Mailing: 2440 East Tudor Road PMB 1143 Anchorage, AK 99507 Physical: 4000 Old Seward Hwy, Suite 203 (907) 770-2626 AeHN BOARD OF DIRECTORS Paul Sherry President, AeHN Health Policy Strategist, Alaska Native Tribal Health Consortium Ken Osterkamp Vice-President, AeHN State Director, AARP Alaska Chris Emond Treasurer, AeHN Director of Treasury Alaska Communications Carl J. Kegley Secretary, AeHN IT Alaska Senior Director, Banner Health Karen Perdue President/CEO, Alaska State Hospital and Nursing Home Association Jeff Davis President, Premera Blue Cross Blue Shield Melinda Rathkopf, MD Allergy, Asthma and Immunology Center of Alaska William Streur Commissioner State of AK, DHSS Jan Harris Vice Provost for Health Programs University of Alaska Jerome List, MD President, Alaska EHR Alliance Alaska Ear, Nose and Throat Nancy Merriman Executive Director Alaska Primary Care Assoc. Mark Williams Director of Telehealth & Outreach Providence Health & Services, Alaska Susan Yeager Director, Alaska VA Healthcare System AeHN Board of Directors Meeting May 21, 2014 11:30 AM to 1:00 PM Location: AeHN Conference Room, 4000 Old Seward, Suite 203 Dial in: 1‐424‐203‐8400 Access Code: 239155# Business Agenda 1. Call to Order/Paul Sherry a. Welcome and Introductions b. Approval of Agenda c. Approval of Minutes ( 04‐16‐2014) 2. Standing Reports: a. President's Report/Paul Sherry b. Treasurer’s Report/Chris Emond c. Executive Director's Report/Rebecca Madison d. REC Report/Dave Peters e. State Status Report/Paul Cartland 3. Privacy and Security Update/Carolyn Heyman‐Layne Policy review: 2.000, 2.200, 2.300, 2.400, 3.100, 4.200 4. AeHN Proposed Budget 2015 5. Strategy Map / Paul Sherry 6. Notice of Regular Meeting – June 18, 2014 AeHN Conference Room 7. Adjournment 1 PG 1 PG 3 PG 11 PG 22 PG 27 PG 44 PG 90 PG 100
Transcript
Mailing: 2440 East Tudor Road PMB 1143Anchorage, AK 99507
Physical: 4000 Old Seward Hwy, Suite 203 (907) 770-2626
AeHN BOARD OF DIRECTORS
Paul Sherry President, AeHN Health Policy Strategist, Alaska Native Tribal Health Consortium
Ken Osterkamp Vice-President, AeHN State Director, AARP Alaska
Chris Emond Treasurer, AeHN Director of Treasury Alaska Communications
Carl J. Kegley Secretary, AeHN IT Alaska Senior Director, Banner Health
Karen Perdue President/CEO, Alaska State Hospital and Nursing Home Association
Jeff Davis President, Premera Blue Cross Blue Shield
Melinda Rathkopf, MD Allergy, Asthma and Immunology Center of Alaska
William Streur Commissioner State of AK, DHSS
Jan Harris Vice Provost for Health Programs University of Alaska
Jerome List, MD President, Alaska EHR Alliance Alaska Ear, Nose and Throat
Nancy Merriman Executive Director Alaska Primary Care Assoc.
Mark Williams Director of Telehealth & Outreach Providence Health & Services, Alaska
Susan Yeager Director, Alaska VA Healthcare System
AeHN Board of Directors Meeting May 21, 2014
11:30 AM to 1:00 PM
Location: AeHN Conference Room, 4000 Old Seward, Suite 203
Dial in: 1‐424‐203‐8400 Access Code: 239155#
Business Agenda
1. Call to Order/Paul Sherrya. Welcome and Introductionsb. Approval of Agendac. Approval of Minutes ( 04‐16‐2014)
4. AeHN Proposed Budget 20155. Strategy Map / Paul Sherry6. Notice of Regular Meeting – June 18, 2014
AeHN Conference Room7. Adjournment
1
PG 1PG 3
PG 11
PG 22
PG 27
PG 44PG 90
PG 100
Claudette
Typewritten Text
Claudette
Typewritten Text
Claudette
Typewritten Text
Alaska eHealth Network
Page 2 of 2
Action Items required: May 21, 2014
Section 1: Call to Order
o Motion to approve the Agenda
o Motion to approve the minutes of April 16, 2014
Section 2: Standing Reports
o Motion to approve Presidents Report
o Motion to approve Treasurers Report
o Motion to approve Executive Director’s report
Section 3: Other Reports
o Motion to approve Policies:2.000, 2.200, 2.300, 2.400, 3.100, 4.200
o Motion to approve 2015 Proposed Budget
2
AeHN Board of Directors Meeting AeHN Conference Room, 4000 Old Seward Hwy, Suite 203, Anchorage
Wednesday, April 16, 2014 11:30 p.m.- 1:30 p.m.
Alaska eHealth Network –Board of Directors Meeting Minutes Page 1 of 3 April 16, 2014
Board Members Present A Davis, Jeff – Premera BC/BS P Osterkamp, Ken - AARP Ad Hoc: A Harris, Jan – University of AK (NV) P Rathkopf, Melinda MD P Madison, Rebecca Executive Director P Williams, Mark - Providence A Perdue, Karen – ASHNHA (Proxy-C Beemer) T Heyman-Layne, Carolyn AeHN (P-NV) T Kegley, Carl - Banner Health P Sherry, Paul - ANTHC T Yesmant, Claudette - Recorder T List, Jerome, MD – AEHRA A Streur, Bill - DHSS (Proxy - Paul Cartland) T Yeager, Susan – Dept. of Veterans Affairs P Emond, Chris - Alaska Communications T Merriman, Nancy - APCA P=Present / T=Teleconference / A=Absent / NV=Non-voting Member (Quorum = 7 Voting Members or Member Proxies) Guests Present (P) Carney, Darcy CCG (P-NV) (P) Hall, Rich - ANTHC (P) Cartland, Paul DHSS – Proxy B Streur
(P) Peters, Dave AeHN (P-NV) (T) Hartman, Sara - FCC (P) Jensen, Chad LaTouche Pediatrics (P) Cogan, Suzanne – Orion Health (T) Beemer, Connie ASHNHA – Proxy K Perdue (P) Montgomery, Kent – Orion Health Supporting Documents:
TIME AGENDA ITEM – Presenter/Discussion Consensus/Action
11:33 am
CALL TO ORDER a. Welcome and Introductions
President Sherry welcomed all attendees. Having determined that a quorum was present, President Sherry called the meeting to order at 11:33am. b. Approval of Agenda President Sherry presents a brief review of the agenda for today’s meeting. There was a motion by Mark Williams to approve the amended agenda, seconded by Ken Osterkamp. Motion approved.
Motion to approve agenda passed
3
Page 2 of 3
c. Approval of Minutes President Sherry gave an overview of the meeting minutes from 03/19/2014. There were no changes/edits recommended.
There was a motion by Chris Emond to approve the meeting minutes from 03/19/2014, seconded by Ken Osterkamp. Motion approved.
1. President’s Report (Paul Sherry) President Sherry reports that the officers continued to work on the evaluation process for the Executive Director and will discuss the final review during the Executive Session at the end of this meeting. There was a motion by Paul Cartland to approve the President’s Report, seconded by Connie Beemer.
2. Treasurer’s Report (Chris Emond) Chris Emond gives the Statement of Financial Position report as of February 28, 2014. Cash and money market accounts total $323,282.95. A review of the Statement of Activities ending February 28, 2014 shows a net income of $588,622.73. Enhancements to the financial reports continue to be made. A forecast for HIE Operations will be included next month. There was a motion by Mark Williams to approve the Treasurer’s Report, seconded by Paul Cartland. 3. Executive Directors Report (Rebecca Madison) Rebecca Madison presented the Executive Directors’ report. 1. Financial: Continue to complete State of Alaska deliverables; $3,261,276 of $4,608,528. Continuing to review and complete required monthly grant and contractor reports. 2. DSM: Working with Orion to beta test and implement DSM v2; developing migration plan from v1 to v2. 3. HIE: Fairbanks Cancer Center and Providence are the two highest priorities at this time. ANTHC and South Peninsula are next to onboard. Mt. Edgecumbe/SEARHC may onboard sooner due to their EHR readiness. 4. REC: Continues to sign on providers for MU services. 5. Privacy and Security: Risk Assessment – Futaris review of policies and contracts completed, audit of policy compliance begun, evaluation of HiTrust requirements in process, review of Orion Health Security Plan and policies begun, next phase will include a review of participant compliance, LaTouche Pediatrics will be the pilot site for the first participant audit, scheduled in May is scheduled to do an on-site survey of AeHN in April. Total Opt-Outs received = 29. 6. Resources: No cost extension application for approximately $1.2M accepted and approved. There was a motion by Chris Emond to approve the Executive Directors’ report, seconded by Ken Osterkamp. Motion approved. Update on REC Activities ( Dave Peters) Dave Peters reports the No Cost Extension paperwork was received on 3/26/2014 approving the extension. Clinical Workgroup Report (Melinda Rathkopf, MD) Melinda reports that the 4/9/2014 meeting was used as a practice run for her upcoming talk at Providence Grand Rounds scheduled for 4/25/2014. Clinical Workgroup is working on defining their role.
Motion to approve meeting minutes passed Motion to approve President’s report passed Motion to approve Treasurer’s report passed Motion to approve Executive Director’s report passed
4
Page 3 of 3
State Report (Paul Cartland)
Paul Cartland gives the State of Alaska report. He states that representatives from the Centers for Medicare and Medicaid Services (CMS) will be on-site June 4-5, 2014. 4. Privacy and Security (Carolyn Heyman-Layne) Carolyn Heyman-Layne reports that the Privacy and Security Workgroup meeting is scheduled to meet on 4/17/2014. There will be six policies to review before passing them to the Policy Review committee. The policies will be brought to the 5/21/2014 Board meeting. 5. ORION Health – Services and Product Update: (Suzanne Cogan and Kent Montgomery): Suzanne Cogan, Vice President of Sales and Kent Montgomery, Client Relationship Manager from ORION Health presented the Orion HIE Roadmap and client relationship strategy. PowerPoint slides are attached to minutes. 6. Strategy Map (Paul Sherry): President Sherry is leaving the draft Strategy Map open for additional review and comments, with the intent of getting formal approval in advance of the annual meeting in November. 7. Executive Session: The board entered into Executive Session for personnel matters at 1:00 p.m. and reconvened in regular session at 1:30 p.m. 8. Executive Director Compensation: Ken Osterkamp moved to approve an award of a 10% performance bonus for 2014 to the Executive Director to be paid in the first paycheck paid after June 30, 2014. The Board intends to establish a new compensation profile, including an incentive component, effective for FY2015. Motion seconded by Chris Emond. Motion approved. 9. Adjournment: The Board meeting adjourned at 1:35 p.m.
• Catholic Health Initiatives, CO• Greenville Health System, SC• Highmark BCBS, PA• Huntsville Hospital, AL• KeyHIE, PA• Lahey Clinic, MA• Lehigh Valley Health Network, PA• Mary Washington Healthcare, VA • MS Medicaid• Ochsner Health System, LA• Rush Health, IL• Scottsdale Health Partners, AZ• Sutter Health, CA• St. Luke’s, PA• St Vincent’s Medical Center, FL• St. Francis Care, CT• Western Connecticut Health Network, CT
• Walgreens
HEALTH SYSTEM AND PAYER ORGANIZATIONS
• Catholic Health Initiatives, CO• Greenville Health System, SC• Highmark BCBS, PA• Huntsville Hospital, AL• KeyHIE, PA• Lahey Clinic, MA• Lehigh Valley Health Network, PA• Mary Washington Healthcare, VA • MS Medicaid• Ochsner Health System, LA• Rush Health, IL• Scottsdale Health Partners, AZ• Sutter Health, CA• St. Luke’s, PA• St Vincent’s Medical Center, FL• St. Francis Care, CT• Western Connecticut Health Network, CT
• Walgreens
PUBLIC ORGANIZATIONS• Alaska eHealth Network (AeHN), AK
• District of Columbia, DC• State of Idaho HIE, ID• Inland Empire HIE, CA• Louisiana Health Care Quality Forum, LA
• Maine HealthInfoNet, ME• The Massachusetts Health Information Highway (The HIway)
• Minnesota‐ Community Health Information Collaborative (CHIC)
• New Hampshire Health Information Organization, NH
• Nevada HIE (NV‐HIE)• New Mexico Health Information Collaborative, NM
• North Carolina DHHS, NC• North Dakota, ND• North Texas Accountable Healthcare Partnership, TX
PUBLIC ORGANIZATIONS• Alaska eHealth Network (AeHN), AK
• District of Columbia, DC• State of Idaho HIE, ID• Inland Empire HIE, CA• Louisiana Health Care Quality Forum, LA
• Maine HealthInfoNet, ME• The Massachusetts Health Information Highway (The HIway)
• Minnesota‐ Community Health Information Collaborative (CHIC)
• New Hampshire Health Information Organization, NH
• Nevada HIE (NV‐HIE)• New Mexico Health Information Collaborative, NM
• North Carolina DHHS, NC• North Dakota, ND• North Texas Accountable Healthcare Partnership, TX
CANADA• Alberta Health Services, AB• New Brunswick Department of Health, NB• Quebec Department of Health, QC• Saskatchewan Department of Health, SK• The Northwest Territories, NT• Ministry of Health & Long Term Care, ON• Newfoundland & Labrador Centre for Health Information, NL
CANADA• Alberta Health Services, AB• New Brunswick Department of Health, NB• Quebec Department of Health, QC• Saskatchewan Department of Health, SK• The Northwest Territories, NT• Ministry of Health & Long Term Care, ON• Newfoundland & Labrador Centre for Health Information, NL
Asia• Singapore Ministry of Health, Singapore• Bumrungrad International Hospital, Thailand• Franco‐Vietnamese Hospital, Vietnam
Asia• Singapore Ministry of Health, Singapore• Bumrungrad International Hospital, Thailand• Franco‐Vietnamese Hospital, Vietnam
EUROPE• Greater Glasgow NHS Trust, Scotland• IB Salut, Palma, Spain• Health and Social Care Northern Ireland (HSCNI), Northern Ireland
EUROPE• Greater Glasgow NHS Trust, Scotland• IB Salut, Palma, Spain• Health and Social Care Northern Ireland (HSCNI), Northern Ireland
AUSTRALIA• NSW Health, Sydney, NSW• Hunter New England Local Health District, NSW • Dept. of Health & Ageing PCEHR, Australia
NEW ZEALAND• Canterbury District Health Board
AUSTRALIA• NSW Health, Sydney, NSW• Hunter New England Local Health District, NSW • Dept. of Health & Ageing PCEHR, Australia
ChilmarkOrion Health is arguably the largest provider of healthcare interoperability globally and a major HIE vendor in the U.S. ”
“
KLAS
Orion Health’s easy‐to‐use solutions and applications improve patient care and clinical decision making by enabling the exchange of healthcare information among disparate systems and providing integrated health data in a single, unified view.
“
”
May 2013, IDC Health Insights
#HI240928
Customers comment that Orion Health’s integration tools are flexible when it comes to accessing a wide variety of data sources, and the interfaces are configurable. Additionally, they report that Orion Health is an excellent partner and very responsive to customer suggestions.
• Current market size: $558M*• Expected to reach $878M by 2018 (CAGR of 9.5%)• Driven by:
• Change in reimbursement paradigm – need to reduce costs• Meaningful Use incentives• Growth by affiliation rather than acquisition
• Private HIE market larger than public market in 2013, with a projected CAGR of >10% over next 5 years
• 2013 HIMSS Analytics report: 50% of physicians surveyed indicated they were joining an HIE
• Payers increasingly part of the HIE fabric– Partnering with leading providers to share data and improve care coordination– Acquisitions of HIE technology by United, Aetna, Humana
Total Expenses 1,206,941.95 1,188,513.00 18,428.95
Net Operating Income - - -
Net Income - - -
Alaska eHealth Network
REC Direct Budget vs.ActualJuly 2013 - March 2014
21
Alaska eHealth Network Dashboard as of 3/31/2014
Financial:
Objective: Balanced budget with consistent monthly income that supports HIE for all Alaskans; measurement is positive income and expenses within budget
Notes: Revenue stable, AeHN services expanding
(3,000,000.00)
(2,000,000.00)
(1,000,000.00)
-
1,000,000.00
2,000,000.00
Jul Aug Sep Oct Nov Dec Jan Feb Mar Apr May Jun
Month
AeHN Income
FY12
FY13
FY14
-
20,000.00
40,000.00
60,000.00
80,000.00
100,000.00
Jul Aug Sep Oct Nov Dec Jan Feb Mar Apr May Jun Month
HIE Operations Expense
FY12
FY13
FY14
$0.00
$50,000.00
$100,000.00
$150,000.00
$200,000.00
$250,000.00
$300,000.00
Jul Aug Sep Oct Nov Dec Jan Feb Mar Apr May Jun Month
REC Expense
FY12
FY13
FY14
04/15/2014 Page 1 of 3
22
Alaska eHealth Network Dashboard as of 3/31/2014
Direct Secure Messaging:
Objective: Increase Meaningful Use of EHRs through exchange of data via DSM; measurement is number of providers implementing and number of providers using.
Notes: Over 20,000 messages sent monthly; DSM continues to grow
Health Information Exchange:
Objective: Increase Meaningful Use of EHRs through increased HIE use; measurement is number of users by facility and community
Objective: Timely resolution of help desk issues; measurement is volume/type of calls and time to resolution
Notes: System down time = 0.000%
0
5000
10000DSM Users by Month
Apr 2014 (n=4,650)
FY12 FY13 FY14
0
200
400
600
Hosp Amb SOA Other
Active DSM Users (n=1,708)
Mar-14 Mar-14
0
5
10
Qtr 4 '13 Qtr 1 '14 Qtr 2 '14 Qtr 3 '14
Hospitals
0
200
400
600
Qtr 4 '13 Qtr 1 '14 Qtr 2 '14 Qtr 3 '14
Providers
0
100
200
300
LOGIN ISSUES ERROR TRAINING OTHER
Help Desk Calls (n=295)
Mar-14 Apr-14
04/15/2014 Page 2 of 3
23
Alaska eHealth Network Dashboard as of 3/31/2014
Regional Extension Center:
Objective: Meet REC grant goals by 4/2014; measurement is M1 (contract) % of goal and rank, M2 (certified EHR implemented) % of goal and rank, M3 (MU stage 1) % goal and rank
Notes: Goals for M1 and M2 have been met. M3 target must be met by October if provider is to reach M3 by April 2015.
Update as of 9/16/2013
Percent of Goal (n=538)
% Change Since Last
Month
Overall National Rank (n=62)
Overall Increase
Grant Milestones Mar ‘14 Apr ‘14 Mar ‘14 Apr ‘14 M1 – Contract 124% 126% 2.0% 20 18 +2 M2 – EHR Go-Live 107% 109% 2.0% 32 25 +7 M3 – MU Stage 1 61% 65% 5.0% 55 56 -1
State of Alaska Contract:
Objective: Meet SOA deliverables on time; measurement is deliverables, time and revenues
Notes: Continue to address deliverables. Amendment #3 is fully completed and invoiced.
Contract Amendment
Status Note
#3 (n=44) Completed 41 $34,090 All deliverables submitted, reworking Future
#4 (n=19) Completed 14 $971,435 High priority items remaining are Lab Pilot, MDN, and DSM Upgrades. Late 3 $115,000
Future 2 $50,000 #5 (n=37)
Completed 8 $1,963,750 High priority items are ELR, VacTrAK, BioSense and DSM v2 implementation.
Late Future 29 $1,474,252
#6 (n=5)
Completed 5 $39,000 Late Future
Privacy and Security:
Objective: Ensure patient confidentiality
Total Opt-Outs: 31 (24 Fairbanks, 7 Anchorage)
Event Reported Resolved Time to Resolution Privacy Complaints 0 NA NA Security Issues in Audit 5 5 Corrected Event Attempted Successful Resolution Breach Attempts 0 NA
04/15/2014 Page 3 of 3
24
AeHN Executive Director Report
Apr 16, 2014 to May 21, 2014
1) HIE:
a) Continue to meet weekly with State HIT Coordinator to review issues related to the AeHN/SOA contract; Amendment 3 is completed and billed; Amendment 4 and 5 dates under revision
b) State Reportables: i) ELRs (electronic lab reporting - hospitals) – first successful test achieved, in queue –
Providence, ANMC, FMH and SPH ii) BioSense (syndromic surveillance -hospitals) – first successful test achieved, in queue –
Providence; ANMC, FMH and SPH iii) VacTrAK (immunizations – hospitals and eligible providers) – two successful tests, in queue –
LaTouche, Providence, ANMC, FMH, SPH, CPGH, and other ambulatory entities c) EHR Lite – looking for alternatives, Orion now supports three products Practice Fusion,
Greenway and Athena Health d) Patient Portal – implementation to be completed by end of May, testing will begin with a few
pilot sites e) 8 hospitals signed, 11 hospitals reviewing contract, onboarding started with South Peninsula
Hospital, Wrangell, Petersburg, Providence (includes 4 hospitals), Mt Edgecombe, Central Peninsula General Hospital and Alaska Native Medical Center (includes KANA and SCF)
2) Privacy and Security/Risk Assessment
a) Risk Assessment – Penetration tests showed no vulnerabilities b) Futaris contract – completed AeHN and LaTouche audits; Futaris will report on findings and next
phase of HiTrust certification at the next board meeting
3) Resources a) No current cash flow issues and adequate staffing b) REC grant ends in April 2015, balanced budget will require increased revenues through
additional HIE contracts and fees for other provider services
4) Direct Secure Messages a) Over 4,600 active mailboxes; key usage includes State of Alaska/provider PHI transfers and C-
CDA transfers for referrals b) NATE and VA certificates implemented cleanup of old accounts in process c) Working with Orion Health to beta test and implement DSM v2; migration plan from v1 to v2
5) Lab Pilots a) State Lab – one final issue to address before closure (MDN), waiting for Orion Health
6) Policies and Procedures
a) On-going work to review and implement procedures for AeHN operations b) PSC Workgroup has moved to quarterly meetings
ED Report Page 1 of 2 25
AeHN Executive Director Report
Apr 16, 2014 to May 21, 2014
7) Financial:
a) State Deliverables - $3,261,276 of $4,608,528 b) Developing fee for service and other revenue streams c) Completed required monthly grant and contractor reports
8) Meetings
a) Weekly SOA meeting with HIT Coordinator, weekly with PH b) Weekly onboarding meeting with: 19 onboarding clients c) Biweekly ONC Grantee meetings d) Weekly Orion for status on UAT testing, system upgrades, and DSM concerns
WORKGROUP UPDATES
Clinical and Informatics – No updates since last board meeting.
Privacy, Security, and Compliance - No updates since last board meeting.
ED Report Page 2 of 2 26
Alaska HIT Monthly Status Report Reporting Period: Week of May12th State HIT Coordinator: Paul Cartland
Deliverable Summary: Current (for regular AeHN deliverables) Approved (all approved deliverables have been removed from the tracking table below)
56 of 89
Late 32 of 33
Legend Conditionally Approved Rejected or Late
Schedule
Deliverable has been conditionally approved: may just need to make adjustments or changes and provide an updated deliverable to State that addresses comments
Deliverable has been rejected: revised submission of deliverable is needed or the deliverable is late for submission
Quarterly within 15 calendar days of the end of each quarter
• In March 2014 it was determined that the financial updates provided at each AeHN Board meeting would be considered the quarterly budget update deliverable
• Have not received any quarterly budgets since the original budget was approved in May 2013
• Initial budget was approved 5/31/2013, quarterly budgets can begin September 2013
3, 5, 6 R-3, R-8 Weekly Status Report including transactions by provider type for Direct service
Weekly on Mondays
• AeHN continues to work with DHSS to submit and revise weekly status reports as necessary
• DHSS continues to receive weekly status reports
• DHSS IT Planning office requested that weekly status report contain HIE on-boarding information/matrix
• AeHN weekly reports have been received by DHSS inconsistently, not usually received weekly. DHSS reminded AeHN of the weekly status report
• Continue to receive weekly status report
• Received a combined report on 1/21/2013 for the weeks ending 1/11 and 1/18. Status report does not include DSM metrics.
• Did not receive weekly status report for week of 12/24/2012. Status report does not include DSM metrics needed for ONC reporting.
• Received weekly status report for week of 12/10/2012. Status report
Alaska HIT Project Monthly Status Report – Week of May12, 2014 6 - of - 17
does NOT include DSM metrics needed for ONC reporting.
• Weekly status report has not been received from AeHN since early August.
• Weekly status report for week of Aug 1-8 was received on Monday 8/6/2012
• Weekly status report for week ending 7/20/2012 was received on 7/23/2012 however the only updates in the report were the DSM metrics.
• Weekly status report for week ending 7/13/2012 was received late on 7/17/2012. Comments were sent back to AeHN regarding this status report on 7/20/2012.
• Weekly status report for week ending 7/6/2012 was received late on 7/11/2012; status reports are due on Mondays. Additionally status report was not complete.
• Weekly status report for week ending June 29 was not received. Email was sent to AeHN on 7/5/2012 requesting status of weekly status report, no response received from AeHN.
3 R-4 DSM Directory for Alaska's Master Provider Directory
Weekly • IT Planning office has not received weekly DSM directory since May 2013.
• Continue to receive weekly spreadsheets of DSM Directory
• Received an Excel spreadsheet with DSM directory on 1/21/2013.
• Format needed to be electronically submitted to Alaska's Master Provider Index is still being determined
3 R-5 Workgroup Weekly • DHSS received updated
Alaska HIT Project Monthly Status Report – Week of May12, 2014 7 - of - 17
workgroup rosters in March 2014 • 10/1/2013 – Have not received any
updates
3 R-6 Workgroup Reports to Contractor Board of Directors
Monthly • DHSS continues to not receive any updates
• 10/1/2013 – Have not received any updates
3 R-7 Project Plan Updates
Weekly • DHSS continues to not receive any updates
• 10/1/2013 – Have not received any updates
Alaska HIT Project Monthly Status Report – Week of May12, 2014 8 - of - 17
34
Critical Active Issues Summary - Current Reporting Period and Unresolved from Prior Reporting Period(s) ID Date Project Title Description Discussion Comments Status Trend Resolution 20 11/2/2011 HIE Governance AeHN
Corrective Action Plan (CAP)
The DHSS Commissioner has requested AeHN develop a CAP to address the findings of the HIE Assessment performed by Cognosante
CAP is due to State by 12/2/2011
• 5/14/14: deliverable status has not changed since April report
• 4/8/2014 - currently there are 32 deliverables that are late.
• 3/10/2014 - currently there are 26 late deliverables. DHSS has approved several deliverables for payment without receiving DTFs.
• 1/6/2014 - currently there are 30 late deliverables from contract amendments 1 - 6. There are 46 approved deliverables. There are 13 delivreables not yet submitted by AeHN.
• 10/1/2013 - Currently there are 25 late deliverables from contract amendments #3 - #5. There are 45 approved deliverables from contract amendments #3 - #5. There are 15 deliverables which have not yet been submitted and are due at a future date from contract amendments #3 - #5. There are 5 re-occurring deliverables that are considered late or the IT Planning office has never received.
• 8/20/2013 - Contract amendment #6 was signed • 8/19/2013 - Contract amendment #6 has been sent
to AeHN for signatures • 5/24/2013 - Contract amendment #5 has been
signed by State & AeHN • 4/29/2013 - State and AeHN are still discussing
contract amendment • 4/15/2013 - State and AeHN have agreed to a new
contract amendment following the contract re-negotiations between AeHN and Orion Health. Contract Amendment with State and AeHN will include HIE Phase 2 activities and should be completed and signed shortly.
• 2/19/2013 - continue to receive weekly status reports and now DSM Provider Directory reports on a weekly basis. Currently there are 24 late deliverables (4 of these had been conditionally approved but have long since past their resubmission due dates).
• 1/22/2013 - now receive weekly status report on a more regular basis but other deliverables have not been submitted. Currently there are 20 late deliverables and 4 Conditionally Approved deliverables that have not been re-submitted within 10 business days of the DTF being returned to AeHN.
• 12/13/2012 - improving trends in deliverables from
Active No Change
Alaska HIT Project Monthly Status Report – Week of May12, 2014 9 - of - 17
35
ID Date Project Title Description Discussion Comments Status Trend Resolution AeHN; HIT office is working closely with AeHN to ensure deliverables are satisfactory; there are still 17 late deliverables, 4 that have been withdrawn by AeHN for re-submission, 1 conditionally approved, and 5 not yet submitted.
• 9/26/2012 - improving trend in deliverables from AeHN, 5 deliverables have been approved, 3 are conditionally approved and 1 has been rejected. AeHN Executive Director has provided an updated timeline for when deliverables will be sent to DHSS
• 8/29/2012 - most contract amendment deliverables have either been rejected or have been conditionally approved without updated submissions sent to HIT Program Office. Paul Cartland is working with AeHN's new Executive Director, Rebecca Madison to determine priority of deliverables and updated submission dates.
• 8/7/2012 - 12 deliverables have been rejected without a 2nd updated deliverable having been submitted, 2 deliverables have been rejected and 2nd versions are due later in August, 7 deliverables have been conditionally approved but State has not received any updated documents addressing State's comments (1 of these is not due back to State until next week), 21 deliverables are late, 1 deliverable is in review with State, 2 deliverables are due at either future dates or due dates were not identified in contract amendment
• 7/30/2012 - 12 deliverables have been rejected without a 2nd updated deliverable having been submitted, 1 deliverable was rejected but a 2nd updated deliverable has been submitted, 7 deliverables have been conditionally approved with no updated documents provider to address State comments, 19 deliverables are considered late, 3 deliverables are in review with State, 5 deliverables are due at either future dates or due dates were not identified in contract amendment
• 6/29/2012- Two of the three deliverables required under contract amendment 3 were rejected and the other was conditionally approved. Fifteen deliverables are being reviewed. An additional eight are past due for delivery.
• 5/30/2012- AeHN continues to submit weekly reports. There are concerns with sustainability plans and privacy/security standards.
• 5/2/2012 - AeHN is submitting weekly status reports and is participating in a weekly meeting with HIT
Alaska HIT Project Monthly Status Report – Week of May12, 2014 10 - of - 17
36
ID Date Project Title Description Discussion Comments Status Trend Resolution Program office to discuss the status report, updates and any issues or concerns
• 1/30/2012 - State has not approved AeHN's CAP, State and AeHN continue to work together along with Deloitte technical assistance to reach a point with AeHN's CAP that it can be approved
• 12/21/2011 - State requested that AeHN staff meet with State and Cognosante to develop action items from the CAP review.
• 12/2/2011 - State received AeHN's CAP and will review.
46 1/22/2013 HIE Governance PMP on AeHN staff
AeHN does not currently have a PMP certified staff person.
AeHN does not currently have a PMP certified staff person. This is a requirement in the contract between DHSS and AeHN.
• 4/8/2014 - Anticipated AeHN staff member will be PMP certified by October 2014
• 10/1/2013 - No known change from April comment • 4/15/2013 - no updated provided by AeHN • 1/22/2013 - IT Planning office is unsure what AeHN
is doing about hiring a PMP certified staff person.
Active No Change
47 1/22/2013 HIE Governance Privacy & Security Officer on AeHN staff
AeHN has not been able to hire a privacy and security officer for their staff.
DHSS is concerned because AeHN has not been able to hire a Privacy & Security officer for their staff. This is a critical area of concern for the HIE and is needed before moving to a production status.
• 10/1/2013 - No known change from June comment • 6/10/2013 - AeHN Executive Director is acting as the
Privacy & Security office at this time • 4/15/2013 - no updated provided by AeHN • 1/22/2013 - AeHN has posted a combined Privacy &
Security Office and Data Quality position. The IT Planning office is concerned that AeHN will not be able to find a person with these two skill sets and both these areas are areas of concern and really need to have two separate individuals employed.
Active No Change
49 4/29/2013 HIE Governance Direct Secure Messaging (DSM) Solution current & version 2013
The DSM solution Orion has implemented for Alaska does not meet the needs for State of AK. State has been requesting for months for changes which have not been implemented, these include: group mailboxes, quality email connectivity, reporting by role, and other functionalities.
Orion has recently proposed a new version: 2013 DSM but this version doesn't fulfill all of the state's requests and may even be a step backwards for some functionality.
• 3/10/2014 - DSM V2 beta testing is not progressing. Orion Health has started to conduct meetings with beta testing entities but Orion appears to be working in a silo and not listening to their customers demands.
• DSM V1 continues to have issues that require entire system reboots, latest issues have been related to emails not sending or being received and issues with DSM settings not being saved
• 2/3/2014 - DSM V2 beta testing is not progressing due to lack of Orion support
• 1/6/2014 - Alaska is participating in DSM V2 beta testing, so far functionality in DSM V2 is significantly less and will not meet needs for participants
Active Worsening
Alaska HIT Project Monthly Status Report – Week of May12, 2014 11 - of - 17
37
ID Date Project Title Description Discussion Comments Status Trend Resolution • 10/1/2013 - No known change since September
comment • 9/13/2013 - Orion Health presented a modified plan
for DSM version 2, this modified plan will most likely not work for Alaska because it does not allow for HISP to HISP communication so users of the current DSM solution will not be able to communicate with users on version 2.
• 8/19/2013 - Still waiting for final details and updates about DSM version 2 and exact date this can be implemented and how Orion will address DHSS concerns with solution
• 6/10/2013 - Orion Health DSM version 2 will not be available for email migration until October 2013. This date is not satisfactory for DHSS and has been rejected. AeHN and DHSS are researching mitigation strategies.
• 4/29/2013 - Orion has been telling AeHN and State for weeks that they will provide dates for when Version 2013 could be implemented in Alaska and continues to avoid providing a date and answer the States concerns about 2013 version.
Alaska HIT Project Monthly Status Report – Week of May12, 2014 12 - of - 17
38
Risk Report Summary ID Date Project Title Description Comments Status Severity Probability Impact Strategy 11 12/31/2011 HIE
Governance
Insufficient Funds for Corrective Action Plan
If AeHN is not sufficiently staffed or funded to support the demands of the corrective action plan they will not be able to meet the expectations set in the AeHN/State contract, the Corrective Action Plan, nor other stakeholder expectations.
• 10/1/2013 - No change since September comment
• 9/13/2013 - no update provided by AeHN
• 6/10/2013 - AeHN Executive Director is filling roles until AeHN can hire staff
• 4/29/2013 - Status of a data quality person and a privacy/security staff person has not changed
• 4/15/2013 - AeHN still has not hired a Data Quality person nor a Privacy/Security staff person.
• 1/22/2013 - AeHN has increased staffing; however, AeHN has not hired a Data Quality person nor a Privacy Security staff person and currently has this posted as a single position. The IT Planning office is concerned that these are two critical positions needed and it will be difficult to fill this position combine these two skill sets.
• 12/13/2012 - HIT Office is monitoring staffing
• 9/26/2012 - new AeHN ED has increased staffing through hiring and contracting with third parties.
• 8/29/2012 - New AeHN ED, Rebecca Madison started in early August. Doris Yanis-House has agreed to stay on with
Active 2 - Significant; affecting all performance and budgets
1 - High; will occur (100%)
3 - Moderately Controllable
The Alaska HIT Program office works to supply templates, documentation, assistance and guidance as practical. AeHN prioritizes CAP word appropriately; some HIE program activities may be delayed as a result of focus on Direct implementation and corrective action plan activities.
Alaska HIT Project Monthly Status Report – Week of May12, 2014 13 - of - 17
39
ID Date Project Title Description Comments Status Severity Probability Impact Strategy AeHN as a contract employee to assist with DSM, unsure about Joe Furrer's employment status with AeHN. AeHN continues to struggle with staffing and funds.
• 7/30/2012 - AeHN Executive Director, Bill Sorrells last day was 7/20/2012. The new AeHN ED doesn't start until Aug. 8th. The other two HIE staff: Joe Furrer and Doris Yanis-House have also submitted their resignation letters and will be gone from AeHN by middle of August.
• 5/1/2012 - Due to the CAP for AeHN REC pressure on AeHN as an organization has increased. AeHN is still understaffed and funded. State HIT Program Office developed an HIE Staffing Comparison that was presented to the AeHN Board for discussion.
• 2/29/2012 - The HIT Program office and technical assistance contractor Deloitte continue to work with AeHN regarding their CAP submission.
• 1/30/2012 - HIT Program office and AeHN meet the week of January 2nd to discuss gaps in AeHN's CAP submission. A matrix was provided to AeHN regarding gaps and
Alaska HIT Project Monthly Status Report – Week of May12, 2014 14 - of - 17
40
ID Date Project Title Description Comments Status Severity Probability Impact Strategy strategies were discussed. HIT Program office is still concerned about AeHN's CAP since it has not yet been approved by State and has requested further technical assistance from Deloitte.
• 12/31/2011 - HIT Program office and AeHN are scheduled to meet in early January to discuss action steps necessary for the corrective action plan.
34 4/29/2013 HIE Governance
Direct Secure Messaging (DSM) Current and Version 2013
If Orion Health cannot implement a Direct solution that meets the States requirements and needs the State may have to find HISP services with another vendor.
• 3/10/2014 - Alaska continues to beta test DSM V2, V2 will not meet functionality needs as it has been presented by Orion. DSM V1 is experiencing system issues: emails not sending/receiving, MDNs inconsistently working, settings not saving
• 1/6/2014 - Alaska is beta testing DSM V2, V2 is not currently meeting functionality needs
• 10/1/2013 - No change since September comment
• 9/13/2013 - Orion Health presented to AK a modified DSM version 2 plan which will most likely not work for Alaska because it does not allow for HISP to HISP communication.
• 6/10/2013 - Orion health's DSM solution version 2 will not be ready for implementation until
Active 1 - High; probably project failure
2 - Expected; could occur (75%)
2 - Largely Uncontrollable
Mitigation Strategy - If Orion Health cannot provide a solution that meets the needs State will need to identify another vendor to provide Direct/HISP services.
Alaska HIT Project Monthly Status Report – Week of May12, 2014 15 - of - 17
41
ID Date Project Title Description Comments Status Severity Probability Impact Strategy October 2013, this delivery date has been rejected by State. AeHN and State are developing mitigation strategies.
• 5/3/2013 - Orion Health's DSM solution continues to be unstable: there is a timestamp issue where emails are being sent at a certain time but when received the timestamp on the email reflects a future date/time; at least one State user's DSM User ID disappeared - it was restored but only after system wide shutdown occurred
• 4/29/2013 - Orion Health continues to be unable to meet the States needs for DSM and are unable to provide accurate dates for when they might be able to provide a solution that meets the States needs
36 1/16/2014 HIE Governance
Orion Health Communications
Orion Health has significantly poor communications not only internally to their organization but also with their customers.
• 3/10/2014 - Orion communications continue to be poor
• 1/16/2014 - example of poor communications: Alaska has been asking Orion Health about when the patient portal would be first implemented, Alaska has been asking Orion Health for a date for weeks only to find out from North Dakota customer that Orion Health demoed the
Active 2 - Significant; affecting all performance and budgets
2 - Expected; could occur (75%)
2 - Largely Uncontrollable
Alaska will continue to monitor. DHSS recommended to AeHN that this be logged in a risk register with Orion Health if one is available.
Alaska HIT Project Monthly Status Report – Week of May12, 2014 16 - of - 17
42
ID Date Project Title Description Comments Status Severity Probability Impact Strategy version 4.0 of the Patient Portal to them and plan to roll it out for ND weekend of 1/18/2014.
• Another example of poor internal communication: Orion Health assigned resources to work with Alaska on developing public health interfaces, there were separate resources for the different interfaces, Alaska provided URLs for Orion Health to use to connect to BizTalk for all the interfaces but this information was not communicated internally to all Orion Health resources working on the various interfaces.
Alaska HIT Project Monthly Status Report – Week of May12, 2014 17 - of - 17
43
2.000 Introduction to Internal Security Policies v3 Page 1 of 6 Originally Adopted 09/21/2011 Revision v3 Adopted 05/31/2013
As such, AeHN has adopted a series of Security Policies to comply with theresponsibilitiesoutlinedintheSecurityRuleoftheHealthInsurancePortabilityandAccountability Act of 1996 (HIPAA). This policy provides the general terms andprovisionsthatapplytoalloftheSecurityPolicies,alongwiththedefinedtermsandacronymsthatareusedtherein.
Purpose The Alaska eHealth Network (AeHN) is committed to protecting the privacy andsecurity of the protected health information (PHI) contained in the systems itoversees. This policy reflects AeHN’s commitment to appropriately use andphysicallyprotectEPHI.
Scope/ApplicabilityThis policy is applicable to all AeHN workforce members that manage, control,access, useordiscloseprotectedhealth information for anypurposes. TheAeHNworkforce includesWorkforceMembers and other paid staff, contractors, agents,and vendors. This policy’s scope includes all protected health informationcontained on AeHN equipment, or otherwise accessible by the AeHNWorkforce,includingbutnotlimitedtotheHIEandDSM.
(a)Thedepartmentshallestablishappropriatesecuritystandardstoprotectthetransmission and receipt of individually identifiable information contained in thesystemestablishedunderAS18.23.300.Thestandardsmust
(b) A person may not release or publish individually identifying healthinformationfromthesystemforpurposesunrelatedtothetreatmentorbillingofthepatientwhoisthesubjectoftheinformation.Useordistributionoftheinformationforamarketingpurposeisstrictlyprohibited.
(1)tooptoutofthesystem;(2)toconsenttothedistributionofthepatient'srecordscontainedinthesystem;(3) tobenotifiedofaviolationof the confidentialityprovisions requiredunder
thissection;(4) on request to the department, to view an audit report created under this
AeHN’s Executive Director (ED) and Privacy and Security Officer (PSO) areresponsibleformonitoringandenforcementoftheAeHNInternalSecurityPoliciesandProcedures.
This policy is to be reviewed annually to determine if the policy complies withcurrent HIPAA Security regulations and to ensure that it incorporates all recentdevelopments inAeHNpolicies, procedures, activities, equipment and technology.In the event that significant related legal, regulatory or organizational changesoccur,thepolicywillbereviewedandupdatedasneeded.
Policy
I. GeneralPolicyRequirements:
A. Annual Review. AeHN will annually review all Internal Security Policies andProcedures to determine if they complywith currentHIPAA Security regulations,applicable Alaska law and AeHN contractual obligations. In the event thatsignificantrelatedlegal,regulatoryororganizationalchangesoccur, thepolicywillbereviewedandupdatedasneeded.
46
2.000 Introduction to Internal Security Policies v3 Page 4 of 6 Originally Adopted 09/21/2011 Revision v3 Adopted 05/31/2013
B. FormatofPHI.AeHNusesthesoftware‐as‐a‐servicemodelforthetransmissionandstorage of PHI. Although AeHN does not have PHI directly contained on its owninformationsystems,itisthestewardforsuchinformationheldbycontractorsandinacentraldatarepository. For thatreason,AeHNmustcontinuetocomplywiththesepoliciesandproceduresanytimeitishandlingPHI,inanyformat.
C. Workforce Access. AeHNWorkforceMemberswill not directlymanage or accessPHIonaregularbasis,butsomeWorkforceMemberswillhavetheabilitytodosowhen necessary. This requires such Workforce Members to comply with allresponsibilities of a health information exchange under HIPAA. No employee ofAeHNis tohaveaccess toPHI through theHIE,except forpurposesofauditingorperformingaudit functions, andother legalobligationsof theorganization. AeHNprimarilyfacilitatesthesecuretransferofPHIfromoneEHRtoanotherEHR.
D. Application to AeHN Workforce, Not Other Participants. These policies andproceduresapply to theAeHNworkforcemembers and the informationused anddisclosedbyAeHN.Theymayreferenceandrequirecollaborationwithparticipants,butdonotapplydirectlytoparticipantsintheHIE.Theguidelinesforparticipationand privacy and security responsibilities for participants are outlined in theExternalHIEPrivacy,SecurityandCompliancePolicyandrelatedproceduresfoundat4.200etseq.
II. SecurityStandards:
A. AdministrativeSafeguards. Administrativesafeguardsshallbeusedtomanagethe selection, development, implementation and maintenance of securitymeasurestoprotectPHIandtomanagetheconductofAeHN’sworkforcefortheprotectionofandauthorizedaccess toPHI. AeHN’sAdministrativeSafeguardsPolicy is found at 2.200 and the procedures enacted thereunder are found at2.201etseq. ThoseproceduresfollowthegeneralorderoftheAdministrativeSafeguardprovisionsintheHIPAASecurityRule.
B. Physical Safeguards. Physical Safeguards are to be made in order to protectAeHN’s electronic information systems, related buildings and equipment fromnaturalandenvironmentalhazardsandunauthorizedintrusion.Procedureswillbe implemented either directly or through AeHN vendors that limit physicalaccess to electronic information systems and the facility or facilities inwhichsuchsystemsarehoused,while still ensuring that properauthorizedaccess isallowed. AeHN’s Physical Safeguards Policy is found at 2.300 and theprocedures enacted thereunder are found at 2.301 et seq. Those proceduresfollow the general order of the Physical Safeguard provisions in the HIPAASecurityRule.
47
2.000 Introduction to Internal Security Policies v3 Page 5 of 6 Originally Adopted 09/21/2011 Revision v3 Adopted 05/31/2013
C. TechnicalSafeguards.TechnicalSafeguardsshallbemaintainedthatprotectPHIand control access to assure that such systems are accessed only by thoseindividualsorsoftwareprogramsthathavebeengrantedaccessrights.AeHN’sTechnical Safeguards Policy is found at 2.400 and the procedures enactedthereunder are found at 2.401 et seq. Those procedures follow the generalorderoftheTechnicalSafeguardprovisionsintheHIPAASecurityRule.
D. Breach Notification. A policy and procedures for breach notification shall bemaintained to ensure that breaches are adequately and appropriatelyaddressed. AeHN’sBreachNotificationPolicyisfoundat2.600andtheBreachNotificationProcedureisfoundat2.601.
o DoesnotincludeeducationrecordscoveredbytheFamilyEducationalRightsandPrivacyAct,asamended,20U.S.C.1232g;oremploymentrecordsheldbyanentityinitsroleasemployer.
As such, AeHN has adopted a series of Security Policies to comply with theresponsibilitiesoutlinedintheSecurityRuleoftheHealthInsurancePortabilityandAccountability Act of 1996 (HIPAA). This policy provides the general terms andprovisionsthatapplytoalloftheSecurityPolicies,alongwiththedefinedtermsandacronymsthatareusedtherein.
Purpose The Alaska eHealth Network (AeHN) is committed to protecting the privacy andsecurity of the protected health information (PHI) contained in the systems itoversees. This policy reflects AeHN’s commitment to appropriately use andphysicallyprotectEPHI.
Scope/ApplicabilityThis policy is applicable to all AeHN workforce members that manage, control,access, useor discloseprotectedhealth information for anypurposes. TheAeHNworkforce includesWorkforceMembers and other paid staff, contractors, agents,and vendors. This policy’s scope includes all protected health informationcontained on AeHN equipment, or otherwise accessible by the AeHNWorkforce,includingbutnotlimitedtotheHIEandDSM.
(a)Thedepartmentshallestablishappropriatesecuritystandardstoprotectthetransmission and receipt of individually identifiable information contained in thesystemestablishedunderAS18.23.300.Thestandardsmust
(b) A person may not release or publish individually identifying healthinformationfromthesystemforpurposesunrelatedtothetreatmentorbillingofthepatientwhoisthesubjectoftheinformation.Useordistributionoftheinformationforamarketingpurposeisstrictlyprohibited.
(1)tooptoutofthesystem;(2)toconsenttothedistributionofthepatient'srecordscontainedinthesystem;(3) tobenotifiedofaviolationof the confidentialityprovisions requiredunder
thissection;(4) on request to the department, to view an audit report created under this
AeHN’s Executive Director (ED) and Privacy and Security Officer (PSO) areresponsibleformonitoringandenforcementoftheAeHNInternalSecurityPoliciesandProcedures.
This policy is to be reviewed annually to determine if the policy complies withcurrent HIPAA Security regulations and to ensure that it incorporates all recentdevelopments inAeHNpolicies, procedures, activities, equipment and technology.In the event that significant related legal, regulatory or organizational changesoccur,thepolicywillbereviewedandupdatedasneeded.
Policy
I. GeneralPolicyRequirements:
A. Annual Review. AeHN will annually review all Internal Security Policies andProcedures to determine if they complywith current HIPAA Security regulations,applicable Alaska law and AeHN contractual obligations. In the event thatsignificantrelatedlegal,regulatoryororganizationalchangesoccur,thepolicywillbereviewedandupdatedasneeded.
52
2.000 Introduction to Internal Security Policies v3 Page 4 of 6 Originally Adopted 09/21/2011 Revision v3 Adopted 05/31/2013
B. FormatofPHI.AeHNusesthesoftware‐as‐a‐servicemodelforthetransmissionandstorage of PHI. Although AeHN does not have PHI directly contained on its owninformationsystems,itisthestewardforsuchinformationheldbycontractorsandinacentraldatarepository. For thatreason,AeHNmustcontinuetocomplywiththesepoliciesandproceduresanytimeitishandlingPHI,inanyformat.
C. Workforce Access. AeHNWorkforceMemberswill not directlymanage or accessPHIonaregularbasis,butsomeWorkforceMemberswillhavetheabilitytodosowhen necessary. This requires such Workforce Members to comply with allresponsibilities of a health information exchange under HIPAA. No employee ofAeHNis tohaveaccess toPHI throughtheHIE,except forpurposesofauditingorperformingaudit functions, andother legalobligationsof theorganization. AeHNprimarilyfacilitatesthesecuretransferofPHIfromoneEHRtoanotherEHR.
D. Application to AeHN Workforce, Not Other Participants. These policies andprocedures apply to theAeHNworkforcemembers and the informationused anddisclosedbyAeHN.Theymayreferenceandrequirecollaborationwithparticipants,butdonotapplydirectlytoparticipantsintheHIE.Theguidelinesforparticipationand privacy and security responsibilities for participants are outlined in theExternalHIEPrivacy,SecurityandCompliancePolicyandrelatedproceduresfoundat4.200etseq.
II. SecurityStandards:
A. AdministrativeSafeguards. Administrativesafeguardsshallbeusedtomanagethe selection, development, implementation and maintenance of securitymeasurestoprotectPHIandtomanagetheconductofAeHN’sworkforcefortheprotectionofandauthorizedaccess toPHI. AeHN’sAdministrativeSafeguardsPolicy is found at 2.200 and the procedures enacted thereunder are found at2.201etseq. ThoseproceduresfollowthegeneralorderoftheAdministrativeSafeguardprovisionsintheHIPAASecurityRule.
B. Physical Safeguards. Physical Safeguards are to be made in order to protectAeHN’s electronic information systems, related buildings and equipment fromnaturalandenvironmentalhazardsandunauthorizedintrusion.Procedureswillbe implemented either directly or through AeHN vendors that limit physicalaccess to electronic information systems and the facility or facilities inwhichsuch systemsarehoused,while still ensuring thatproperauthorizedaccess isallowed. AeHN’s Physical Safeguards Policy is found at 2.300 and theprocedures enacted thereunder are found at 2.301 et seq. Those proceduresfollow the general order of the Physical Safeguard provisions in the HIPAASecurityRule.
53
2.000 Introduction to Internal Security Policies v3 Page 5 of 6 Originally Adopted 09/21/2011 Revision v3 Adopted 05/31/2013
C. TechnicalSafeguards.TechnicalSafeguardsshallbemaintainedthatprotectPHIand control access to assure that such systems are accessed only by thoseindividualsorsoftwareprogramsthathavebeengrantedaccessrights.AeHN’sTechnical Safeguards Policy is found at 2.400 and the procedures enactedthereunder are found at 2.401 et seq. Those procedures follow the generalorderoftheTechnicalSafeguardprovisionsintheHIPAASecurityRule.
D. Breach Notification. A policy and procedures for breach notification shall bemaintained to ensure that breaches are adequately and appropriatelyaddressed. AeHN’sBreachNotificationPolicyisfoundat2.600andtheBreachNotificationProcedureisfoundat2.601.
o DoesnotincludeeducationrecordscoveredbytheFamilyEducationalRightsandPrivacyAct,asamended,20U.S.C.1232g;oremploymentrecordsheldbyanentityinitsroleasemployer.
2.200 Administrative Safeguards V3 Page 1 of 8 Originally Adopted 07/20/2011 Revision Adopted 05/31/2013
2.200AdministrativeSafeguardsPolicy
PolicySummaryAlaska eHealth Network (AeHN) ensures the confidentiality, integrity andavailabilityofitsinformationsystemscontainingPHIbyimplementingappropriateand reasonable policies, procedures and controls to prevent, detect, contain, andcorrect security violations. AeHN’s administrative safeguards include a securitymanagementprogrambasedonformalandregularprocessesforriskanalysisandmanagement,sanctionpoliciesfornon‐compliance,andinformationsystemactivityreview.
All AeHN workforce members are responsible for appropriately protecting PHImaintained on the Alaska HIE information systems. AeHN management isresponsible for ensuring the confidentiality, integrity and availability of all PHImaintainedontheAlaskaHIEinformationsystems.
This policy is applicable to all AeHN workforce members that manage, control,access, useor discloseprotectedhealth information for anypurposes. TheAeHNworkforce includes employees and other paid staff, contractors, agents, andvendors.Thispolicy’sscopeincludesallprotectedhealthinformationcontainedonAeHNequipment,orotherwiseaccessiblebytheAeHNWorkforce,includingbutnotlimitedtotheHIEandDSM.
A. Integrity and Confidentiality of PHI. AeHN makes active strides to protect theintegrity and confidentiality of PHI information managed on behalf of providerorganizations participating in the statewide health information exchange. Theseactivities include, but are not limited to the use of identity protected storage,networkstorage,systemaccesslogging,physicalprotectionsandsecurity,andusereducation.
57
2.200 Administrative Safeguards V3 Page 3 of 8 Originally Adopted 07/20/2011 Revision Adopted 05/31/2013
B. Best Practices. AeHN actively enforces compliance with HIPAA regulations byutilizingandrequiringtheuseof‘bestpractice’securitymeasures,including,butnotlimited to, utilizing mandatory network login, strong password discipline,workstationsecurity,protectednetworkstorageandphysicalsecurity.
C. Privacy and Security Officer. AeHN is committed to ensuring the privacy andsecurityofPHIthatitmanagesonbehalfofitsparticipatingproviderorganizations.Inorder tomanage the facilitationand implementationof activities related to theprivacy and security of PHI, AeHN will appoint and maintain an internal PSOposition. The PSO will serve as the focal point for security compliance‐relatedactivitiesandresponsibilities,as listed in theAeHNpoliciesandprocedures. If,atany point, a PSO is not maintained as a separate position, the AeHN ExecutiveDirectorshallserveasthePSO.
II. EmployeeandWorkforceManagement
A. CompliancewithPoliciesandProcedures. AeHNworkforcememberswillcomplywithallapplicableAeHNsecuritypoliciesandprocedures. Compliance ismandatedtoensuretheconfidentiality,integrityandavailabilityoftheAlaskaHIEinformationsystems.
B. TrainingandAwareness. AeHNworkforcememberswill understand andbeawareof allapplicableAeHNsecuritypoliciesandprocedures.AeHNwillprovideregulartrainingandawarenessforworkforcemembersonAeHNsecuritypoliciesandprocedures.
C. Sanctions Procedures. AeHNwill establish formal, documented procedures for applyingappropriate sanctions against workforce members who do not comply with its securitypoliciesandprocedures.
D. Enforcement of Policies and Procedures. AeHN actively controls EPHI and educates itsworkforcemembersinEPHIsecuritybyanyofthefollowing:
1. AeHNwill demonstrate its commitment to enforce HIPAA regulations and secureEPHI information by establishing a PSO who will be charged with the ongoingprocessofestablishing,maintainingandupdatingHIPAArules,policies,proceduresandguidelines.
3. TheAeHNPSO andworkforcememberswillmeet at least semi‐annually to auditexisting procedures and technology to ensure that HIPAA regulations are beingactivelyenforced.
4. TheAeHNPSOisresponsibleforestablishingtrainingguidelinesforeachrespectiveAeHN workforce member specifically with regards to the types and amount oftraining required to meet HIPAA regulations. Training for each person may be
58
2.200 Administrative Safeguards V3 Page 4 of 8 Originally Adopted 07/20/2011 Revision Adopted 05/31/2013
combined and presented in a group setting, or otherwise available in a formatdeemedappropriatebythePSO.
E. BasicSecurityTraining. Despite the fact thatallAeHNworkforcememberswillnothave
2. Identify and prioritize the vulnerabilities of the Alaska HIE information systemscontainingEPHI.
3. Identify and define the security measures used to protect the confidentiality,integrity,andavailabilityoftheAlaskaHIEinformationsystemscontainingEPHI.
6. Any report compiled will include all statistical and technology references toformulaterecommendations.
7. Judgments used in AeHN’s Risk Analysis, such as assumptions, defaults, anduncertainties,shouldbeexplicitlystatedanddocumented.
C. DistributionofRiskAnalysisResults.Asappropriate,theAeHNPSOandmanagementwill
share results of the Risk Analysis with the AeHN Board of Directors and the Audit andComplianceCommittee.
D. Review of Information Systems Activity. The AeHN PSO or assigned AeHN workforcememberwillregularlyreviewrecordsofactivityoninformationsystemscontainingEPHI.
IV. AccessandAuthorization‐Internal
59
2.200 Administrative Safeguards V3 Page 5 of 8 Originally Adopted 07/20/2011 Revision Adopted 05/31/2013
A. PositionAuthority. Individual jobdescriptions forAeHNworkforcememberswill be thebasisfordefiningaccessauthorityandthespecificinformationsystemcontentthatwillbeaccessible. The nature and extent of access to the Alaska HIE information systemscontainingEPHIwillbebasedonanongoingriskanalysisprocess.Ataminimum,theriskanalysiswillconsiderthefollowingfactors:
1. Theimportanceoftheapplicationsrunningontheinformationsystem2. ThevalueorsensitivityoftheEPHIontheinformationsystem3. The extent to which the information system is connected to other information
systems
B. Need for Access. Access to the Alaska HIE information systems containing EPHIwill beauthorizedonlyforproperlytrainedAeHNworkforcemembershavingalegitimateneedforspecificinformationinordertoaccomplishjobresponsibilitiesasdefinedinindividualjobdescriptions. Job descriptionswill be reviewed at least annually to validate necessity ofaccesstosomeorallEPHImaintainedintheAlaskaHIEinformationsystems.
C. Limitation on Authorization. AeHN workforce members will not access the Alaska HIEinformation systems containing EPHI for which they have not been given properauthorization. NoemployeeofAeHNis tohaveaccess toPHI throughtheHIE,except forpurposes of auditing or performing audit functions, or other legal obligations of theorganization.AeHNwillensurethatallworkforcememberswhohavetheabilitytoaccessthe Alaska HIE information systems containing EPHI are appropriately authorized orsupervised. AeHNwillmaintainadocumentedprocessforauthorizingappropriateaccesstotheAlaskaHIEinformationsystemscontainingEPHI.Thiswillinclude:
role.3. An annual review of roles and authorized categories of access to EPHI to be
conductedaspartoftheongoingriskanalysisprocess.
D. WorkforceScreeningandTermination.AeHNworkforcememberswillbescreenedduringthehiringprocesstoidentifypossibleareasofriskwhichwillbevettedbeforeretentioninapositionthatrequiresaccesstoEPHI.AeHNwillsustainaformal,documentedprocessforterminatingaccesstoEPHIwhentheemploymentofaworkforcememberends,ortheneedtoaccessEPHIotherwiseterminates.
E. Confidentiality Agreements. All AeHN workforce members who access the Alaska HIEinformation systems containing EPHIwill sign a confidentiality agreement inwhich theyagree not to provide or discuss EPHI or confidential information with unauthorizedpersons. Confidentiality agreements will be reviewed and signed annually by AeHNworkforcememberswhoaccesstheAlaskaHIEinformationsystemscontainingEPHI.
60
2.200 Administrative Safeguards V3 Page 6 of 8 Originally Adopted 07/20/2011 Revision Adopted 05/31/2013
V. Access&Authorization–ExternalorParticipatingSiteWorkforceMembers
AeHN will have a formal, documented process for establishing, documenting, reviewing, andmodifyingaccesstotheAlaskaHIEinformationsystemscontainingEPHI.Theprocesswillbebasedon AeHN and the Participating Organizations’ access authorization policy. At a minimum, theprocessmustinclude:
A. Access Establishment. Procedure for establishing different levels of access to the AlaskaHIEsystemscontainingEPHI.
B. Access Documentation. Procedure for documenting levels of access established to theAlaskaHIEinformationsystemscontainingEPHI.
C. Access Review. Procedure for regularly reviewingAeHN and ParticipatingOrganizationsworkforce member access privileges to the Alaska HIE information systems containingEPHI.
D. Access Modification. Procedure for modifying AeHN and Participating Organizationsworkforce member access privileges to the Alaska HIE information systems containingEPHI.
E. Access Termination. Procedure for terminating AeHN and Participating Organizationworkforce members’ access privileges to the Alaska HIE information systems containingEPHI.
VI. InformationSecurity
A. SecurityReminders. AeHNwillmakecertain thatallof itsworkforcemembers, includingthosewhoworkremotely,areregularlyremindedofinformationsecurityrisksandhowtofollow AeHN security policies. Additionally, workforce members will be provided withinformation aboutAeHN security procedures andhow to use theAlaskaHIE informationsystemsinwaysthatminimizepossiblesecurityrisks.
B. Maintenance of Security. AeHN will ensure that the confidentiality, integrity, andavailability of EPHI on the Alaska HIE information systems is maintained when itsinformationsystemsareaccessedbythirdparties.Beforethirdpartypersonsaregrantedaccess to the Alaska HIE information systems containing EPHI, a risk analysis will beperformed.Afterasuccessfulriskanalysis,accessbythirdpartypersonstotheAlaskaHIEinformation systems containing EPHI will be allowed only after an agreement has beensigneddefiningthetermsforaccess.
C. RiskDetection. AeHNmust be able to effectively detect and preventmalicious software,particularly viruses, worms and malicious code. AeHN will develop, implement, and
61
2.200 Administrative Safeguards V3 Page 7 of 8 Originally Adopted 07/20/2011 Revision Adopted 05/31/2013
regularly review a formal, documented process for guarding against, detecting, andreportingmalicioussoftwarethatposesarisktoitsinformationsystemsanddata.
VII. PasswordsandLog‐In
A. MonitoringLog‐In. AeHNwilldevelop, implement,andregularlyreviewa formalprocessformonitoring log‐in attempts and reporting discrepancies. Access to all theAlaskaHIEinformationsystemswillbeviaasecurelog‐inprocess.
B. Password Safeguards. AeHN will develop, implement, and regularly review a formalprocessforappropriatelycreating,changingandsafeguardingpasswordsusedtovalidateauser’sidentityandestablishaccesstoitsinformationsystemsanddata.
VIII. SecurityIncidents
A. SecurityIncidentResponse.AeHNwillalsomaintainadocumentedprocessforquicklyandeffectively detecting and responding to security incidents that may impact theconfidentiality, integrity, or availability of the Alaska HIE information systems. At aminimum,AeHN’sPSOwillensurethat:
1. All actions taken are intended tominimize the damage of a security incident andpreventfurtherdamage.
2. Onlyauthorizedandappropriately trainedAeHNemployeesareallowedaccess toaffected information systems in order to respond to or recover from a securityincident.
3. Allactionstakenarecarefullydocumented.
B. Security Incident Monitoring. AeHN will maintain a mechanism for quantifying andmonitoringthetypes,volumesandcostsofsecurityincidents.Thisinformationwillbeusedtoidentifytheneedforimprovedoradditionalsecuritycontrols.AeHN’sPSOisauthorizedto investigate any and all alleged violations of AeHN security policies, and to takeappropriateactiontomitigatetheinfractionandapplysanctionsaswarranted.
IX. DisasterRecovery&Backup
A. Emergency Response. AeHN will have a formal process for both preparing for andeffectively responding to emergencies and disasters that damage the confidentiality,integrityoravailabilityofitsinformationsystems.ThiswillincludecoordinationwithourSaaSvendortoensurethatithasappropriatedisasterrecoveryandbackupproceduresinplace.
B. Backup Plan. AeHN, independently or through its SaaS vendor, must have a formal,documentedbackupplanforitsinformationsystems.Ataminimum,theplanmust:
2.200 Administrative Safeguards V3 Page 8 of 8 Originally Adopted 07/20/2011 Revision Adopted 05/31/2013
2. Provideabackupschedule.3. Identifywherebackupmediaarestoredandwhomayaccessthem.4. Outlinerestorationprocedures.5. Identify who is responsible for ensuring the backup of information systems and
electronicmedia.
C. Data Restoration. Restoration procedures for the Alaska HIE electronic media andinformation systems containing EPHI must be regularly tested to ensure that they areeffectiveandthattheycanbecompletedwithinthetimeallottedintheAlaskaHIE’sdisasterrecoveryplan.
D. Data Retention. The retention period for backup of EPHI on the AlaskaHIE informationsystemsandelectronicmediaandanyrequirements forarchivecopiestobepermanentlyretainedmustbedefinedanddocumented.
E. Disruption Analysis. Risk analysis should be used to determine and document themaximumamountof lossthatmayoccurifbackupoftheAlaskaHIEinformationsystemsand electronic media is disrupted. Such analysis should be used to determine if allappropriateandreasonablemeasuresarebeingusedtobackuptheAlaskaHIEinformationsystemsandelectronicmedia.
ThispolicyisapplicabletoallAeHNworkforcemembersthatmanage,control,access,useordiscloseprotectedhealth information foranypurposes. TheAeHNworkforce includesemployees and other paid staff, contractors, agents, and vendors. This policy’s scopeincludes all protected health information contained on AeHN equipment, or otherwiseaccessiblebytheAeHNWorkforce,includingbutnotlimitedtotheHIEandDSM.
RegulatoryCategory,Type,LegalRegulatoryReference
Implement policies and procedures to limit physical access to its electronic informationsystemsand the facilityor facilities inwhich theyarehoused,while ensuring thatproperlyauthorizedaccessisallowed.
Physical Safeguards, Standard, AS 18.23.300 et seq.; 45 CFR 164.310; ; 7 AAC166.010;7AAC166.030;7AAC166.040;7AAC166.050;7AAC166.900
PolicyAuthority/Enforcement
AeHN’s Executive Director (ED) and Privacy and Security Officer (PSO) areresponsibleformonitoringandenforcementofthispolicy.
RelatedPolicies&Procedures
Standard NumberWorkstationUse 2.301WorkstationSecurity 2.302DeviceandMediaControls 2.303Accountability 2.304
Formatted: Indent: Left: 0", Hanging: 0.5"
64
2.300 Physical Safeguards V3 Page 2 of 4 Originally Adopted 07/20/2011 Revision Adopted 05/31/2013
Renewal/ReviewThis policy is to be reviewed annually to determine if the policy complies with current HIPAA Security regulations and to ensure that it incorporates all recent developments in AeHN policies, procedures, activities, equipment and technology. In the event that significant related legal, regulatory or organizational changes occur, the policy will be reviewed and updated as needed.
Policy
I. UseofAeHNProperty.AeHNfacilities,workstations,equipmentandstoragewillbeusedonly
for authorized purposes: to support the educational, clinical, administrative, and otherfunctionsofAeHN.Suchusedemonstratesrespectforintellectualproperty,ownershipofdata,securitycontrols,andindividuals'rightstoprivacy.
A.Workstations
1. All workforce members who use AeHN workstations will take all reasonableprecautionstoprotecttheconfidentiality,integrity,andavailabilityofPHI.
2. Workforce members will not use AeHN facilities, workstations, equipment orstorage toengage inanyactivity that iseither illegalunder local, state, federal,orinternationallaworisinviolationofAeHNpolicy.
1. It is the policy of AeHN that no PHI is to be stored on any media within AeHN for any purpose. No employee of AeHN is to have access to PHI through the HIE, except for purposes of auditing or performing audit functions, or other legal obligations of the organization. AeHN primarily facilitates the secure transfer of PHI from one EHR to another EHR.
2. PHI located on the Alaska HIE information systems or electronic media will beprotected against damage, theft, and unauthorized access. This includes both PHIreceived by the Alaska HIE and created within the Alaska HIE. PHI must beconsistentlyprotectedandmanagedthroughitsentirelifecycle,fromoriginationtodestruction.
65
2.300 Physical Safeguards V3 Page 3 of 4 Originally Adopted 07/20/2011 Revision Adopted 05/31/2013
3. AeHNwillregularlyconductaformal,documentedprocessthatensuresconsistentcontrol of all electronic media and information systems containing PHI that iscreated,sent,receivedordestroyedbytheAlaskaHIE.
4. All Alaska HIE information systems and electronic media containing PHI will belocated and stored in secure environments that are protected by appropriatesecurity barriers and entry controls. The level of these controls should becommensurate with identified risks to the electronic media and informationsystems. AllAlaskaHIE informationsystemsandelectronicmediacontainingPHIwillbedisposedofsecurelyandsafelywhennolongerrequired.
6. AeHNemployeesandaffiliateswhomoveelectronicmediaorinformationsystemscontainingPHIareresponsibleforthesubsequentuseofsuchitemsandwilltakeallappropriate and reasonable actions to protect them against damage, theft, andunauthorizedaccess.
C.DataBackupandStorage
1. Backup of PHI onAlaskaHIE information systems and electronicmedia, togetherwith accurate and complete records of the backup copies and documentedrestoration procedures, will be stored in a secure remote location, at a sufficientdistance from AeHN facilities to escape damage from a disaster at AeHN. ThisprocessmaybecarriedoutinaHIPAAcompliantmannerbyAeHN’sSaaSvendor.
2. AeHNwillconfirmthatthevendorhasenactedbackupandrestorationproceduresfortheAlaskaHIEelectronicmedia,andinformationsystemscontainingPHIwillberegularly tested to ensure that they are effective and that they can be completedwithinareasonableamountoftime.
3. TheretentionperiodforbackupofPHIontheAlaskaHIEinformationsystemsandelectronic media and any requirements for archive copies to be permanentlyretainedwill be defined and documented by AeHN or the vendor responsible forsuchbackup.
66
2.300 Physical Safeguards V3 Page 4 of 4 Originally Adopted 07/20/2011 Revision Adopted 05/31/2013
AlaskaeHealthNetwork(AeHN)mustpurchaseandimplementinformationsystemsthat comply with AeHN’s Technical Safeguards policy. Alaska HIE informationsystems must support a formal process for granting appropriate access to theAlaskaHIEinformationsystemscontainingEPHI.AccesstoAlaskaHIEinformationsystemscontainingEPHImustbelimitedtoAeHNandParticipatingSiteworkforcemembersandsoftwareprogramshavinganeedforspecificinformationinordertoaccomplishalegitimatetask.
Purpose
This policy reflects AeHN’s commitment to purchase and implement informationsystemsthatcomplywithAeHN’sHIPAASecuritypolicies.
Scope/Applicability
This policy is applicable to all AeHN workforce members that manage, control,access, useor discloseprotectedhealth information for anypurposes. TheAeHNworkforce includes employees and other paid staff, contractors, agents, andvendors.Thispolicy’sscopeincludesallprotectedhealthinformationcontainedonAeHNequipment,orotherwiseaccessiblebytheAeHNWorkforce,includingbutnotlimitedtotheHIEandDSM.
RegulatoryCategory,Type,LegalRegulatoryReference
“ImplementpoliciesandproceduresforelectronicinformationsystemsthatmaintainEPHItoallow access only to those persons or software programs that have been granted accessrights...”
Technical Safeguards, Standard, AS 18.23.300 et seq.; 45 CFR 164.312; 7 AAC166.010;7AAC166.030;7AAC166.040;7AAC166.050;7AAC166.900
PolicyAuthority/Enforcement
AeHN’s Executive Director (ED) and Privacy and Security Officer (PSO) areresponsibleformonitoringandenforcementofthispolicy.
Standard NumberAccessControl 2.401UniqueUserIdentification 2.402AutomaticLogoff 2.403EncryptionandDecryption 2.404AuditControls 2.405Integrity 2.406PersonorEntityAuthentication
2.407
TransmissionSecurity 2.408 Renewal/Review
This policy is to be reviewed annually to determine if the policy complies with current HIPAA Security regulations and to ensure that it incorporates all recent developments in AeHN policies, procedures, activities, equipment and technology. In the event that significant related legal, regulatory or organizational changes occur, the policy will be reviewed and updated as needed.
PolicyI. InformationSystems
A. AeHNpurchasesandimplementsinformationsystemsthatcomplywithAeHN’sHIPAASecuritypolicies.
B. All current Alaska HIE information systems that do not currently comply with AeHN’sAdministrative Safeguardswill be identified and evaluated according to AeHN’s risk analysisprocess.
II. AccessControlandUniqueUserIDs
A. Asappropriate,AlaskaHIEinformationsystemssupportoneormoreofthefollowingtypesofaccess control to protect the confidentiality, integrity and availability of EPHI contained onAlaskaHIEinformationsystems:
1. Userbased2. Rolebased3. Contextbased
B. AlaskaHIEinformationsystemssupportaformalprocessforgrantingappropriateaccesstothe
2. Procedure for tracking and logging authorization of access to the Alaska HIEinformationsystemscontainingEPHI.
3. Procedure for regularly reviewing and revising, as necessary, authorization ofaccesstotheAlaskaHIEinformationsystemscontainingEPHI.
C. Asappropriate, security controlsormethods thatallowaccess to theAlaskaHIE information
systemscontainingEPHIwillinclude,ataminimum:
1. Uniqueuseridentifiers(userIDs)thatenablepersonsandidentitiestobeuniquelyidentified.User IDswillnotgiveany indicationof theuser’sprivilege level.Groupidentifierswill not be used to gain access to the Alaska HIE information systemscontainingEPHI.
E. Appropriate Alaska HIE information system owners or their designated delegates regularlyreview workforce member and software program access rights to Alaska HIE informationsystems containing EPHI to ensure that access is granted only to those having a need forspecific information in order to accomplish a legitimate task. Such rights will be revised asnecessary.
F. AllrevisionstoAeHNworkforcememberandsoftwareprogramaccessrightsaretrackedandlogged.Thisinformationissecurelymaintained.
III. AutomaticLogoff
A. AeHNworkforcemembersendelectronicsessionsoninformationsystemsthatcontainorcanaccessEPHIwhensuchsessionsarecompleted,unlesstheinformationsystemissecuredbyanappropriatelockingmethod,e.g.apasswordprotectedscreensaver.
B. AeHNworkforcememberslogofffromorlocktheirworkstation(s)whentheirshiftiscompleteortheyleavetheirworkstation(s).
IV. EncryptionandDecryption
When risk analysis indicates it is necessary, appropriate encryption is used to protect theconfidentiality, integrity, and availability of EPHI contained on the Alaska HIE informationsystems. The risk analysis is also used to determine the type and quality of the encryptionalgorithmandthelengthofcryptographickeys.
A. AeHNisabletorecordandexaminesignificantactivityonitsinformationsystemsthatcontainor use EPHI. AeHN will conduct a risk analysis to identify and define what constitutes“significantactivity”onaspecificinformationsystem.
B. Appropriate hardware, software, or procedural auditing mechanisms are implemented onAlaska HIE information systems that contain or use EPHI. The level and type of auditingmechanismsthatareimplementedonAlaskaHIEinformationsystemsthatcontainoruseEPHIisdeterminedbyAeHN’sriskanalysisprocess.
C. Logs created by audit mechanisms implemented on Alaska HIE information systems will bereviewedregularly. ThefrequencyofsuchreviewwillbedeterminedbyAeHN’sriskanalysisprocess.
VI. DataIntegrity
A. AeHN appropriately protects the integrity of all EPHI contained on its information systems.SuchEPHI isprotected from improperalterationordestruction. AeHNperformsregularriskanalysistodeterminetheappropriatemeanstoprotecttheintegrityofallEPHIcontainedonitsinformationsystems.
B. AeHNhasimplementedaformal,documentedprocessforappropriatelyprotectingtheintegrityofallEPHIcontainedonitsinformationsystems.Ataminimum,theprocessincludes:
2. A procedure defining how the Alaska HIE will detect and report instances ofattemptedorsuccessfulimproperalterationordestructionofAlaskaHIEEPHI.
3. A procedure defining how AeHN will respond to instances of attempted orsuccessfulimproperalterationordestructionofAlaskaHIEEPHI.
4. AproceduredefiningwhenandhowunnecessaryAlaskaHIEEPHIcanbedestroyed.Such destructionwill be conducted only by properly authorized AeHNworkforcemembers,ortheirdelegates.
C. MethodsusedtoprotecttheintegrityofEPHIcontainedonAlaskaHIEinformationsystemswill
B. AeHNusesanappropriateandreasonablesystem(s)toensurethatonlyproperlyauthenticatedpersonsandentitiesaccessAlaskaHIEEPHI.
VIII. DataTransmission&Integrity
A. AeHNappropriatelyprotectstheconfidentiality,integrityandavailabilityofalldataittransmitsoverelectroniccommunicationsnetworks.
B. Unless risk analysis indicates that there is not significant riskwhen sendingAlaskaHIEdataoveranelectroniccommunicationsnetwork,thedatawillbesentinencryptedformandhavecontrols to safeguard the integrity of the data. AeHN PSO will approve all encryption andintegritycontrolspriortotheiruse.
C. IntegritycontrolsarealwaysbeusedwhenhighlysensitiveAlaskaHIEdatasuchaspasswordsaretransmittedoverelectroniccommunicationsnetworks.
D. The AlaskaHIE’s integrity controls ensure that the value and state of all transmitted data ismaintainedandthedataisprotectedfromunauthorizedmodification.
RegulatoryCategory,Type,LegalRegulatoryReferencePrivacy Rule, 45 CFR §164.500 et seq.; AS 18.23.300 et seq.; 7 AAC 166.010; 7 AAC 166.030; 7 AAC 166.040; 7 AAC 166.050; 7 AAC 166.900
PolicyAuthority/EnforcementAeHN’s Executive Director (ED) and Privacy and Security Officer (PSO) are responsible for monitoring and enforcement of this policy.
RelatedPolicies&Procedures 3.200 Privacy and Confidentiality Policy
Renewal/Review
This policy is to be reviewed annually to determine if the policy complies with current HIPAA Security regulations and to ensure that it incorporates all recent developments in AeHN policies, procedures, activities, equipment and technology. In the event that significant related legal, regulatory or organizational changes occur, the policy will be reviewed and updated as needed.
To meet the requirements of the Privacy, Security and Breach Notification Rules, AeHN has adopted this policy to govern the use and disclosure of PHI in the Health Information Exchange (HIE) (including Direct Secure Messaging). This document establishes, in accordance with applicable law, AeHN’s policy for ethical and compliant behavior in regard to the privacy and security of Protected Health Information (PHI), Personal Information, and other records protected by applicable state and federal confidentiality laws and contained in the HIE. The policy is divided into Privacy, Security and Breach Notification elements, each of which are further carried out by the procedures found at 4.201 et seq.
The following procedures apply to the access, use and disclosure of protected healthinformation by Participants through the AeHN Health Information Exchange ("HIE") andotherdataexchangeservicesbeingmadeavailabletoParticipantsinAeHN,suchasDirectSecureMessaging(theHIEandotherservicesarecollectivelyreferredtoasthe"System").If there is any conflict between this Policy and the Participation Agreement, theParticipationAgreementshallcontrol.Theproceduresfoundat4.201etseq.willspecifyifthey pertain solely to HIE, Direct Secure Messaging or both activities. Here is a tableindicatingtheapplicabilityoftheprocedurestoHIEandDSM,aswellasthecorrespondingprovisionoftheParticipationAgreement,ifany:Procedure Sections
AeHN’s Executive Director (ED) and Privacy and Security Officer (PSO), incollaborationwiththeParticipants,areresponsibleformonitoringandenforcementoftheExternalHIEPrivacy,SecurityandCompliancePolicyandrelatedProcedures.
RelatedPolicies&Procedures Security Rule ‐ Internal Security Policies and Procedures found at 2.100 through
ExternalHIEPrivacy,SecurityandComplianceProceduresfoundat4.201through4.213Renewal/ReviewThis policy is to be reviewed annually to determine if the policy complies with current HealthInsurancePortability andAccountabilityActof 1996 (HIPAA)Security regulationsand to ensure
B. QualifyingUsesofInformation. AeHNandParticipantshaveplacedtheburdenontherequestingParticipanttoaccessinformationfromanotherParticipant’srecordsonlyfora qualifying use by the requesting Participant. A qualifying use is one thatmeets thetermsoftheParticipationAgreementandStateandFederallaw.
A. AccessB. AmendmentC. AccountingofDisclosuresofPHID. ConfidentialCommunicationsE. RequestsforRestrictionsonUsesandDisclosuresofPHI
II. SecurityPolicy
1. Compliance. AeHN is committed to running the HIE in compliance with allapplicable laws,regulationsandAeHNpolicies/procedures.AeHNhasadoptedthis policy in part to provide for the security of EPHI in accordancewith thefederal HIPAA Security Regulations. This policy and the procedures enactedhereunder encompass AeHN’s general approach to compliance with HIPAASecurityRegulationsthroughpolicystatementsandproceduresinthefollowingcategories:
a. AdministrativeSafeguards,b. PhysicalSafeguards,andc. TechnicalSafeguards.
2. Administrative Safeguards. The security management process is designed toprevent,detect,contain,andcorrectsecurityviolationsrelativetotheHIE.Theexecution, development and implementation of remediation programs is thejointresponsibilityofAeHNandtheParticipants.
a. Participants are expected to cooperate fully with any risk assessmentbeingconductedbyAeHN.
b. HIEauditprocedureswillbe implementedandmaintainedtoregularlyreviewrecordsofinformationsystemactivity,suchasauditlogs,accessreports, and security incident tracking reports. These reviewswill beused todetermine ifParticipantsarecomplyingwith therequirementsofthispolicyandtherelatedprocedures.
c. ParticipantswillassistinmakingsureaccesstotheHIEisassignedandmanaged appropriate to the duties and responsibilities of eachauthorizeduser, and thatauthorizedusersareproperly trainedon theapplicablelaws,policiesandprocedures.
andunauthorizedintrusion.Procedureswillbeimplementedthatlimitphysicalaccess to electronic information systems and the facility or facilities inwhichsuch systemsarehoused,while still ensuring thatproperauthorizedaccess isallowed. Participants should ensure that similar safeguards are in place toprotectaccesspointstotheHIEownedbyorhousedwithParticipants.
4. Technical Safeguards. Technical Safeguards shall be maintained by eachParticipantthatprotecttheHIEandcontrolaccesstoassurethatsuchsystemsare accessed only by those individuals or software programs that have beengrantedaccessrights. Participantswill implementtechnicalsecuritymeasuresto guard against unauthorized access to ormodification of EPHI that is beingtransmittedtoorfromtheHIE.
III. BreachNotificationPolicy.AeHNhasimplementedinternalpoliciesandprocedurestoaddressbreaches, includingbreachnotificationandmitigationmeasures. Participantsare expected to assist with the breach notification process as it applies to theirorganization,andtofollowrelatedproceduresenactedunderthispolicy.
AeHN has modeled its Network Responsibilities on the Nebraska Health InformationInitiative Privacy Rules, and the Connecting For Health "Model Privacy Rules andProceduresforHealthInformationExchange,"withanumberofdifferencesbasedonstatelaw, physical and technical safeguards available through AeHN, and AeHN's uniqueoperating environment. Thank you to those organizations for their knowledge andexpertise in this area. These core privacy principles and the rules that flow from thempromote balance between consumer control of and access to health information and theoperationalneedofcoveredentitiestoensurethatinformationusesanddisclosuresarenotoverly restricted, such that consumers would be denied many of the benefits andimprovements that information technologycanbring to thehealthcaresystem.Therulesare intended to reflect a carefully balanced view of all of the principles and avoidemphasizingsomeoverothersinanywaythatwouldweakentheoverallapproach.
PolicySummary
To meet the requirements of the Privacy, Security and Breach Notification Rules, AeHN has adopted this policy to govern the use and disclosure of PHI in the Health Information Exchange (HIE) (including Direct Secure Messaging). This document establishes, in accordance with applicable law, AeHN’s policy for ethical and compliant behavior in regard to the privacy and security of Protected Health Information (PHI), Personal Information, and other records protected by applicable state and federal confidentiality laws and contained in the HIE. The policy is divided into Privacy, Security and Breach Notification elements, each of which are further carried out by the procedures found at 4.201 et seq.
The following procedures apply to the access, use and disclosure of protected healthinformation by Participants through the AeHN Health Information Exchange ("HIE") andotherdataexchangeservicesbeingmadeavailabletoParticipantsinAeHN,suchasDirectSecureMessaging(theHIEandotherservicesarecollectivelyreferredtoasthe"System").If there is any conflict between this Policy and the Participation Agreement, theParticipationAgreementshallcontrol.Theproceduresfoundat4.201etseq.willspecifyifthey pertain solely to HIE, Direct Secure Messaging or both activities. Here is a table
4.209RequestsforRestrictions All All 4.210Mitigation All All 4.211 Investigations; IncidentResponseSystem
All All PAII.B.3HDVI.E
4.212 Authorized UserControls
All All HDV.D
4.213Sanctions All All
RegulatoryCategory,Type,LegalRegulatoryReference
45CFR§164(SecurityRule,BreachNotificationRule&PrivacyRule);AS18.23.300etseq.;7AAC166.010etseq.45CFR§164.502Usesanddisclosuresofprotectedhealthinformation:generalrules.(a)Standard.Acoveredentitymaynotuseordiscloseprotectedhealthinformation,exceptaspermittedorrequiredbythissubpartorbysubpartCofpart160ofthissubchapter.(1) Permitted uses and disclosures. A covered entity is permitted to use or disclose
(i)Totheindividual;(ii) For treatment, payment, or health care operations, as permitted by and incompliancewith§164.506;(iii) Incident to a use or disclosure otherwise permitted or required by this subpart,provided that the covered entity has complied with the applicable requirements of§164.502(b),§164.514(d),and§164.530(c)withrespecttosuchotherwisepermittedorrequireduseordisclosure;(iv)Pursuanttoandincompliancewithavalidauthorizationunder§164.508;(v)Pursuanttoanagreementunder,orasotherwisepermittedby,§164.510;and(vi)Aspermittedbyandincompliancewiththissection,§164.512,or§164.514(e),(f),or(g).
(2) Required disclosures. A covered entity is required to disclose protected healthinformation:(i)Toanindividual,whenrequestedunder,andrequiredby§164.524or§164.528;and(ii)WhenrequiredbytheSecretaryundersubpartCofpart160ofthissubchapter toinvestigateordeterminethecoveredentity'scompliancewiththissubpart.
45CFR§164.306Securitystandards:Generalrules.(a)Generalrequirements.Coveredentitiesmustdothefollowing:(1) Ensure the confidentiality, integrity, and availability of all electronic protected healthinformationthecoveredentitycreates,receives,maintains,ortransmits.(2)Protectagainstanyreasonablyanticipatedthreatsorhazardstothesecurityorintegrityofsuchinformation.(3)ProtectagainstanyreasonablyanticipatedusesordisclosuresofsuchinformationthatarenotpermittedorrequiredundersubpartEofthispart.(4)Ensurecompliancewiththissubpartbyitsworkforce.45CFR§164.404NotificationtoIndividuals.(a) Standard—(1) General rule. A covered entity shall, following the discovery of a breach of unsecured protected healthinformation,notifyeachindividualwhoseunsecuredprotectedhealthinformationhasbeen,or is reasonablybelievedby thecoveredentity tohavebeen,accessed,acquired,used,ordisclosedasaresultofsuchbreach.Privacy,SecurityandBreachNotificationRules;RequiredandAddressableStandards;45CFR§164
PolicyAuthority/Enforcement
AeHN’s Executive Director (ED) and Privacy and Security Officer (PSO), incollaborationwiththeParticipants,areresponsibleformonitoringandenforcementoftheExternalHIEPrivacy,SecurityandCompliancePolicyandrelatedProcedures.
RelatedPolicies&Procedures Security Rule ‐ Internal Security Policies and Procedures found at 2.100 through
Renewal/ReviewThis policy is to be reviewed annually to determine if the policy complies with current HealthInsurancePortability andAccountabilityActof1996 (HIPAA)Security regulations and to ensurethatitincorporatesallrecentdevelopmentsinAeHNpolicies,procedures,activities,equipmentandtechnology. Intheeventthatsignificantrelatedlegal,regulatoryororganizationalchangesoccur,thepolicywillbereviewedandupdatedasneeded.Policy
I. PrivacyPolicy.I.A. TheguidingAeHNprivacyprinciplesareappliedbyAeHNthroughitsinternalPrivacy
andSecurityPolicies, aswell as itsPrivacyandSecurityPlan.Theseprinciples areasfollows,andshouldbeappliedbyParticipants in theiruseof theHIEandDSMareasfollows::
technology concerning the handling of protected health information is vital toprotecting privacy. Individuals should be able to understand what informationexistsaboutthem,howthepersonalinformationisused,andhowtheycancontroluseofthatinformation.
B.2. Purpose Specification and Minimization. Access to and use of protected healthinformation must be limited to the type and amount necessary to accomplishspecified permitted purposes.Minimizing the use of protected health informationwillhelpdecreasetheamountofprivacyviolations,whichmayoccurwhendataiscollected for one legitimate reason and then reused for different or unauthorizedpurposes.
C.3. Disclosure Limitation. Protected health information should be made availablethroughtheAeHNSystemtoParticipantsonlybylawfulmeans.Electroniccollectionofprotected informationmaybeconfusing tomost individuals. Individualsshouldbe educated about the potential health and treatment benefits aswell as risks totheir protected health information that are associated with participation in theSystem.IndividualsdecidingnottoparticipateshouldhavetheopportunitytoknowtheSystem‐wideeffectofsuchdecisionandthepotentialdisadvantages.
D.4. AccessandUseLimitation.ProtectedhealthinformationshouldbeobtainedbyoneParticipant from the System only pursuant tomutual agreement (included in theParticipant Agreement) that the information is being accessed for qualifyingpurposesoftherequestingParticipant.Informationrecipientsmayuseanddiscloseprotected health information obtained through the System only for purposes anduses consistent with the Participant Agreement and consistent with their
Formatted: Font: 11 pt
Formatted: Font: 11 pt
Formatted: Font: 11 pt
Formatted: Font: 11 pt
Formatted: Font: 11 pt
Formatted: Font: 11 pt
Formatted: Font: 11 pt
Formatted: Space After: 10 pt, Numbered + Level: 1 +Numbering Style: A, B, C, … + Start at: 1 + Alignment: Left +Aligned at: 0.5" + Indent at: 0.75"
E.5. IndividualParticipationandControl.Consistentwiththescopeof individualrightsinHIPAA, individualsshouldhave theright torequestandreceive ina timelyandintelligible manner information regarding various parties that may have thatindividual’s specific health information. Individuals have a vital stake in personalprotected health information, such rights enable individuals to make informeddecisions about participation and provide another means to monitor forinappropriateaccess,useanddisclosureofprotectedhealthinformation.Individualparticipation promotes information quality, privacy, and confidence in privacypractices.IndividualsshouldbemadeawareoftheirrightswithregardtotheHIE,through theAeHNNoticeofDataPractices and theParticipants’ revisedNoticeofPrivacyPractices.
F.6. Data Integrity and Quality. Health information should be detailed, complete,appropriate,andcurrenttoguaranteeitsvaluetothevariousparties.Theeffectivedeliveryofqualityhealthcaredependsoncompletehealthinformation.Therefore,the System must maintain the integrity of protected health information andindividualsmustbeallowedtoviewinformationaboutthemandrequesttoamendsuchhealthinformationsothatitisaccurateandcomplete.
G.7. Security Safeguards and Controls. In an era of increased computer and Internet‐related crime, security safeguards are vital to privacy protection. Electronicenvironmentscouldbesusceptibletocyber‐crimewithoutadequatecontrols.Suchcontrolsareputinplacetopreventinformationloss,corruption,unauthorizeduse,modification, and disclosure. Safeguards that can be implemented includeinformation scrubbing, identity management tools, hashing, auditing,authenticating,andothermeanstoensureinformationprivacy.Privacyandsecuritysafeguards should be coordinated for the protection of protected healthinformation.
H.8. Accountability and Oversight. Privacy protections have less value to anindividual if privacy violators are not held accountable for failing to followprocedures relating to such privacy protections. Participants are unlikely to fullytrust the System and fully participate if they believe other Participants are notapplyingthesamerulesandbeingheldtothesamestandardofaccountability.Userandworkforcetraining,privacyaudits,andotheroversighttoolscanhelptoidentifyandaddressprivacyviolationsandsecuritybreachesbyconditioningparticipationand access authority on compliance with these and the individual Participant'sprivacy policies, by excluding from participation those who violate privacyrequirements,andbyidentifyingandcorrectingweaknessesinprivacyandsecuritysafeguards.
I.9. Remedies.Toensureprivacyprotectiontheremustbelegalandfinancialremediesthat hold violators accountable for failing to comply with System policies. Suchremedies will give individuals confidence in the organization’s commitment tokeeping protectedhealth informationprivate, andmitigate anyharm that privacy
violations may cause individuals. As a condition of continued participation, allParticipantsintheSystemmusthaveacommondutytoparticipateininvestigation,mitigationandremediationstepsfortheintegrityoftheSystem.
J.10. RelianceonCoveredEntityRulesandEnforcement.WhileAeHNshouldhavea number of core policies and procedures for the benefit and confidence of allParticipants, AeHN should not try to replace policies, procedures and methodsalready adopted by Participants as covered entities under HIPAA. AeHN shouldidentify,disseminateandenforceonlythosepoliciesandproceduresnecessaryforcoordinationofprivacybreachresponseandothermitigatingmeasures,butshouldrecognizethatexistingParticipantpoliciesgoverninallotherareas.
B. QualifyingUsesof Information. AeHNandParticipantshaveplacedtheburdenontherequestingParticipanttoaccessinformationfromanotherParticipant’srecordsonlyfora qualifying use by the requesting Participant. A qualifying use is one thatmeets thetermsoftheParticipationAgreementandStateandFederallaw.
1. Compliance. AeHN is committed to running the HIE in compliance with allapplicable laws,regulationsandAeHNpolicies/procedures.AeHNhasadoptedthis policy in part to provide for the security of EPHI in accordancewith thefederal HIPAA Security Regulations. This policy and the procedures enactedhereunder encompass AeHN’s general approach to compliance with HIPAASecurityRegulationsthroughpolicystatementsandproceduresinthefollowingcategories:
a. AdministrativeSafeguards,b. PhysicalSafeguards,andc. TechnicalSafeguards.
2. Administrative Safeguards. The security management process is designed toprevent,detect,contain,andcorrectsecurityviolationsrelativetotheHIE.Theexecution, development and implementation of remediation programs is thejointresponsibilityofAeHNandtheParticipants.
a. Participants are expected to cooperate fully with any risk assessmentbeingconductedbyAeHN.
b. HIEauditprocedureswillbe implementedandmaintainedtoregularlyreviewrecordsofinformationsystemactivity,suchasauditlogs,accessreports, and security incident tracking reports. These reviewswill beused todetermine ifParticipantsarecomplyingwith therequirementsofthispolicyandtherelatedprocedures.
c. ParticipantswillassistinmakingsureaccesstotheHIEisassignedandmanaged appropriate to the duties and responsibilities of eachauthorizeduser, and thatauthorizedusersareproperly trainedon theapplicablelaws,policiesandprocedures.
3. PhysicalSafeguards.PhysicalSafeguardsaretobemadeinordertoprotecttheHIE,relatedbuildingsandequipmentfromnaturalandenvironmentalhazardsandunauthorizedintrusion.Procedureswillbeimplementedthatlimitphysicalaccess to electronic information systems and the facility or facilities inwhichsuchsystemsarehoused,while still ensuring that properauthorizedaccess isallowed. Participants should ensure that similar safeguards are in place toprotectaccesspointstotheHIEownedbyorhousedwithParticipants.
4. Technical Safeguards. Technical Safeguards shall be maintained by eachParticipantthatprotecttheHIEandcontrolaccesstoassurethatsuchsystemsare accessed only by those individuals or software programs that have beengrantedaccessrights. Participantswill implementtechnicalsecuritymeasuresto guard against unauthorized access to ormodification of EPHI that is beingtransmittedtoorfromtheHIE.
Formatted: Font: +Headings (Cambria), 11 pt
Formatted: Normal, Space After: 10 pt, No bullets ornumbering
IV.III. BreachNotificationPolicy.AeHNhasimplementedinternalpoliciesandprocedurestoaddressbreaches, includingbreachnotificationandmitigationmeasures. Participantsare expected to assist with the breach notification process as it applies to theirorganization,andtofollowrelatedproceduresenactedunderthispolicy.
