HIE Assessment Codebook

Health Information Exchange Assessment

Codebook

This codebook describes the variables in a dataset that examines variation in state laws relating to health information exchanges (HIEs). This dataset includes laws in effect on June 7, 2016. The jurisdictions selected for measurement are the 50 states, US territories, and the District of Columbia.

HIE Governance

Variable Name Question Answer Options Dataset Value Does the law Yes 1 authorize No/Not mentioned 2 implementation of a | Ambiguous 4 G StateW statewide HIE? Who retains control State entity di over the statewide State-designated 2 HIE’s operations? entity (SDE) State option to control | 3 Not mentioned 4 Ambiguous 5 G StateW_Ctrl N/A 6 If an SDE controls the Yes 1 operation of the No/Not mentioned 2 statewide HIE, is it Ambiguous 4 required or authorized N/A 5 G StateW_Ctrl_ SDE_non to function asa Profit nonprofit corporation? Does the law require | Yes 1 HIE participants to No/Not mentioned 2 enter into Ambiguous 4 participation N/A 5 agreements or business associate agreements with the G PartAgree HIE/HIO? Does the law Financial 1 incentivize HIE Nonfinancial 2 participation Both 3 (excluding funds to None 4 be spent solely on HIE creation or Incentives implementation)? Is there an entity Yes 1 with oversight No/Not mentioned 2 responsibilities for Ambiguous 4 G Oversight the HIE? Is the state entity Yes 1 authorized to No/Not mentioned 2 promulgate rules and | Ambiguous 4 regulations N/A 5 G Oversight Rules pertaining to the HIE? G_Oversight_Resolve Is the oversight entity | Yes 1 authorized to resolve | No/Not mentioned 2

HIE Assessment Codebook

disputes and/or levy | Ambiguous 4 administrative N/A 5 penalties related to the HIE? Does the law Yes 1 authorize the No/Not mentioned 2 creation of Ambiguous 4 committees or N/A 5 advisory boards to assist the oversight

G Oversight AdvisB entity? Does the law require | Yes 1 a HIE or health No/Not mentioned 2 information Ambiguous 4 organization to be N/A 5 certified as a prerequisite to

G_Oversight_Cert operation? Does the law require | Yes 1 HIE participants to No/Not mentioned 2 meet certain Ambiguous 4 technical and/or interoperability

G_Oversight_Stand standards? Does the law set Yes 1 forth a complaint No/Not mentioned 2 mechanism for Ambiguous 4 patients or HIE N/A 5 participants for adverse events

G Oversight Compl related to the HIE? Does the law include | Yes 1 provisions addressing | No/Not mentioned 2 public transparency | Ambiguous 4 of HIE activities, including but not limited to public participation in HIE policy and public disclosures of HIE policies, operations,

G_Transparancy and activities? Does the law provide | Yes 1 authority to a state No/Not mentioned 2 entity for the Ambiguous 4 evaluation or measurement of the

G_Transparancy_ Eff HIE’s effectiveness? Is the HIE required to | Yes 1 submit reports to the | No/Not mentioned 2 public or legislature | Ambiguous 4

N/A 5

G Transparancy_Eff Rep

on its operations?

HIE Assessment Codebook

Does the law provide | Yes 1 authority to a state No/Not mentioned 2 entity for auditing HIE | Ambiguous 4

G Transparancy Eff Aud | operations? ies 5 Does the law address | Yes et the ownership of data | No/Not mentioned 2

G Ownership disclosed to the HIE? | Ambiguous |e Do entities Yes 1 contributing to the No/Not mentioned 2 HIE retain a property | Ambiguous 4 right/ownership N/A 5 interest over those

G_Ownership_ Prop data? Does the HIE acquire | Yes 1 an ownership interest pe mentioned -

j ? MbDIQUOUS G Ownership Prop HIE See oo N/A = 5

Variable Name

Question

Answer Options

Dataset Value

Does the law Yes, authorizes it 1 authorize providers Yes, does not 2 to access or authorize it 3 contribute to HIE Not mentioned 4 data for patient hee ow ° Use_Provid treatment? Does the law Yes cl authorize No/Not mentioned 2 participating Ambiguous 4 healthcare facilities N/A 5 to designate roles within the facility for Use Provid Desig authorized HIE use? Does the law Yes 1 mandate any No/Not mentioned 2 providers to access | Ambiguous 4 or contribute to HIE | N/A 5 Use Provid Mand data? Can the HIE be used | Yes 1 for an advanced No 2 directives registry? Not mentioned 3 Ambiguous 4 Use Provid AdvDir N/A 5 Use_ Patient Are patients Yes, authorizes it 1 authorized to access | Yes, does not Zz their HIE data authorize it 3 electronically through | Not mentioned 4 an HIE portal or user Ryemee :

interface (i.e.,

excluding patient

HIE Assessment Codebook

access to emailed, faxed, or mailed copies of their

records)? Does the law Yes, authorizes it 1 authorize Yes, does not 2 bidirectional authorize it 3 communication Not mentioned a between patients and Rae =) other HIE participants (e.g., communication between patients and providers regarding their medical treatment through an HIE portal or user Use Patient Bi interface)? Are patients Yes, request il authorized to use the | amendments 2 HIE to request Yes, make alterations | 3 amendments or Both . make revisions to Moyen imiein donee 6 their data directly ae d through an HIE portal Use Patient Change or user interface? Does the law Yes, authorizes it 1 specifically authorize | Yes, does not 2 emergency medical | authorize it 3 services (EMS) to Not mentioned 4 access or contribute See ya 5 to HIE data for Use EMS patient treatment? Does the law Yes, authorizes it 1 authorize payers to Yes, does not 2 access HIE data? authorize it 3 Not mentioned 4 Ambiguous 5 Use_Payer N/A Does the law address | Yes, authorizes it 1 bidirectional Yes, does not 2 communication authorize it 3 between payers and_ | Not mentioned 4 other HIE participants eae 2) through an HIE portal Use Payer Bi or user interface? Does the law Yes, authorizes it 1 authorize medical Yes, does not 2 labs to convey authorize it 3 medical test results | Not mentioned a Use Lab through the HIE? ce 5 Use Research Does the law Yes, authorizes it 1 authorize educational | Yes, does not Z

HIE Assessment Codebook

or other research authorize it 3 institutions to access | Not mentioned 4 HIE data through an | Ambiguous 5 HIE portal or user N/A interface (excluding research requiring express consent for the use of an individual’s information)? Does the law Yes, authorizes it 1 authorize employers | Yes, does not 2 to access the HIE a ee : (e.g., for conveying the results of heeee 5 employee drug tests or background Use Employer checks)? Does the law Yes, authorizes it 1 authorize Yes, does not 2 pharmacists and authorize it 3 pharmacies to access | Not mentioned 4 the HIE (e.g., for the eae 5 purposes of executing prescription drug orders and documenting other pharmaceutical Use Pharm care)? Can the HIE be used | Yes, authorizes it 1 for prescription Yes, does not 2 monitoring purposes | authorize it 3 by prescribers and Not mentioned oy those dispensing aes > Use Pharm PDMP prescriptions? Does the law address | Yes, authorizes it 1 the use of HIE data Yes, does not 2 for marketing or authorize it 3 other commercial Not mentioned 2 purposes (excluding Nae 5 marketing or commercial purposes requiring express consent for the use of an individual’s Use Marketing information)? Does the law Yes, authorizes it 1 authorize state and Yes, does not 2 local health authorize it 3 authorities to access_| Not mentioned a Ambiguous 5

Use_ PH

the HIE?

N/A

HIE Assessment Codebook

Does the law address | Yes, authorizes it 1 HIE bidirectional Yes, does not 2 communication authorize it 3 between public Not mentioned 4 health authorities Se 5 and other HIE participants through an HIE portal or user Use PH Bi interface? Can the HIE be used | Yes 1 for prescription drug | No 2 monitoring? Not mentioned B} Ambiguous 4 Use PH PDMP N/A Is Can the HIE be used | Yes 1 for case reporting? No 2 Not mentioned 3 Ambiguous 4 Use _PH_CaseReport N/A 5 Can the HIE be used | Yes 1 for immunization No 2 reporting? Not mentioned 3 Ambiguous 4 Use _PH_IIS N/A 5 Can the HIE be used | Yes 1 for syndromic No Z surveillance? Not mentioned 3 Ambiguous 4 Use PH SyndSurv N/A 5 1 2 3 4 5

Use_StateAgency

Does the law authorize any other state agency or entity (other than public health) to access the HIE?

Yes, authorizes it Yes, does not authorize it

Not mentioned Ambiguous

N/A

Does the law address | Yes, authorizes it cl bidirectional Yes, does not 2 communication authorize it 3 between these state | Not mentioned a agencies and other A egaa se 5 Use StateAgency Bi HIE participants? Does the law Yes, authorizes it 1 authorize the Yes; does not Z collection of data on | authorize it 3 healthcare operations | Not mentioned a and quality through iene 3

Use QM

Variable Name

the HIE?

Question

Answer Options

Dataset Value

HIE Assessment Codebook

confidentiality related to HIE data?

Does the law have mes 1 patient notice No/Not mentioned 2 requirements Ambiguous 4 (excluding patient- N/A 5 initiated requests for information, such as a request fora medical record

Data PtNotice access audit log)? ...of the content of Yes 1 data collected or No/Not mentioned 2 released by or Ambiguous 4

Data_PtNotice Collect through the HIE? N/A > ...of the entities with | Yes 1 access to HIE data? No/Not mentioned Z

Ambiguous 4

Data_PtNotice_ Entities N/A 5 ...of the purposes for | Yes 1 which patient data No/Not mentioned 2 can be Ambiguous 4

Data PtNotice Purpose | disclosed/used? N/A 5 Is there a procedure | Yes 1 for correcting or No/Not mentioned 2 removing HIE data? | Ambiguous 4

Data_Correct N/A 5 Does the law vary on | Yes 1 data protection No/Not mentioned 2 requirements for Ambiguous 4 query-based and N/A 5 point-to-point HIE

Data_HIEType functions? Does the law require | Yes 1 privacy protections No/Not mentioned 2 for the HIE (excluding | Ambiguous 4 direct reference to N/A ° state or federal

Data_Privacy privacy laws)? Does the law address | Yes 1 privacy violations or | No/Not mentioned 2 breaches? Ambiguous 4

Data_Privacy Breach N/A 5 Can participating Yes 1 patients restrict No/Not mentioned 2 certain health Ambiguous 4 information from N/A -) being disclosed to the HIE or restrict certain accesses or

Data_Privacy_PtRestricti | uses by HIE

ons participants?

Data Privacy Consent Is patient consent Opt-in 1

HIE Assessment Codebook

required for Opt-out 2 disclosure of patient | Voluntary (not 5 data in the HIE? specified) 4 No/Not mentioned 5 Ambiguous 6 N/A Can patients change _ | Yes 1 : their consent No/Not mentioned 2 Data_Privacy_Consent_C preference? Ambiguous 4 hange N/A 5 Is there an exception | Yes if to the consent No/Not mentioned 2 Data Privacy Consent_E | requirement in Ambiguous 4 merg emergencies? N/A 5 Are there specific Yes it consent No/Not mentioned 2 Data Privacy Consent_M | requirements for Ambiguous 4 inors minors? N/A 5 Does the law address | Yes 1 administrative, No/Not mentioned 2 technical, or physical | Ambiguous 4 safeguards to secure N/A 5 HIE data (excluding direct references to state or federal Data_Security laws)? Does the law require | Yes 1 HIE users to receive beat mentioned 7 j iN ? MmMbDIQUOUS Data Security Training roa aL N/A 5 Does the law require | Yes 1 minimum encryption | No/Not mentioned 2 standards of HIE data | AMbiguous 4 (excluding general N/A 5 references to interoperability Data Security Encrypt standards)? Does the law require | Yes 1 minimum standards | No/Not mentioned 2 for authentication of | Ambiguous 4 Data Security Authent | user identity? N/A 5 Are there express Yes 1 duties for providers | No/Not mentioned 2 or other HIE users to | Ambiguous 4 protect patient data N/A 3 from unauthorized Data_Confid accesses/disclosures? Are there provisions | Yes 1 addressing No/Not mentioned 2 subpoenas or other | Ambiguous A judicial court orders | N/A 5 Data_Confid_ Subpoena for HIE data? Data_Confid_FOIA Are there provisions _| Yes 1

HIE Assessment Codebook

Data Confid Sensitive

addressing public No/Not mentioned 2 access requests of Ambiguous 4 HIE data? N/A 5 Does the law provide | Yes 1 heightened No/Not mentioned 2 protections for Ambiguous -

N/A 5

sensitive health information (e.g., mental health information, genetic information, HIV test results)?

Funding

Variable Name Question Answer Options Dataset Value

Does the law address | Yes 1

HIE funding? No/Not mentioned 2 Funding Ambiguous 4

Does the law specify | Yes 1

funding sources to No/Not mentioned 2

cover initial HIE Ambiguous 4

implementation N/A 5 Funding Implement costs? Funding Implement_ST State resources True/False Funding _Implement_Fed Federal resources True/False Funding Implement_Priv Private contributions True/False Funding Implement_Fee Participant fees True/False

Does the law specify | Yes 1

funding sources for No/Not mentioned 2

long-term Ambiguous 4 Funding Longterm operability? N/A 5 Funding Longterm_ST State resources True/False Funding Longterm Fed Federal resources True/False Funding Longterm Priv Private contributions True/False Funding Longterm Fee Participant fees True/False

Liability

Variable Name

Liability

Question

Does the law provide immunity from liability for the HIE/HIO or its participants?

Answer Options HIE

Healthcare provider Both

No/Not mentioned Ambiguous

Dataset Value

ABWNFH

Interjurisdictional Exchange

Variable Name

Question

Answer Options

Dataset Value

Interjurisdiction

Does the law address the exchange of data across state borders?

Yes, authorizes it Yes, does not authorize it

Not mentioned Ambiguous

1

2 3 4

HIE Assessment Codebook