HIE Governance

Contents

Executive Summary
I. Governance for Health Information Sharing Efforts
II. Governance Processes and Stages
III. Principles and Characteristics of Good Governance
Appendix

Executive Summary

This Policies in Practice resource describes how health information sharing efforts¹ can achieve trust and interoperability through sound governance principles and mechanisms, and provides real-world examples that illustrate how these principles can be manifest in practice.

In general, governance of health information sharing includes the following three components:

1. Clear goals and objectives: Governance includes definitions of the objectives and mission for health information sharing efforts.
2. Mechanisms and processes for the development, oversight, enforcement and coordination of policies, standards and services: Governance mechanisms and processes do not necessarily imply a structure, but rather a cycle of activity potentially performed by an array of entities or participants that are loosely or tightly bound together.
3. A set of policies, standards, and services: Trusted and effective information sharing calls for a common set of policies and technical specifications.

Governance is a dynamic process that involves a number of stages focused on decision- and policy-making. Each stage may involve different participants and institutions, all of which are part of a cycle in which issues are identified and prioritized, and solutions are developed, implemented, enforced and then re-evaluated. This process starts with the identification of problems that hamper secure and trusted health information sharing, and is followed by the design of potential solutions. Once a solution is identified, it is then implemented and potentially enforced. In the last stage of the governance cycle, the impact and the cost-benefit balance of these efforts are evaluated and reviewed. This final step may surface new problems that will start this cycle anew.

A number of principles and characteristics can be applied throughout these stages to support sound governance practices, including:

• Participation
• Transparency
• Representation
• Accountability
• Effectiveness
• Flexibility
• Well-defined and bounded mission

Applying these sound governance practices can help enable trusted, secure and meaningful exchange of health information between and among multiple participants—including providers, consumers, payers, researchers, public health officials and others—to improve health and health care. It takes both leadership and the establishment of processes to support it. When well-executed, the articulation of a common vision, support for common goals, and well-understood accountability among participants can result in greater trust and interoperability. Governance can also help improve the performance, impact and long-term viability of entities engaged in health information sharing.

« Back to top

I. Governance for Health Information Sharing Efforts

Trust and interoperability are essential to the sharing of health information to improve health and health care. When choosing to share health information, data holders must be confident that information will be handled appropriately and respectfully (garnering trust) and that information will be conveyed in a way that others can use and understand (enabling interoperability). Without interoperability, it is difficult for information to reach the people who need it to make critical health care decisions in a format that they can readily use. Similarly, without trust, patients may not share important information with their care team and may forgo much-needed care² to prevent their health information from falling into what they perceive as the wrong hands. Clinicians may also keep information unnecessarily siloed to prevent breaches that could harm their patients and create legal vulnerabilities.³

Applying sound governance practices can help enable trusted, secure and meaningful exchange of health information between and among multiple participants—including providers, consumers, payers, researchers, public health officials and others—to improve health and health care.

In general, governance of health information sharing includes the following three components:

1. Clear goals and objectives: Governance includes definitions of the objectives and mission for health information sharing efforts. Setting objectives upfront helps to guide the allocation of resources and activities. Defining a mission, also allows governance to focus on decisions that are necessary without tackling problems that may be secondary. For example, clear and concrete health objectives can be used to help guide meaningful participation and align efforts in the public interest.
2. Mechanisms and processes for the development, oversight, enforcement and coordination of policies, standards and services: Governance mechanisms and processes do not necessarily imply a structure, but rather a cycle of activity potentially performed by an array of entities or participants that are loosely or tightly bound together. Examples of mechanisms and processes include, but are not limited to: town hall meetings to gather public input, processes for developing and adopting shared standards and specifications for transporting health information, and mechanisms for handling disputes among network participants.
3. A set of policies, standards, and services: Trusted and effective information sharing calls for a common set of policies and technical specifications. Policies may include those that establish who has access to health information, what uses of information are acceptable, the extent to which patients can give or withhold access to their information, and the privacy and security safeguards in place. Technical specifications and services include, but are not limited to, choices about standards and specifications for transporting information, the preferred structure and vocabulary of shared health information, and technical methods for locating records.

Governance may include the efforts of an array of entities or participants, from a single medical practice to a nationwide effort. There are just as many ways to configure governance efforts as there are ways to share health information. For example, governance may focus on practices within one individual health information sharing effort or among multiple health information sharing efforts, may include a wide range of participation from both public and private entities, and may span many geographic regions or have a more local focus.

The development of governance practices and principles for health information sharing is not a new endeavor. Over the last 10 years, several public and private entities at federal, state and local levels have addressed many policy challenges to health information sharing. Today, a widely distributed set of governance bodies and processes reside in federal and state governmental agencies, federal and state legislative committees, industry associations, public-private collaborations, and through the Office of the National Coordinator for Health Information Technology (ONC) and several federal advisory committees created by the 2009 Health Information Technology for Economic and Clinical Health Act^{4, 5} (see Appendix). Current governmental activities include ONC’s development of a governance regulation⁶ to inform the development, operations and oversight of the Nationwide Health Information Network (NwHIN). (ONC is anticipated to release an Advanced Notice of Proposed Rule Making on NwHIN governance in the first quarter of 2012.⁷ ) These existing endeavors offer an important starting point for governance activity and create many opportunities for meaningful coordination.

In sum, governance is an essential and achievable endeavor and a worthy investment in sustainability, credibility and trust. Governance takes both leadership and the establishment of processes to support it. When well-executed, the articulation of a common vision, support for common goals, and well-understood accountability among participants can result in greater trust and interoperability. Governance also can improve the performance, impact and long-term viability of participating entities engaged in health information sharing.

Examples of questions that governance can help address

• How will patient information be transmitted in a trusted and interoperable manner?
• What are the shared quality improvement goals and how will they be evaluated?
• What policies will be common to all network participants in a health information sharing effort and where is diversity allowed?
• Who will be involved in developing policies for a health information sharing effort?
• What mechanisms and processes are necessary to implement policies and to maintain a focus on the public interest?
• How will complaints and violations be mitigated?

« Back to top

II. Governance Processes and Stages

Governance is a dynamic process that involves a number of stages focused on decision- and policy-making. Each stage may involve different participants and institutions, all of which are part of a cycle in which issues are identified and prioritized, and solutions are developed, implemented, enforced, and then re-evaluated.

Adopting a staged or “cycle” approach helps to deconstruct what is often considered a complex set of abstract governance processes.⁸

Problem identification and agenda-setting: It is critical at the outset to identify problems that may hamper secure and trusted health information sharing. Problems can range from compliance with state laws to insufficient infrastructure or funding to complicated local politics. It is important to note that not all problems can or should be added to the governance agenda or considered for governance action. In addition, broad input is essential at this stage to ensure wide participation and minimize the risk that one perspective disproportionately influences decision making at the expense of others.

Design, formulation and adoption: Once a problem is identified, the next step is to design a potential solution. Several mechanisms can be used, including but not limited to rules, technical requirements, contracts, new incentive structures or funding streams, technology procurement, certification, sanctions, or other more informal procedures. In addition, policies should also define the organization(s) responsible for implementation of solutions, develop timetables and identify the target participants.

Implementation and enforcement: A governance objective will only be achieved if it is executed and enforced and involves broad adoption of practices, policies and technologies. Implementation often happens through a combination of “top-down” and “bottom-up” approaches. A top-down approach involves traditional oversight and execution by a dedicated staff. A bottom-up method focuses on the critical role played by participants, such as health care providers and consumers, who must abide by adopted policies.

Evaluation and review: Steps must be taken to ensure that there are resources and agreed-upon indicators to evaluate the impact and the cost-benefit balance of an information policy or particular technical approach. One important consideration in any evaluation is whether a separate structure or body may be required to conduct such evaluations and reviews, for example, in the oversight and audit of third parties.

Example Governance Stages from the Health Information Partnership for Tennessee

Health Information Partnership for Tennessee (HIP TN) is a Tennessee not-for-profit organization that works to improve access to health information through a statewide collaborative process by providing services and infrastructure for the secure electronic exchange and use of health information. This vignette describes the governance stages, from problem identification to evaluation and review that will lead to the development of a service for providing access to patients’ complete medication histories.

« Back to top

III. Principles and Characteristics of Good Governance

A number of principles and characteristics can be applied when establishing or evaluating governance for health information sharing efforts. Appropriate and successful governance efforts demonstrate the following:

• Participation
• Transparency
• Representation
• Effectiveness
• Well-defined and Bounded Mission
• Accountability

Each characteristic is described below:

Participation: Regular and intentional public outreach and deliberations are an important aspect of legitimate decision-making and governance processes. Policies and procedures developed through a collaborative process that seeks early input, promotes broad participation, and provides public comment periods have a greater likelihood of being understood and supported by those they are designed to serve.

Transparency and Openness: It is also important to provide clear explanations for the rationale behind final policies and decisions. This includes documenting the processes and decisions of any workgroups or subgroups and addressing comments received by the public. Transparency should be a goal in other administrative respects, including how operations are financially supported and sustained.

Representation: Meaningful engagement and balanced representation of a wide variety of participants, including patients and consumers, is critical to the success of health information sharing efforts. Because the goal of safe, secure and appropriate health information sharing depends on the buy-in and participation of a wide variety of health care system participants, that same range of engagement and input is required for governance to succeed. Public-private partnerships are often considered effective governance models because these partnerships can enable broad participation both within and outside of government. All participants should come to the governance process with the aim of solving mutual challenges standing in the way of shared goals.⁹

Making broad and balanced participation a priority ensures that health information sharing initiatives are not unduly influenced by the size, resources or specialized knowledge of any one interest group. It also ensures that the needs of those the health information sharing effort aims to serve are fully known and expressed. Although participation make-up will vary, the input of all members should be equally valued. As such, it is crucial to ensure that patients and consumers in particular not only have a seat at the table and a voice, but are in a position to substantially influence decisions. Their decision-making influence in developing and meeting quality and sustainability goals will contribute significantly to broader acceptance and trust, and therefore, ultimately, success.

Effectiveness: A successful governance model will create the structure and processes needed to support effective and efficient decision-making. To operate effectively, governance efforts need adequate resources and staff who are knowledgeable, dedicated and able to execute the policies and procedures. No single governance model works for all information sharing efforts, but rather an array of tools and processes that can be used by different entities and/or participants.

Flexibility: Policies and procedures need to be flexible. Governance models should keep members informed and enable them to react quickly to a changing environment. This could include new opportunities or potential barriers as they relate to public trust and operational sustainability, funding, access to expertise, and different jurisdictional requirements.

Governance models should also accommodate constant and rapid innovations in technology. Flexibility will allow an entity to incorporate and maximize use of these technological innovations, and thus governance policies should remain technology-neutral. While precise policies should be developed with respect to desired functionality and outcomes, the means of achievement should not be overly prescriptive. This could lock in a specific type of technology or tool that may later prove sub-optimal.

Well-defined and bounded mission: A plainly articulated vision that clearly sets forth the value case for information sharing, as well as a well-defined scope of authority, will help ensure that the governance processes are timely, relevant and appropriate. The scope should be limited to the necessary policies and procedures that must be commonly defined and agreed upon to achieve these two high-level objectives. Clearly articulating a high level mission is critical for prioritizing strategic objectives and addressing issues appropriately as they emerge over time. In the context of the Markle Connecting for Health Common Framework for Private and Secure Health Information Exchange, adopting two high level goals helped to circumscribe the scope of efforts; these two goals include the following: (1) improving health while establishing trust; and (2) assuring interoperability while encouraging innovation.

Accountability: Accountability is a vital element of any governance process and should include procedures for the submission and handling of complaints related to policy violations. In addition, a clear and public dispute resolution process should be developed. Annual reports, independent audits and external reviews are other good methods of ensuring accountability and identifying areas for appropriate enforcement. Health information sharing efforts have a range of accountability and enforcement mechanisms to choose from to best fit their particular objectives and circumstances, but the existence of each should be shared publicly. The implementation of an oversight committee is one way to ensure that mechanisms are put in place and maintained effectively. Additional information on accountability and oversight can be found in the Policies in Practice Mechanisms for Oversight, Accountability, and Enforcement: The Model Contract Update and More.

« Back to top

Appendix

The Current Landscape of Governance at the National Level

Today a widely distributed set of governance bodies exists to address the policy and technology aspects of health information sharing through federal and state government agencies, federal and state legislative committees, industry associations, public-private collaborations, and through several interim public advisory groups created by the 2009 HITECH Act. Coordination with those existing health information sharing governance efforts and processes is key to prevent duplication and confusion.

Federal Executive Agencies

The Office of the National Coordinator for Health Information Technology (ONC)

The Office of the National Coordinator for Health Information Technology, within the Department of Health and Human Services (HHS), is the principal federal entity charged with coordination of nationwide efforts to facilitate health information sharing. The position of National Coordinator was created in 2004 through an Executive Order, and formally established in the Health Information Technology for Economic and Clinical Health Act (HIEECH Act) of 2009. The HITECH Act provides ONC with the authority to promulgate regulations and guidance to support the development of an interoperable, private and secure nationwide health information technology infrastructure.

Please note that as of March 2012, ONC anticipates that it will release an Advanced Notice of Proposed Rule Making on NwHIN governance during the first quarter of 2012. This rule will inform the development, operations and oversight of the Nationwide Health Information Network.

In addition, two ONC offices, in particular, are important from a governance perspective for health information sharing efforts:

• The Office of the Deputy National Coordinator for Programs & Policy is responsible, among other things, for developing the mechanisms for establishing and implementing standards necessary for nationwide health information sharing; formulating policy for the privacy and security of health information; and developing policies as may be otherwise necessary for implementing its mission.
• The Office of the Chief Privacy Officer is responsible for advising the National Coordinator on privacy, security and data stewardship of electronic health information and coordinating ONC’s efforts with similar privacy officers in other federal agencies, state and regional agencies, and foreign countries.

ONC works with two Federal Advisory Committees (FACAs), established by the HITECH Act.

• The Health IT Policy Committee makes recommendations to the National Coordinator on a policy framework for the development and adoption of a nationwide health
• The Health IT Standards Committee is charged with making recommendations to the National Coordinator for Health IT on standards, implementation specifications, and certification criteria for the electronic exchange and use of health information. In developing, harmonizing or recognizing standards and implementation specifications, the Standards Committee will also provide for the testing of the same by the National Institute for Standards and Technology (NIST).

Office for Civil Rights (OCR)

The Office for Civil Rights within HHS implements and enforces a number of federal regulations, including the:

• HIPAA Privacy Rule, which protects the privacy of individually identifiable health information;
• HIPAA Security Rule, which sets national standards for the security of electronic protected health information;
• Confidentiality provisions of the Patient Safety Rule, which protect identifiable information being used to analyze patient safety events and improve patient safety; and the
• Interim final breach notification regulations, requiring HIPAA-covered entities and their business associates to provide notification following a breach of unsecured protected health information.

Centers for Medicare and Medicaid Services (CMS)

The HITECH Act established programs under Medicare and Medicaid administered by Centers for Medicare and Medicaid Services to provide incentive payments to eligible providers and hospitals for the “meaningful use” of certified electronic health record (EHR) technology. The programs began in 2011 and are designed to spur the use of EHRs to improve the quality, safety and efficiency of health care.

Other important Federal entities affecting health information sharing Governance (in alphabetical order):

• Agency for Healthcare Research and Quality (AHRQ)
• Centers for Disease Control and Prevention (CDC)
• Department of Defense (DoD)
• Federal Trade Commission (FTC)
• Food and Drug Administration (FDA)
• National Institutes of Health—National Library of Medicine (NIH-NLM)
• Veterans Affairs (VA)

Congressional Committees

Several Congressional committees have jurisdiction over governance for health information efforts. The main committees include:

House of Representatives

• Science and Technology Committee (Technology and Innovation Subcommittee)
• Energy and Commerce Committee (Subcommittee on Health)
• Ways and Means Committee (Subcommittee on Health)

Senate

• Committee on Health, Education, Labor & Pensions (HELP Committee)
• Committee on Finance (Subcommittee on Health Care)

Private Entities

There are a number of private entities currently conducting some governance functions for health information efforts. These include:

• Various ONC-Authorized Testing and Certification Bodies (ONC-ATCB), who are required to test and certify EHRs against certification criteria defined by the Secretary of HHS. Examples include: Surescripts LLC , ICSA Labs , SLI Global Solutions, InfoGard Laboratories, Inc., Certification Commission for Health Information Technology (CCHIE) and the Drummond Group, Inc. (DGI).
• Numerous Standard Developing Organizations (SDOs) are working on developing interoperable health information sharing solutions. These include, among others, ASTM, CPT , DICOM , Health Level 7, HISB , IEEE, IOM Patient Safety Data Standards, ICD-9CM, LOINC , MedBiquitous, NCPDP , NDF-RT and RxNorm, SNOMED, UMLS and X12. The memberships of these organizations differ widely but are mainly composed of private companies.

State and Local Entities

Across the United States, numerous entities and organizations have emerged to enable the movement and exchange of health-related information. Two broad categories can be distinguished from a health information sharing governance perspective:

• Regional Extension Centers (RECs) were established and funded by the American Recovery and Reinvestment Act of 2009, to enable healthcare practitioners to receive local technical assistance, guidance and information on best practices in the deployment, adoption and use of electronic health records. They are designed to address unique community requirements and to support and accelerate provider—small and rural in particular—efforts to become “meaningful users” of EHRs. A map of these RECs can be found at ONC’s website.
• Health Information Exchange (HIE) or Health Information Organizations (HIOs) are efforts and organizations that govern the exchange of health related information among independent and disparate entities. The relationship between HIE and HIOs can vary across and within states. For instance, an HIO may be the legal entity governing the activity of HIE while at the same time be the entity providing the physical infrastructure for HIE services. Or an HIO may be the legal entity governing the activity of health information exchange while a separate entity or collaborative provide the physical infrastructure. A comprehensive overview of HIE/HIOs across the United States is provided by HIMSS and can be found at HIMSS State HIT Dashboard. In addition, ONC’s State HIE Cooperative Agreement Program funds states’ efforts to rapidly build capacity for exchanging health information across the health care system both within and across states. Program participants can be found at State Health Information Exchange Cooperative Agreement Program.

Several cross-state initiatives exist as well, aimed at coordinating or providing assistance in the area of governance for health information sharing efforts:

• State Health Policy Consortium (SHPC) is facilitating groups of states in resolving policy issues at a concrete level to enable the exchange of health information across state lines. Through the SHPC, ONC’s contractor, RTI International, provides support services such as subject matter experts, meeting resources, policy and legal research, and travel to approved multistate Consortium meetings.
• State Alliance for eHealth is a consensus-based, executive-level body of state elected and appointed officials, formed to address the unique role state governments can play in facilitating adoption of interoperable electronic HIE. It is also intended to be a forum through which stakeholders can work together to identify new inter- and intrastate-based policies and best practices and explore solutions to programmatic and legal issues related to the exchange of health information.
• State-level Health Information Exchange Consensus Project’s main objective is to provide a forum for ONC to work with states to ensure all health information exchange activities throughout the Unites States align. This is a forum that enables ONC to disseminate information about the national agenda and for the states-based efforts to inform the federal government, thereby enabling a nationwide alignment of all health information sharing activities.

« Back to top

__________

1. The Policies in Practice apply the term “health information sharing effort” broadly to refer to any initiative that supports the electronic exchange of health information between data holders. Similar terminology includes “health information exchange (HIE),” “regional health information organization (RHIO),” and “sub-network organization (SNO).”
2. Amalia R. Miller and Catherine E. Tucker, “Privacy Protection and Technology Diffusion: The Case of Electronic Medical Records.” Management Science, 55, no. 7 (2009): 1077-093.
3. James G. Anderson, “Social, Ethical and Legal Barriers to E-Health.” International Journal of Medical Informatics, 76, no. 5, (2007): 480-83.
4. The 2009 HITECH Act, which provides states with funds to accelerate the development of statewide HIEs, also called for the development of the Nationwide Health Information Network which comprises “a set of policies, standards and services that enable the Internet to be used for secure and meaningful exchange of health information,” The 2009 HITECH Act also mandated the Office of the National Coordinator to develop a mechanism for NHIN Governance.
5. Health Information Technology for Economic and Clinical Health (HITECH) Act, Title XIII of Division A and Title IV of Division B of the American Recovery and Reinvestment Act of 2009 (ARRA), Pub. L. No. 111-5, 123 Stat. 115 (February 17, 2009), codified at 42 U.S.C. §§300jj et seq.; §§17901 et seq. http://www.gpo.gov/fdsys/pkg/BILLS-111hr1enr/pdf/BILLS-111hr1enr.pdf (accessed on February 22, 2012).
6. Progress of this upcoming rulemaking can be tracked at: http://healthit.hhs.gov/portal/server.pt/community/healthit_hhs_gov_regulations_and_guidance/1496.
7. Office of the National Coordinator for Health Information Technology, Transcripts of Meetings of the HIT Policy Committee, Meeting of February 1, 2012, 23. http://healthit.hhs.gov/portal/server.pt/gateway/PTARGS_0_0_6010_1814_17824_43/http%3B/wci-pubcontent/publish/onc/public_communities/_content/files/20120201_hitpc_transcript_draft.pdf (accessed on March 12, 2012).
8. The cycle is adapted from and based upon political science and public policy literature that describes policymaking processes in a variety of settings. Among the key sources used to develop the cycle include: Public Policy-making: An Introduction (Anderson, 2000); A Practical Guide for Policy Analysis: The Eightfold Path to More Effective Problem Solving (Bardach, 2000); An Introduction to the Policy Process (Birkland, 2001); Top Down Policymaking (Dye, 2001); Citizens as Partners: OECD Handbook on Information, Consultation and Public Participation in Policy-making, Organisation for Economic Cooperation and Development (Gramberger, 2001) [Downloadable from the OECD Website]; Beyond the New Public Management: Changing Ideas and Practices in Governance; Theories of the Policy Process (Munger, 2000); and Policy Paradox: the Art of Political Decision Making (Stone, 2002).
9. This model for Consumer Engagement was adapted from the resources available from the National Partnership for Women & Families’ “Quality Tool Box.”
10. This model for Consumer Engagement was adapted from the resources available from the National Partnership for Women & Families’ “Quality Tool Box.”
11. Definition courtesy of the National Partnership for Women & Families, www.nationalpartnership.org.