In 2006 the Department of Health and Human Services funded significant initiatives through a new Office of the National Coordinator (ONC) to play a key role laying the groundwork to support widespread interoperable electronic health information exchange. ONC has become responsible for nationwide coordination of projects that have developed the parameters for technical and policy challenges and priorities, and supported the development of required content and process knowledge. The Privacy and Security Projects have been carried out through the Health Information Security and Privacy Collaboration (HISPC). HISPC 2006 – 2009 has been one of the nationwide initiatives to identify and address barriers and challenges to health information exchange (HIE). Goals have been to:

• Preserve privacy and security protections in a manner consistent with interoperable HIE exchange;  
• Promote stakeholder identification of practical solutions and implementation strategies through an open and transparent consensus-building process; and  
• Create a knowledge-base about privacy and security issues in electronic HIE in states and communities that can endure to inform future HIE activities.

On the nationwide level, key topic areas addressed by solutions included the need to:

• Harmonize the approach to patient permission for disclosure
• Simplify the complex interplay among HIPAA privacy and security rules, other federal law and state laws
• Reduce variation in interpretations of HIPAA
• Foster trust between providers participating in exchange and among consumers permitting their information to be exchanged.

For Massachusetts HISPC the key findings impeding HIE included:

• Stakeholder entities manage HIE with differing interpretation of privacy and security requirements from federal and state laws and regulations
• The recognition of the compelling need to develop comprehensive communications and education strategy as critical components for future initiatives.

And Solutions identified as critical in Massachusetts included the need to:

• Develop detailed stakeholder and experts' consensus on the sequence or logic flow for patient consent requirements, including sensitive medical information
• Clarify access requirements among providers and consumers
• Address the lack of common understanding regarding privacy requirements, i.e. the critical need for consumer and provider education.

HISPC Final Reports:

• The MA HISPC Final Report

• RTI Project Site
• AHRQ National Resource Center

HISPC Phase 2 was a six-month project conducted through December 2007 with 42 states and 2 territories participating. The scope was for each state to implement a critical state-specific solution identified during the Phase 1 assessment and findings, and to develop plans for multi-state collaboration in an anticipated HISPC Phase 3.

On the nationwide level:

• 34 states produced a multitude of state-specific deliverable, including reports, videos, websites model agreements, model forms and educational toolkits
• 42 states/territories submitted proposals to participate in the Phase 3 Collaborative work groups.

For Massachusetts HISPC the focus was Consent Management:

• A uniquely descriptive consensus driven work product was developed that detailed logical paths of information flow with the needed consent check points required to move PHI (permit disclosure) including the legal privacy requirements and community preferences or practices – both entity and patient.
• The information flow was situation/case driven
• It mapped the logic flow to manage the interplay of rules and preferences
• It confirmed the complexity of inter-dependencies and hierarchical decision making that exists currently in the decision to “correctly” disclose PHI.
• It confirmed that the challenge is not the laws, rather it is at the community entity level, where the need to capture consent is diverse and dynamic

HISPC Phase 3 Began in April 2008 and ran through March 2009, ONC selected 40 states and 2 territories to participate in 7 content-specific Collaboratives and to execute the collaborative strategies developed in Phase 2. The 7 Collaboratives are:

• Interstate Disclosure and Patient Consent Requirements
• Consumer Education and Engagement
• Consent Policy Options
• Harmonizing State Privacy Law
• Provider Education
• Adoption of Standard Policies
• Inter-organizational Agreements

Massachusetts HISPC was chosen for 2 Multi State Collaboratives--as Co-Chair of the Interstate Disclosure and Patient Consent Requirements Collaborative and Chair for the Consumer Education and Engagement Collaborative.

The Multi-State Interstate Disclosure and Patient Consent Requirements Project examined the environment where patient consent laws vary from state-to-state regarding when consent would and would not be required in order to disclose the patient's PHI to a treating health care provider. With the complexity of state laws and the variation in interpretation of state laws, this Project was a challenge that demonstrated the inherent difficulty of knowing when a patient's health information can be shared and when it cannot.

•  The Project established a model for identifying and resolving patient consent and information disclosure across states; the approach was scenario based with work products the describe the variation among the 11 participating states.

•  The Project has identified state statutes and regulations that govern when specific types of health information may be disclosed to a patient's treating health care providers, whether in state or out of state.

•  The Project revealed that any given statutory and regulatory provision is often subject to varying interpretation.

•  The project presented several options to reduce the variability among state laws and facilitate electronic health information exchange using both nationally-and state-driven approaches. These options were presented with recognition that it may be difficult and challenging to accomplish them.

The Multi-State Consumer Education and Engagement Collaborative Project , u sed the knowledge of local populations and with the Collaborative's 7 participating states, developed tools and strategies to ngeage and educate the consumers in each state. Of note, significant recognition was given to the need to rely on language and literacy-controlled materials specifically targeted to populations with known healthcare needs. These state projects have already begun to serve as a testing ground, with results feeding back for ongoing updates and customized improvements. In addition, the Collaborative defined high priority “common projects” that included the participation of all Collaborative states. Massachusetts was appointed the lead state for this Collaborative. The Collaborative states all contributed to the common projects, along with the management of their state-specific projects.

The Collaborative Common Projects:

•  A glossary of HIT/HIE terms

•  Inventory matrix of existing HIE/HIT education and engagement materials

•  FAQs about HIT/HIE privacy and security

•  A sum mary document on risk and benefits of HIE

•  A sum mary document of patient rights under HIPPA

•  Guidelines for Engaging Consumers

•  Methodology for translating informational/educational documents into different literacy levels and languages

•  Guidelines for patient consent

The MA Projects:

•  A Self-directed tutorial on sensitive health information

•  Frequently Asked Questions (FAQs) for sensitive health information

•  Legal inventory of MA requirements for sensitive health information

•  Consumer Information sheets associated with the legal inventory

•  Video, “ Balancing Risks & Benefits: the Sharing of Sensitive Health Information ”

•  Personal Health Record (PHR) website analysis

•  Consumer guide to PHRs

HISPC Phase 3.5 From April through July 2009, ONC has provided the opportunity for the Multi-State Collaboratives to take additional time to disseminate the valuable deliverables from their respective projects and importantly the education and engagement materials for the Consumer and Provider Collaboratives.

•  The Massachusetts HISPC Interstate and Patient Consent Requirements Collaborative is working under an extension to seek answers to the question: Is it feasible to determine each state's capacity to declare an official position regarding consent requirements for disclosure of a patient's health information for treatment purposes? The Project is seeking to understand the legal mechanism or other process that a participant state would use to provide answers to this question and officially confirm that those answers meet your state's legal, regulatory and policy requirements. The official position of a state is considered to be a defensible position on the interpretation of State laws and regulations that could be used to definitively guide disclosures of specific types of protected health information (PHI) by specific parties for specific purposes, e.g. treatment. Such a clear position could be codified and used in automated consent management solutions in support of advancing electronic health information exchange on a broad scale as is envisioned in the Nationwide Health Information Network (NHIN).

•  The Massachusetts HISPC Consumer Education and Engagement Collaborative will present Phase 3 materials in a “how-to” format and will include a “Town Meeting” approach to reach and engage consumers.

•  The MA video, “ Balancing Risks & Benefits: the Sharing of Sensitive Health Information ” and the Oregon tools for creation of successful “Town Meetings” the MA project team will be used to obtain sponsorship from a local MA Board of Health and to plan a “Town Meeting” type of consumer event. The MA HISPC team will provide panelists for introduction, Q&A and discussion. A Public Service Documentary will be created that will include an introduction to the Town Meeting session, the MA video and the Q&A session.

•  Dissemination of MA video, “Balancing the Risks and Benefits: Sharing Sensitive Health Information” will be accomplished via a local town cable station. The video and introduction (to be developed) will then be uploaded to the state cable library with a description of the content for use by any Massachusetts community's local cable station.

•  The creation of a “For Consumers” section of MA HISPC website will include consumer tools and resources in user-friendly formats. The five (5) MA HISPC projects will be reviewed and re-formatted (where necessary) and placed on the site as well as links to other appropriate consumer resources.