Frequently Asked Questions

What is a health information exchange?

A health information exchange is a secure electronic network that gives authorized health care providers the ability to access and share patient information across a statewide information network. It improves health care quality, enhances patient safety, improves health outcomes, and reduces overall health care costs by making health information available to participating health care providers.

What is the NC HIEA?

The North Carolina General Assembly created the North Carolina Health Information Exchange Authority (NC HIEA) to oversee and administer the state-designated HIE (NCGS § 90-414.7). NC HIEA receives input and advice from its Advisory Board, which consists of patients , hospital personnel, physicians, technology experts, public health officials and other key stakeholders to continuously improve the HIE network, now called NC HealthConnex, and to move towards more efficient and effective care.

What is NC HealthConnex?

NC HealthConnex is a secure electronic network that facilitates conversations between health care providers, allowing them to access and share health-related information across the state.

Created by the North Carolina General Assembly (NCGS § 90-414.1 et seq.), NC HealthConnex is the state-designated health information exchange. It is managed by the North Carolina Health Information Exchange Authority (NC HIEA), housed within the N.C. Department of Information Technology.

What is the HIE Act and the state’s requirements for connectivity?

The HIE Act is found in Article 29B of Chapter 90 of the North Carolina General Statutes. It established the NC HIEA within the North Carolina Department of Information Technology (NC DIT) in 2015. The purpose of the HIE Act is to improve the quality of health care delivery within this state by facilitating and regulating the use of a voluntary, statewide health information exchange network for the secure electronic transmission of individually identifiable health information among health care providers, health plans, and health care clearinghouses in a manner that is consistent with the Health Insurance Portability and Accountability Act, Privacy Rule and Security Rule, 45 C.F.R. §§ 160, 164.

What is the purpose of the HIE Act’s requirement to submit patient clinical and demographic data?

The legislature also enacted the Medicaid Transformation Act in 2015 to transition the North Carolina Medicaid program from a fee-for-service model into a value-based managed care model. N.C. Session Law 2015-245. Value-based managed care requires that program administrators be given access to patients’ clinical information in addition to medical claims data to align payments to patient outcomes, to coordinate care across disparate provider settings, and to reduce duplication of services across the health care continuum. (N.C. Session Law 2015-245).

Seeing an opportunity to expand the utility of the HIE Network and to support the rollout of Medicaid Transformation, the General Assembly included a requirement in the HIE Act that all Medicaid providers and all other entities that receive state funds for the provision of health services, including local management entities/managed care organizations, submit demographic and clinical information pertaining to services rendered to Medicaid and other state-funded health care program beneficiaries and paid for with Medicaid or other state-funded health care funds to the network by February 1 or June 1, 2018. N.C. Session Law 2015-241 Sections 12A.5.(a)-(d). The HIE Act has since been updated to amend the deadlines, to clarify which entities must submit data to NC HealthConnex, and to specify what type of data, clinical or claims, is required to be submitted. See N.C. Session Law 2017-57 Section 11A.5.(a) through (i); N.C. Session Law 2018-41 Section 9(a). In sum, the HIE Act provides for the mandated submission of clinical and demographic data from health care providers, but it also allows for the voluntary exchange of patient data if providers choose to send clinical and demographic data pertaining to services paid for with non-state funds.

Who is required to connect to NC HealthConnex?

All health care providers who receive state funds (e.g., Medicaid, NC Health Choice, State Health Plan, etc.) for the provision of health care services must connect to NC HealthConnex by specific dates in 2018, 2020 and 2021 to continue to receive payments for services provided (NCGS § 90-414.4).

Specifically:

• Hospitals, physicians, physician assistants and nurse practitioners who provide Medicaid services and who have an electronic health record system must connect by June 1, 2018.
• Local Management Entities/Managed Care Organizations (LMEs/MCOs) are required to submit encounter and claims data by June 1, 2020.
• Ambulatory surgical centers, dentists, licensed physicians whose primary area of practice is psychiatry, and the State Laboratory of Public Health operated by the Department of Health and Human Services must submit demographic and clinical data by 2021.
• Pharmacies and State health care facilities operated under the jurisdiction of the Secretary of the Department of Health and Human Services must submit claims data by June 1, 2021.
• Providers who do not receive state funding for the provision of health care services may also connect to the NC HIEA on a voluntary basis to support whole-person care.

How does a health care provider connect to NC HealthConnex?

1. The first step is reviewing and signing the Participation Agreement, which is the contract that governs the data sharing between the health care provider and the NC HIEA. This agreement can be found on our website with instructions for completion. For more information, visit our How to Connect page. Interested providers may also join a monthly “How to Connect Call” that is scheduled for the last Monday of each month at noon.
2. The second step is to have required technology in place. The NC HIEA Participation Agreement requires EHRs that are minimally capable of sending HL7 messages, version 2 and higher. EHR products that are ONC-certified for Meaningful Use for Centers for Medicare & Medicaid Services (CMS) Incentive Programs can usually connect more easily to NC HealthConnex. The NC HIEA has also created a technology specification and data target that can be found here. This document can also be used to ensure that your EHR vendor can meet our technology standards.

Providers who are planning to install and use an electronic health record system (EHR/EMR) in their practice should expect the process to last on average 12 to 18 months, as follows:

• Six to nine months for procurement
• Three to six months for implementation and training
• Three to four months for onboarding to NC HealthConnex.

How does a health care provider meet the "connected" requirement?

A health care provider is considered “connected” when its clinical and demographic information pertaining to services paid for by Medicaid and/or other state health care funds are sent to NC HealthConnex daily. This transmission of information may be through a direct connection to NC HealthConnex or through an indirect connection, such as through another HIE, EHR vendor or a similar affiliate. Participation agreements must provide details of indirect connections through other entities, such as Mission Health’s HIE.

Does HIPAA allow health care providers to submit data beyond the state’s requirements in the HIE Act?

The Health Insurance Portability and Accountability Act (HIPAA) and the U.S. Department of Health and Human Services (HHS) contemplate such exchange of health information. Health care providers and other covered entities are permitted to voluntarily share patient data with business associates, such as health information organizations like NC HealthConnex. See the definition of “business associate” in 45 C.F.R. § 160.103, which includes health information organizations; see also 45 C.F.R. § 164.502(a);(e)(1). HIPAA also recognizes that the disclosure of protected health information (PHI) may be required by law and does not limit what amount of data should be exchanged in that circumstance. 45 C.F.R. § 164.512 and 164.502(b)(2)(v).

In addition, if disclosure of PHI is required by law, providers do not have to seek authorization from the patient before making such a disclosure. 45 C.F.R. § 164.512. Furthermore, covered entities may seek but are not required to obtain patient consent for disclosures made for the purposes of treatment, payment, and health care operations unless an exception applies. 45 C.F.R. § 164.506.

What is the Participation Agreement?

The Participation Agreement is the legal contract that governs data sharing between the health care provider and the NC HIEA. This agreement can be found on the NC HealthConnex website with instructions for completion.

The Full Participation Agreement, which is aligned with the eHealth Exchange the Data Use and Reciprocal Support Agreement or DURSA , allows providers full use of current and future NC HealthConnex value-added features and satisfies the State requirement to submit, at a minimum, clinical and demographic data for the provision of health care services paid by state funds. Organizations with a Full Participation Agreement may submit data to NC HealthConnex either through a uni-directional connection or a bi-directional data connection. Full participants with a uni-directional connection can access patient data using the NC HealthConnex clinical portal. Bi-directional, or EHR-integrated participants, view NC HealthConnex clinical data within their EHR.

The Submission Only Participation Agreement will enable a provider to submit the clinical and demographic data required by law in a uni-directional technical connection in order to be in compliance with the HIE Act. However, this agreement will prohibit all other data exchange services, including HIE data query and response of patient records, clinical or event notifications, and public health registries. Participants with a Submission Only Agreement should consult with legal counsel prior to sending data that does not pertain to health care services paid for with State funds pursuant to the HIE Act. Being able to only submit State-funded data will also depend on the technical capability of your EHR vendor to implement data filtering.

Note: Providers may use either agreement to submit state-required data. The primary difference between the two agreements is whether or not the health care provider would like to be able to view the longitudinal patient record and utilize the additional services offered by the HIEA. If so, providers should sign the Full agreement.

Who is required to sign the Participation Agreement: individual providers or health care entities?

The health care entity signs the Participation Agreement on behalf of the practice or facility. Individual providers who are a part of a health care system or larger practice should ensure that their organization is a participant. A complete list of participants is available here.

What is the difference between a Submission Only and a Full Participation Agreement?

There are two primary differences between the Submission Only and Full Participation Agreement.

• The Submission Only Participation Agreement does not include a Business Associate Agreement, and therefore providers are neither able to access to the patient longitudinal health record nor can they utilize any services provided by NC HealthConnex. Some of these services include NC*Notify, an event notification service as well as participation in registries to meet Meaningful Use/Promoting Interoperability requirements. The Submission Only agreement also requires the technical capability of the EHR to implement data filtering, which may come at a cost to participants. Participants with a Submission Only Agreement should consult with legal counsel before sending data not pertaining to health care services paid for with State funds pursuant to the HIE Act (Medicaid, NC State Health Plan, NC Grant Funding, etc.).
• The Full Participation Agreement provides for a Business Associate Relationship between the HIEA and the provider organization. With this agreement, providers* can query and access patients’ longitudinal records and can utilize all NC HealthConnex services at no additional fee and may send all patient data to support whole person care or may choose to send only state-required data. Note: A bi-directional interface is not required with this agreement.

Note: Some mental health provider organizations’ service offerings may be limited due to 42 CFR Part 2 regulations. The HIEA provider relations team can answer more specific questions if you fall under 42 CFR Part 2.

How do I know if the organization is connected or has signed a Participation Agreement?

A complete list of participants is available here.

What are participating entities?

Participating entities are organizations that either a participant controls, that are under common control with a participant, or that share information or EHR systems with a participant and who the main participant organization will submit patient data to NC HealthConnex on behalf of.

A participating entity may also be a natural person or business entity with whom the participant has a direct or indirect business or employment relationship, including any person or entity provided a license or right to access and use any of a participant’s EHR product, software and/or services. Participating entities may elect to submit HIE data to NC HealthConnex under a single participant or as multiple separate participants.

For instance, an integrated health system may own or license EHR software to several hospitals, ambulatory clinics, and residential facilities within its organization. The larger health system organization could be considered the participant organization and the other facilities it owns or has a business relationship with would be the participating entities.

It is very important that each organization lists all their participating entities in their participation agreement in order for each facility to be marked as compliant with NC HealthConnex, to better inform our Outreach team about who is not yet connected to NC HealthConnex yet, and to help add more details about where patients were seen when submitting data.

What is a Participant Account Administrator (PAA)?

The PAA serves as the organization’s main contact to receive questions and communications from the NC HIEA. The PAA works with the HIEA Help Desk to manage the creation and deactivation of user accounts for the NC HealthConnex portal and DSM accounts, and acts as the organization’s point person for questions and training on NC HealthConnex. This person must be a staff member of your organization.

Who in the organization needs to sign the Participation Agreement, and where does he or she sign?

The staff member who has the authority to sign contractual agreements on behalf of the practice, facility or organization can sign the Participation Agreement.

The Participation Agreement includes instructions on where the signatory must sign. The Participation Agreement is the legal document governing data use between the health care organization and the HIEA. EHR vendors or business associates are not approved to sign agreements on behalf of their customers.

Should the organization send the Participation Agreement by email or U.S. mail?

The Participation Agreement is an editable pdf document with form fields where information from your organization is needed, and it is available on the website. The NC HIEA prefers for this agreement to be both completed and submitted electronically to hiea@nc.gov. Note: If a provider chooses to use the form fill functionality, s/he must save the document before emailing it to hiea@nc.gov.

A participant may also decide to send the entire completed and signed Participation Agreement in hard copy to the address below. However, email is preferred, the HIEA does not require two copies.

The physical mailing address is:

NC Health Information Exchange Authority
Re: NC HIEA Participation Agreement
Mail Service Center 4101
Raleigh, NC 27699-4101

Is an organization required to register for an organization ID (OID)?

If the facility does not have an OID, our technical team, SAS, will provide one during development. A facility does not have to acquire one prior to onboarding.

What types of patient information can health care providers access via NC HealthConnex?

Participating providers may access and retrieve information about their patients from across the patient’s various care settings to create a more complete health record including details around encounters, laboratory results, diagnostic studies and clinical documents. This information can be viewed via a web-based portal or within an EHR if a bi-directional connection has been established with your EHR vendor. Current data elements available in NC HealthConnex include the following:

• Allergies
• Encounters
• Immunizations
• Medications
• Problems
• Procedures
• Results

Can information be shared with organizations that do not participate with NC HealthConnex?

No. Only full participants may access information within NC HealthConnex.

Can health care providers choose to submit only clinical and demographic data paid for with state funds?

Health information exchange networks operate across the country and accept all patient data for the purpose of whole-person care. To date, the majority of NC HealthConnex participants send all patient records for this purpose. However, it is acceptable if a practice prefers to comply with the HIE Act by submitting only the required data to NC HealthConnex (Medicaid, State Health Plan, state grants).

Note: Being able to submit only State-funded data will also depend on the technical capability of your EHR vendor to implement data filtering. Providers may use the Full Participation Agreement and submit only state-required patient data while also receiving access to HIEA services, or they may use the Submission-Only Participation Agreement.

Is NC HealthConnex secure?

Yes. The NC HIEA takes patient health data privacy and security very seriously. The NC HIEA is a Health Information Organization (HIO) under HIPAA. In accordance with HIPAA regulations and state and federal law, the NC HIEA has entered into and will enter into Business Associate Agreements or HIPAA-compliant agreements with all organizations (e.g. covered entities) that disclose and receive personal health information (PHI) from NC HealthConnex. North Carolina also has the authority to audit the activity of organizations that receive PHI from the NC HealthConnex network. The NC HIEA follows the highest information security standards available. Information is always encrypted at rest and in transit. Additionally, the environment is SOC 2 compliant.

What policies are in place in the event of a breach?

The NC HIEA recognizes the vital role that information technology has in the health care industry, specifically health information exchange. NC HIEA and its participants have a shared responsibility to protect our cyber resources and citizens’ electronic health care records. The Authority has privacy and security policies and terms in the Participation Agreement that detail the procedures for security, HIPAA, or eHealth Exchange breaches.

The NC HIEA takes its role as a steward of patient data very seriously and abides by the highest security standards as set by federal and state law. Additionally, the NC HIEA will perform regular audits to ensure compliance, follow data specifications standards already set by the eHealth Exchange, and strive to minimize the amount of data shared to what is required to provide safe, quality and affordable care to patients.

Can the NC HIEA sell the patient care data that providers submit?

No. All data is protected, stored and accessed only for purposes permissible under federal and state law. The NC HIEA takes patient health data privacy and security very seriously and will never use HIE data for commercial purposes.

How will data submitted to NC HealthConnex be used?

Patient data will become part of the patient’s longitudinal record for the permitted purposes outlined in the Participation Agreement (governing agreement for data use and sharing) and in applicable law. The NC HIEA protects the data that is being entrusted to NC HealthConnex for the purposes of health information exchange and as outlined by the General Assembly. As a State entity, health care providers can rest assured that the State is prohibited from using HIE data for commercial purposes. SAS, the State’s technology vendor, is also prohibited from using HIE data for commercial purposes, and can only use, disclose or access the data as directed by the State. Permitted uses of HIE data include only those allowable under HIPAA and applicable law, including patient treatment, payment, health care operations, as well as public health activities, registries and reporting. As an example, a clinical event notification will allow a full participant who shares a patient with another health care organization to know where that patient has touched the system as this supports care coordination.

I am concerned about my patients’ protected health information. How can I be sure that it will remain private and secure?

The NC HIEA takes patient health data privacy and security very seriously. In accordance with HIPAA regulations and state law, the NC HIEA has entered and will enter Business Associate Agreements with all organizations that submit and receive personal health information (PHI) from NC HealthConnex. The State also has the authority to audit the activity of organizations that receive PHI from NC HealthConnex. The NC HIEA follows the highest information security standards available. Information is always encrypted at rest and in transit. Additionally, the environment is SOC 2 compliant.

What are the benefits of joining NC HealthConnex?

NC HealthConnex exists to improve health care quality, enhance patient safety, improve health outcomes and reduce overall health care costs by enabling health information to be readily available to health care providers and clinical staff across the state. It empowers providers with nearly real-time clinical information that links to colleagues across North Carolina and travels securely to their practices, ultimately helping to reduce medical errors and duplicate procedures.

What are the value-added features of full participation in NC HealthConnex?

The full list of value-added features is as follows:

• Exchange Services (EHR integrated, clinical portal, eHealth Exchange)
• Secure Messaging Services
• Registry Services
• Notification Services
• Data Quality
• Work Groups

What types of information can health care providers expect to receive on the patients they serve?

Participants will receive patient information from other provider organizations with whom they share a relationship. This information will include laboratory results, diagnostic studies and clinical documents. Current data elements available in NC HealthConnex include:

• Demographics
• Encounters
• Allergies
• Immunizations
• Medications
• Problems
• Procedures
• Results

Which EMR systems support connection to NC HealthConnex?

Here is a list of EHR vendors that are live and submitting data to NC HealthConnex . This list is not exhaustive. NC HealthConnex is continuing to grow and work with new vendors. To ensure that vendors can meet NC HealthConnex standards, review the technology specifications and discuss them with your vendor.

What if the vendor does not have the technical capability to connect to NC HealthConnex?

The NC HIEA offers a variety of connection options to NC HealthConnex. However, there are some instances in which an electronic health record vendor does not have the technical capability to connect to NC HealthConnex. In those instances, you will receive correspondence from the NC HIEA about this and options for possible next steps.

How do Full Participants gain access to the NC HealthConnex portal?

The Participant Account Administrator (PAA) for your organization is responsible for managing the creation of user accounts. Please contact your PAA to request access to the NC HealthConnex portal or a DSM account. If you do not know your PAA, please contact the HIEA Help Desk team at HIESupport@sas.com or (919) 531-2700.

How do participating providers gain access to the clinical portal to view patient records?

The NC HIEA takes its role as steward of patient data very seriously and gives credentials to the participant’s assigned Participant Account Administrator. The Participant Account Administrator grants the health care provider access based on his or her specific role within the health care organization. NC HealthConnex is configured with various clinical views that end users can access. Not all views need to be accessed be all users, and access can be based on sensitivity of information or relevance to the user. User groups and roles are used to control this access.

What is the difference between a uni-directional and bi-directional connection/integration?

Organizations who have a “Full Participation” agreement may access NC HealthConnex data via either a uni-directional or a bi-directional (EHR integrated) data connection. Organizations with a uni-directional connection/integration to NC HealthConnex may access their patient’s longitudinal patient record via the NC HealthConnex clinical portal. Organizations connected bi-directionally may access NC HealthConnex data via their organizational electronic health record.

Note: Bi-directional data connections to NC HealthConnex are dependent upon your electronic health record’s technical capability. Please work with your electronic health record vendor to determine if this is an option for your organization.

Are there restrictions on submitting substance abuse data to NC HealthConnex?

Alcohol or substance use disorder programs that hold themselves out as or advertise as providers of substance use disorder treatment and who receive any type of federal assistance as outlined in 42 C.F.R. Part 2 cannot generally disclose data through to NC HealthConnex in the following conditions:

1. If the data would identify a patient as an alcohol or substance abuser, and
2. If that data was obtained by an alcohol or substance abuse program for treating, diagnosing or making a referral for the patient’s alcohol or substance abuse problem.

Units within a larger health care organization that are covered by 42 C.F.R. Part 2 should also withhold patient data pertaining to substance use disorder patients. However, the remaining clinical data (i.e., general medical information, mental health data, procedures, laboratory tests, etc.) can be submitted to NC HealthConnex.

Part 2 providers may disclose part 2 information in the event of an emergency directly to a requesting physician if he or she needs the information to treat the emergency condition pursuant to 42 C.F.R. §2.51, or if the patient has authorized the specific disclosure in writing in compliance with 42 C.F.R. § 2.31. This can be done using NC HealthConnex Direct Secure Messaging. Please review 42 C.F.R. Part 2 before disclosing any alcohol or substance abuse information through NC HealthConnex.

Can I share data related to a patient’s behavioral health through NC HealthConnex?

Yes. Most behavioral health information is permitted to be shared through NC HealthConnex. However, HIPAA does not allow mental health providers to disclose a patient’s psychotherapy notes to others unless the patient authorizes the disclosure.

Although participants cannot submit Part 2 data or psychotherapy notes to the NC HealthConnex data repository, participants are permitted to share these types of information via direct secure messaging with other participants through NC HealthConnex. The provider sending the message must comply with applicable law and obtain the required consent or authorization from the patient before disclosing the data. To learn more about the HIEA’s secure messaging service, click here.

The HIPAA Privacy Rule defines “psychotherapy notes” as follows:

Notes recorded (in any medium) by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint or family counseling session and that are separated from the rest of the individual’s medical record. Psychotherapy notes exclude medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests and any summary of the following items: Diagnosis, functional status, the treatment plan, symptoms, prognosis and progress to date.

What is the patient consent model for North Carolina?

The HIE Act explicitly provides individual patients the right to “opt out” of NC HealthConnex. The legislation defines “opt out” as “an individual's affirmative decision communicated to the Authority in writing to disallow his or her protected health information from being disclosed by the Authority to covered entities or other persons or entities through the HIE Network.” NCGS § 90-414.3(13).

The opt out model for North Carolina was adopted in 2012. The decision to choose this consent model was included in an operational plan that was submitted to the Office of the National Coordinator for Health Information Technology within HHS. As an opt out state, all data related to North Carolina patients that are submitted to NC HealthConnex, regardless of payer, are viewable by certain authorized users who can access clinical records unless a patient opts out of exchange. The HIE Act also permits the NC HIEA to retain a copy of an opted-out individual’s patient records in the NC HealthConnex system but prohibits disclosure or access unless an exception applies. NCGS § 90-414.11(4).

The NC HIEA ensures providers educate patients about their opt out rights through obligations assigned to participants in the NC HealthConnex Participation Agreements, by distributing provider and patient education brochures to participants, and by providing a sample provision for providers’ patient-facing Notices of Privacy Practices that explains data will be submitted to NC HealthConnex. The NC HIEA also provides information on its website to directly communicate to patients about the benefits of health information exchange, how it works to improve care coordination and quality of care, as well as their choice to opt out.

What is the health care provider’s responsibility for patient education? When does patient education need to happen?

The HIE Act requires that the NC HIEA ensure that health care providers educate their patients about NC HealthConnex and the right to opt out or rescind a decision to opt out (See NCGS 90-414.7(b)(1)(d).) To aid participants and providers in educating their staff and their patients about NC HealthConnex, a comprehensive Welcome Packet is sent at the time of contract execution via email. It is also available on the website. The packet contains:

Initial Announcement Tools

• Sample initial email for CIO/CEO
• Sample employee newsletter announcement
• Talking points to educate employees
• NC Health Information Exchange Authority (NC HIEA) fact sheet

Go Live Announcement Tools

• Sample press release
• Sample senior leader email
• Talking points to educate patients
• Frequently Asked Questions for patients

Patient Education

• 8.5 x 11 fact sheet (available via the NC HIEA website for you to print or provide electronically)
• Waiting Room Tri-fold brochure order form (printed and mailed to participants at no charge)
• Opt-Out form (this will be available via the NC HIEA website for patients/providers to access)
• Sample Notice of Privacy Practices excerpt about disclosures to NC HealthConnex

How patients are educated on their right to opt out is subject to the discretion of the health care provider. The NC HIEA provides tools and resources in the Welcome Packet and reference information for providers to utilize to educate their patients to assist, but they are not required for use. We do, however, encourage providers to include a statement about disclosures made to NC HealthConnex in their Notice of Privacy Practices so providers can ensure all of their patients have been given the opportunity to read about the disclosure to NC HealthConnex.

After signing a Participation Agreement, the technical onboarding process will begin. It can take more than 12 weeks for a connection to be built and for data to start flowing to NC HealthConnex. Providers are encouraged to use this time to educate patients about their organization’s participation in NC HealthConnex and the benefits of health information exchange to improve care and lower cost.

How do patients opt out of NC HealthConnex?

Opt out forms are readily available online on our “For Patients” page. Once the patient mails NC HIEA the form and it is received by our office, the opt out processed within two business days. Forms must be completed in their entirety in order to be processed. Partially completed forms will not be accepted.

Once a health care provider signs a Participation Agreement, the NC HIEA provides a welcome packet which includes valuable patient education and opt-out materials. Providers can choose how they would like to include this information into their workflow. However, we encourage providers to include a statement about disclosures made to NC HealthConnex in their Notice of Privacy Practices. We recommend that participants begin patient education as soon as they sign the PA, while their facility is in onboarding for the technical connection. The NC HIEA also includes information for patients on its website here.

What is the cost of subscribing to NC HealthConnex?

Currently, there is no fee to connect. The NC HIEA is funded by North Carolina, with a goal to be receipts-supported in the future. The North Carolina General Assembly believes in the value of a robust state-operated HIE, and has committed $9 million annually to this endeavor. As we develop a roadmap for future sustainability, fees related to the consumption of value-added features will be vetted thoroughly with all stakeholders and recommended to the General Assembly before any final decisions are made.

Note: While there are currently no fees charged by the State for the connection to or use of NC HealthConnex, some EHR vendors may charge fees (technical build, maintenance, etc.) to their customers for this connection.

Are there fees to obtain a Direct Secure Message (DSM) account?

There are no fees to obtain a DSM account. DSM is a secure, scalable and standards-based method for the exchange of protected health information (PHI). However, medical providers will need to sign a Full Participation Agreement to receive credentials.

Note: DSM credentials are part of the package of HIE services that includes a technical connection to submit data. For more information access the Direct Secure Messaging Fact Sheet.

What happens to health care providers that do not connect?

Health care providers must demonstrate connectivity to NC HealthConnex by certain dates in 2020 and 2021 in order to continue to receive State funds in payment for health care services.

Are health care providers that do not have an EHR exempt from the law?

No. Providers who have not yet acquired an electronical health/medical record (EHR/EMR) for their practice have been given until June 1, 2020, to procure, implement, and onboard to NC HealthConnex. This process can take between 12-18 months. House Bill 70 has been introduced during the 2019 Legislative Session to allow for hardship exemptions for certain criteria.

Are health care providers that do not collect clinical patient information exempt from the law?

No. However, the NC General Assembly directed the NC HIEA, in partnership with DHHS and the State Health Plan, to conduct a feasibility study to understand the type of providers impacted by the HIE Act, the data collected and how it could be used in the HIE for patient care, as well as alternative methods of connection and data transport. The results of the study are linked here. House Bill 70 was introduced during the 2019 Legislative Session to allow for certain providers to be exempted from the requirement to submit data to the HIE. These certain providers may still connect to the HIE network and submit data voluntarily.

I am a patient of a provider connected to NC HealthConnex. Do I have rights to access the portal to view my medical history?

At this time, patient access to NC HealthConnex is not functional. As North Carolina continues its focus on patient-centered population health to improve health care outcomes, it is possible that the NC HIEA would look to expand this functionality at some date in the future.

Can I receive a copy of my patient data that is stored in NC HealthConnex?

Under HIPAA, Health Information Organizations like the NC HIEA are considered “Business Associates” of your health care providers who submit patient data to us. Business Associates are not required to respond to patient requests for a copy of their patient data unless the Business Associate has agreed to do so in their agreement with health care providers. We are not currently set up to respond directly to patient requests. However, you can ask your health care providers directly for a copy of your patient data, and we will assist them in responding to that request.

When can I expect my Opt-Out form to be processed in NC HealthConnex?

As soon as your Opt-Out form is received in the mail it goes into processing and takes about two business days.

Can I see where my patient data has been sent in NC HealthConnex?

Yes. You can fill out an Accounting of Disclosures form here. Please note that the NC HIEA does not have to report where your information was sent for certain purposes, such as for treatment purposes, which is the main reason why data is exchanged by and through NC HealthConnex. Please remember to mail a hard copy of your form to the NC HIEA.

Why can’t I email the Opt-Out form or the Accounting of Disclosures Form?

Unfortunately, because the Opt-Out form and the Accounting of Disclosure Form contains personally-identifying information (PII), email is not a secure form of submitting this information. The security of your PII is of utmost importance to the NC HIEA.

How do I know if HB 70 (N.C. Session Law 2019‐23) affects my requirement to connect to the HIE Network known as NC HealthConnex?

HB 70 now exempts certain provider types from the mandatory requirement to connect and send data to the HIE Network, NC HealthConnex. The following provider types have the option to connect on a voluntary basis, however, they are no longer required:

1. Community-based long-term services and supports providers, including personal care services, private duty nursing, home health and, hospice care providers.
2. Intellectual and developmental disability services and supports providers, such as day supports and supported living providers.
3. Community Alternatives Program waiver services (including CAP/DA, CAP/C, and Innovations) providers.
4. Eye and vision services providers.
5. Speech, language, and hearing services providers.
6. Occupational and physical therapy providers.
7. Durable medical equipment providers.
8. Nonemergency medical transportation service providers.
9. Ambulance (emergency medical transportation service) providers.
10. Local education agencies and school-based health providers.

These providers must sign a Full Participation Agreement if they want to submit data to NC HealthConnex or if they simply want to access patient data in the clinical portal or utilize the suite of services. Submission Only Agreements do not include a Business Associate Agreement and therefore can only be signed by providers who are required to connect and submit data to NC HealthConnex.

Does HB 70 change the deadline to connect for providers not identified above?

• Providers who originally had a deadline of June 1, 2019, to connect will now have a new deadline of June 1, 2020.
• Licensed physicians whose primary area of practice is psychiatry now have until June 1, 2021, to connect.

What if my organization has signed a participation agreement with the NC HIEA, but we are now no longer required to connect per changes in HB 70?

Provider types listed under NCGS § 90-414.4(e) who are no longer required to connect have several choices. Exempt providers can still connect to NC HealthConnex, but they must sign a full participation agreement. Submission only agreements will not be processed for exempt providers.

What does this mean for your health care organization?

If you have submitted a full participation agreement:

1. You may choose to not finalize your full participation agreement if it has not been signed by the NC HIEA yet. If it has been signed by the NC HIEA, we can terminate the agreement for you. Please send an email to hiea@nc.gov if you do not want the NC HIEA to process your participation agreement or you would like to terminate it. This will end your relationship with the NC HIEA/NC HealthConnex.
2. You have the option to continue your relationship as a participating organization. You may choose to still submit data to NC HealthConnex, or you may choose to simply receive access to the clinical portal and other value-added services. Having access to the clinical portal will allow you to view a more complete health record for patients with whom you have treatment relationship. No action is necessary at this time if you plan to become a full participant of NC HealthConnex.

For more information about the benefits of participating in NC HealthConnex, visit our website or sign up for the next How to Connect Call that is hosted the last Monday of each month at noon.

Note: If you previously signed a Submission Only agreement and would like to voluntarily participate in NC HealthConnex in order to view patient records or utilize the HIE value‐added features, your organization can complete a Full Participation Agreement, which is available at https://nchealthconnex.gov.

Are all providers who receive funds from the State of North Carolina for the provision of health care services required to connect to the HIE Network, NC HealthConnex, even if we are physically located outside of North Carolina?

HB 70 provides clarification that the state’s requirements for connectivity apply to providers licensed to practice in the State of North Carolina.

Does HB 70 allow providers to apply for hardship exemption?

The legislation provides for the Department of Health and Human Services to develop a process by which health care providers will be able to apply for a hardship extension until December 31, 2022, if implementing an EHR and connecting to NC HealthConnex would constitute undue hardship. This process will be communicated to health care providers in coordination with DHHS once it is defined.

Is more information available?

For more information, visit https://hiea.nc.gov, call the NC HIEA business office at (919) 754-6912, or email to hiea@nc.gov.