NC HealthConnex Deadline Fast Approaching

Some North Carolina medical practices may not be aware of the North Carolina Statewide Health Information Exchange Act (“the Act”) or the changes that were made to the Act in 2017. However, the Act has near-term implications for health care practitioners in the state. Starting on June 1, 2018, all hospitals, physicians, physician assistants, and nurse practitioners who treat North Carolina Medicaid patients and who have an electronic health record system (EHR) must connect to North Carolina’s statewide health information exchange (“the HIE”), now known as NC HealthConnex.

The deadline to connect is fast approaching, but there is an extension process that may offer providers up to another year to consider a number of key questions and prepare for participating in the HIE.

Here are some common questions and corresponding guidance for practices to consider:

1)   What if a practice doesn’t connect or get an extension?

Practices that do not connect or obtain an extension from the HIE may not receive payment for treatment provided to North Carolina Medicaid and other state-funded program beneficiaries after June 1, 2018.

2)    How can practices obtain an extension?

Practices that treat Medicaid patients but have not yet connected to the HIE still have a few weeks to apply for and obtain an extension for connecting. In order to submit the extension application, practices must have signed a Participation Agreement with NC HealthConnex. In the extension application, practices must describe how their organization plans to connect to the HIE within the next 12 months.

A copy of the extension application is available here.

3)    What does it cost to connect?

Currently, there is no charge for providers to join NC HealthConnex. However, some EHR vendors are charging fees to create or maintain the technical connection between providers’ EHRs and the HIE. In the future, charges may also be collected to join NC HealthConnex for its value-added features in order to make the HIE financially self-sustaining. See the section about the Participation Agreement below for more information on the value-added features.

4)    What is the Participation Agreement?

The Participation Agreement is a contract between the HIE and all providers who connect to it to receive and/or submit health information (PHI) about patients they are treating. The HIE refers to these connected providers as “Participants.”  The Participation Agreement describes (1) the rights of Participants and the HIE to use and disclose PHI obtained from the HIE, and (2) the obligations of Participants and the HIE to protect the privacy and security of all PHI that is obtained from the HIE. Each Participant that receives and/or submits patient data through the HIE must sign the Participation Agreement and agree to comply with the HIE’s related privacy and security and user access policies.

There are two versions of the Participation Agreement—the Full Participation Agreement and the Submission-Only Participation Agreement. Practices should consider which version they will sign:

• The Full Participation Agreement permits providers to both submit patient data to and receive patient data from the HIE. Providers can also take advantage of other services offered to Full Participants, including direct secure messaging, electronic laboratory reporting, disease registries, and other similar services.
• The Submission-Only Participation Agreement allows providers to only submit to the HIE the information required by the Act. Providers who choose this option will not be able to receive any information from the HIE about treatment their patients received from other providers or use the value-added services described above.

The Act requires that Participants submit PHI of their Medicaid and other state-funded health plan patients (including North Carolina Health Choice and the North Carolina State Employee Health Plan). This means that whether practices sign the Full Participation Agreement or the Submission-Only Participation Agreement, they may choose to send to the HIE only the PHI of their state-funded patients. 

However, practices that choose this option should confirm if their EHR system can differentiate between payor source and send only state-funded patients’ data to the HIE. Practices will need to discuss this issue with their EHR vendor.  If a practice has an EHR vendor that cannot distinguish payor source, the practice must either submit PHI of all practice patients to the HIE, or decide to seek an extension from the HIE while the vendor determines whether and when it will be able to limit the information being submitted from the practice.

5)    How would practices be affected if they submit PHI of only state-funded patients?

• Updates to Notice of Privacy Practices. The Act requires all Participants to update their Notices of Privacy Practices (Notice) to inform patients about the benefits of the HIE (which include enabling different treating providers to make more informed decisions about patients’ care), to advise patients that they may opt out of having their health data accessed through the HIE, and to describe for patients the process for opting out of the HIE or rescinding a previous decision to opt out. Practices that decide to limit the information submitted to the HIE to only PHI of state-funded beneficiaries will want their Notice to mention this decision. They should also mention that these patients have the right to opt out of having their PHI released through the HIE.Practices that plan to submit PHI of all patients to the HIE should specify in their Notice that all patients have the opportunity to opt out of having their information exchanged by the HIE.Practices must make copies of the updated Notice available to patients upon request and must also post a copy of the current Notice in prominent places, including on the practice website.

• Notifying patients about opt-out right. It is important to note that when a practice connects to the HIE, PHI of all patients the practice decides to submit to the HIE (either all patients or only state-funded patients) will be sent to the HIE, whether or not any such patients have opted out of the HIE. The HIE is then permitted to share PHI of such patients with “Authorized Users” of the HIE (any user registered by a Participant) unless a patient has exercised his or her right to opt out.The Participation Agreement requires Participants to establish a process for notifying patients about the benefits of the HIE, the patient’s right to opt out and the consequences of such a choice, and the patient’s right to revoke a previous opt-out decision. If a practice will be sending only PHI of state-funded patients to the HIE, then only these patients will have the opportunity to opt out. If a practice will be sending all patients’ PHI to the HIE, then all patients must be notified that they can opt out of having their PHI released from the HIE to other Participants.Practices should also consider how they will operationalize a process to verify that patients are aware of their opt-out rights and the consequences of opting out. Practice leaders should consider the following questions: Will patients be provided opt-out educational documentation at registration or be verbally advised that such information is available?  Will registration clerks or the Privacy Officer be able to answer questions about the HIE and the opt-out process, or will patients simply be directed to the HIE’s website for questions?The HIE has made pamphlets and opt-out forms available for use by Participants here.

6)    Can practices submit substance use disorder diagnosis and treatment information to the HIE?

The HIE is currently unable to accept data from a substance use disorder “program,” due to a federal law and regulation (42 CFR Part 2) that provides more protection for PHI about substance use disorders than HIPAA. This means that practices or individual providers that qualify as a Part 2 “program”—in short, they provide substance-use disorder diagnosis or treatment and advertise or hold themselves out to the public as doing so—may not submit information identifying patients having a substance use disorder diagnosis or receiving treatment at the practice unless and until the HIE notifies it can accept this type of information. Practices that provide these services may wish to ask the HIE for an extension to connect.