# Presentation: 753053

## NHIN / HISPC / SLHIE Joint Conference

**Harmonization of State Security and Privacy Laws Collaborative **
***May 1, 2008***
*Dallas, TX*
**Florida, Michigan, **
**Texas, Kentucky, Kansas,**
**New Mexico, Missouri**

## States in the HSPLC Collaborative

**Florida**
**Michigan **
**Texas **
**Kentucky **
**Kansas**
**New Mexico **
**Missouri**

**Notes:**
Introduce co-chairs and identify how long they’ve been a HISPC state.

## HISPC Phase Three Major Goals

- Identify state laws that may impact the privacy and security of HIE
- Create a means for individual states to organize those laws into categories relevant to HIE (eventually allowing for  state to state comparisons)
- Create a methodology to allow individual states to rank their own state privacy and security laws

## HISPC Phase Three

- Reach out to national organizations to coordinate with ongoing efforts and gather existing analyses of state laws related to HIE
- Update New Mexico’s report on state laws and recently proposed legislation in other states related to EHRs and HIE.
- Work in conjunction with other HISPC collaborations to add depth to analyses where appropriate
- Draft detailed final report  including a roadmap for other states to follow with project deliverables and lessons learned from individual state experiences

## HISPC Phase Three: HSPLC Project Goals

- Draft detailed final report identifying state laws that facilitate HIE and those that may act as barriers to HIE
- Create an updated inventory of state privacy and security laws
- Develop roadmap for other states to follow

## Florida

**Florida **
**Presented by:**
**Carolyn H. Turner, M.S.**
- _[turnerc@ahca.myflorida.com](mailto:turnerc@ahca.myflorida.com)_
- Agency for Health Care Administration
- Florida Center for Health Information and Policy Analysis
- Office of Bureau Chief
- 2727 Mahan Drive MS 16
- Tallahassee, FL 32308

- Coordinate the development of uniform HIE privacy and security policies—harmonizing of state privacy laws
- Adoption of electronic health records—provider education outreach

**Promote Health Information Exchange (HIE)**

## Complete statutory analysis and develop priority recommendations through Legal Work Group (LWG)

- Increase consumer participation
- Community forums
- Legal Work Group
- Recommendations of LWG included in legislation passed in Florida House of Representatives (HB 637--2008)

**Florida HISPC Project Successes**

## Reconcile hospital licensure statutes and medical practice statutes regarding health records disclosure  

- Reconcile clinical laboratory statutes and medical practice statutes
- Adopt a uniform consent process for HIE

**Priority LWG Recommendations**

## Florida Objectives 2008

**Florida Objectives 2008**

**Harmonizing State Privacy Laws Collaboration**
-   Reconvene Legal Work Group
-   Review other states’ statutory analysis and
-      revise Florida analysis
-   Align analysis with collaborative taxonomy
-   Revise priority recommendations and 	legislation for 2009

## Florida Objectives 2008

**Florida Objectives 2008**

**Provider Education Collaboration**
-   Develop risk assessment toolkit
- 	Create a crosswalk between 	HIPAA and Florida statutes

## Florida HIE Status 2008

**Florida HIE Status 2008**

-   Health Information Exchange Coordinating
-      Committee (HIECC)
-   Eight (8) active HIEs/RHIOs
-   No grants for FY 2008-2009
-   Florida E-Prescribing report & metrics
-   North Florida FCC Rural Broadband Grant
-   CMS EHR adoption demo
-   AHCA PHR promotion—disaster preparedness

## Components of Proposed HB 637

**Components of Proposed HB 637**

-   Revises grants program
-   Creates physician loan program
-   Health Information Exchange Coordinating
-       Council appointed by governor & legislature
-   **Reduces legal barriers to HIE **
-   Long-term plan for a statewide network in 2010

## Florida Center for Health 

**Florida Center for Health **
**Information and Policy Analysis**
- _[http://ahca.myflorida.com/dhit/PandSproject/PSprojectIndex.shtml](http://ahca.myflorida.com/dhit/PandSproject/PSprojectIndex.shtml)_
- _[http://ahca.myflorida.com/dhit/index.shtml](http://ahca.myflorida.com/dhit/index.shtml)_
- _[http://www.fhin.net/](http://www.fhin.net/)_

## Kentucky

**KENTUCKY**
- Presented by:
**Julia F. Costich, J.D., Ph.D.**
- University of Kentucky
- College of Public Health

## Eliminating Barriers to Health Information Exchange in Kentucky Law

- PURPOSE:
- 1.	To identify regulatory language that may impede health information exchange in Kentucky and nationally.
- 2.	To propose revisions to regulatory language that remove the identified barriers.

## Barrier to Interoperability: Example

**902 KAR 20:016  Hospitals; Operations and Services**
- Section 3. Administration and Operation.
- (11) Medical and other patient records.
- 	(c) 	Records of patients are the property of the hospital and shall not be taken from the facility except by court order. A patient's records, or portion thereof, including x-ray film, may be routed for consultation.
- 1. Only authorized personnel shall be permitted access to the patient's records.
- 2. Patient information shall be released only on authorization of the patient, the patient's guardian, or the executor of his estate.

## Proposed Amendments: Guiding Principles

- Use health information privacy standards established by HIPAA in lieu of varying confidentiality-related language;
- Use 42 USC Part 2 (MHSA) privacy standards where applicable (mental health, alcohol and drug abuse);
- Remove the “proper release” language to remove barriers to continuity of care and interoperability of EHR;
- Where the summary or transfer form language appears, broaden it to clarify that other information may be transferred within HIPAA guidelines;

## Proposed Amendments: Guiding Principles

- Add reference to “original” medical record for institutional ownership and release;
- Delete  the “ink” and “lock” language;
- Clarify linkage language;
- Maintain specific provisions related to public health;
- Assure, at a minimum, compliance with HIPAA.

## Proposed Amendments

**	****902 KAR 20:016  Hospitals; Operations and Services**
- 	Section 3 (11) Medical and other hospital records.
- 	**(a)****	****The term ‘medical record’ shall have the same meaning as the terms “protected health information” and “electronic protected health information” set forth in HIPAA, 45 C.F.R. § 160.103.**
-     (b) The hospital shall have a medical records service with administrative responsibility for medical records. A medical record shall be maintained, in accordance with accepted professional principles, for every patient admitted to the hospital or receiving outpatient services.

## Proposed Amendments

**902 KAR 20:016  Hospitals; Operations and Services**
- Section 3 (11) Medical and other hospital records.
- (e) Confidentiality/Security; Use and Disclosure.
- 	1.	The hospital shall maintain the confidentiality and security of medical records in compliance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA), 42 U.S.C. 1320d-2 to 1320d-8, and 45 C.F.R. Parts 160 and 164, including the security requirements mandated by subparts A and C of part 164 of title 45 of the CFR, or as provided by applicable federal or state law.

## Issue: Revision of non-standard usage that does not raise a barrier

**Example:**
- 902 KAR 20:048. Operation and services; nursing homes
- Section 4. Provision of Services.
**	**6. Infection control and communicable diseases.
- 		h. If, after admission, a patient is suspected of having a communicable disease that would endanger the health and welfare of other patients, the administrator shall assure that a physician is contacted and that appropriate measures are taken on behalf of the patient with the communicable disease and the other patients.

**Issue:****	****Non-Barrier**** ****regulatory language - Delete, Revise or Leave.**

## NEXT STEPS

- Findings presented to e-Health Board in December 2007
- Ongoing discussion of proposed amendments with stakeholders
- Meshing this work with HSPL collaborative
- Aligning strategies with state e-Health Board leadership priorities

## New Mexico

***NEW MEXICO***
**Presented by:**
**Maggie Gunter, Ph.D.**
**Lovelace Clinic Foundation**
**Albuquerque, New Mexico**

## OverviewNew Mexico Health Information Collaborative (NMHIC)

**NMHIC **created in 2004—funding from AHRQ and community organizations.
_**Objective**_: creation of a statewide health information exchange network to provide cross-organization data to providers at point of care and then patients.
_**Lead agency**_**:** Lovelace Clinic Foundation (LCF), non-profit applied health research institute.
- Governed by 35-member Steering Committee.
_**Accomplishments:**_ built basic technical infrastructure, community governance structure and trust, conducted two pilot exchange demonstrations, multiple signed data sharing agreements.
- New Mexico awarded one of 9 NHIN contracts to further develop technical infrastructure, test interoperability with other NHIN sites, and develop business model for sustainability—progress on track and new partners signed up.

## HISPC Focus: Health Privacy Legislation

- NMDOH/LCF received HISPC award-2006
- Project tasks: Identify key privacy barriers to HIE in NM and develop solutions
**Major issue**: fragmented, outdated health privacy laws addressing only paper records
**Proposed solution**: develop and pass comprehensive new state health information legislation to address issues and supersede all previous laws
**Goal**: Draft legislation that authorizes the use of EHRs and facilitates the operation of HIEs while protecting patient privacy

## Methods and Key Tasks

- Research health information laws in all 50 states
- Initial meetings with privacy experts
- Develop first draft of legislation
- Engage stakeholders in review of legislation
- Redraft legislation as needed
- Identify legislative sponsors
- Introduce bill (New Mexico Electronic Health Information Act) in 2008 NM Legislative Session
- Legal authorization of EHRs
- Authorize plan to set dates to require electronic claims, EHRs, and health information exchange
- Privacy requirements for EHRs and HIE

## All Aspects Were Controversial

- EHR Authorization: MD legislator: “I never use medical records—they’re a waste of time.  We should carry our health records on a 3” by 5” card, as they do in Nepal.”
- Resistance to an unfunded mandate for EHRs
- Some opposition to Governor’s health reform proposal (included the privacy bill)
- Privacy controversy (a gulf):
- ACLU favored stronger privacy protections and penalties
- Payers and health systems:  no stronger than HIPAA
- Similar issues in other states and nationally
- Outcome:  Passed the House, failed in the Senate

## Good news: heightened awareness of the issue
Possible opportunity for revision and introduction of bill at Special Legislative Session called for July
Identify and educate key legislators as champions
Community meetings to be held throughout state to educate stakeholders, obtain feedback on bill, and seek consensus
Lessons learned:
Difficult to achieve workable compromise between needs of privacy advocates and perceived burden of health care providers
Sadly, Legislative 101 is not taught in grad school
Politics is not for sissies!

- Possible opportunity for revision and introduction of bill at Special Legislative Session called for July
- Identify and educate key legislators as champions
- Community meetings to be held throughout state to educate stakeholders, obtain feedback on bill, and seek consensus
**Lessons learned**:
- Difficult to achieve workable compromise between needs of privacy advocates and perceived burden of health care providers
- Sadly, Legislative 101 is not taught in grad school
- Politics is not for sissies!

**What’s Next?**

## Kansas

**Kansas**
**Presented by: **
**Julie Roth**
**Christina Stephan**

## Kansas Health Information Exchange

- Kansas Health Policy Authority (KHPA):
-  State agency created through legislation 2005
- Coordinates state purchasing ,administration health promotion policy
- Compiles, disseminates health care data
- Health Reform Recommendations 2007
- Define Medical Home
- Implementation of state-wide Cerner Community Health Record (CHR)
- Promote insurance card standardization with BlueCross/BlueShield Advanced ID Card
- Additional information: _[http://www.khpa.ks.gov/AuthorityBoard/Health%20Reform/KHPA%20Final%20Report_3Ps_UPDATED_013008.pdf](http://www.khpa.ks.gov/AuthorityBoard/Health Reform/KHPA Final Report_3Ps_UPDATED_013008.pdf)_

## Current HIT/HIE activities in Kansas

- CareEntrust  employer driven EHR
- Kansas City Regional Electronic Exchange (KCREE)
- KC Care Link
- Kansas Immunization Registry
- Kansas Public Health Information Exchange (PHIX)
- Kan-ED
- KU Center for HealthInformatics’ Simulated E-health Delivery System (SEEDS) Project
- Kansas City Health Exchange (KCHE)
- Central Plains Regional Health Care Foundation Clinics Patient Index

## Kansas Legal Workgroup  2007 Activities

- Goals:
- Identify and analyze laws relevant to health information exchange
- Catalog those laws into centralized place
- Propose legislation

## Catalog Spreadsheet

- Designed Spreadsheet Data Collection Tool
- Different sheets for different categories of law
- Public health
- Insurance
- Minors, mentally ill, probate
- Domestic relations & civil procedure
- Criminal & law enforcement
- Other
- Laws further categorized within each sheet (e.g., treatment, payment, public health reporting, etc.)
- Each sheet populated with hyperlinked laws
- Last sheet designed to facilitate a preemption analysis
- Also included “Directions” sheet and “Resources” sheet

## Survey of Kansas Law

- Research process
- 10 law student researchers
- Divided all Kansas statutory law into 10 sections and assigned to researchers
- Also divided Kansas agencies  among researchers
- Asked researchers to:
- Identify any laws that directly involved the collection, use, or disclosure of individual health information
- Identify any laws where the collection/disclosure of health information is directly relevant to establishing compliance or violation of the law

## Survey of Kansas Law

- “Refining” the catalog
- Team of public and private sector attorneys
- Sheet sections divided equally among group
- First charge:
- Identify all laws with the specific purpose of protecting the privacy of health information
- Identify all laws where privacy of health information is protected in a direct, clear, and substantial way

## Survey of Kansas Law

- “Refining” the catalog continued
- Second charge
- For each law identified, determine:
- Can the state law be harmonized with federal law?
- Does the law have implications for HIE?
- Used “Analysis” sheet in catalog to facilitate this determination

## Key Findings

- Estimated 200 Kansas statutes and regulations relate to/directly impact  health information privacy and security
- Generally, HIPAA Privacy Rule standards supplement Kansas law
- Kansas law largely silent regarding EHRs/HIE

## Action

- Developed draft resolution to demonstrate:
- Recognition of individuals’ primary interest in the confidentiality, security, integrity, and availability of their health information;
- Commitment to review, modify, and construe laws to:
- Protect individuals’ interest in confidentiality, security, integrity, and availability of their health information
- Promote use of information technology
- Promote uniformity in policy
- Codify standards in cohesive and comprehensive statutory structure

## Texas

**TEXAS**
**Presented by:**
**Patricia Gray**

## Texas

- New HISPC partner
- University of Houston Law Center Health Law & Policy Institute
- UH Health Law program ranked #2 in US
- State goal:  To identify and resolve conflicts in Texas law to facilitate implementation of electronic data sharing

## Slide 42

## Existing analyses of Texas law

- 2004 Attorney General Report
- _[http://www.oag.state.tx.us/notice/hipaa.pdf](http://www.oag.state.tx.us/notice/hipaa.pdf)_
- Texas Hospital Association
- HIPAA Privacy:  Navigating Texas and Federal Regulations ($295 for non-members)

## Enacted HIE Legislation in Texas

- 80th R	SB 204 (addresses certain electronic medical record software used in Texas immunization registry)
- 80th R	HB 1066 (creates Texas Health Services Authority to support implementation of electronic medical technology)
- 80th R	SB 10, Sections 22 and 23 (Omnibus Medicaid Reform Act including incentives for EHRs and e-prescribing)
- 79th R	SB 45 (creates Health Care Information Technology Advisory Committee)
- 78th R	SB  1136 (Authorized OAG task force to examine preemption issues)
- 77th R	SB 11 (State equivalent of HIPAA)

## Conflict resolution issue list (incomplete)

- Length of time for record storage
- Federal/state law access issues for mental health and substance treatment records
- Reproduction costs of electronic vs. paper records for records requests
- Determination/verification of consent
- Enforcement of privacy and security protections
- Frontier, rural, suburban, and urban provider differences

## Missouri

**Missouri**
**Presented by:**
** **
**Charlotte Krebs**

## Established in 2006 by Gov. Matt Blunt

**Task Force Recommendations****:**
- Establish an ongoing Steering Committee
- Mirror national initiatives
- Reform Medicaid system
- Improve public health
- Expand telehealth and telepharmacy

**Missouri Healthcare Information Technology Task Force**

## TF Survey of HIT/HIE in Missouri

- Relatively low adoption rate
- Lab info systems, EHRs, telehealth and e-prescribing
- Use of all four in one entity was rare
- Those *without *– plans to implement?
- No plans – Mental/behavioral health, local public health, LTC/SNF
- Over half – Hospitals & provider offices
- HIE activities developing in metro areas
- Kansas City Regional Electronic Exchange (KCREE)
- Primary Care Home Initiative
-   St. Louis Health Information Exchange

**TF Survey of HIT/HIE in Missouri**

## March 2007 Executive Order

- Requires state agencies to support interoperable health information systems and products, including privacy and security
***Newcomer to the HSPL Collaborative!***
- Looking forward to:
- Learning from work that has gone before
- Challenge of getting up to speed
- Using the developing taxonomy

**March 2007 Executive Order**

## Michigan

**Michigan**
**Presented by:**
**Kelly Coyle, J.D.**

## Current HIE Initiatives:

**2006**
- Health Information Technology (HIT) Commission
*Conduit to Care* roadmap report released
- HISPC Phase One
**2007**
- State grants issued to 7 of Michigan’s regional initiatives for planning and implementation
- State creates MiHIN Resource Center
- HISPC Phase Two
- Michigan awarded Medicaid Transformation Grants
- Centralized Provider Credentialing
- Transforming Paper Vital Records to Electronic
**2008**
- State funding for planning and implementation
- FCC Rural Health Grant
- HISPC Phase 3

## Three-Phased Coordinated Approach

## Moving Forward

- Continuing to utilize HISPC workgroups to address issues
- Identifying alternate pathways to facilitate HIE without legislative changes
- Working closely with the state and with Michigan’s nine regional initiatives  to ensure that the diverse needs of the state are met

## Harmonization of Security and Privacy Laws Collaborative 

-  Overall Collaborative Goals
- Creation of a common organizational structure or subject-matter taxonomy
- Development of a draft general methodology, allowing individual states to further refine individual HIE goals and barriers that need to be addressed through a ranking process
- Coordination of ongoing efforts with national organizations, such as National Conference of Commissioners on Uniform State Laws (NCCUSL) and the State Governors Association (SGA), to avoid overlap and utilize the respective areas of strength.
- Develop tools and a roadmap useable by other states as they work through similar issues in the development of HIE.

## Harmonization of Security and Privacy Laws Collaborative

-    HSPLC States: Florida, Michigan, Texas, Kentucky, Kansas, New Mexico, and Missouri
- General overview of state objectives
- Create and pilot legislative template
- Use a common taxonomy
- Each state to analyze its own privacy and security laws
- Better understanding of the requirements for HIE within and across state lines

## Other HISPC Collaboratives

**Overall goal – increase the focus of cross-state collaboration and coordination**
**Consumer Education and Engagement**
- Increase the targeted consumer-population subgroups’ engagement in and understanding of privacy and security issues in HIE
**Provider Education**
- Enhance provider awareness, inform and motivate, and engage providers in adopting and using electronic HIE in a secure and private manner
**Standards Policy Adoption**
- Establish draft business or operational security policies/practices that can be tied to already proposed technical standards.

## Other HISPC Collaboratives cont.

**Consent Options, Outcomes, and Best Practices**
- Develop resources for entities attempting to make decisions about consent process and policy
**Consent Data Elements required for Data Transfer**
- Understand the landscape of electronic consent between states
**Interorganizational Agreements**
- Develop model cross-state interorganizational agreements – MOUs and data sharing agreements
**Harmonizing State Privacy Laws**

## Harmonization of Security and Privacy Laws Collaborative

**    ****HISPC 2008 and beyond**
**Goals **
- Continue to reduce the burden to any one state in their development and promotion of HIE
- Create common policies to permit private and secure statewide and nationwide HIE.
- Education of stakeholders/communities to enhance knowledge base in each of our individual states and collectively as a nation
- Develop dissemination pathways to achieve widespread adoption and coordination with other national initiatives

## Slide 59