To plan a statewide health information exchange (HIE), the Maryland Health Care Commission (MHCC) engaged stakeholders and published policy reports (see Health IT Policy Reports). The HIE aims to support high-quality, safe, and effective care through secure data exchange, transparency, stakeholder inclusion, regional and national connectivity, financial sustainability, and health care transformation in Maryland.
Following a nine-month planning period, the MHCC selected the non-profit Chesapeake Regional Information System for our Patients (CRISP) to build the statewide HIE in 2009. CRISP, a multi-stakeholder group including Johns Hopkins Medicine, MedStar Health, University of Maryland Medical System, Erickson Retirement Communities, and over two dozen other stakeholders, was chosen through a competitive process. Initial funding of $10 million was awarded in August 2009 by the Health Services Cost Review Commission.
Maryland House Bill 784, the Medical Records - Health Information Exchanges law, was enacted on May 19, 2011. This legislation mandates that the MHCC regulate the privacy and security of protected health information (PHI) exchanged through all state HIEs. To address these issues, the MHCC established an HIE Policy Board in 2009. This advisory group's goals are to maximize HIE benefits for consumers and providers, mitigate privacy and security risks, promote consumer control over health information use and access (where technically possible), support existing law, minimize healthcare system costs, and facilitate public health and research uses. Policy Board members were chosen for their expertise, stakeholder representation, and consumer advocacy experience. The Board advises the MHCC on privacy and security policies for PHI exchanged through state HIEs.
The responsibilities of this Policy Board include, although they are not limited to, the development and recommendation of policies for privacy and security of PHI exchanged through an HIE operating in Maryland. The MHCC will consider the recommendations of the Policy Board and adopt regulations for HIEs to implement. In particular, the Policy Board will establish policies regarding consumer authorization and consent, user authentication, role-based authorization, security requirements, and audit trail requirements. The Policy Board will develop policies that ensure a high level of privacy and security protections for HIEs in Maryland.
For more information or questions about the Policy Board, please contact
Anna Gribble, Assistant Chief for Health Information Technology
Center for Health Information Technology and Innovative Care Delivery
Phone: 410.764.3379
Fax: 410.358.1236
Email: anna.gribble1@maryland.gov