CDC-Data-2025/Cleared_HIE_Assessment_Codebook_word_djvu.txt

HIE Assessment Codebook 


Health Information Exchange Assessment 


Codebook 


This codebook describes the variables in a dataset that examines variation in state laws relating to health 
information exchanges (HIEs). This dataset includes laws in effect on June 7, 2016. The jurisdictions selected 
for measurement are the 50 states, US territories, and the District of Columbia. 


HIE Governance 


Variable Name Question Answer Options Dataset Value 
Does the law Yes 1 
authorize No/Not mentioned 2 
implementation of a | Ambiguous 4 
G StateW statewide HIE? 
Who retains control State entity di 
over the statewide State-designated 2 
HIE’s operations? entity (SDE) 
State option to control | 3 
Not mentioned 4 
Ambiguous 5 
G StateW_Ctrl N/A 6 
If an SDE controls the Yes 1 
operation of the No/Not mentioned 2 
statewide HIE, is it Ambiguous 4 
required or authorized N/A 5 
G StateW_Ctrl_ SDE_non to function asa 
Profit nonprofit corporation? 
Does the law require | Yes 1 
HIE participants to No/Not mentioned 2 
enter into Ambiguous 4 
participation N/A 5 
agreements or 
business associate 
agreements with the 
G PartAgree HIE/HIO? 
Does the law Financial 1 
incentivize HIE Nonfinancial 2 
participation Both 3 
(excluding funds to None 4 
be spent solely on 
HIE creation or 
Incentives implementation)? 
Is there an entity Yes 1 
with oversight No/Not mentioned 2 
responsibilities for Ambiguous 4 
G Oversight the HIE? 
Is the state entity Yes 1 
authorized to No/Not mentioned 2 
promulgate rules and | Ambiguous 4 
regulations N/A 5 
G Oversight Rules pertaining to the HIE? 
G_Oversight_Resolve Is the oversight entity | Yes 1 
authorized to resolve | No/Not mentioned 2 


HIE Assessment Codebook 


disputes and/or levy | Ambiguous 4 
administrative N/A 5 
penalties related to 
the HIE? 
Does the law Yes 1 
authorize the No/Not mentioned 2 
creation of Ambiguous 4 
committees or N/A 5 
advisory boards to 
assist the oversight 

G Oversight AdvisB entity? 
Does the law require | Yes 1 
a HIE or health No/Not mentioned 2 
information Ambiguous 4 
organization to be N/A 5 
certified as a 
prerequisite to 

G_Oversight_Cert operation? 
Does the law require | Yes 1 
HIE participants to No/Not mentioned 2 
meet certain Ambiguous 4 
technical and/or 
interoperability 

G_Oversight_Stand standards? 
Does the law set Yes 1 
forth a complaint No/Not mentioned 2 
mechanism for Ambiguous 4 
patients or HIE N/A 5 
participants for 
adverse events 

G Oversight Compl related to the HIE? 
Does the law include | Yes 1 
provisions addressing | No/Not mentioned 2 
public transparency | Ambiguous 4 
of HIE activities, 
including but not 
limited to public 
participation in HIE 
policy and public 
disclosures of HIE 
policies, operations, 

G_Transparancy and activities? 
Does the law provide | Yes 1 
authority to a state No/Not mentioned 2 
entity for the Ambiguous 4 
evaluation or 
measurement of the 

G_Transparancy_ Eff HIE’s effectiveness? 
Is the HIE required to | Yes 1 
submit reports to the | No/Not mentioned 2 
public or legislature | Ambiguous 4 

N/A 5 


G Transparancy_Eff Rep 


on its operations? 


HIE Assessment Codebook 


Does the law provide | Yes 1 
authority to a state No/Not mentioned 2 
entity for auditing HIE | Ambiguous 4 

G Transparancy Eff Aud | operations? ies 5 
Does the law address | Yes et 
the ownership of data | No/Not mentioned 2 

G Ownership disclosed to the HIE? | Ambiguous |e 
Do entities Yes 1 
contributing to the No/Not mentioned 2 
HIE retain a property | Ambiguous 4 
right/ownership N/A 5 
interest over those 

G_Ownership_ Prop data? 
Does the HIE acquire | Yes 1 
an ownership interest pe mentioned - 

j ? MbDIQUOUS 
G Ownership Prop HIE See oo N/A = 5 


Variable Name 


Question 


Answer Options 


Dataset Value 


Does the law Yes, authorizes it 1 
authorize providers Yes, does not 2 
to access or authorize it 3 
contribute to HIE Not mentioned 4 
data for patient hee ow ° 
Use_Provid treatment? 
Does the law Yes cl 
authorize No/Not mentioned 2 
participating Ambiguous 4 
healthcare facilities N/A 5 
to designate roles 
within the facility for 
Use Provid Desig authorized HIE use? 
Does the law Yes 1 
mandate any No/Not mentioned 2 
providers to access | Ambiguous 4 
or contribute to HIE | N/A 5 
Use Provid Mand data? 
Can the HIE be used | Yes 1 
for an advanced No 2 
directives registry? Not mentioned 3 
Ambiguous 4 
Use Provid AdvDir N/A 5 
Use_ Patient Are patients Yes, authorizes it 1 
authorized to access | Yes, does not Zz 
their HIE data authorize it 3 
electronically through | Not mentioned 4 
an HIE portal or user Ryemee : 


interface (i.e., 


excluding patient 


HIE Assessment Codebook 


access to emailed, 
faxed, or mailed 
copies of their 


records)? 
Does the law Yes, authorizes it 1 
authorize Yes, does not 2 
bidirectional authorize it 3 
communication Not mentioned a 
between patients and Rae =) 
other HIE participants 
(e.g., communication 
between patients and 
providers regarding 
their medical 
treatment through an 
HIE portal or user 
Use Patient Bi interface)? 
Are patients Yes, request il 
authorized to use the | amendments 2 
HIE to request Yes, make alterations | 3 
amendments or Both . 
make revisions to Moyen imiein donee 6 
their data directly ae d 
through an HIE portal 
Use Patient Change or user interface? 
Does the law Yes, authorizes it 1 
specifically authorize | Yes, does not 2 
emergency medical | authorize it 3 
services (EMS) to Not mentioned 4 
access or contribute See ya 5 
to HIE data for 
Use EMS patient treatment? 
Does the law Yes, authorizes it 1 
authorize payers to Yes, does not 2 
access HIE data? authorize it 3 
Not mentioned 4 
Ambiguous 5 
Use_Payer N/A 
Does the law address | Yes, authorizes it 1 
bidirectional Yes, does not 2 
communication authorize it 3 
between payers and_ | Not mentioned 4 
other HIE participants eae 2) 
through an HIE portal 
Use Payer Bi or user interface? 
Does the law Yes, authorizes it 1 
authorize medical Yes, does not 2 
labs to convey authorize it 3 
medical test results | Not mentioned a 
Use Lab through the HIE? ce 5 
Use Research Does the law Yes, authorizes it 1 
authorize educational | Yes, does not Z 


HIE Assessment Codebook 


or other research authorize it 3 
institutions to access | Not mentioned 4 
HIE data through an | Ambiguous 5 
HIE portal or user N/A 
interface (excluding 
research requiring 
express consent for 
the use of an 
individual’s 
information)? 
Does the law Yes, authorizes it 1 
authorize employers | Yes, does not 2 
to access the HIE a ee : 
(e.g., for conveying 
the results of heeee 5 
employee drug tests 
or background 
Use Employer checks)? 
Does the law Yes, authorizes it 1 
authorize Yes, does not 2 
pharmacists and authorize it 3 
pharmacies to access | Not mentioned 4 
the HIE (e.g., for the eae 5 
purposes of 
executing 
prescription drug 
orders and 
documenting other 
pharmaceutical 
Use Pharm care)? 
Can the HIE be used | Yes, authorizes it 1 
for prescription Yes, does not 2 
monitoring purposes | authorize it 3 
by prescribers and Not mentioned oy 
those dispensing aes > 
Use Pharm PDMP prescriptions? 
Does the law address | Yes, authorizes it 1 
the use of HIE data Yes, does not 2 
for marketing or authorize it 3 
other commercial Not mentioned 2 
purposes (excluding Nae 5 
marketing or 
commercial purposes 
requiring express 
consent for the use of 
an individual’s 
Use Marketing information)? 
Does the law Yes, authorizes it 1 
authorize state and Yes, does not 2 
local health authorize it 3 
authorities to access_| Not mentioned a 
Ambiguous 5 


Use_ PH 


the HIE? 


N/A 


HIE Assessment Codebook 


Does the law address | Yes, authorizes it 1 
HIE bidirectional Yes, does not 2 
communication authorize it 3 
between public Not mentioned 4 
health authorities Se 5 
and other HIE 
participants through 
an HIE portal or user 
Use PH Bi interface? 
Can the HIE be used | Yes 1 
for prescription drug | No 2 
monitoring? Not mentioned B} 
Ambiguous 4 
Use PH PDMP N/A Is 
Can the HIE be used | Yes 1 
for case reporting? No 2 
Not mentioned 3 
Ambiguous 4 
Use _PH_CaseReport N/A 5 
Can the HIE be used | Yes 1 
for immunization No 2 
reporting? Not mentioned 3 
Ambiguous 4 
Use _PH_IIS N/A 5 
Can the HIE be used | Yes 1 
for syndromic No Z 
surveillance? Not mentioned 3 
Ambiguous 4 
Use PH SyndSurv N/A 5 
1 
2 
3 
4 
5 


Use_StateAgency 


Does the law 
authorize any other 
state agency or 
entity (other than 
public health) to 
access the HIE? 


Yes, authorizes it 
Yes, does not 
authorize it 

Not mentioned 
Ambiguous 

N/A 


Does the law address | Yes, authorizes it cl 
bidirectional Yes, does not 2 
communication authorize it 3 
between these state | Not mentioned a 
agencies and other A egaa se 5 
Use StateAgency Bi HIE participants? 
Does the law Yes, authorizes it 1 
authorize the Yes; does not Z 
collection of data on | authorize it 3 
healthcare operations | Not mentioned a 
and quality through iene 3 


Use QM 


Variable Name 


the HIE? 


Question 


Answer Options 


Dataset Value 


HIE Assessment Codebook 


confidentiality related 
to HIE data? 


Does the law have mes 1 
patient notice No/Not mentioned 2 
requirements Ambiguous 4 
(excluding patient- N/A 5 
initiated requests for 
information, such as 
a request fora 
medical record 

Data PtNotice access audit log)? 
...of the content of Yes 1 
data collected or No/Not mentioned 2 
released by or Ambiguous 4 

Data_PtNotice Collect through the HIE? N/A > 
...of the entities with | Yes 1 
access to HIE data? No/Not mentioned Z 

Ambiguous 4 

Data_PtNotice_ Entities N/A 5 
...of the purposes for | Yes 1 
which patient data No/Not mentioned 2 
can be Ambiguous 4 

Data PtNotice Purpose | disclosed/used? N/A 5 
Is there a procedure | Yes 1 
for correcting or No/Not mentioned 2 
removing HIE data? | Ambiguous 4 

Data_Correct N/A 5 
Does the law vary on | Yes 1 
data protection No/Not mentioned 2 
requirements for Ambiguous 4 
query-based and N/A 5 
point-to-point HIE 

Data_HIEType functions? 
Does the law require | Yes 1 
privacy protections No/Not mentioned 2 
for the HIE (excluding | Ambiguous 4 
direct reference to N/A ° 
state or federal 

Data_Privacy privacy laws)? 
Does the law address | Yes 1 
privacy violations or | No/Not mentioned 2 
breaches? Ambiguous 4 

Data_Privacy Breach N/A 5 
Can participating Yes 1 
patients restrict No/Not mentioned 2 
certain health Ambiguous 4 
information from N/A -) 
being disclosed to 
the HIE or restrict 
certain accesses or 

Data_Privacy_PtRestricti | uses by HIE 

ons participants? 

Data Privacy Consent Is patient consent Opt-in 1 


HIE Assessment Codebook 


required for Opt-out 2 
disclosure of patient | Voluntary (not 5 
data in the HIE? specified) 4 
No/Not mentioned 5 
Ambiguous 6 
N/A 
Can patients change _ | Yes 1 
: their consent No/Not mentioned 2 
Data_Privacy_Consent_C preference? Ambiguous 4 
hange N/A 5 
Is there an exception | Yes if 
to the consent No/Not mentioned 2 
Data Privacy Consent_E | requirement in Ambiguous 4 
merg emergencies? N/A 5 
Are there specific Yes it 
consent No/Not mentioned 2 
Data Privacy Consent_M | requirements for Ambiguous 4 
inors minors? N/A 5 
Does the law address | Yes 1 
administrative, No/Not mentioned 2 
technical, or physical | Ambiguous 4 
safeguards to secure N/A 5 
HIE data (excluding 
direct references to 
state or federal 
Data_Security laws)? 
Does the law require | Yes 1 
HIE users to receive beat mentioned 7 
j iN ? MmMbDIQUOUS 
Data Security Training roa aL N/A 5 
Does the law require | Yes 1 
minimum encryption | No/Not mentioned 2 
standards of HIE data | AMbiguous 4 
(excluding general N/A 5 
references to 
interoperability 
Data Security Encrypt standards)? 
Does the law require | Yes 1 
minimum standards | No/Not mentioned 2 
for authentication of | Ambiguous 4 
Data Security Authent | user identity? N/A 5 
Are there express Yes 1 
duties for providers | No/Not mentioned 2 
or other HIE users to | Ambiguous 4 
protect patient data N/A 3 
from unauthorized 
Data_Confid accesses/disclosures? 
Are there provisions | Yes 1 
addressing No/Not mentioned 2 
subpoenas or other | Ambiguous A 
judicial court orders | N/A 5 
Data_Confid_ Subpoena for HIE data? 
Data_Confid_FOIA Are there provisions _| Yes 1 


HIE Assessment Codebook 


Data Confid Sensitive 


addressing public No/Not mentioned 2 
access requests of Ambiguous 4 
HIE data? N/A 5 
Does the law provide | Yes 1 
heightened No/Not mentioned 2 
protections for Ambiguous - 

N/A 5 


sensitive health 
information (e.g., 
mental health 
information, genetic 
information, HIV test 
results)? 


Funding 


Variable Name Question Answer Options Dataset Value 

Does the law address | Yes 1 

HIE funding? No/Not mentioned 2 
Funding Ambiguous 4 

Does the law specify | Yes 1 

funding sources to No/Not mentioned 2 

cover initial HIE Ambiguous 4 

implementation N/A 5 
Funding Implement costs? 
Funding Implement_ST State resources True/False 
Funding _Implement_Fed Federal resources True/False 
Funding Implement_Priv Private contributions True/False 
Funding Implement_Fee Participant fees True/False 

Does the law specify | Yes 1 

funding sources for No/Not mentioned 2 

long-term Ambiguous 4 
Funding Longterm operability? N/A 5 
Funding Longterm_ST State resources True/False 
Funding Longterm Fed Federal resources True/False 
Funding Longterm Priv Private contributions True/False 
Funding Longterm Fee Participant fees True/False 


Liability 


Variable Name 


Liability 


Question 

Does the law provide 
immunity from 
liability for the 
HIE/HIO or its 
participants? 


Answer Options 
HIE 

Healthcare provider 
Both 

No/Not mentioned 
Ambiguous 


Dataset Value 


ABWNFH 


Interjurisdictional Exchange 


Variable Name 


Question 


Answer Options 


Dataset Value 


Interjurisdiction 


Does the law address 
the exchange of data 
across state borders? 


Yes, authorizes it 
Yes, does not 
authorize it 

Not mentioned 
Ambiguous 


1 


2 
3 
4 


HIE Assessment Codebook