Frequently Asked Questions

What is a health information exchange?

A health information exchange is a secure electronic network that gives authorized health care providers the ability to access and share patient information across a statewide information network. It improves health care quality, enhances patient safety, improves health outcomes, and reduces overall health care costs by making health information available to participating health care providers.

What is the NC HIEA?

The North Carolina General Assembly created the North Carolina Health Information Exchange Authority (NC HIEA) to oversee and administer the state-designated HIE (NCGS 90-414.7). NC HIEA receives input and advice from its Advisory Board, which consists of patients, hospital personnel, physicians, technology experts, public health officials and other key stakeholders to continuously improve the HIE network, now called NC HealthConnex, and to move towards more efficient and effective care.

What is NC HealthConnex?

NC HealthConnex is a secure electronic network that facilitates conversations between health care providers, allowing them to access and share health-related information across the state.

Created by the North Carolina General Assembly (NCGS 90-414.7), NC HealthConnex is the state-designated health information exchange. It is managed by the North Carolina Health Information Exchange Authority (NC HIEA), housed within the N.C. Department of Information Technology.

Who is required to connect to NC HealthConnex?

All health care providers who receive state funds (e.g., Medicaid, NC Health Choice, State Health Plan, etc.) for the provision of health care services must connect to NC HealthConnex by specific dates in 2018 and 2019 to continue to receive payments for services provided (NCSL 2015-241 as amended by NCSL 2017-57).

Specifically:

• Hospitals, physicians, physician assistants and nurse practitioners who provide Medicaid services and who have an electronic health record system must connect by June 1, 2018.
• All other providers of Medicaid and state-funded services must connect by June 1, 2019.
• Local Management Entities/Managed Care Organizations (LMEs/MCOs) are required to submit encounter and claims data by June 1, 2020.
• Providers who do not receive state funding for the provision of health care services may also connect to the NC HIEA on a voluntary basis to support whole-person care.

How does a health care provider connect to NC HealthConnex?

1. The first step is reviewing and signing the Participation Agreement, which is the contract that governs the data sharing between the health care provider and the NC HIEA. This agreement can be found on our website with instructions for completion. For more information, visit our How to Connect page.
2. The second step is to have required technology in place. The NC HIEA Participation Agreement requires EHRs that are minimally capable of sending HL7 messages, version 2 and higher. EHR products that are ONC-certified for Meaningful Use for Centers for Medicare & Medicaid Services (CMS) Incentive Programs are preferred. The NC HIEA has also created a technology specification and minimum data target that can be found here. This document can also be used to ensure that your EHR vendor can meet our technology standards.

Providers who are planning to install and use an electronic health record system (EHR/EMR) in their practice should expect the process to last on average 12 to 18 months, as follows:

• six to nine months for procurement
• three to six months for implementation and training
• and three to four months for onboarding to NC HealthConnex.

How does a health care provider meet the "connected" requirement?

A health care provider is considered “connected” when its clinical and demographic information pertaining to services paid for by Medicaid and/or other state health care funds are sent to NC HealthConnex daily. This transmission of information may be through a direct connection to NC HealthConnex or through an indirect connection, such as through another HIE, EHR vendor or a similar affiliate. Participation agreements must provide details of indirect connections through other affiliates.

What is the Participation Agreement?

The Participation Agreement is the legal contract that governs data sharing between the health care provider and the NC HIEA. This agreement can be found on the NC HealthConnex website with instructions for completion.

• The Full Participation Agreement, which is aligned with the eHealth Exchange the Data Use and Reciprocal Support Agreement or DURSA, will allow providers full use of current and future NC HealthConnex value-added features and satisfies the State requirement to submit clinical and demographic data. Organizations with a Full Participation Agreement may submit data to NC HealthConnex either through a uni-directional connection or a bi-directional data connection. Full participants with a uni-directional connection can access patient data using the NC HealthConnex clinical portal.
   
• The Submission Only Participation Agreement will enable a provider to submit the clinical and demographic data required by law in a uni-directional technical connection in order to be in compliance with the HIE Act. However, this agreement will prohibit all other data exchange services, including HIE data query and response, clinical or event notifications, and public health registries. Participants with a Submission Only Agreement should consult with legal counsel prior to sending data that does not pertain to health care services paid for with State funds pursuant to the HIE Act.  Being able to only submit State funded data will also depend on the technical capability of your EHR vendor to implement data filtering.

Who is required to sign the Participation Agreement: individual providers or health care entities?

The health care entity signs the Participation Agreement on behalf of the practice or facility. Individual providers who are a part of a health care system or larger practice should ensure that their organization is a participant. A complete list of participants is available.

What is the difference between a Submission Only and a Full Participation Agreement?

There are two primary differences between the Submission Only and Full Participation Agreement.

• The Submission Only Participation Agreement does not include a Business Associate Agreement, and therefore providers are unable to utilize any services provided by NC HealthConnex. Some of these services include NC*Notify, an event notification service; clinical portal access to query patient records; and participation in registries to meet Meaningful Use/Promoting Interoperability requirements. 2) The Submission Only agreement also requires the technical capability of the EHR to implement filtering, which may come at a cost to participants. Participants with a Submission Only Agreement should consult with legal counsel before sending data not pertaining to health care services paid for with State funds pursuant to the HIE Act (Medicaid, NC State Health Plan, NC Grant Funding, etc.).
   
• The Full Participation Agreement provides for a Business Associate Relationship between the HIEA and the provider organization. With this agreement providers may utilize all NC HealthConnex services at no additional fee and may send all patient data to support whole person care. Note: A bidirectional interface is not required with this agreement.

How do I know if the organization is connected or has signed a Participation Agreement?

A complete list of participants is available on NC HealthConnex.

What are participating entities?

Participating entities are entities that a participant controls, that are under common control with a participant, or that share information systems with a participant.

A participating entity may also be a natural person or business entity with whom the participant has a direct or indirect business or employment relationship, including any person or entity provided a license or right to access and use any of a participant’s EHR product, software and/or services. Participating entities may elect to submit HIE data through NC HealthConnex to NC HIEA under a single participant or as multiple separate participants.

It is very important that each organization lists all their participating entities. These entities include separate facilities and locations. For example, some of our large connected health systems have more than 300 listed participating entities.

Who in the organization needs to sign the Participation Agreement, and where does he or she sign?

The staff member who has the authority to sign contractual agreements on behalf of the practice, facility or organization can sign the Participation Agreement. The Participation Agreement includes instructions on where the signatory must sign.

Should the organization send the Participation Agreement by email or US Mail?

The Participation Agreement is an editable pdf document available on the website. The NC HIEA prefers for this agreement to be completed and submitted electronically to hiea@nc.gov. A participant may also decide to send the entire completed and signed Participation Agreement in hard copy to the address below. However, email is preferred, and we do not require two copies.

The physical mailing address is as follows:

NC Health Information Exchange Authority Legal Team
Mail Service Center 4101
Raleigh, NC 27699-4101

Is an organization required to register for an organization ID (OID)?

If the facility does not have an OID, our technical team, SAS, will provide one during development. A facility does not have to go acquire one.

What types of patient information can health care providers access on NC HealthConnex?

Participating providers can receive information about their patients, including laboratory results, diagnostic studies and clinical documents. This information is currently housed within provider organizations, and can be viewed via web-based portal or within an EHR if a bidirectional connection has been established with that vendor. Current data elements available in NC HealthConnex include the following:

• Allergies
• Encounters
• Immunizations
• Medications
• Problems
• Procedures
• Results

Can information be shared with organizations that do not participate with NC HealthConnex?

No. Only full participants may access information within NC HealthConnex.

Can health care providers choose to submit only clinical and demographic data paid for with state funds?

Health information exchanges operate across the country, and accept all patient data for the purpose of whole-person care. To date, all NC HealthConnex participants send all patient records for this purpose. However, it is acceptable if a practice prefers to comply with the HIE Act by submitting only required data to NC HealthConnex.

Those providers may use the Full Participation Agreement and submit only state-required patient data while also receiving access to HIEA services, or they may use the Submission-Only Participation Agreement. However, the submission-only agreement does not allow providers to query NC HealthConnex for patient data, exchange data with other participants, demonstrate active engagement with NC HIEA registries to meet meaningful use requirements, or to access any of the value-added features offered by the NC HIEA.

Is NC HealthConnex secure?

The NC HIEA takes patient health data privacy and security very seriously. The NC HIEA is a Health Information Organization (HIO) under HIPAA. In accordance with HIPAA regulations and state and federal law, the NC HIEA has entered into and will enter into Business Associate Agreements or HIPAA-compliant agreements with all organizations (e.g. covered entities) that will receive personal health information (PHI) from NC HealthConnex. North Carolina also has the authority to audit the activity of organizations that receive PHI from the NC HealthConnex network. The NC HIEA follows the highest information security standards available. Information is always encrypted at rest and in transit. Additionally, the environment is SOC 2 compliant.

What policies are in place in the event of a breach?

The NC HIEA recognizes the vital role that information technology has in the health care industry, specifically health information exchange. NC HIEA and its participants have a shared responsibility to protect our cyber resources and citizens’ electronic health care records. The Authority has privacy and security policies that detail the procedures for security, HIPAA or eHealth Exchange breach in which any incident of unauthorized access to/acquisition of encrypted records or data containing personal information along with the confidential process occurs.

The NC HIEA takes its role as a steward of patient data very seriously and abides by the highest security standards as set by federal and state law. Additionally, the NC HIEA will perform regular audits to ensure compliance, follow data specifications standards already set by the eHealth Exchange and strive to minimize the amount of data shared to what is required to provide safe, quality and affordable care to patients.

Can the NC HIEA sell the patient care data that providers submit?

No. All data is protected, stored and accessed only for purposes permissible under federal and state law. The NC HIEA takes patient health data privacy and security very seriously and will never use HIE data for commercial purposes.

How will data submitted to NC HealthConnex be used?

Patient data will become part of the patient’s longitudinal record for the permitted purposes outlined in the Participation Agreement (governing agreement for data use and sharing) and in applicable law. The NC HIEA takes very seriously the responsibility of protecting the data that is being entrusted to NC HealthConnex for the purposes of health information exchange and as outlined by the General Assembly. As a State entity, health care providers can rest assured that the State is prohibited from using HIE data for commercial purposes. SAS, the State’s technology vendor, is also prohibited from using HIE data for commercial purposes, and can only use, disclose or access the data as directed by the State. Permitted uses of HIE data include only those allowable under HIPAA and applicable law, including patient treatment, payment, health care operations, as well as public health activities, registries and reporting. As an example, a clinical event notification will allow a full participant who shares a patient with another health care organization to know where that patient has touched the system as this supports care coordination.

I am concerned about my patients’ protected health information. How can I be sure that it will remain private and secure?

The NC HIEA takes patient health data privacy and security very seriously. In accordance with HIPAA regulations and state law, the NC HIEA has entered and will enter Business Associate Agreements with all organizations that will receive personal health information (PHI) from NC HealthConnex. The State also has the authority to audit the activity of organizations that receive PHI from NC HealthConnex. The NC HIEA follows the highest information security standards available. Information is always encrypted at rest and in transit. Additionally, the environment is SOC 2 compliant.

What are the benefits of joining NC HealthConnex?

NC HealthConnex exists to improve health care quality, enhance patient safety, improve health outcomes and reduce overall health care costs by enabling health information to be readily available to health care providers and clinical staff across the state. It empowers providers with nearly real-time clinical information that links to colleagues across North Carolina and travels seamlessly and securely to their practices, ultimately helping to reduce medical errors and duplicate procedures.

What are the value-added features of full participation in NC HealthConnex?

The full list of value-added features is as follows:

• Exchange Services
• Messaging Services
• Registry Services
• Notification Services
• Data Quality
• Work Groups

What types of information can health care providers expect to receive on the patients they serve?

Participants will receive patient information from other provider organizations with whom they share a relationship. This information will include laboratory results, diagnostic studies and clinical documents. Current data elements available in NC HealthConnex include:

• Allergies
• Encounters
• Immunizations
• Medications
• Problems
• Procedures
• Results

Which EMR systems support connection to NC HealthConnex?

List of EHR vendors that are currenly live with NC HealthConnex.

This list is not exhaustive. NC HealthConnex is continuing to grow and work with new vendors. To ensure that vendors can meet NC HealthConnex standards, review the Technology Specifications. You may also visit the How to Connect page for a list of vendors with whom the HIEA is currently working or has experience building integrations.

What if the vendor does not have the technical capability to connect to NC HealthConnex?

The NC HIEA offers a variety of connection options to NC HealthConnex. However, there are some instances in which a electronic health record vendor does not have the technical capability to connect to NC HealthConnex. In those instances, you will receive correspondence from the NC HIEA notifying you that your electronic health record vendor is not technically capable of connecting to NC HealthConnex.

If your organization has received this correspondence and is moving forward with procuring an electronic health record that is capble of connecting and has an executed participation agreement on file, your organization will automatically receive an extension.

Please note: Participants must remain responsive with the NC HealthConnex technical team and continue to move forward in the connection process. The extension is not a waiver, but simply an extended period of time to finish the connection build.

• All health care providers must connect to NC HealthConnex by June 1, 2020, as required by law, so no extension deadlines will be set beyond June 1, 2020.

This extension process is not a request for a waiver/exemption from the state’s requirements, but an extension of time to meet the state’s requirements. It simply allows more time for the technical onboarding to occur to be in compliance with the HIE Act.  The extension process was created for organizations who have made a “good faith” effort to meet their NC HealthConnex statutory deadline, but have encountered limitations beyond their control (i.e. technology, etc.) prohibiting them from meeting their identified deadline. If you are interested in learning more about this process, click here.

How do participating providers gain access to the clinical portal to view patient records?

The NC HIEA takes its role as steward of patient data very seriously and gives credentials to the participant’s assigned Participant Account Administrator. The Participant Account Administrator grants the health care provider access based on his or her specific role within the health care organization. NC HealthConnex is configured with various clinical views that end users can access. Not all views need to be accessed by all users, and access can be based on sensitivity of information or relevance to the user. User groups and roles are used to control this access.

What is the difference between a uni-directional and bi-directional connection/integration?

Organizations who have a “Full Participation” agreement may access NC HealthConnex data via either a uni-directional or a bi-directional data connection. Organizations with a uni-directional connection/integration to NC HealthConnex may access their patient’s longitudinal patient record via the NC HealthConnex clinical portal. Organizations connected bi-directionally may access NC HealthConnex data via their organizational electronic health record.

*NOTE: Bi-directional data connections to NC HealthConnex are dependent upon your electronic health record’s technical capability. Please work with your electronic health record vendor to determine if this is an option for your organization.

Are there restrictions on submitting substance abuse data to NC HealthConnex?

Alcohol or substance abuse programs that receive any type of federal assistance as outlined in 42 C.F.R.2.12 cannot generally disclose data through an HIE in the following conditions:

1. If the data would identify a patient as an alcohol or substance abuser, and
2. If that data was obtained by an alcohol or substance abuse program for treating, diagnosing or making a referral for the patient’s alcohol or substance abuse problem.

However, providers may disclose that information in the event of an emergency if the requesting physician needs the information to treat the emergency condition pursuant to 42 C.F.R. 2.51, or if the patient has authorized the specific disclosure in writing in compliance with 42 C.F.R. 2.31. Please review 42 C.F.R. Part 2 before disclosing any alcohol or substance abuse information through NC HealthConnex.

Can I share data related to a patient’s behavioral health through NC HealthConnex?

Yes. Most behavioral health information is permitted to be shared through NC HealthConnex. Although participants cannot submit Part 2 data or psychotherapy notes to the NC HealthConnex data repository, participants are permitted to share these types of information via direct secure messaging with other participants through NC HealthConnex. The provider sending the message must comply with applicable law and obtain the required consent or authorization from the patient before disclosing the data.

The HIPAA Privacy Rule defines “psychotherapy notes” as follows:

Psychotherapy notes means notes recorded (in any medium) by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint or family counseling session and that are separated from the rest of the individual’s medical record. Psychotherapy notes exclude medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests and any summary of the following items: Diagnosis, functional status, the treatment plan, symptoms, prognosis and progress to date.

How do patients opt out of NC HealthConnex?

Once a health care provider signs a Participation Agreement, the NC HIEA provides a welcome packet which includes valuable patient education and opt-out materials. Providers can choose how they would like to include this information into their workflow. However, we encourage providers to include a statement about disclosures made to NC HealthConnex in their Notice of Privacy Practices. Opt-Out forms are also readily available online. Once the form is received by our office, it is processed in two business days. We recommend that participants begin patient education as soon as they sign the PA while their facility is in onboarding for the technical connection. The NC HIEA also includes information for patients on its website at
https://hiea.nc.gov/patients.

What is the cost of subscribing to NC HealthConnex?

Currently, there is no fee to connect. The NC HIEA is funded by North Carolina, with a goal to be receipts-supported in the future. The NC HIEA, in consultation with the Advisory Board, decided in December 2016 to not charge a fee for the submission of data to meet N.C.G.S. 90-414.4. The North Carolina General Assembly believes in the value of a robust state-operated HIE, and has committed $9 million annually to this endeavor. The NC HIEA’s focus for the next 12-18 months is on building connections and helping providers meet the mandate. As we develop a roadmap for future sustainability, fees related to the consumption of value-added features will be vetted thoroughly with all stakeholders and recommended to the General Assembly before any final decisions are made.

While there are currently no fees charged by the State for the connection to or use of NC HealthConnex, some EHR vendors may charge fees (technical build, maintenance, etc.) to their customers for this connection.

Are there fees to obtain a Direct Secure Message (DSM) account?

There are no fees to obtain a DSM account. DSM is a secure, scalable and standards-based method for the exchange of protected health information (PHI). However, medical providers will need to sign a Participation Agreement to receive credentials.

DSM credentials are part of the package of HIE services that includes a technical connection to submit data. For more information access the Direct Secure Messaging Fact Sheet.

Will I need to join NC HealthConnex if my organization is already participating in the NC HIE run by CCNC?

The NC HIE that was taken over by North Carolina in March 2016 is now being called NC HealthConnex.

If you signed a participation agreement with the state-operated NC Health Information Exchange Authority that was executed on or after March 1, 2016, you are automatically a participant in NC HealthConnex.

Any contracts signed with the former HIE organization managed by CCNC were terminated on February 29, 2016. To connect your organization to NC HealthConnex, new contracts between your organization and the NC HIEA must be executed.

What happens to health care providers that do not connect?

Health care providers must demonstrate connectivity to NC HealthConnex by certain dates in 2018 and 2019 in order to continue to receive State funds in payment for health care services. Additionally, the General Assembly has authorized the NC HIEA, in consultation with DHHS, to develop an extension process that ends June 1, 2020.

What is the extension process?

Participants who are in the queue to connect and are moving forward in the technical process, will automatically receive an extension and remain in compliance.

• New participants who are mandated to connect by June 1, 2019, will automatically receive an extension if they are still in the queue to connect on their deadline.

Please note: Participants must remain responsive with the NC HealthConnex technical team and continue to move forward in the connection process. The extension is not a waiver, but simply an extended period of time to finish the connection build.

• All health care providers must connect to NC HealthConnex by June 1, 2020, as required by law, so no extension deadlines will be set beyond June 1, 2020.

• This process is not a request for a waiver/exemption from the state’s requirements, but an extension of time to meet the state’s requirements. It simply allows more time for the technical onboarding to occur to be in compliance with the HIE Act.

Are health care providers that do not have an EHR exempt from the law?

No. Providers who have not yet acquired an electronical health/medical record (EHR/EMR) for their practice have been given until June 1, 2019, to procure, implement, and onboard to NC HealthConnex. This process can take between 12-18 months.

Are health care providers that do not collect clinical patient information exempt from the law?

No. However, the NC General Assembly directed the NC HIEA, in partnership with DHHS and the State Health Plan, to conduct a feasibility study to understand the type of providers impacted by the HIE Act, the data collected and how it could be used in the HIE for patient care, as well as alternative methods of connection and data transport. The results of the study are linked here.

Is more information available?

For more information, visit https://hiea.nc.gov, call the NC HIEA business office at (919) 754-6912, or email to hiea@nc.gov.