# Presentation: 076866

## NHIN / HISPC / SLHIE Joint Conference

***NHIN / HISPC / SLHIE Joint Conference***
**(IOA) Collaborative Update**
**Interorganizational Agreements (IOA) Collaborative Update**
***May 1, 2008***
*Dallas, TX*
**Presenter:  ****Susan Brown**
**	****        ****Iowa Foundation for Medical Care**

## IOA Collaborative Composition

**IOA Collaborative Composition**

**Participating states/territories** (7):
- Alaska
- Guam
- Iowa
- New Jersey
- North Carolina
- Puerto Rico
- South Dakota
**2 Co-chairs, Legal lead, Technical lead**
**NHIN/DURSA liaison**
**RTI liaison**

**Notes:**
New to HISPC Project: Guam and South Dakota

Co-Chairs: Bill O’Byrne from New Jersey, Susan Brown from Iowa

Legal Lead: Sue Miller from Massachusetts
Technical Lead: Arnie Miller from New Jersey
New Jersey’s significant representation is due to NJ/New York Immunization Sharing Project from HISPC Phase I

NHIN/DURSA Liaison: Roy Wyman of NC, another project link is Holt Anderson of NCHICA

RTI liaison: Ariana Napier

## Relevance/Need for Project

**Relevance/Need for Project**

- Wide variety of data sharing agreements
- Delays/missed opportunities to share data
- Liability concerns in electronic environment

**Notes:**
In sharing electronic information across entities, various types of data sharing agreements may or may not exist and are not standardized if they do exist.  HISPC Phase I revealed the variation that exists in agreements, MOUs, etc. that are used for data exchange.

Lack of consistency leads to increased time requirements to negotiate agreements and missed or delayed opportunities.

The increased time and resource requirements drive up the costs and the overall burden of executing agreements.

Add to that the heightened liability concerns associated with release of health information in the electronic environment – these factors all create barriers to the exchange of information.

## Assumptions

**Assumptions**

- Standard agreements will streamline/speed up data sharing
- Actual use in live pilots will increase trust
- Ultimately reduces resource and time requirements for this task

**Notes:**
The IOA Collaborative considers it important to address the variation in data sharing agreements, MOUs, etc. and the barriers created by lack of standardization that impede data sharing.
The HISPC project could provide a valuable resource by creating model template agreements that thoroughly address privacy and security.
The goal is that model agreements will speed the process for organizations to reach the point of actual data sharing, will reduce the resources required for the “legal/agreements” phase of a data sharing project, and will reduce liability concerns.
The IOA wants to go beyond just developing model agreements to actually testing them in live data sharing pilots.  The idea is that if organizations, governmental units, etc. will sign the agreements in “real life”, this will increase trust in the work products and provide “proof of concept”.

## Assumptions (cont’d)

**Assumptions (cont’d)**

- Technology: often easiest
- Legal agreements, culture, liability: difficult
- Public health data sharing is good place to start
- Point to point agreements for private entities also needed

**Notes:**
It is widely recognized that technology is often not the hardest part of health information exchange.  The difficult aspects are related to legal agreements between the parties exchanging data, cultural and policy differences between organizations, and liability concerns.

For example, the New Jersey Immunization Sharing Project has been “ready” from a technological standpoint for quite some time. It is the Legal agreements that have taken the most time to finalize and are still on the table.

The IOA group considered different scenarios for pilot testing the model agreements.  Two were chosen: public health to public health data exchange and private entity to private entity.

First, public health was considered a good place to start due to the value in exchanging such data across state lines and the somewhat “benign” privacy and security aspects when compared to sharing data such as electronic health records.

Private entity to private entity was also chosen due to the need for “point to point” data exchange from one private entity to another. Some Collaborative members were more interested in pursuing these agreements; others more so with the public health setting.

## IOA Goals

**IOA Goals**

- Develop standardized core set of components for data sharing agreements
- Execute agreements and exchange data through cross-state pilots

**Notes:**
The standardized IOA agreements will focus on the privacy and security aspects of such agreements vs. technology specifications or other aspects.

The IOA does not intend to duplicate work but will incorporate the work of NHIN DURSA (explained later in presentation), HISPC Phase I and the other HISPC collaboratives where applicable.  

Agreements will be in template form, including a common format, standard sections, a core set of privacy and security components and a set of agreed upon defined terms.

The agreements will be pilot tested (i.e., executed, signed, utilized) in public health to public health settings and private to private entity settings.

The idea is to publish for national use any model data sharing agreements produced as a result of the project, as well as lessons learned from implementation.

## IOA: Questions to Address 

**IOA: Questions to Address **

- For model agreements:
- Are the privacy and security bases covered?
- How do different state laws affect the agreement?
- What level of detail/granularity is needed for privacy and security standards?

**Notes:**
Identify which components of a data sharing agreement touch on privacy and security.

Use work of HISPC Legal Work Groups and Phase I to determine how state laws might affect agreements.  Also coordinate with Harmonizing State Laws collaborative and other state law analysis projects to complete this work.  Build on what information has already been/is being gathered.

How detailed should an agreement be relative to standards such as secure connection, transmission, encryption, user identification, authentication, authorization, audit control, non-repudiation, document integrity, etc.?

## IOA: Questions to Address (cont’d)

**IOA: Questions to Address (cont’d)**

- How is sensitive data handled?
- How do we best use existing agreements or templates?
- What about liability and breaches to the agreements?
- Would a given state or entity sign the agreement?  Why or why not?

**Notes:**
There are many existing data sharing agreements “out there” – where do we start?  IOA group is developing a library of examples from our own states, from cross-state data sharing projects, from organizations such as Markle, and from other HISPC states such as CO and NM that have shared agreements with our collaborative.

Since liability is such an overriding concern in data sharing agreements, it is necessary to address what actions might be taken when inappropriate disclosures arise, for mitigation of harm, breaches of contract, etc.  Our group was specifically asked to look at “cyber liability” by another HISPC collaborative.

Once a template is determined, each participating state will ask “would my state sign such an agreement? Why or why not?  Who has the authority to sign it for various scenarios (e.g. public health to public health data exchange)?”  The answers to these questions will help drill down to the state and organizational variations in policies, practices and laws related to interorganizational data sharing.  

## IOA Deliverables

**IOA Deliverables**

- Library of IOA examples
- Incorporate DURSA
- Incorporate related work, e.g. Markle Found.
- Pilot: public health to public health exchange
- 		   private to private entity exchange
- Evaluate and document results in final report
- Publish model agreements nationally

**Notes:**
Library of examples: May 2008
Incorporate DURSA and other related work: First 100-day phase
Finalize model agreement templates: First 100-day phase
Concurrent activity - plan pilots: First 100-day phase
Execute agreements and conduct pilot data exchange: Second 100-day phase
Allow adequate time to evaluate successes and lessons learned; document results: Third 60-day phase
Publish results to share nationally: End of 12 months

## IOA Timeline

**IOA Timeline**

**Notes:**
Three project phases as shown:
First phase approximately 100 days (gathering examples, developing agreements, incorporating other work, planning pilots) – heavier on Legal aspect
Second phase approximately 100 days (executing agreements, implementing pilots) – Legal and Technical aspects
Third phase approximately 60 days (evaluation and documentation)

## IOA Resources

**IOA Resources**

- Existing data sharing agreements
- HISPC Phase I Legal Work & Work Groups
- New Jersey Immunization sharing project
- NHIN DURSA
- Other HISPC Collaboratives

**Notes:**
Examples include:
New Mexico data sharing agreement
Colorado RHIO agreement
New Jersey Immunization Sharing Project agreement
IOA Collaborative member states agreements
NHIN DURSA draft documents
Markle Foundation guidelines

## IOA Relationship to DURSA* Project

**IOA Relationship to DURSA* Project**

- NHIN ***D**ata **U**se and **R**eciprocal **S**upport **A**greement
_**DURSA**__:_
- Model agreement for nationwide “network of networks”
- Longer term, more national in scope
- Began 10/07
_**IOA HISPC**_:
- Model agreements for current point-to-point data sharing
- More interim in nature, state to state scope
- Privacy and security is focus
- Began 04/08

**Notes:**
It is very important to ONC that work is not duplicative and is coordinated.

The two projects have a related, but different, scope.

Leadership from both projects have held initial phone conferences to begin coordination.  Coordination continues through break out sessions such as this and additional face-to-face meetings of leadership from both groups this week in Dallas.

Coordination will continue after Dallas through regular phone conferencing, liaisons such as Holt Anderson and Roy Wyman, coordination at the “top” by ONC representatives, and other opportunities such as sharing of work products.

Due to project timelines, initially DURSA will provide more information sharing to HISPC.  As HISPC unfolds it is hoped that more reciprocal sharing of resources can occur.

## IOA Relationship to New Jersey Project

**IOA Relationship to New Jersey Project**

- Immunization Sharing Project from HISPC I
- Draft Legal documents developed
- Technical aspects ready
- Lessons learned to share with IOA
- Positioned to expand and add other states

**Notes:**
Arnie Miller of New Jersey will be sharing a detailed presentation on the New Jersey project immediately following this one.

Overall the Legal portion of the project has taken much longer than anticipated.

The background work of the New Jersey project will help to jump start the work of the IOA collaborative.  

States outside of the IOA collaborative have expressed an interest in joining the multi-state immunization sharing project at some point.

## IOA Relationship to Other HISPC Collaboratives

**IOA Relationship to Other HISPC Collaboratives**

- Consent 1 – Data Elements
- Consent 2 – Policy Options
- Harmonizing Privacy Law
- Consumer Education and Engagement
- Provider Education
- Adoption of Standard Policies

**Notes:**
The HISPC Steering Committee is charged with communicating and collaborating across the 7 topics identified for Phase III.

The Steering Committee met in April and discussions included which groups are most likely to intersect.

The IOA group will most likely coordinate with the Harmonizing Privacy Law and the Adoption of Standard Policies group.  The Standard Policies group may pursue pilots, or “proof of concept” efforts and may want to coordinate those with the IOA.  The Consumer group requested that the IOA consider “cyber liability” as an important component to review in the model agreements.

## Long Term Vision

**Long Term Vision**

- Model agreements endorsed by HISPC
- Successfully tested in real-life settings
- Published for use nationally
- Easily replicable for other projects
- Trust that privacy/security was addressed

## Long Term Vision (cont’d)

**Long Term Vision (cont’d)**

- Share lessons learned from implementation
- Possible expansion of pilots to add other states
- Possible coordination with Centers for Disease Control (CDC)

**Notes:**
Assuming the pilots are successful, the group has discussed expanding the execution of data sharing agreements and data sharing pilots to add other states (after HISPC Phase III).

This could prove especially useful in the public health arena and could potentially be coordinated with the Centers for Disease Control (CDC) to accomplish some of their goals related to nationwide public health data sharing.  This would expand use of the HISPC data sharing agreements at the same time.

The potential exists to increase public trust in these types of activities and expand health data sharing to the next level, gradually adding in more participants and other types of health data.

## IOA Contact Information

**IOA Contact Information**

_**Co-Chair:**_**	****	****	****	**_**Co-Chair:**_
- Susan Brown 			Bill O’Byrne
- 6000 Westown Parkway			20 West State Street
- West Des Moines, IA  50266		Trenton, NJ 08625
- (O) 515-440-8215 (F) 515-440-8200		(O) 609-292-5316 x50032 (F) 609-292-3144
- _sbrown@ifmc.org_ 		 	_wobryne@dobi.state.nj.us_
_**Legal Lead**_**:**				_**Technical Lead**_**:**
- Sue Miller				Arnie Miller
- (O) 978-369-2092 			101 Kingsland Circle
- (C) 978-505-5660			Monmouth Junction, NJ 08852
- (F) 978-369-6296			(O) 732-274-9624
- _[Tmsam@aol.com](mailto:Tmsam@aol.com)_			 _[elitebussvcs@verizon.net](mailto:elitebussvcs@verizon.net)_
_**IOA/NHIN DURSA Liaison**_
- Roy Wyman
- P.O. Box 13646
- Research Triangle Park, NC  27709
- (O) 919-981-4313 (F) 919-361-2262
- _rwyman@williamsmullen.com_