Four years ago the Maryland Health Care Commission (MHCC) began the process of planning for a statewide health information exchange (HIE) by engaging numerous stakeholders to address fundamental policy issues and to plan a course of action. The MHCC has published a number of major policy reports based on these consensus-building deliberations (see Health IT Policy Reports). The statewide HIE will: support high quality, safe, and effective health care; make certain that data is exchanged privately and securely; ensure transparency and stakeholder inclusion; support connectivity regionally and nationally; achieve financial sustainability; and serve as the foundation for transforming health care in Maryland.
Subsequent to a nine-month planning project, in 2009 the MHCC selected the Chesapeake Regional Information System for our Patients (CRISP), a non-profit organization, to build the statewide HIE following a competitive application process. This multi-stakeholder group consists of Johns Hopkins Medicine, MedStar Health, University of Maryland Medical System, Erickson Retirement Communities, and more than two dozen other stakeholder groups. In August 2009, the Health Services Cost Review Commission awarded $10 million through its unique all-payor rate setting system as initial funding of the statewide HIE.
On May 19, 2011, House Bill 784, Medical Records – Health Information Exchanges (HB 784) was signed into law. This law stipulates that the MHCC will adopt regulations for the privacy and security of protected information exchanged through all HIEs in the state. The MHCC has assembled a Policy Board in 2009 with responsibility of providing guidance and input to staff regarding the development and operations of the statewide HIE. After the enactment of HB 784, the Board evaluated and recommended to MHCC staff the privacy and security policies that will apply to all HIEs in Maryland. The members were selected based upon their expertise, consideration regarding the breadth of stakeholder representation, and a strong consumer background. The Policy Board's separation of responsibilities assures participation by the public in both policy development and operational oversight.
Role of the Board
The responsibilities of this Policy Board include, although are not limited to, the development and recommendation of policies for privacy and security of protected information exchanged through a health information exchange operating in Maryland. The MHCC will consider the recommendations of the Policy Board and adopt regulations for health information exchanges to implement. In particular, the Policy Board will establish policies regarding consumer authorization and consent, user authentication, role-based authorization, security requirements, and audit trail requirements. The Policy Board will develop policies that ensure a high level of privacy and security protections for health information exchanges in Maryland.
HIE Policy Board Members
Policy Board Operating Guidelines
Health IT Policy Reports
HIE Policy Development
HIE policies are continuously evolving. The HIE Policy Development webpage includes all of the policies, resolutions, corresponding drafts, and voting results pertaining to HIE policies, which is an effort to display the evolution of HIE policy development and approval processes in Maryland. The Approved Final Policies, Proposed Draft Policies and Primary Reviewers List depicts currently approved policies and the prioritization of proposed policies for HIEs. The status of policy development, the Policy Board members assigned as Primary Reviewers for each policy, and their respective organizations are listed. In an effort to facilitate the policy development process of the HIE Policy Board workgroup meetings are convened. The HIE Policy Board Workgroup Summary includes dates of meetings, policies discussed, and the number of attendees at each workgroup meeting. The Currently Approved Final Policies and Resolutions document indicates all policies and resolutions currently approved by the Policy Board. Finally, the National HIE Policies webpage includes the links to other states regarding their HIE policies.
HIE Policy Development
Recommended Policies & Proposed Policies for Development
HIE Policy Board Workgroup Summary
All Currently Approved Final Policies and Resolutions
April 5, 2012
Planning Team Reports
Chesapeake Regional Information System for Our Patients (CRISP)
Montgomery County Health Information Exchange Collaborative (MCHIE)
Request for Application for A Consumer-Centric Health Information Exchange for Maryland
CRISP Response to RFA
HIPAA/HITECH Privacy & Security Checklist - Assessment and Guidance Instructions
HIPAA Security Series - Security Standards: Technical Safeguards
HIT Implementation Realties Versus Policy Aspirations
Making IT Meaningful: How Consumers value and Trust Health IT
Maryland Hospitals to Share Patient Data
NeHC Roadmap for HIE - The Landscape and a Path Forward
Last Updated: September 12, 2012