibility and Agility –No Rip and Replace –Multiple Implementation Models

5. 781-890-7446 Health Delivery Services May 29, 20094 Definitions Participant: A Provider Organization, Payer Organization, or Other Organization that has directly entered into a Data Sharing Agreement with NEHEN, accesses Protected Health Information via NEHEN, and actively participates in the exchange of electronic healthcare data via NEHEN. Sending Participant: A Participant engaged in sending clinical data to another Participant via NEHEN. Receiving Participant: A Participant engaged in receiving clinical data from another Participant via NEHEN. Sending User: A person who is associated with a NEHEN Participant and sends clinical data via that association. Receiving User: A person who is associated with a NEHEN Participant and receives clinical data via that association.

6. 781-890-7446 Health Delivery Services May 29, 20095 Policy Questions and Issues: Resolutions for Review What is NEHEN’s responsibility as regards Participant compliance with data sharing agreements and policies? Assume compliance or audit for compliance? –Resolution: Create a "statement of compliance" and require a legal signatory of the Participant to sign on an annual basis. The statement should include the right to make unannounced audits regarding privacy at any time. Should all disclosures be reported to a patient upon patient request, or just selected disclosures? –Resolution: Report on all disclosures based on available data. Provide capabilities for Participants to use local NEHEN audit logs in their disclosure reporting work flows. What should be the baseline for privacy and security protection—meeting minimum legal requirements or developing/meeting community best practices? –Resolution: Meet minimum legal requirements. Review Participant practices, and consider common practices for “best practice” implementation.

7. 781-890-7446 Health Delivery Services May 29, 20096 Policy Questions and Issues for Discussion: Responsibilities of the Exchange Do we need to define the purpose of the exchange to address the issue of the Receiving Participant/User’s liability (e.g., lab results received by a physician other than the physician who ordered the test)? –Examples: The intent of the exchange is to support “live care” The intent of the exchange is to support “better care management” Must NEHEN restrict participation in order to comply with legal requirements, including state laws? –Examples: May individuals and organizations operating in/licensed in New England states other than Massachusetts be users of the clinical data exchange? Must NEHEN policies address requirements for those states (e.g., sensitive information requirements)? Can an organization operating in/licensed in another state be made responsible for compliance with that state’s laws? May an individual operating in/licensed in another state be a user of the exchange?

8. 781-890-7446 Health Delivery Services May 29, 20097 Policy Questions and Issues for Discussion: Responsibilities of the Exchange Are NEHEN and/or Participants responsible for : –Attempting to influence legislation? –Educating the public about the exchange of clinical data? –Informing users of the potential for increased liability due to increased availability of information? –Informing or training Users on appropriate use of the exchange?

9. 781-890-7446 Health Delivery Services May 29, 20098 Policy Questions and Issues for Discussion: Responsibilities of Persons/Organizations Receiving Messages Must a Receiving Participant/User view a message received from an external source? –Examples: May a receiver “turn off” receipt of some or all messages? May a receiver “reject” a message that has been appropriately addressed? May a receiver discard a message without viewing it? What are a Receiving Participant/User’s responsibilities for acknowledging a message? –Examples: Notify the sender that the message was received. Notify the sender that the message was delivered to its final destination. Notify the sender that the message could not be delivered (i.e., “addressee unknown”) Notify the sender that the message was addressed to the wrong recipient (i.e., “not me”) Must a Receiving Participant/User retain a message received from an external source? May a Receiving Participant/User specify preferences for how/when they receive messages regardless of message type (e.g., “as soon as available”, “bundled” at end of day)?

10. 781-890-7446 Health Delivery Services May 29, 20099 Policy Questions and Issues for Discussion: Responsibilities of Persons/Organizations Sending Messages May/must a Sending Participant/User include in a message information that was received from an external source (i.e., not originally collected by the sender)? –If so, should it be identified as having come from an external source? Must a Sending Participant/User resolve ambiguous destinations for a Receiving User (e.g., a physician who practices in multiple organizations or physical locations) –May/must a Receiving User identify a “preferred address” for cases where the ambiguity is not resolved? May a Sending Participant/User specify preferences for how and when messages will be delivered (e.g., specify urgency or method of delivery)?

11. 781-890-7446 Health Delivery Services May 29, 200910 Policy Questions and Issues for Discussion: Provider Registration/Addressing May a message be addressed to an organization rather than an individual (e.g., a clinic or a CHC)? May a message be addressed to a Receiving Practitioner who is other than a licensed care provider? May a message be addressed to a Receiving Participant who acts as an intermediary for practitioners (e.g., a vendor offering portal access)? Must a Receiving Practitioner be affiliated with a Receiving Participant organization for the purpose of authentication, authorization, and routing? –Examples: California pediatrician refers patients to Children’s and wishes to be “added” as a Children’s user. MMS or a vendor wishes to offer portal access. NEHEN wishes to make access available via the NEHEN Portal. Must NEHEN or the Participant organization obtain a provider’s consent to register the provider in the community directory?

12. 781-890-7446 Health Delivery Services May 29, 200911 Next Steps Distribute update to Advisory Committee week of June 1 Incorporate today’s decisions and redistribute draft for Policy Group review week of June 1 Distribute draft document and summary presentation to EMHI members not represented on Policy Group week of June 1 or June 8