HomeMy WebLinkAbout2019-303-E Emergency Svc - NCHIEA participation agreementNorth Carolina Health Information Exchange Authority
FULL NC HIEA PARTICIPATION AGREEMENT INSTRUCTIONS
Please read these instructions carefully. Missing or inaccurate information will delay processing of your agreement.
1. Read and review the entire NC HIEA Participation Agreement with your legal department, Contract
Administrator, or other authorized staff member.If you have already signed a previous participation
agreement with NC HIEA, signing and executing this document will replace and supersede any
previous participation agreements.
2. On page 2, include the legal entity name of the provider or facility. If you “Do business as” another identity,
please include that information. The address listed should be the appropriate USPS mailing address.
3. Please have an authorized signatory sign page 28 under “Participant”and page 38 under “Covered Entity.”
Wet ink or digital signatures will be accepted, but text signatures will not. By signing these pages, you are
agreeing to the terms of the Participation Agreement and to the Business Associate Agreement in
Attachment 5. The agreement cannot be executed by NC HIEA without signatures on these pages.
4. In Attachment 1 on page 29, please provide your contact information for your organization where you will
receive formal Notices from NC HIEA.
5. In Attachment 2 on page 30, please provide the name and contact information for your: Participant Account
Administrator, Contract Administrator, and Technical Services Contact (CIO or other Technical Support
contact) where indicated. If one person fulfills multiple roles, please indicate this.
6. In Attachment 3 on page 31, please provide information about your practice, your EMR or EHR vendor,
what health system or HIE your organization is a member of, and the remaining requested information.
Please also review the Technical Specifications, Targeted Data Standards, and On-Boarding Process that you
are required to comply with.
7. In Attachment 4 on page34,please identify your Participating Entitiesand locations,if applicable. Please
see Section 2.37 for the definition of a Participating Entity. If you have more than 10 entities or locations,
please attach an spreadsheet with all the requested information for the entities. Incomplete information in this
section will delay the processing of your agreement.
8. In Attachment 5 starting on page 36, please review the Business Associate Agreement.Please include the
legal entity name of the provider or facility next to “name of Participant,” and sign on page 38 under
“Covered Entity.”
9. In Attachment 11, please review the information and sign the document to demonstrate your intent to submit
data to and be actively engaged with the NC HealthConnex Diabetes Registry.
10. Please return the entire 51-page signed Participation Agreement to the North Carolina Health Information
Exchange Authority via email to HIEA@NC.gov. Or you can mail it to the address below.
NC Health Information Exchange Authority Legal Team
Mail Service Center 4101
Raleigh, NC 27699-4101
The North Carolina Health Information Exchange Authority will confirm receipt of the fully executed
Participation Agreement by email to one or more of the individuals identified in Attachment 2 on page 30. This
email will include important contact information for technical assistance and the next steps in the connection
process.
DocuSign Envelope ID: 47B4445A-C7CA-4D2E-9075-2AFD82F82DEC
1
NC HIEA
Full Participation Agreement
for NC HealthConnex Access and Data
Use
Version Date: March 7, 2018
DocuSign Envelope ID: 47B4445A-C7CA-4D2E-9075-2AFD82F82DEC
2
North Carolina Health Information Exchange Authority
Full Participation Agreement for NC HealthConnex Access and Data Use
The NC HIEA Full Participation Agreement for NC HealthConnex Access and Data Use (“Participation
Agreement” or “Agreement”) is made and entered into by and between the North Carolina Health Information
Exchange Authority (“NC HIEA”),anagencyoftheStateofNorthCarolinaDQG
_____________________________________________________(Participant) by the Effective Date
defined herein. (NC HIEA and Participant may be referred to individually as “Party” and collectively as
“Parties.”).
WITNESSETH:
WHEREAS, NC HIEA was created and enabled by the NC General Assembly by S.L. 2015-241
to assume operations of the previously authorized State health information exchange and associated network as
the successor to the NC HIE, and
WHEREAS, NC HIEA was created and enabled by the NC General Assembly by S.L. 2015-241
for purposes enumerated therein which the Parties acknowledge as public purposes of the State,
WHEREAS, NC HIEA is engaged in the oversight, administration and operation of a statewide
electronic health information exchange network (“NC HealthConnex”), and in connection therewith makes
available certain HIE Features (as defined herein) for use by Participants of NC HealthConnex. The
Participants enter into this Agreement to enable their participation in health information exchange activities, as
set forth below;
WHEREAS, Participants in NC HealthConnex may voluntarily submit or receive data through
NC HealthConnex; and a Participant may be both a data Submitter and a data Recipient, and the Participants
desire to electronically Transact, on their own behalf or on behalf of their Authorized Users or Participating
Entities, health information among Participants;
WHEREAS, notwithstanding the voluntary nature of NC HealthConnex under N.C.G.S. §90-414.2 and
as a condition of receiving State funds, Health Care Providers are required by law to connect to NC
HealthConnex and submit, through NC HealthConnex, demographic and clinical information pertaining to
health care services rendered to Medicaid, State Health Plan for Teachers and State Employees, and other
State-funded health care program beneficiaries and paid for with State-funded health care funds;
WHEREAS, the Participants are organizations that oversee and conduct, on their own behalf and
on behalf of their Participating Entities and Authorized Users, electronic transactions or exchanges of
health information among groups of persons or organizations; have the technical ability to electronically
transact health information on their own behalf or on behalf of their Participating Entities and Authorized
Users; have the organizational infrastructure and legal authority to comply with the obligations in this
Agreement and to require their Participating Entities and Authorized Users to comply with applicable
requirements in this Agreement;
WHEREAS, the relationship between the Participant and the individuals whose records are
available within or through their respective Systems varies from Participant to Participant and, in some cases,
there is no direct relationship;
WHEREAS, as a condition of Transacting information with other Participants, each Participant must
enter into this Participation Agreement, and has agreed to do so by executing this Agreement;
NOW, THEREFORE, for and in consideration of the mutual covenants herein contained, the
Participants hereto mutually agree as follows:
Orange County, North Carolina by and through its "Emergency Services Department"
DocuSign Envelope ID: 47B4445A-C7CA-4D2E-9075-2AFD82F82DEC
3
1.Cooperation.The Parties understand and acknowledge that numerous activities with respect to this
Agreement shall likely involve each Party’s employees, agents, and third party contractors, vendors, or
consultants. In seeking another Party’s cooperation, each Party shall make all reasonable efforts to
accommodate the other Party’s schedules and reasonable operational concerns. A Party shall promptly report,
in writing, to the other Party, any problems or issues that arise in working with the other Party’s employees,
agents, or subcontractors that threaten to delay or otherwise adversely impact a Party’s ability to fulfill its
responsibilities under this Agreement. In no case shall a Party be required to disclose PHI in violation of
Applicable Law. This writing shall set forth in detail and with clarity the problems that the Party has
identified. To the extent not legally prohibited, each Party shall:
1.01. cooperate fully with the other Party and any such third parties with respect to such activities as they
relate to this Agreement;
1.02. provide such information to the other Party or such third parties as they may reasonably request for
purposes of performing activities related to this Agreement;
1.03. devote such time as may reasonably be requested by the other Party to review information, meet with,
respond to, and advise the other Party with respect to activities as they relate to this Agreement;
1.04. provide such reasonable assistance as may be requested by the other Party when performing activities
as they relate to this Agreement; and
1.05.subject to a Party’s right to restrict or condition its cooperation or disclosure of information in the
interest of preserving privileges in any foreseeable dispute or litigation or protecting a Party’s
Confidential Participant Information, provide information and assistance to NC HIEA or other
Parties in the investigation of HIPAA BreachHV, Security Breaches, or Disputes.
2.Definitions.For the purposes of this Agreement, the following terms shall have the meaning ascribed to them
below. All defined terms are capitalized throughout this Agreement. Certain terms are defined by, or defined
by reference, N.C.G.S. §90-414.3 and shall have the meaning and intent herein as set forth therein. Such
terms include: business associate, business associate contract, covered entity, department, disclose or
disclosure, emergency medical condition, HIPAA, individual, NC Health Information Exchange Advisory
Board, NC Health Information Exchange Authority, opt out, protected health information, public health
purposes, research purposes and State CIO.
2.01.Applicable Law shall mean all applicable statutes and regulations of North Carolina and of the
state(s) or jurisdiction(s) in which the Participant operates, as well as all applicable United States
federal statutes, regulations, standards and policy requirements.
2.02.Approved Third Parties shall mean Business Associates, Covered Entities, agencies of the State of
North Carolina, and other entities that have entered into HIPAA compliant data sharing agreements
with NC HIEA to further the purposes outlined in N.C.G.S. 90-414.2 et. seq. and other Applicable
Law.
2.03.Authorization shall have the meaning and include the requirements set forth at 45 C.F.R. § 164.508
of the HIPAA Regulations and include any similar but additional requirements under Applicable Law.
2.04.Authorized User shall mean any person who has been authorized to Transact Message Content
through the respective Participant’s System in a manner defined by the respective Participant.
“Authorized Users” may include, but are not limited to, Health Care Providers; Health Plans; and
employees, contractors, or agents of a Participant. An Authorized User may act as either a Submitter,
Recipient or both when Transacting Message Content.
2.05.Clinical Portal shall mean the NC HealthConnex portal system made available to Participant,
Participating Entities, and Authorized Users to use for Permitted Purposes.
DocuSign Envelope ID: 47B4445A-C7CA-4D2E-9075-2AFD82F82DEC
4
2.06.Confidential Participant Information, for the purposes of this Agreement, shall mean proprietary
or confidential materials or information of a Participant in any medium or format that Participant
labels as such upon disclosure. Message Content and HIE Data is excluded from the definition of
Confidential Participant Information because other provisions of this Agreement and the DURSA
address the appropriate protections for Message Content and HIE Data. Notwithstanding any label
to the contrary, Confidential Participant Information does not include Message Content; any
information which is or becomes known publicly through no fault of a Receiving Party; is learned of
by a Receiving Party from a third party entitled to disclose it; is already known to a Receiving Party
before receipt from a Participant as documented by Receiving Party’s written records; or, is
independently developed by Receiving Party without reference to, reliance on, or use of, Participant’s
Confidential Participant Information. Confidential Participant Information includes the following
types of information which are not subject to disclosure pursuant to the N.C. Public Records Act when
in the possession or custody of the NC HIEA, but is not limited to:
a.a Party’s designs, drawings, procedures, trade secrets as defined in N.C.G.S. §66-152 et seq.,
processes, specifications, source code, System architecture, security measures, research and
development, including, but not limited to, research protocols and findings, passwords and
identifiers, new products, and marketing plans;
b. proprietary financial and business information of a Party; and
c. information or reports provided by a Party to a Receiving Party in the performance of this
Agreement.
For purposes of this Section 2.06and 16, Submitter’s information shall include third party information
deemed proprietary, or non-public, by Submitter or such third party.
2.07.Data Use and Reciprocal Support Agreement or DURSA shall mean the first restatement of the
multiparty legal agreement that established a trust framework between the participants of the
nationwide eHealth Exchange that was updated on September 30, 2014. NC HIEA will or has become
a participant of the eHealth Exchange
2.08.Digital Credentials shall mean a mechanism that enables Participants to electronically prove their
identity in order to connect to NC HealthConnex, to submit HIE Data to NC HIEA, and to Transact
Message Content with other Participants.
2.09.Direct Secure Messaging shall mean the encrypted messaging service provided to Participants by
the NC HIEA, a certified Health Information Service Provider, that allows Participants to
communicate securely with other NC HealthConnex Participants or with other certified Direct Secure
Message recipients.
2.10.DirectTrust means the collaborative non-profit association of health information technology and
health care provider organizations to support secure, interoperable health information exchange via
Direct Secure Message protocols.
2.11.Dispute shall mean any controversy, dispute, or disagreement arising out of or relating to this
Agreement.
2.12.Effective Date shall mean the date on which the last of the following events occurs (i): the full
execution of this Agreement by both the Parties, and (ii) the full execution of the Business Associate
Agreement by the parties attached hereto as Attachment 5.
2.13.eHealth Exchange shall mean the nationwide health information network that allows participants to
exchange data using an agreed upon set of national standards, services and policies developed by the
DocuSign Envelope ID: 47B4445A-C7CA-4D2E-9075-2AFD82F82DEC
5
Sequoia Project in coordination with the Office of National Coordinator within the U.S. Department
of Health and Human Services.
2.14.EHR Product shall mean the electronic software system, products or services related to electronic
health record and medical practice management solutions used by Participants.
2.15.Go Live Date shall mean the date of completion of the Onboarding process.
2.16.Health Care Operations shall have the meaning set forth at 45 C.F.R. §164.501 of the HIPAA
Regulations.
2.17.Health Care Provider shall have the meaning set forth at 45 C.F.R. §160.103 of the HIPAA
Regulations.
2.18.Health Information Service Provider or HISP shall mean a company or other organization that will
support one or more Participants by providing them with operational, technical, or health information
exchange services.
2.19.Health Plan shall have the meaning set forth at 45 C.F.R. §160.103 of the HIPAA Regulations.
2.20.HIE Data shall mean the clinical and demographic data submitted to, exchanged, and stored by NC
HIEA as required by N.C.G.S. §90-414.4 together with such other PHI or individually identifiable
information as may be necessary or proper to achieve the purposes of the NC HIEA in N.C.S.L. 2015-
241, N.C.S.L. 2015-264, and other Applicable Law.
2.21.HIE Features shall mean a set of technical features that Participants have the option of accessing or
using for Permitted Purposes, and for such other purposes as permitted by Applicable Law. Current
HIE Features are identified in Attachment 7 and are available on the NC HIEA website.
2.22.HIE Operations shall mean the obligations of NC HIEA pursuant to S.L. 2015-241 and as provided
for in Section 10. HIE Operations include the following:
DFacilitating exchanges and Transactions of HIE Data and Message Content with eligible
Participants and Approved Third Parties for Permitted Purposes.
EProcessing or otherwise implementLQJ Opt Out requests.
FPerforming patient identity or patient records maintenance.
GConducting or assisting in the performance of audits permitted or required by the NC HIEA
Policies and Procedures, including the performance of audits of emergency access.
HEvaluating the performance of or develop recommendations for improving the operation of NC
HealthConnex.
IConducting technical system support and maintenance of NC HealthConnex.
JEngaging in any other activities as may be required to facilitate the operation of NC
HealthConnex that are authorized by NC HIEA and are consistent with this Agreement and
Applicable Law.
2.23.HIPAA Breach shall mean the unauthorized acquisition, access, disclosure, or use of HIE Data,
Message Content while Transacting such Message Content, or Protected Health Information while
utilizing the NC HealthConnex Resources pursuant to this Agreement. The term ‘‘HIPAA Breach’’
does not include the following:
a. any unintentional acquisition, access, disclosure, or use of HIE Data, PHI, or Message Content
by an employee or individual acting under the authority of a Participant or Authorized User if:
DocuSign Envelope ID: 47B4445A-C7CA-4D2E-9075-2AFD82F82DEC
6
1. such acquisition, access, disclosure, or use was made in good faith and within the course and
scope of the employment or other professional relationship of such employee or individual,
respectively, with the Participant or Authorized User; and
2. such information is not further acquired, accessed, disclosed or used by such employee or
individual; or
3. any acquisition, access, disclosure or use of information contained in or available through the
Participant’s System where such acquisition, access, disclosure or use was not directly related
to Transacting Message Content.
b. Unauthorized disclosure of Participant Confidential Information.
2.24.Individual shall have the meaning set forth at 45 C.F.R. §160.103 of the HIPAA Regulations.
2.25.Meaningful Use of Certified Electronic Health Record Technology or Meaningful Use shall have
the meaning assigned to it in the regulations promulgated by the U.S. Department of Health and
Human Services under 42 USC §§1395w-4, -1395ww (the American Recovery and Reinvestment
Act, Sections 4101 and 4102).
2.26.Medicaid shall mean the health insurance program for certain low-income and/or disabled individuals
that is administered by the North Carolina Department of Health and Human Services.
2.27.Message shall mean an electronic transmission of Message Content Transacted between Participants
and the State of North Carolina using NC HealthConnex. Messages are intended to include all types
of electronic transactions as necessary or desired for the Permitted Purposes, including the data or
records transmitted with those transactions.
2.28.Message Content shall mean that information contained within a Message or accompanying a
Message. This information includes, but is not limited to, Protected Health Information (PHI), de-
identified data (as defined in the HIPAA Regulations at 45 C.F.R. § 164.514), individually identifiable
information, pseudonymized data, metadata, Digital Credentials, and schema associated actually or
logically with PHI. Message Content does not include HIE Data submitted by Participant to NC
HIEA as required by N.C.G.S. 90-414.4(b).
2.29.NC HealthConnex Resources shall mean software, utilities and automated tools, if any, made
available for use by NC HIEA or a third party in connection with the Transaction of Message Content.
This includes access to NC HealthConnex via the Clinical Portal, interfaces between Participant’s
EHR Product and NC HealthConnex, the HIE Features, and any other NC HealthConnex Resources
identified by NC HIEA.
2.30.NC HIEA Policies and Procedures shall mean the policies and procedures, including the Privacy
and Security Policies and User Access Policies, adopted by NC HIEA that describe (i) management,
operation and maintenance of NC HealthConnex; (ii) qualifications, requirements and activities of
Participants and Authorized Users when accessing the NC HealthConnex Resources or Transacting
Message Content with other Participants; and (iii) support of the Participants who wish to Transact
Message Content with other Participants. The NC HIEA Policies and Procedures are amended from
time to time in accordance with Section 9.03, and are available on the NC HIEA website.
2.31.Notice or Notification shall mean a written communication, unless otherwise specified in this
Agreement, sent to the appropriate Participant’s representative at the address listed in Attachment 1
or NC HIEA in accordance with Section 22.
2.32.Office of the National Coordinator or ONC shall mean the Office of the National Coordinator for
Health Information Technology within the U.S. Department of Health and Human Services.
DocuSign Envelope ID: 47B4445A-C7CA-4D2E-9075-2AFD82F82DEC
7
2.33.Onboarding shall mean the process of establishing and implementing the required credentials for
Participants to access NC HealthConnex Resources, and building an active connection between
Participant and NC HealthConnex through secure electronic data submission that allows Participant
to submit HIE Data to the NC HIEA pursuant to N.C.G.S. §90-414.4(b).
2.34.Onboarding and Technical Specifications shall mean the Onboarding and technical process and
specifications for connecting to NC HealthConnex, for submitting HIE Data to NC HealthConnex as
required by Applicable Law, as well as any implementation guidance and other technical materials
and resources approved by NC HIEA.
2.35.Participant shall mean any organization that (i) meets the requirements for participation as contained
in N.C.G.S. 90-414.7 et seq.;(ii) is provided with Digital Credentials; and (iii) is a signatory to this
Agreement. Participants may act as a Submitter, Recipient or both when Transacting Message
Content.
2.36.Participant Account Administrator means the staff member(s) employed by Participant or
Participating Entities who will be authorized to assign user credentials to Authorized Users within the
Participant’s or Participating Entity’s Workforce. The Participant Account Administrator will also
be the main contact person who will receive communication from NC HIEA and who will coordinate
the collaboration between NC HIEA’s technology vendor and the Participant’s technical services
staff.
2.37.Participating Entities shall include (i) entities that a Participant has control over, (ii) entities that
are under common control with Participant, and/or (iii) entities that share information systems with
Participant, and for whom Participant will submit or cause to submit HIE Data under this Agreement.
Participating Entities may elect to submit HIE Data or Transact Messages through NC HealthConnex
under a single Participant or as multiple separate Participants. A Participating Entity of a Participant
may also be a natural person or business entity with whom the Participant has a direct or indirect
business or employment relationship, including any person or entity provided a license or right to
access and use any of a Participant’s EHR Product, software and/or services. However, if Participant
does not intend to sign this Agreement on behalf of such natural persons or business entities, those
persons or entities should sign a separate Agreement.
2.38.Payment shall have the meaning set forth at 45 C.F.R. §164.501 of the HIPAA Regulations.
2.39.Permitted Purposes
a. As to Participants, Permitted Purposes shall mean one of the following reasons for which
Participants may legitimately exchange HIE Data, Transact Message Content, or otherwise use,
access, or disclose HIE Data:
1. Treatment of the Individual;
2. Payment activities, provided that the Participant has an established Treatment relationship
with the Individual and that the use or Disclosure otherwise complies with the requirements
of HIPAA and is otherwise permitted by Applicable Law;
3. Health Care Operations of the Participant;
4. Public health activities and reporting as permitted by Applicable Law, including N.C.G.S.
§90-414.5, Chapter 130A and the HIPAA Regulations at 45 C.F.R. § 164.512(b) or
164.514(e);
5. Any purpose to demonstrate Meaningful Use of Certified Electronic Health Record
Technology by the (i) Submitter, (ii) Recipient or (iii) Covered Entity on whose behalf the
Submitter or the Recipient may properly Transact Message Content under this Agreement,
DocuSign Envelope ID: 47B4445A-C7CA-4D2E-9075-2AFD82F82DEC
8
provided that the purpose is not otherwise described in subsections (a)(1) through (4) of this
definition and the purpose is permitted by Applicable Law, including but not limited to the
HIPAA regulations;
6. Research purposes as permitted by Applicable Law and the NC HIEA Policies (please note
that is not a Permitted Purpose for Transacting Message Content through the eHealth
Exchange);
7. To carry out Benefits Determinations; and
8. Uses and disclosures pursuant to an Authorization provided by the individual who is the
subject of the Message or such individual’s personal representative as described in 45 C.F.R.
§164.502(g) of the HIPAA Regulations.
EAs to NC HIEA, Permitted Purposes shall mean one of the following reasons for which NC
HIEA maylegitimatelyexchangeHIEData,TransactMessageContent,orotherwiseuse,access,
or disclose HIE Data:
HIE Operations;
Public health activities and reporting as permitted by Applicable Law, including N.C.G.S.
§90-414.1 et seq., Chapter 130A and the HIPAA Regulations at 45 C.F.R. § 164.512(b) or
164.514(e);
Health Care Operations;
Benefits Determinations for Individuals who apply for or do receive services from State
funded programs;
Activities to support data aggregation and analytics as set forth in 45 § C.F.R. 164.504(e),
1C.S.L. 2015-264 Section 86.5.(a), and other Applicable Law;
Research purposes as permitted by Applicable Law and the NC HIEA Policies and
Procedures;
Activities required by Applicable Law; and
Support of the Permitted Purposes of Participants and Approved Third Parties.
FAs to Approved Third Parties, Permitted Purposes shall mean one of the following reasons for
which Approved Third Parties may legitimately exchange HIE Data, Transact Message Content,
or otherwise use, access, or disclose HIE Data:
If Transacted through the eHealth Exchange or another nationwide or regional network, for
all Permitted Purposes listed in subsection (a) of this Section with the exception of any
purpose excluded by the relevant nationwide or regional network governance body or
agreement (e.g., See Attachment 9);
Public health activities and reporting as permitted by Applicable Law, including N.C.G.S.
§90-414.5, Chapter 130A and the HIPAA Regulations at 45 C.F.R. § 164.512(b) or
164.514(e);
Research purposes as permitted by Applicable Law and the NC HIEA Policies and
Procedures; and
Activities SHUPLWWHGRUrequired by Applicable LawLQFOXGLQJ1&*6 D DQG
GPursuant to N.C.G.S. § 90-414.6, no entitymayuse, disclose, oraccess HIE Data for commercial
purposes.
DocuSign Envelope ID: 47B4445A-C7CA-4D2E-9075-2AFD82F82DEC
9
2.41.Primary Provider User Guide shall mean the user guide published by NC HIEA that provides
education and guidance to Participants, Participating Entities, and Authorized Users on the operation
of NC HealthConnex and the NC HealthConnex Clinical Portal.
2.42.Privacy and Security Policies shall mean the HIPAA compliant policies and procedures developed
and adopted by each Party that govern the privacy and security of access to NC HealthConnex and
the NC HealthConnex Resources.
2.43.Receiving Party shall mean a Party or Participant that receives Confidential Participant Information
in any capacity from a Recipient.
2.44.Recipient shall mean the Participant(s) or Authorized User(s) that receives Message Content through
a Message from a Submitter for a Permitted Purpose. For purposes of illustration only, Recipients
include, but are not limited to, Participants, Participating Entities, or Authorized Users who receive
queries, responses, subscriptions, publications or unsolicited Messages.
2.45.Security Breach shall have the meaning set forth at N.C.G.S. §75-61; i.e. An incident of unauthorized
access to and acquisition of unencrypted and unredacted records or data containing personal
information where illegal use of the personal information has occurred or is reasonably likely to occur
or that creates a material risk of harm to a consumer. Any incident of unauthorized access to and
acquisition of encrypted records or data containing personal information along with the confidential
process or key shall constitute a Security Breach. Good faith acquisition of personal information by
an employee or agent of the business for a legitimate purpose is not a Security Breach, provided that
the personal information is not used for a purpose other than a lawful purpose of the business and is
not subject to further unauthorized disclosure. For the purposes of this Agreement, only Security
Breaches that involve personal information accessed, used, or disclosed through the NC
HealthConnex System will require compliance with the relevant provisions in this Agreement, in
addition to Applicable Law.
2.46.State shall mean the State of North Carolina.
2.47.State Health Plan for Teachers and State Employees or State Health Plan shall mean the health
insurance plan provided for employees of the State of North Carolina.
2.48.Submitter shall mean the Participant(s) or Authorized User(s) who submits Message Content through
a Message to a Recipient for a Permitted Purpose. For purposes of illustration only, Submitters
include, but are not limited to, Participants or Authorized Users who push Messages with Message
Content, send Messages seeking Message Content, send Messages in response to a request, send
subscription Messages, or publish Messages with Message Content in response to subscription
Messages.
2.49.System shall mean software, portal, platform, or other electronic medium controlled by a Participant
through which the Participant conducts its health information exchange related activities. For
purposes of this definition, it shall not matter whether the Participant controls the software, portal,
platform, or medium through ownership, lease, license, or otherwise.
2.50.Targeted Data Standards shall mean standards adopted by the NC HIEA that list the required
clinical and demographic data elements, fields, and data feeds that must be submitted to NC HIEA
through NC HealthConnex in order to comply with N.C.G.S. 90-414.4(b) as set forth on Attachment
3. To the extent possible, Participants must submit the Meaningful Use Data Elements within the
Clinical Summary MU2 Summary Type delivered via CCD within the CCDA, an ADT feed, and an
ITI-41 feed as provided in Attachment 3.
DocuSign Envelope ID: 47B4445A-C7CA-4D2E-9075-2AFD82F82DEC
10
2.51.Testing or Test shall mean the tests and demonstrations of a Participant’s System and processes used
for interoperable health information exchange, to assess conformity with the Onboarding plan.
2.52.Transact shall mean to send, submit, request, receive, assert, respond to, submit, route, subscribe to,
or publish Message Content using NC HealthConnex. Transacting Message Content does not refer
to the submission of HIE Data to NC HealthConnex as required by Applicable Law.
2.53.Treatment shall have the meaning set forth at 45 C.F.R. §164.501 of the HIPAA Regulations; i.e.
the provision, coordination, or management of health care and related services by one or more health
care providers, including the coordination or management of health care by a health care provider
with a third party; consultation between health care providers relating to a patient; or the referral of a
patient for health care from one health care provider to another.
2.54.User Access Policies shall mean the policies and procedures adopted by each Party that addresses the
access, use and disclosure of HIE Data, Message Content, and the use and access of NC HealthConnex
Resources of NC HealthConnex.
2.55.Workforce shall have the meaning set forth at 45 C.F.R. §160.103 of the HIPAA Regulations.
3.Incorporation of Recitals. The Recitals set forth above are hereby incorporated into this Agreement in their
entirety and shall be given full force and effect as if set forth in the body of this Agreement. This Agreement
and together with all Exhibits shall be interpreted as an integrated agreement. Any ambiguity or material
conflict between any of their provisions shall be resolved with an order of precedence among such documents
as follows:
3.01. Business Associate Agreement, Attachment 5
3.02. This Agreement
3.03. NC HIEA Policies and Procedures, Attachment 6
3.04. Onboarding & Technical Specifications, Attachment 3
3.05. eHealth Exchange Terms and Conditions, Attachment 9
3.06. Fee Schedule, Attachment 8
3.07. HIE Features, Attachment 7
3.08. Addresses for Notice, Attachment 1
3.09. Participating Entities, Attachment 4
3.10.
Participant Staff Contact Information, Attachment 23.11.
Technical Support, Attachment 10
4.Purpose of this Agreement. The purpose of this Agreement is to provide a legal framework that will enable
Participants to connect to NC HealthConnex to submit HIE Data to NC HIEA as required or permitted by
N.C.G.S. 90-414.4(b) and other Applicable Law, to Transact Message Content with other Participants, and to
access and use the NC HealthConnex Resources. Such purposes are not intended to create or facilitate
disclosure or sharing of Participant Confidential Information.
5.HIE Features; Fees.
5.01.HIE Features. Subject to the terms and conditions of this Agreement, Participant, Participating
Entities, and Authorized Users (together and unless otherwise noted, “Participant”) is authorized to
use NC HealthConnex and the HIE Features identified in Attachment 7 as they are available.
Participants shall be granted access to the HIE Features after execution of the Participation Agreement
3.1.
'LDEHWHV5HJLVWU\)RUP Attachment 1
DocuSign Envelope ID: 47B4445A-C7CA-4D2E-9075-2AFD82F82DEC
11
at the appropriate time during or at the completion of the Onboarding process. The HIE Features are
subject to NC HIEA Policies and Procedures, which shall be available on the NC HIEA website.
a. NC HIEA reserves the right in its sole discretion to amend the HIE Features and shall have no
liability to Participant or its Authorized Users for or arising out of such discontinuance of HIE
Features. Participant is also entitled to receive support and maintenance as part of this Agreement
and such Technical Support is described in Attachment 10 provided that Participant is not in
default of this Agreement.
b. NC HIEA, along with any successors or assignees, shall not discontinue any offering that enables
Participant to submit HIE Data to NC HIEA for as long as it is required by Applicable Law, unless
otherwise permitted by Section 19 (Term, Suspension & Termination) of this Agreement.
5.02. Fees.
a. Pursuant to N.C.S.L. 2015-241, s. 12A.5, NC HIEA shall gradually become and remain one
hundred percent (100%) receipt-supported. In consideration of the rights and obligations of the
Parties hereunder, Participant shall pay to NC HIEA the fees set forth on the Fee Schedule
attached hereto as Attachment 8 and incorporated herein by reference, at the times and in the
manner, and subject to all other terms and conditions, as are set forth on such Fee Schedule,
without notice or demand therefor, and without deduction or offset therefrom.
b. Upon written Notice by NC HIEA to Participant at least one hundred eighty (180) days before
the end of the initial term of this Agreement or the then current renewal term, NC HIEA reserves
the right in its sole discretion to charge fees or to increase or decrease fees pursuant to this
Agreement. NC HIEA shall have no liability to Participant for or arising out of such decision to
charge, increase, or decrease in fees, provided any such change in fees shall only be effective for
an extension or renewal of the then current term.
6. NC HIEA and the NC HIEA Advisory Board
6.01. NC HIEA Authority. NC HIEA has duties to provide oversight, facilitation and support for NC
HealthConnex and Participants by conducting activities including, but not limited to, the following:
a. Performing HIE Operations;
b. Establishing and modifying the clinical and demographic data elements for services paid for with
Medicaid, State Health Plan, or other State funds within the defined Targeted Data Standards,
provided that Participants shall be given reasonable advance notice of any modification of
Targeted Data Standards, and such standards shall be consistent in all respects with the
requirements of N.C.G.S. 90-414.4, and otherwise permitted under all Applicable Laws.
c. Developing and amending the NC HIEA Policies and Procedures in accordance with Section 9
of this Agreement;
d. Receiving reports of HIPAA Breaches or Security Breaches and acting upon such reports in
accordance with Section 14 of this Agreement (Breach Notification);
e. Suspending or terminating Participants in accordance with Section 19 of this Agreement
(Suspension and Termination);
f. Resolving Disputes with and between Participants in accordance with Section 20 of this
Agreement (Dispute Resolution);
g. Managing the amendment of this Agreement in accordance with Section 24.03 of this
Agreement;
h. Evaluating requests for the introduction of technical specifications into the production
environment used by the Participants to submit HIE Data or to Transact Message Content;
DocuSign Envelope ID: 47B4445A-C7CA-4D2E-9075-2AFD82F82DEC
12
i. Coordinating to help ensure the interoperability with other health information exchange
initiatives including, but not limited to, providing input into the broader ONC specifications
activities and ONC standards and interoperability framework initiatives; and
j. Fulfilling all other responsibilities delegated by North Carolina General Assembly and the
Participants to NC HIEA as set forth in this Agreement.
k. To the extent permitted under Applicable Law, this grant of authority to NC HIEA is
unconditional and does not require any further consideration or action by any Participant.
6.02. NC HIEA Advisory Board. The NC HIEA Advisory Board is organized and operates pursuant to
N.C.G.S. §90-414.8. The NC HIEA Policies and Procedures will be amended in consultation with
the Advisory Board as required by N.C.G.S. §90-414.7. Participants may attend any public meetings
of the Advisory Board.
7. System Access.
7.01. Policies.
a. The Parties shall have User Access Policies and Privacy and Security Policies as necessary or
sufficient in the Parties’ discretion to ensure proper use of NC HealthConnex and NC
HealthConnex Resources pursuant to this Agreement.
b. Each Party acknowledges that User Access Policies may differ among Participants, and that
mutual benefits are available pursuant to this Agreement. Each Participant shall be responsible
for determining whether and how to Transact Message Content based on the application of its
business policies and Applicable Law to the information contained in the Message. Each
Participant entering into this Agreement agrees to comply with the Applicable Law, this
Agreement, and all applicable NC HIEA Policies and Procedures in submitting HIE Data and in
Transacting Message Content.
7.02. Authorized Users and HISPs. The Parties shall require that all of their Participating Entities,
Authorized Users, and HISPs Transact Message Content only in accordance with the terms and
conditions of this Agreement, including without limitation those governing the use, confidentiality,
privacy, and security of Message Content. The Parties shall discipline appropriately any of their
Participating Entities or employee Authorized Users, or take appropriate contractual action with
respect to contractor Authorized Users or HISPs, who fail to act in accordance with the terms and
conditions of this Agreement relating to the privacy and security of Message Content, in accordance
with the Parties’ employee disciplinary policies and procedures and its contractor and vendor policies
and contracts, respectively.
7.03. Identification. The Parties shall employ a process by which the Party, or its designee, validates
sufficient information to uniquely identify each person seeking to become an Authorized User prior
to issuing credentials that would grant the person access to the Party’s System or NC HealthConnex
Resources. See the NC HIEA User Access Policy and the Primary Provider User Guide for
requirements related to assigning Authorized Users credentials for NC HealthConnex.
7.04. Authentication. Each Participant shall employ a process by which the Participant, or its designee,
uses the credentials issued pursuant to this Section 7 to verify the identity of each Authorized User
prior to enabling such Authorized User to Transact Message Content using NC HealthConnex. This
process shall include the completion of an NC HIEA Onboarding process by the Participant before
the Participant Account Administrator can assign user credentials for NC HealthConnex or for Direct
Secure Messaging to users.
7.05. Participant Workforce Access. Each Participant Account Administrator shall only assign user
credentials for NC HealthConnex or for Direct Secure Messaging through NC HealthConnex for
Authorized Users who are Workforce members of Participant or its Participating Entities. In the
event of changes in the employment status of an Authorized User, the Participant Account
DocuSign Envelope ID: 47B4445A-C7CA-4D2E-9075-2AFD82F82DEC
13
Administrator or other authorized personnel shall change the access or level thereof of the Authorized
User within five (5) business days of the employment change.
8. Security.
8.01. General. The Parties shall be responsible for maintaining secure environments for their operations,
data and Transactions. The Parties shall use appropriate safeguards to prevent use or disclosure of
HIE Data or Message Content other than as permitted by this Agreement, including appropriate
administrative, physical, and technical safeguards that protect the confidentiality, integrity, and
availability of HIE Data or Message Content. Appropriate safeguards for Participants shall be those
identified in the HIPAA Security Rule, 45 C.F.R. Part 160 and Part 164, Subparts A and C, as
safeguards, standards, “required” implementation specifications, and “addressable” implementation
specifications to the extent that the “addressable” implementation specifications are reasonable and
appropriate in the Participant’s environment. If an “addressable” implementation specification is not
reasonable and appropriate in the Party’s environment, then the Party must document why it would
not be reasonable and appropriate to implement the implementation specification and implement an
equivalent alternative measure if reasonable and appropriate.
8.02. NC HealthConnex Security. NC HIEA shall adhere to the Statewide Security Manual and Policies
as required by N.C.G.S. §143B-1375 et seq., Security of Information Technology, and all Applicable
Law that governs data confidentiality, privacy, and security.
8.03. Malicious Software. The Parties shall ensure that they employ security controls that meet applicable
industry, State or Federal standards so that HIE Data and Message Content being Transacted and any
method of Transacting such information and Message Content will not introduce any viruses, worms,
unauthorized cookies, trojans, malicious software, “malware,” or other program, routine, subroutine,
or data designed to disrupt the proper operation of a System or any part thereof or any hardware or
software used by a Participant in connection therewith, or which, upon the occurrence of a certain
event, the passage of time, or the taking of or failure to take any action, will cause a System or any
part thereof or any hardware, software or data used by a Party in connection therewith, to be
improperly accessed, destroyed, damaged, or otherwise made inoperable. In the absence of
applicable industry standards, each Party shall use all commercially reasonable efforts to comply
with the requirements of this Section.
9. NC HIEA Policies and Procedures.
9.01. General Compliance. The Parties shall comply with the NC HIEA Policies and Procedures adopted
by NC HIEA in accordance with this Agreement. The NC HIEA Policies and Procedures will be
made available on the NC HIEA website and by request.
9.02. Development of the NC HIEA Policies and Procedures. The NC HIEA may amend, repeal,
replace, or adopt new Policies and Procedures at any time. Any changes to the NC HIEA Policies
and Procedures will be developed and amended in consultation with the Advisory Board as required
by N.C.G.S. §90-414.7
9.03. NC HIEA Policies and Procedures Change Process.
a. Prior to approving any new, amended, repealed or replaced NC HIEA Policies and Procedures,
the NC HIEA may provide notice of proposed changes to Participants. The NC HIEA may solicit
and consider comments from the Participants on the new, amended, repealed or replaced NC
HIEA Policies and Procedures.
b. Adoption of changes shall be determined by the NC HIEA in consultation with the Advisory
Board.
DocuSign Envelope ID: 47B4445A-C7CA-4D2E-9075-2AFD82F82DEC
14
c. NC HIEA shall notify all Participants of amended, repealed or replaced NC HIEA Policies and
Procedures at least thirty (30) calendar days prior to the effective date of such amended, repealed
or replaced NC HIEA Policies and Procedures, or such longer period as the NC HIEA shall
determine after consultation with the NC HIEA Advisory Board.
10. Obligations of NC HIEA.
10.01. NC HIEA shall maintain the functionality of NC HealthConnex and associated NC HealthConnex
Resources provided by NC HIEA, and provide or arrange for the provision of such service, security,
and other updates to NC HealthConnex as NC HIEA determines to be appropriate from time to time.
10.02. HIE Data, Message Content, data associated with Transactions, PHI or ePHI, or other Confidential
Information of Participant shall be accessed, used, or disclosed by NC HIEA and NC HIEA
Workforce members, or the Workforce members of any subcontractors or technology partners of NC
HIEA, to the extent necessary to conduct HIE Operations and for Permitted Purposes. Pursuant to
N.C.G.S. 90-414.6, NC HIEA shall not allow HIE Data it receives pursuant to N.C.G.S. 90-414.4 or
any other provision of Article 29B of the North Carolina General Statutes to be used or disclosed by
or to any person or entity for commercial purposes.
10.03. Opt Out.
a. NC HIEA will provide information and education to Participants about the right of Individuals
on a continuing basis to Opt Out or to rescind a decision to Opt Out.
b. After an Individual has notified NC HIEA of his or her decision to Opt Out of NC HealthConnex,
NC HIEA will ensure that the Individual's HIE Data will not be disclosed to any other entities
unless as required or permitted by law, or as permitted by N.C.G.S §90-414.10.
10.04. Obligations under 42 C.F.R. Part 2 as a Qualified Service Organization: NC HIEA may act as a
Qualified Service Organization on behalf of Participant in the event Participant or a unit within
Participant’s organization is a substance abuse treatment program that must comply with 42 C.F.R.
Part 2. To the extent the PHI received by NC HIEA is protected by the 42 C.F.R. Part 2 (hereafter
“Part 2 Data”), NC HIEA acknowledges that in receiving, storing, processing or otherwise dealing
with Part 2 Data, NC HIEA is fully bound by the Part 2 Regulations. If necessary, NC HIEA will
resist in judicial proceedings any efforts to obtain access to Part 2 Data except as permitted by 42
C.F.R. Part 2. Participant shall not send Part 2 Data to NC HealthConnex unless and until NC HIEA
notifies Participant in writing that NC HIEA can accept Part 2 Data.
10.05. Disclosure To Covered Entities, Business Associates, and Approved Third Parties. NC HIEA
shall display on its public website the Covered Entities, Business Associates, and Approved Third
Parties that have been granted access to NC HealthConnex or to HIE Data pursuant to N.C.G.S. 90-
414.7(b)(6) through (9) and other Applicable Law.
11. Obligations of Participants.
11.01. Submission of HIE Data to NC HIEA. Pursuant to N.C.S.L 2015-241 and N.C.G.S. §90-414.4,
Participant shall submit all data elements set forth in the Targeted Data Standards to the extent
possible for, at a minimum, all health care services rendered by Participant to Medicaid, State Health
Plan, and other State-funded health care program beneficiaries.
11.02. Prohibition of the Exchange of Certain Data. Participant shall not submit data to NC HIEA or
Transact Message Content through NC HealthConnex in contravention of Applicable Law without
an Authorization if one is required by Applicable Law before such disclosure is made.
11.03. Equipment and Software. Each Participant shall be responsible for procuring, and assuring that
its Participating Entities and Authorized Users have or have access to, all equipment and software
DocuSign Envelope ID: 47B4445A-C7CA-4D2E-9075-2AFD82F82DEC
15
necessary for it to submit HIE Data to NC HIEA and to Transact Message Content. Each Participant
shall ensure that all computers and electronic devices owned or leased by the Participant and its
Authorized Users to be used are properly configured, including, but not limited to, the base
workstation operating system, web browser, and Internet connectivity.
11.04. Participant Onboarding and Technical Specifications. Each Participant shall comply with the
Onboarding and Technical Specifications developed by NC HIEA during the Onboarding process to
initiate a connection to NC HealthConnex and while submitting HIE Data to NC HIEA.
11.05. Minimum Standards for Transacting Message Content for Treatment.
a. All Participants that request, or allow their respective Participating Entities and Authorized Users
to request, Message Content for Treatment shall have a corresponding reciprocal duty to respond
to Messages that request Message Content for Treatment. A Participant shall fulfill its duty to
respond by either (i) responding to the Message with the requested Message Content or, (ii)
responding with a standardized response that indicates the Message Content is not available or
cannot be exchanged. All responses to Messages shall comply with NC HIEA Policies and
Procedures, this Agreement, any agreements between Participant, Participating Entities, and
their Authorized Users, and Applicable Law. Participants may, but are not required to, Transact
Message Content for a Permitted Purpose other than Treatment. Nothing in this Section 11 shall
require a disclosure that is contrary to a restriction placed on the Message Content by a patient
pursuant to Applicable Law.
b. Each Participant that requests, or allows its respective Participating Entities or Authorized Users
to request, Message Content for Treatment shall Transact Message Content with all other
Participants for Treatment, in accordance with Sections 7, 11.05(a), and 13 of this Agreement.
If a Participant desires to stop Transacting Message Content with another Participant based on
the other Participant’s acts or omissions in connection with this Agreement, the Participant may
temporarily stop Transacting Message Content with such Participant either through modification
of its User Access Policies or through some other mechanism, to the extent necessary to address
the Participant’s concerns. If any such cessation occurs, the Participant shall provide a
Notification to NC HIEA of such cessation and the reasons supporting the cessation. The
Participants shall submit the Dispute leading to the cessation to the Dispute Resolution Process
in Section 20. If the cessation is a result of a HIPAA Breach or Security Breach that was reported
to, and deemed resolved by, NC HIEA pursuant to Section 14, the Participants involved in the
HIPAA Breach or Security Breach and the cessation shall engage in the Dispute Resolution
Process in Section 20 in an effort to attempt to reestablish trust and resolve any security concerns
arising from the HIPAA Breach or Security Breach.
11.06. Use of Message Content and NC HealthConnex Resources.
a. Permitted Purpose. Participants shall only Transact Message Content and use the NC
HealthConnex Resources for a Permitted Purpose as defined in this Agreement. Each Participant
shall require that its Participating Entities and Authorized Users comply with this Section 11.
b. Permitted Future Uses. Subject to this Section 11 and Section 19.05, Recipients may retain,
use and re-disclose Message Content or HIE Data accessed from NC HealthConnex Resources
in accordance with Applicable Law and the Recipient’s record retention policies and procedures.
If the Recipient is a Participant that is a Business Associate of its Authorized Users, such
Participant may retain, use and re-disclose Message Content in accordance with Applicable Law
and the agreements between the Participant and its Authorized Users.
c. Management Uses. NC HIEA may request information from Participants, and Participants shall
provide requested information, for the purposes listed in Section 6.01 of this Agreement. Any
information, other than Message Content, provided by a Participant to NC HIEA shall be labeled
as Confidential Participant Information and shall be treated as such in accordance with Section
16.
DocuSign Envelope ID: 47B4445A-C7CA-4D2E-9075-2AFD82F82DEC
16
11.07. Specific Duties of a Participant When Submitting a Message. Whenever a Participant acts as a
Submitter by submitting a Message to another Participant, the Submitter shall be responsible for:
a. Submitting each Message in compliance with Applicable Law, this Agreement, the applicable
NC HIEA Policies and Procedures including, but not limited to, representing that the Message
is:
1. for a Permitted Purpose;
2. submitted by a Submitter who has the requisite authority to make such a submission;
3. supported by appropriate legal authority for Transacting the Message Content including, but
not limited to, any consent or Authorization, if required by Applicable Law; and
4. submitted to the intended Recipient.
b. Representing that assertions or statements related to the submitted Message are true and accurate,
if such assertions or statements are required by the NC HIEA Policies and Procedures.
c. Submitting a copy of the Authorization, if the Submitter is requesting Message Content from
another Participant, based on the Permitted Purposes described in Section 2.39. Nothing in this
Section shall be interpreted as requiring a Submitter who is requesting Message Content to obtain
or transmit an Authorization for a request based on a Permitted Purposes other than the one
described in Section 2.39 even though certain other Participants require such Authorization to
comply with Applicable Law.
11.08. Participant Duty to Terminate Participation. If, as a result of a change made by NC HIEA in
accordance with this Section 11, a Participant will not be able to comply with the NC HIEA Policies
and Procedures or the Onboarding or Technical Specifications, or does not otherwise desire to
continue to Transact Message Content with other Participants or to use NC HealthConnex Resources
after such change becomes effective, then such Participant shall terminate this Agreement
accordance with Section 19.02.
11.09. Compliance with the eHealth Exchange DURSA. When Transacting Message Content over the
nationwide eHealth Exchange through NC HealthConnex, Participant shall (i) comply with all
Applicable Law; (ii) reasonably cooperate with NC HIEA on issues related to this Agreement and
with the eHealth Exchange DURSA; (iii) Transact Message Content only for a permitted purposes
as outlined in Attachment 9; (iv) use Message Content received from another Participant in
accordance with the terms and conditions of this Agreement; (v) as soon as reasonably practicable
after determining that a HIPAA Breach occurred, report such Breach to NC HIEA and any affected
Participants; (vi) refrain from disclosing to any other person any passwords or other security
measures issued to the Authorized User by NC HIEA or the Participant Account Administrator; and
(vii) comply with the provisions outlined in Attachment 9.
11.10. Participating Entities. Participating Entities that will be participating in NC HealthConnex under
the authority of Participant shall be listed in Attachment 4 of this Agreement and each party so listed
shall be individually entitled to the rights and subject to the obligations set forth in the Participation
Agreement. Participating Entities may act under the authority of one Participant of NC
HealthConnex or as multiple Participants with a separate Participation Agreement for each
Participating Entity.
11.11. Patient Education of the Right to Opt Out. Participant shall establish a process for notifying
Individuals about:
a. the benefits of NC HealthConnex,
b. the Individual’s right to Opt Out and the potential consequences to Individuals of Opting Out,
c. the Individual's right to rescind a previous decision to Opt Out.
DocuSign Envelope ID: 47B4445A-C7CA-4D2E-9075-2AFD82F82DEC
17
11.12. Creation of Test Data. Participant shall submit test data that closely approximates the production
HIE Data intended to be submitted to NC HIEA. Any Test data that has been created, or will be
created in the future, shall not contain any personal or individually identifiable information, including
without limitation, PHI.
12. License to NC HealthConnex Resources.
12.01. Participant is hereby granted a nonexclusive, nontransferable, revocable and limited license to the
NC HealthConnex Resources solely for use as a Participant in performance of this Agreement.
Participant shall not (a) sell, sublicense, transfer, exploit or, other than pursuant to this Agreement,
or (b) reverse engineer, decompile, disassemble, or otherwise attempt to discover the source code to
any NC HealthConnex Resources. THE NC HEALTHCONNEX RESOURCES ARE PROVIDED
“AS IS” AND “AS AVAILABLE” WITHOUT ANY WARRANTY OF ANY KIND, EXPRESS
OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND
NONINFRINGEMENT.
12.02. Exchange of Data for Meaningful Use. If Participant elects to utilize NC HealthConnex for
Meaningful Use purposes, Participant is granted a nonexclusive, nontransferable, revocable and
limited license to the NC HealthConnex Resources for the purpose of exchanging clinical and
demographic information through NC HealthConnex to comply with Meaningful Use or other federal
guidelines. Participant also grants NC HIEA a nonexclusive, nontransferable, revocable and limited
license to access, use, and store data submitted to or through NC HealthConnex under this subsection.
13. Privacy and Security.
13.01. Applicability of HIPAA Regulations. HIE Data Message Content contains PHI. Furthermore,
some, but not all, Participants are either a Covered Entity or a Business Associate of a Covered
Entity. Because the Participants are limited to Transacting Message Content for only a Permitted
Purpose, the Participants do not intend to become each other’s Business Associate by virtue of
signing this Agreement or Transacting Message Content. As a result, this Agreement is not intended
to serve as a Business Associate Agreement among the Participants. To support the privacy,
confidentiality, and security of the Message Content, each Participant agrees as follows:
a. If the Participant is a Covered Entity, the Participant does, and at all times shall, comply with the
HIPAA Regulations to the extent applicable.
b. If the Participant is a Business Associate of a Covered Entity, the Participant does, and shall at
all times, comply with the provisions of its Business Associate Agreements (or for governmental
entities relying upon 45 C.F.R. §164.504(e)(3)(i)(A), its Memoranda of Understanding) and
Applicable Law.
c. If Participant is a governmental entity, the Participant shall comply with the applicable privacy
and security laws.
14. Breach Notification. The following provisions apply to both a HIPAA Breach and a Security Breach as
defined in Section 2 (Definitions). For this Section 14 only, the term “Breach” refers to either a HIPAA
Breach or a Security Breach.
14.01. The Parties agree that within one (1) hour of discovering information that leads the Party to
reasonably believe that a Breach may have occurred, it shall alert the other Party and other
Participants whose Message Content may have been Breached. Participant must also alert the SAS
Help Desk at HIEsupport@sas.com within one (1) hour of discovery and describe the incident. As
soon as reasonably practicable, but no later than twenty-four (24) hours after determining that a
Breach has occurred, the Parties shall provide a Notification to the other Party and to all
DocuSign Envelope ID: 47B4445A-C7CA-4D2E-9075-2AFD82F82DEC
18
Participants likely impacted by the Breach. The Notification should include sufficient information
for the other Party or other Participants to understand the nature of the Breach. For instance, such
Notification could include, to the extent available at the time of the Notification, the following
information:
a. One or two sentence description of the Breach
b. Description of the roles of the people involved in the Breach (e.g. employees, Authorized Users,
service providers, unauthorized persons, etc.)
c. The type of Message Content Breached
d. Participants likely impacted by the Breach
e. Number of individuals or records impacted/estimated to be impacted by the Breach
f. Actions taken by the Participant to mitigate the Breach
g. Current Status of the HIPAA Breach (under investigation or resolved)
h. Corrective action taken and steps planned to be taken to prevent a similar Breach.
14.02. The Parties shall supplement the information contained in the Notification as it becomes available
and cooperate with other Participants in accordance with Section 1(e) of this Agreement. The
Notification required by this Section 14 shall not include any PHI. If, on the basis of the Notification,
a Participant desires to stop Transacting Message Content with the Participant that reported a Breach,
it shall stop Transacting Message Content in accordance with Section 1 of this Agreement. If, on
the basis of the Notification, NC HIEA determines that (i) the other Participants that have not been
notified of the Breach would benefit from a summary of the Notification or (ii) a summary of the
Notification to the other Participants would enhance the security of NC HealthConnex, it may
provide, in a timely manner, a summary to such Participants that does not identify any of the
Participants or individuals involved in the Breach.
14.03. Information provided by a Participant in accordance with this Section, except Message Content, may
be “Confidential Participant Information.” Such “Confidential Participant Information” shall be
treated in accordance with Section 16.
14.04. This Section shall not be deemed to supersede a Participant’s obligations (if any) under relevant
security incident, Breach notification or confidentiality provisions of Applicable Law.
14.05. Compliance with this Section shall not relieve Participants of any other security incident or Breach
reporting requirements under Applicable Law including, but not limited to, those related to
consumers.
15. Representations and Warranties.
15.01. Accurate Participant Information. Except to the extent prohibited by Applicable Law, each
Participant has provided, and shall continue to provide, NC HIEA with all information reasonably
requested by NC HIEA and needed by NC HIEA to discharge its duties under this Agreement or
Applicable Law, including during the Dispute Resolution Process. Any information provided by a
Participant to NC HIEA shall be responsive and accurate. Each Participant shall provide Notice to
NC HIEA if any information provided by the Participant to NC HIEA materially changes. Each
Participant acknowledges that NC HIEA reserves the right to confirm or otherwise verify or check,
in its sole discretion, the completeness and accuracy of any information provided by a Participant at
any time and each Participant shall reasonably cooperate with NC HIEA in such actions, given
reasonable prior notice. This Section 15.01 does not apply to HIE Data.
15.02. Execution of the Participation Agreement. Prior to submitting HIE Data to NC HIEA, Transacting
Message Content with other Participants, or accessing and using NC HealthConnex Resources, each
DocuSign Envelope ID: 47B4445A-C7CA-4D2E-9075-2AFD82F82DEC
19
Participant shall have executed this Agreement and returned an executed copy of this Agreement to
NC HIEA. In doing so, the Participant affirms that it has full power and authority to enter into and
perform this Agreement and has taken whatever measures necessary to obtain all required approvals
or consents in order for it to execute this Agreement. The representatives signing this Agreement on
behalf of the Participants affirm that they have been properly authorized and empowered to enter
into this Agreement on behalf of the Participant and any Participating Entities.
15.03.Compliance with this Agreement. Except to the extent prohibited by Applicable Law, each
Part\shall comply fully with all provisions of this Agreement. To the extent that a Participant
delegates its duties under this Agreement to a third party (by contract or otherwise) and such third
party will have access to Message Content and NC HealthConnex Resources, that delegation shall
be in writing and require the third party, prior to Transacting Message Content with any Participants
or accessing and using NC HealthConnex Resources, to agree to the same restrictions and conditions
that apply through this Agreement to a Participant. Participant represents and warrants that
disclosures to other Participants or third parties as necessary to perform this Agreement are
permissible under the Privacy Rule and any other Applicable Law.
15.04.Agreements with Technology Partners. To the extent that the Parties use technology partners or
subcontractors in connection with the Participant’s submission of HIE Data or Transaction of
Message Content, each Party affirms that it has valid and enforceable agreements with each of its
technology partners, including HISPs, that require the technology partner to, at a minimum: (i)
comply with Applicable Law; (ii) protect the privacy and security of any HIE Data or Message
Content to which it has access; (iii) as soon as reasonably practicable after determining that a HIPAA
Breach or Security occurred, report such Breach to the Party; and (iv) reasonably cooperate with the
other Party and other Participants on issues related to this Agreement, under the direction of the
Party.
15.05.Accuracy of HIE Data and Message Content. When acting as a Submitter, each Participant, in
accordance with Section 17.02, hereby represents that at the time of transmission, the HIE Data and
Message Content it provides is (a) an accurate representation of the data contained in, or available
through, its System, (b) sent from a System that employs security controls that meet industry
standards so that the information and Message Content being transmitted are intended to be free from
malicious software, and (c) provided in a timely manner and in accordance with the NC HIEA
Policies and Procedures. Other than those representations in Sections 15.05, 15.06, and 15.07, the
Submitter makes no other representation, express or implied, about the HIE Data or Message
Content.
15.06.Express Warranty of Authority to Submit HIE Data and to Transact Message Content. To the
extent each Participant is a Submitter and is submitting HIE Data to NC HIEA or providing Message
Content to a Recipient, each Participant represents and warrants that it has sufficient authority to
submit such HIE Data or to Transact such Message Content.
15.07.Use of Message Content and NC HealthConnex Resources.Each Participant hereby represents
and warrants that it shall use the Message Content and NC HealthConnex Resources only in
accordance with the provisions of this Agreement.
15.08.Auditing. Each Party represents that, through its agents, employees, and independent contractors, it
shall have the ability to monitor and audit all access to and use of its System related to this
Agreement, for system administration, security, and other legitimate purposes. Each Party shall
perform those auditing activities required by the NC HIEA Policies and Procedures.
DocuSign Envelope ID: 47B4445A-C7CA-4D2E-9075-2AFD82F82DEC
20
15.09. Compliance with Laws. Each Party shall, at all times, fully comply with all Applicable Law relating
to this Agreement, the Transaction of Message Content for a Permitted Purpose, and the use of
Message Content.
15.10. Absence of Final Orders. Each Participant hereby represents and warrants that, as of the Effective
Date, it is not subject to a final order issued by any federal, State, local or international court of
competent jurisdiction or regulatory or law enforcement organization, which will materially impact
the Participant’s ability to fulfill its obligations under this Agreement. Each Participant shall inform
NC HIEA if at any point during the term of this Agreement it becomes subject to such an order.
16. Confidential Information.
16.01. Confidential Participant Information. Each Receiving Party shall hold all Confidential Participant
Information in confidence and agrees that it shall not, during the term or after the termination of this
Agreement, redisclose to any person or entity, nor use for its own business or benefit, any information
obtained by it in connection with this Agreement, unless such use or redisclosure is permitted by the
terms of this Agreement.
16.02. Application of the North Carolina Public Records Act. NC HIEA may receive from Participant
certain confidential types of information described in N.C.G.S. §132-1 et seq. and Section 2.06,
which NC HIEA shall protect in accordance with Section 16.01. Participant may designate data and
information as confidential, consistent with and to the extent permitted under Applicable Law, by
marking the top and bottom of pages containing confidential information with a legend in boldface
type “CONFIDENTIAL” or by identifying electronically supplied information as
“CONFIDENTIAL.” NC HIEA shall promptly notify Participant of a public record request
involving information that Participant has deemed confidential pursuant to this Agreement.
Participant must then notify NC HIEA in writing whether to disclose the information or to restrict
disclosure. The Parties shall cooperate and assist each other in preparing an appropriate response to
the request or action, if the records responsive to the request include Confidential Submitter
Information. If an action is brought pursuant to N.C.G.S. §132-9 to compel NC HIEA to disclose
information marked confidential, NC HIEA shall provide Participant prompt written notice of such
action. If the Participant has requested in writing that NC HIEA not disclose the Confidential
Participant Information, Participant shall promptly intervene in the action through its counsel and
participate in defending NC HIEA, including any public official(s) or public employee(s). The
Participant agrees that it shall hold NC HIEA and any official(s) and individual(s) harmless from any
and all damages, costs, and attorneys’ fees awarded against NC HIEA in the action. NC HIEA shall
have the right, at its option and expense, to participate in the defense of the action through its counsel.
NC HIEA shall have no liability to Participant with respect to the disclosure of Confidential
Participant Information ordered by a court of competent jurisdiction pursuant to N.C.G.S. §132-9 or
other applicable law.
17. Disclaimers.
17.01. Reliance on a System. Each Participant acknowledges and agrees that: (i) the HIE Data and
Message Content received or provided by, or through, its System is drawn from numerous sources,
and (ii) it can only confirm that, at the time Message Content is Transacted, the information and
Message Content Transacted are an accurate representation of data contained in, or available through,
its System. Nothing in this Agreement shall be deemed to impose responsibility or liability on a
Participant related to the clinical accuracy, content or completeness of any HIE Data or Message
Content provided pursuant to this Agreement. The Participants acknowledge that other Participants’
Digital Credentials may be activated, suspended or revoked at any time or the Participant may
DocuSign Envelope ID: 47B4445A-C7CA-4D2E-9075-2AFD82F82DEC
21
suspend its participation; therefore, Participants may not rely upon the availability of HIE Data or a
particular Participant’s Message Content.
17.02. Incomplete Medical Record. Each Participant acknowledges that HIE Data or Message Content
Transacted by Participants may not include the individual’s full and complete medical record or
history. Such HIE Data or Message Content will only include that data which is the subject of the
Message and available for exchange among Participants.
17.03. Patient Care. HIE Data or Message Content obtained through NC HealthConnex is not a substitute
for any Participant, if that person/entity is a Health Care Provider, obtaining whatever information
he/she/it deems necessary, in his/her professional judgment, for the proper treatment of a patient.
The Participant, if he/she/it is a Health Care Provider, shall be solely responsible for all decisions
and actions taken or not taken involving patient care, utilization management, and quality
management for his/her/its respective patients and clients resulting from, or in any way related to,
the use of the NC HealthConnex, HIE Features, and NC HIEA Policies and Procedures agreed to by
the Participants pursuant to this Agreement or the HIE Data or Message Content made available
thereby. By executing this Agreement or Transacting Message Content, neither Participant,
Participating Entity, or an Authorized User assumes any responsibility or liability for the health care
services provided by any other Participant, Participating Entity, or Authorized User to a patient.
17.04. Carrier lines. All Participants acknowledge that the submission of HIE Data to NC HIEA or the
Transaction of Message Content between Participants is to be provided over various facilities and
communications lines, and information shall be transmitted over local exchange and Internet
backbone carrier lines and through routers, switches, and other devices (collectively, “carrier lines”)
owned, maintained, and serviced by third-party carriers, utilities, and Internet service providers, all
of which may be beyond the Participants’ control. Provided a Participant uses reasonable security
measures, no less stringent than those directives, instructions, and specifications contained in this
Agreement and the NC HIEA Policies and Procedures, the Participants assume no liability for or
relating to the integrity, privacy, security, confidentiality, or use of any information while it is
transmitted over those carrier lines, which are beyond the Participants’ control, or any delay, failure,
interruption, interception, loss, transmission, or corruption of any HIE Data, Message Content, or
other information attributable to transmission over those carrier lines which are beyond the
Participants’ control. Use of the carrier lines is solely at the Participants’ risk and is subject to all
Applicable Law.
17.05. No Warranties. EXCEPT AS REPRESENTED IN SECTIONS 15.05 AND 15.06, HIE DATA
AND MESSAGE CONTENT IS PROVIDED “AS IS” AND “AS AVAILABLE” WITHOUT ANY
WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
PURPOSE, AND NONINFRINGEMENT. IT IS EXPRESSLY AGREED THAT IN NO EVENT
SHALL THE PARTIES BE LIABLE FOR ANY SPECIAL, INDIRECT, CONSEQUENTIAL, OR
EXEMPLARY DAMAGES, INCLUDING BUT NOT LIMITED TO, LOSS OF PROFITS OR
REVENUES, LOSS OF USE, OR LOSS OF INFORMATION OR DATA, WHETHER A CLAIM
FOR ANY SUCH LIABILITY OR DAMAGES IS PREMISED UPON BREACH OF CONTRACT,
BREACH OF WARRANTY, NEGLIGENCE, STRICT LIABILITY, OR ANY OTHER
THEORIES OF LIABILITY, EVEN IF THE PARTIES HAVE BEEN APPRISED OF THE
POSSIBILITY OR LIKELIHOOD OF SUCH DAMAGES OCCURRING. THE PARTIES
DISCLAIM ANY AND ALL LIABILITY FOR ERRONEOUS TRANSMISSIONS AND LOSS OF
SERVICE RESULTING FROM COMMUNICATION FAILURES BY TELECOMMUNICATION
SERVICE PROVIDERS OR OTHER THIRD PARTIES.
18. Liability.
DocuSign Envelope ID: 47B4445A-C7CA-4D2E-9075-2AFD82F82DEC
22
18.01. Participant Liability. Participant shall be responsible for its acts and omissions and not for the acts
or omissions of NC HIEA or any other Participant. In circumstances involving harm to other
Participants caused by the acts or omissions of individuals who Transact Message Content or
Confidential Participant Information through the Participant or by use of any password, identifier, or
log-on received or obtained directly or indirectly, lawfully or unlawfully, from the Participant or any
of the Participating Entities or Authorized Users, each Participant shall be responsible for such harm
to the extent that the individual's access was caused by the Participant's breach of the Agreement or
its negligent conduct for which there is a civil remedy under Applicable Law. Notwithstanding any
provision in this Agreement to the contrary, Participant shall not be liable for any act or omission if
a cause of action for such act or omission is otherwise prohibited by Applicable Law. This Section
shall not be construed as a hold harmless or indemnification provision.
18.02. NC HIEA Liability. Participant shall not hold NC HIEA, the NC HIEA Advisory Board, or any of
their members liable for or relating to any impairment of the privacy, security, confidentiality,
integrity, availability, or restricted use of any information on a System resulting from any
Participant’s actions or failures to act, except to the extent such action or failure to act was directed
by NC HIEA. NC HIEA is not liable for any damages resulting from loss of HIE Data or Message
Content, or use of Message Content by Approved Third Parties following transfer or Transaction of
such by NC HIEA. NC HIEA disclaims all liability connected to disclosures made to NC HIEA by
Participant in contravention of Applicable Law. NC HIEA does not waive any defenses or rights
based upon sovereign immunity of the State of North Carolina.
18.03. Effect of Agreement. Except as provided in Section 17 (Disclaimers) and Section 20 (Dispute
Resolution), nothing in this Agreement shall be construed to restrict a Participant’s right to pursue
all remedies available under law for damages or other relief arising from acts or omissions of other
Participants related to this Agreement, or to limit any rights, immunities or defenses to which a
Participant or Authorized User may be entitled under Applicable Law.
19. Term, Suspension and Termination.
19.01. Term. The initial term of this Agreement shall begin on the Effective Date and extend for one year
measured from the Effective Date. The Parties shall complete all necessary Onboarding activities
and meet any Onboarding and Technical Specifications during the period following execution of this
Agreement and prior to the Go Live Date. Upon the expiration of the initial term, this Agreement
shall automatically renew for successive one-year terms unless terminated pursuant to this Section
19.
19.02. Suspension or Termination by Participant.
a. A Participant may voluntarily suspend its own right to Transact Message Content or to use NC
HealthConnex Resources by Notifying NC HIEA of its voluntary suspension. Once a Participant
has properly Notified NC HIEA of its voluntary suspension, neither the Participant, nor its
Participating Entities or Authorized Users, shall Transact Message Content until the voluntary
suspension has ended and the Participant has Notified NC HIEA that the suspension has ended.
During the period of the voluntary suspension, the Participant’s inability to Transact Message
Content and comply with those terms this Agreement that require Transaction of Message
Content shall not be deemed a breach of this Agreement.
b. A Participant may terminate its own right to Transact Message Content or to use NC
HealthConnex Resources by terminating this Agreement, with or without cause, by giving NC
HIEA at least five (5) business days prior written Notice. Once proper Notice is given, NC HIEA
shall be empowered to revoke the Participant’s Digital Credentials as of the date of termination
DocuSign Envelope ID: 47B4445A-C7CA-4D2E-9075-2AFD82F82DEC
23
specified in the Notice. Once NC HIEA revokes the Participant’s Digital Credentials, NC HIEA
shall provide a notice of the revocation to the remaining Participants.
19.03.Suspension by NC HIEA. Upon NC HIEA completing a preliminary investigation and determining
that there is a substantial likelihood that a Participant’s acts or omissions create an immediate threat
or will cause irreparable harm to another party including, but not limited to, a Participant; a
Participating Entity; an Authorized User; the integrity or operation of NC HealthConnex; or an
individual whose Message Content is Transacted using the Onboardingand TechnicalSpecifications;
the Participants hereby grant to NC HIEA the power to summarily suspend, to the extent necessary
to address the threat posed by the Participant, a Participant’s Digital Credentials, pending the
submission and approval of a corrective action plan, as provided in this Section. Upon suspension,
NC HIEA shall immediately suspend the Participant’s Digital Credentials and within twelve (12)
business hours of suspending a Participant’s right to Transact Message Content (i) provide a notice
of such suspension to all Participants; and (ii) provide to the suspended Participant a written summary
of the reasons for the suspension. The Participant shall use reasonable efforts to respond to the
suspension Notice with a detailed plan of correction or an objection to the suspension within three
(3) business days or, if such submission is not reasonably feasible within three (3) business days,
then at the earliest practicable time. If the Participant submits a plan of correction, NC HIEA shall,
within five (5) business days, review and either accept or reject the plan of correction. If the plan of
correction is accepted, NC HIEA shall, upon completion of the plan of correction, reinstate the
Participant’s Digital Credentials and provide a notice to all Participants of such reinstatement. If the
plan of correction is rejected, the Participant’s suspension will continue, during which time NC HIEA
and the Participant shall work in good faith to develop a plan of correction that is acceptable to both
the Participant and NC HIEA. At any time after NC HIEA rejects a Participant’s plan of correction,
either the Participant or NC HIEA may submit a Dispute to the Dispute Resolution Process described
in Section 20. If NC HIEA and the Participant cannot reach agreement on a plan of correction
through the Dispute Resolution Process, NC HIEA may terminate the Participant in accordance with
Section 19.04.
19.04.Termination by NC HIEA. The Parties hereby acknowledge and agree that NC HIEA may
terminate a Participant’s connection to NC HealthConnex and Participant’s right to Transact
Message ContentIROORZLQJ1RWLFHWR3DUWLFLSDQWE\1&+,($DQGDVIROORZV:
a. After taking a suspension action in accordance with Section 19.03 when there is a substantial
likelihood that the Participant’s acts or omissions create an immediate threat or will cause
irreparable harm to another party including, but not limited to, a Participant, a Participating
Entity, or an Authorized User, integrity or operation of NC HealthConnex, or an individual
whose Message Content is Transacted; or
b. In the event a Participant is in material default of the performance of a duty or obligation imposed
upon it by this Agreement and such default has not been substantially cured within thirty (30)
calendar days following receipt by the defaulting Participant of written Notice thereof from NC
HIEA.
c. A Participant whose Digital Credentials are revoked by virtue of termination may appeal such
revocation through the Dispute Resolution Process. However, during the pendency of any such
appeal, the Participant’s Digital Credentials may continue to be revoked at the discretion of NC
HIEA.
19.05.Effect of Termination. Upon any termination of this Agreement for any reason, the terminated party
shall cease to be a Participant and thereupon and thereafter neither that Party nor its Authorized Users
shall have any rights to submit HIE Data or have access to the NC HealthConnex Resources or
Transact Message Content with other Participants (unless such Authorized Users have an
DocuSign Envelope ID: 47B4445A-C7CA-4D2E-9075-2AFD82F82DEC
24
independent right to Transact Message Content through another Participant). NC HIEA shall revoke
a terminated Participant’s Digital Credentials, which will terminate Participant’s ability to Transact
Message Content. Once NC HIEA revokes the Participant’s Digital Credentials, NC HIEA shall
provide a notice of such revocation to the remaining Participants. In the event that any Participant(s)
is terminated, this Agreement will remain in full force and effect with respect to all other Participants.
19.06. Disposition of Message Content on Termination. At the time of termination, Recipient may, at its
election, retain Message Content on Recipient’s System in accordance with the Recipient’s document
and data retention policies and procedures, Applicable Law, and the terms and conditions of this
Agreement.
19.07. Availability of Funds. The HIE Features are expressly contingent upon and subject to the
appropriation, allocation, and availability of funds to NC HIEA for the purposes set forth in this
Agreement. Notwithstanding NC HIEA’s authority to become self -supporting, HIE Features and
operations funded in whole or in part by federal funds or appropriations by the N.C. General
Assembly shall be subject to and contingent upon the continuing availability of such funds for the
purposes of this Agreement. If funds to support NC HIEA operations or HIE Features are not
available, NC HIEA will provide written notification to Participant together with notice of
termination. NC HIEA shall have no liability or continuing obligation if this Agreement is
terminated for lack of available funds.
20. Dispute Resolution.
20.01. General. The Parties acknowledge that it may be in their best interest to resolve Disputes through
an alternative Dispute Resolution Process rather than through civil litigation. The Parties have
reached this conclusion based upon the fact that the legal and factual issues involved in this
Agreement are unique, novel, and complex and limited case law exists which addresses the legal
issues that could arise from this Agreement. Except in accordance with Section 20.02, if a Party
refuses to participate in the Dispute Resolution Process, such refusal shall constitute a material
breach of this Agreement and may be grounds for termination in accordance with Section 19.04.
During the time the Parties are attempting to resolve any dispute, each shall proceed diligently to
perform their respective duties and responsibilities under this Agreement. If a dispute cannot be
resolved between the Parties within thirty (30) days after delivery of notice, either Party may elect
to exercise any other remedies available under this Agreement, or at law; or invite the other party to
submit the matter to mediation.
20.02. Immediate Injunctive Relief. Notwithstanding Section 20.01, a Party may be relieved of its
obligation to participate in the Dispute Resolution Process if such Party (i) believes that another
Party’s acts or omissions create an immediate threat to the confidentiality, privacy or security of
Message Content or will cause irreparable harm to another party (Participant, Authorized User, the
integrity or operation of NC HealthConnex, or consumer) and (ii) pursues immediate injunctive relief
against such other Participant in a court of competent jurisdiction. The Party pursuing immediate
injunctive relief must provide a Notification to the other Party of such action within 24 hours of filing
for the injunctive relief and of the result of the action within 24 hours of learning of same.
20.03. If the injunctive relief sought in Section 20.02 is not granted and the Party seeking such relief chooses
to pursue the Dispute, the Parties must then submit to the Dispute Resolution Process in accordance
with this Section 20.03. If both Parties agree to submit the matter to mediation, the following actions
shall be taken:
a. Each Party shall recommend a mediator certified by the North Carolina Courts after first
determining that the recommended mediator, and said mediator’s firm, if any, have no conflict
DocuSign Envelope ID: 47B4445A-C7CA-4D2E-9075-2AFD82F82DEC
25
or prior knowledge of the Dispute to be resolved, and no prior work for or against either Party;
and,
b. The recommended mediators must have knowledge of the general subject matter of the
Applicable Law; and,
c. The recommended mediators must be able to execute and deliver a satisfactory confidentiality
and non-disclosure agreement if information exempt from disclosure under N.C. Gen. Stat. §132-
1, et seq. is relevant or material to the matter to be resolved; and,
d. Recommended mediators and their respective contact and qualification information shall be
exchanged within five (5) days to each Party following the agreement to mediate; and
e. Unless the Parties mutually agree to select a particular mediator, the selection of a mediator shall
be determined by the mediator’s earliest available date to initiate mediation. Any agreement to
mediate shall require the Parties to appear and mediate the matter in good faith in accordance
with the schedule and calendar established by the Mediator; and,
f. Provided, however, that this term shall not constitute an agreement by either Party to mediate or
arbitrate any dispute; and that any agreement to mediate may be revoked or terminated without
penalty therefore if so advised by the North Carolina Attorney General.
20.04. Activities During Dispute Resolution Process. Pending resolution of any Dispute under this
Agreement, the Parties agree to fulfill their responsibilities in accordance with this Agreement, unless
the Party voluntarily suspends its right to Transact Message Content in accordance with Section
19.02, is suspended in accordance with Section 19.03, or exercises its right to cease Transacting
Message Content in accordance with Section 11.05(b).
20.05. Implementation of Agreed Upon Resolution. If, at any point during the Dispute Resolution
Process, the Parties to the Dispute accept a proposed resolution of the Dispute, the Parties agree to
implement the terms of the resolution in the agreed upon timeframe.
20.06. Reservation of Rights. If, following the Dispute Resolution Process, in the opinion of either Party,
the mandatory Dispute Resolution Process failed to adequately resolve the Dispute, the Party or
Parties may pursue any remedies available to it in a court of competent jurisdiction.
21. Publications.
21.01. Any Participant published or distributed reports, data, or other information that reference NC HIEA
or NC HealthConnex shall contain a disclaimer statement to the following effect: Any opinions,
findings, conclusions, or recommendations expressed in this publication are those of the author(s)
and do not necessarily reflect the view and policies of NC HIEA.
21.02. NC HIEA may publish or arrange for the publication of information resulting from work carried out
under this Agreement, and copyright any books, publications, films, or other copyrightable materials
developed in the course of or resulting from work under this Agreement.
21.03. Upon Participant’s publication of materials resulting from HIE Data, Participant shall furnish a
minimum of two copies of reprints to NC HIEA.
22. Notices. All Notices to be made under this Agreement shall be given in writing to the appropriate Participant’s
representative at the address listed in Attachment 1, and shall be deemed given: (i) upon delivery, if personally
delivered; (ii) upon the date indicated on the return receipt, when sent by the United States Postal Service
Certified Mail, return receipt requested; and (iii) if by a form of electronic transmission, upon receipt when
the Notice is directed to an electronic mail address listed on Attachment 1 and the sending electronic mail
address receives confirmation of receipt by the electronic mail address.
DocuSign Envelope ID: 47B4445A-C7CA-4D2E-9075-2AFD82F82DEC
26
23. Medicare Record Access. In compliance with 42 U.S.C. §1395x(v)(l)(I) and implementing regulations, NC
HIEA agrees, until the expiration of four (4) years after the HIE Features are furnished under this Agreement,
to allow the Secretary of the U.S. Department of Health and Human Services and the Comptroller General
access to this Agreement, all applicable purchase orders, and to the books, documents and records of NC
HIEA necessary to verify the nature and extent of the costs of this Agreement. NC HIEA further agrees that
if any of the duties of this Agreement are carried out by a subcontractor of NC HIEA, such subcontract will
contain a clause to the effect that, until the expiration of four (4) years after the HIE Features are furnished
under such subcontract, the Secretary of the U.S. Department of Health and Human Services and the
Comptroller General will have access to such subcontract and to the books, documents and records of the
subcontractor necessary to verify the nature and extent of the costs of such subcontract. This Section 23 will
survive the expiration or termination of this Agreement.
24. Miscellaneous/General.
24.01. Governing Law. This Agreement is made under and shall be governed and construed in accordance
with the laws of the State of North Carolina. The place of this Agreement or purchase order, its situs
and forum, shall be Wake County, North Carolina, where all matters, whether sounding in contract
or in tort, relating to its validity, construction, interpretation and enforcement shall be determined.
Participant agrees and submits, solely for matters relating to this Agreement, to the jurisdiction of
the courts of the State of North Carolina, and stipulates that Wake County shall be the proper venue
for all matters.
24.02. Authority; No Conflict. NC HIEA and Participant each represent and warrant to the other as
follows: (i) that it is authorized to enter into this Agreement and to perform its obligations hereunder,
and that the individual signatory executing this Agreement on its behalf is authorized, and has the
capacity, to so execute this Agreement on its behalf, and (ii) that the execution of this Agreement by
it and the performance of its obligations hereunder shall not conflict with or result in, with or without
the passage of time or the giving of notice thereof, any breach, default or violation of any third party
agreement to which it is bound, or any judgment, order or ruling of any court, administrative or
regulatory agency or body, or arbitration award, to which it is bound or subject.
24.03. Amendment. This Agreement may be amended by agreement between the Parties. However, if the
change is required for NC HIEA or Participants to comply with Applicable Law, NC HIEA may
implement the change within a time period NC HIEA determines is appropriate under the
circumstances. All Participants shall be required to sign an amendment adopted in accordance with
the provisions of this Section or terminate participation in accordance with Section 19.02.
24.04. Governmental Restrictions. In the event any restrictions are imposed by governmental
requirements that necessitate alteration of the performance of this Agreement, each Party shall
provide written notification of the necessary alteration(s) to the other Party’s Contract Administrator.
NC HIEA reserves the right to accept any such alterations, including any price adjustments
occasioned thereby, or to cancel the Agreement. NC HIEA may advise Participant of any restrictions
or changes in specifications required by North Carolina legislation, rule or regulatory authority that
require compliance by the State. In such event, Participant shall use its best efforts to comply with
the required restrictions or changes. If compliance cannot be achieved by the date specified by NC
HIEA, the Parties may terminate this Agreement.
24.05. Inspection At Participant’s Site. Pursuant to N.C.G.S. §147-64.7, the State reserves the right to
inspect, during Participant’s regular business hours at a reasonable time, upon notice of not less than
two (2) weeks, and at its own expense, the prospective equipment or other tangible goods, or the
plant or other physical facilities of a prospective Participant prior to Agreement award, and during
the Agreement term as necessary or proper to ensure conformance with the specifications or
DocuSign Envelope ID: 47B4445A-C7CA-4D2E-9075-2AFD82F82DEC
27
requirements and their adequacy and suitability for the proper and effective performance of the
Agreement.
24.06. Audit, Access To Records. Pursuant to N.C.G.S. §147-64.7, the Agency, the State Auditor,
appropriate federal officials, and their respective authorized employees or agents are authorized to
examine all books, records, and accounts of the Participant insofar as they relate to transactions with
any department, board, officer, commission, institution, or other agency of the State of North
Carolina pursuant to this Agreement or to costs charged to this Agreement. The Participant shall
retain any such books, records, and accounts for a minimum of three (3) years after the completion
or termination of this Agreement. Additional audit or reporting requirements may be required by
any Agency, if in the Agency’s opinion, such requirement is imposed by federal or state law or
regulation.
24.07. Assignment. No Party shall assign or transfer this Agreement, or any part thereof, without the
express written consent of NC HIEA. Any assignment that does not comply with the requirements
of this Section 24.07 shall be void and have no binding effect. NC HIEA, in its own discretion, will
not unreasonably withhold its approval of an assignment in the context of a merger, acquisition, or
sale of Participant.
24.08. Conflicts Of Interest. Participant acknowledges and represents that it has adopted policies
governing conflicts of interest and ethics in the exercise of its authority, and its actions under this
Agreement. Participant will review, disclose and employ its best efforts to resolve any anticipated
or reported conflict of interest or issue involving its ethics policies during the performance of this
Agreement.
24.09. Survival. The following provisions shall survive the termination of this Agreement for any reason:
Sections 1, 2, 11.06.b), 11.06.c), 13, 15.07, 16, 18, 19.06, 20, 23, 24.01, 24.09, and 24.11.
24.10. Waiver. No failure or delay by any Participant in exercising its rights under this Agreement shall
operate as a waiver of such rights, and no waiver of any right shall constitute a waiver of any prior,
concurrent, or subsequent right.
24.11. Entire Agreement. This Agreement, together with all Attachments, sets forth the entire and only
Agreement among the Parties relative to the subject matter hereof. This Participation Agreement
replaces and supersedes all prior participation or subscription agreements between NC HIEA and
Participant, and expresses the entire understanding of the Parties with respect to the transactions
contemplated herein, and shall not be amended, modified or altered except pursuant to Section 24.03.
Any representation, promise, or condition, whether oral or written, not incorporated herein, shall not
be binding upon any Party.
24.12. Validity of Provisions. In the event that a court of competent jurisdiction shall hold any Section,
or any part or portion of any Section of this Agreement, invalid, void or otherwise unenforceable,
each and every remaining Section or part or portion thereof shall remain in full force and effect.
24.13. Headings. The headings throughout this Agreement are for reference purposes only, and the words
contained therein may in no way be held to explain, modify, amplify, or aid in the interpretation or
construction of meaning of the provisions of this Agreement. All references in this instrument to
designated “Sections” and other subdivisions are to the designated Sections and other subdivisions
of this Agreement. The words “herein,” “hereof,” “hereunder,” and other words of similar import
refer to this Agreement as a whole and not to any particular Section or other subdivision.
24.14. Relationship of the Participants. The Participants are independent contracting entities. Nothing in
this Agreement shall be construed to create a partnership, agency relationship, or joint venture among
the Parties. Neither NC HIEA nor any Participant shall have any authority to bind or make
commitments on behalf of another Participant for any purpose, nor shall any such Party hold itself
DocuSign Envelope ID: 47B4445A-C7CA-4D2E-9075-2AFD82F82DEC
28
out as having such authority. No Participant shall be held liable for the acts or omissions of another
Participant.
24.15.Third-Party Beneficiaries. With the exception of the Participants to this Agreement, there shall
exist no right of any person to claim a beneficial interest in this Agreement or any rights occurring
by virtue of this Agreement.
24.16.Force Majeure. A Participant shall not be deemed in violation of any provision of this Agreement
if it is prevented from performing any of its obligations by reason of: (a) severe weather and storms;
(b) earthquakes or other disruptive natural occurrences; (c) strikes or other labor unrest; (d) power
failures; (e) nuclear or other civil or military emergencies; (f) terrorist attacks; (g) acts of legislative,
judicial, executive, or administrative authorities; or (h) any other circumstances that are not within
its reasonable control. This Section 24.16 shall not apply to obligations imposed under Applicable
Law.
24.17.Time Periods.Any of the time periods specified in this Agreement may be changed pursuant to the
mutual written consent of NC HIEA and the affected Participant(s).
This Agreement has been entered into and executed by officials duly authorized to bind their respective Parties
as of the dates set forth underneath their signatures below.
Participant:
Participant Organization Name:
By:
Authorized Signature
Name:
Title:
Date:
North Carolina Health Information Exchange
Authority
By:
Authorized Signature
Name:
Title:
Date:
Dinah Jeffries
Emergency Services Director
Orange County, North Carolina by and through its "Emergency Services Department"
DocuSign Envelope ID: 47B4445A-C7CA-4D2E-9075-2AFD82F82DEC
29
Attachment 1
Addresses for Notice
Participant is required to provide information inthe Primary Contact fields below unless otherwise noted.
Pursuant to Section 22, Notifications will EHVHQWWRWKHFRQWDFWVEHORZFRQFHUQLQJWKLV$JUHHPHQWLQFOXGLQJ
WKHQHHGIRUDPHQGPHQWV1RWLILFDWLRQVZLOOnot be sent via facsimile; however, please feel free to provide this
information.
Participant Address for Notice
Primary Contact Alternate Contact
Not required
Name
Title
Organization
Address
City, State
Zip
Phone
Fax (not
required)
E-mail
NC HIEA Address for Notice
1&+,($Legal Contact for NotiFH 6$6Technical Contact for
Notice RQ Breaches
Mailing
Address
NC HIEA
Attn: Legal Team
4101 Mail Service Center
Raleigh, NC 27699-4101
Not Applicable
Phone Phone: 919-754-6928 (919) 531-2700
Email HIEALegal@NC.Gov HIESupport@SAS.com
Kim Woodward Kyle Ronn
EMS Operations Manager QA/QI Coordinator
Orange County EMS Orange County EMS
510 Meadowlands Drive 510 Meadowlands Drive
Hillsborough, NC 27278 Hillsborough, NC 27278
(919) 245 - 6133 (919) 245 - 6124
N/A N/A
kwoodward@orangecountync.gov kronn@orangecountync.gov
DocuSign Envelope ID: 47B4445A-C7CA-4D2E-9075-2AFD82F82DEC
30
Attachment 2
Participant Staff Contact Information
Please provide contact information for the following staff members at your organization. Each field must be filled
even if one person occupies more than one role. All fields must be completed or the processing of
your Participation Agreement will be delayed.
Participant Account Administrator
Staff member who will be the point of contact for the NC HIEA for communications and credentialing
NC HealthConnex users in your organization.
Name:
Position Title:
Email Address:
Phone Number:
Mailing Address:
Technical Services Contact
Staff member who will work with our technology vendor to build a connection from your organization to
NC HealthConnex.
Name:
Position Title:
Email Address:
Phone Number:
Mailing Address:
Kyle Ronn
Quality Assurance Coordinator
kronn@orangecountync.gov
(919)245-6124
510 Meadowlands Drive, Hillsborough, NC 27278
Beth Ann Arbogast
IT Systems Analyst
barbogast@orangecountync.gov
(919)245-2282
131 West Margaret Lane, Hillsborough, NC 27278
DocuSign Envelope ID: 47B4445A-C7CA-4D2E-9075-2AFD82F82DEC
31
Attachment 3
Onboarding & Technical Specifications
Participant Background Information
1. Type of facility or system:Please select all that apply below.
Hospital, Health
System, or
Regional HIE
Ambulatory/
Outpatient
Clinic
Laboratory Pharmacy Other Please specify:
_____________________
2. Provider type:
This field is not required if your organization is a Hospital, Health System, Regional HIE, Laboratory, or Pharmacy
Primary Care Dental or Orthodontic Respiratory, Developmental,
Rehabilitative or Restorative
Pediatrics Residential Facility Speech, Language and
Hearing
OB/GYN In Home Care, e.g. PCS, CAP-
C/DA, etc.
Other Please specify:
_________________________ Behavioral Health Eye & Vision
3. Participant Organization National Provider
Identifier (NPI):________________________________
4. How many Participating Entities (PEs) or
facility locations does your organization have?
If you have any PEs or more than one facility
location, please complete Attachment 4 _______
5. Is your provider or health system a part of one or more the following? Yes No
If yes, please select all that apply and list the name of the organization(s).
Health system
Regional HIE
Accountable Care Organization
Clinically Integrated Network
Substance Use Disorder Treatment Information
6. Does your organization or any unit within
your organization provide Substance Use
Disorder treatment?
Yes No
7. If yes to 6, does your organization fall under
42 C.F.R. Part 2?
If unsure, please contact your legal counsel and visit the
SAMHSA website at www.SAMHSA.gov
Yes No
Electronic Health Record (EHR Vendor) Information
Please discuss these questions with your Technical Services Contact
8. EHR Vendor:
Emergency Medical Services
EMS Care
1629178629
1
ESO Solutions
✔
✔
✔
✔
DocuSign Envelope ID: 47B4445A-C7CA-4D2E-9075-2AFD82F82DEC
32
9.EHR Vendor Product & Version:
10. Hosting Location:
On-site Cloud-based
Hub/server on-site at
another location Other: _____________
11. EHR Vendor Contact Name:
12. EHR Vendor Contact Email:
13. EHR Vendor Contact Phone Number:
State Funding Information
14. Do you accept and receive reimbursement
from NC Medicaid? Yes No
15. If yes to 14, do you receive reimbursement
through a Managed Care Organization (MCO)
or Local Management Entity (LME)?
Yes No
If yes, please specify:_____________________________
16. Do you accept and receive reimbursement
from NC State Health Plan? Yes No
17. Do you receive any other funds from the
State of North Carolina for the provision of
health services, including grants?
Yes No
HIE Features
18. NC HIEA offers Direct Secure Messaging
(DSM) at no cost. Would you be interested in
learning more about these services?
Yes No
19. Would your organization be interested in
connecting to the NC Immunization Registry
through NC HealthConnex?
Yes No
Technical Specifications for Onboarding & Targeted Data Standards
1.EHR Product.Any ONC certified EHR Product can be connected to NC HealthConnex. Other EHR
Products may also be used if the product is capable of sending HL7 messages, version 2 and higher. The
timeline for connecting your organization will depend on various factors, including the technical resources
and capabilities of your EHR vendor, any work already undertaken by NC HIEA, SAS Institute (“SAS,”
our technology partner and subcontractor), and your EHR vendor to connect other participants, and
resources available at your organization, NC HIEA, and SAS.
2. Targeted Data Standards
a.CCD/CCDA Submission and Exchange. Participants with ONC certified EHR Products that
are Meaningful Use Stage 2 Certified shall submit the following data elements to NC
HealthConnex to the extent possible for all data pertaining to Medicaid, State Health Plan, and
State-funded health services provided by Participant as required by Applicable Law.
i. Meaningful Use Data Elements within the Clinical Summary or Discharge Summary
MU2 Summary Types. The preferred format is XML formatted according to C-CDA r2
specifications.
ii. Inbound and Outbound from NC HealthConnex:
1. Inbound Feed to NC HealthConnex
ESO Suite v5.16.1764.0
Zac Taylor
zac.taylor@eso.com
9199036252
✔
✔
✔
✔
✔
✔
✔
DocuSign Envelope ID: 47B4445A-C7CA-4D2E-9075-2AFD82F82DEC
33
a. ADT Feed –Establish identity with the NC HIEA
i. Standard HL7 v2 or v3 PIF or ADT message. This may vary
with each approved participant
b. ITI-41 –Provide and register document set (PnR)
i. CCDA is the preferred document format, but other formats
may be acceptable
2. Query Interface from NC HealthConnex
a. ITI-9 –PIX Query (Patient Identity)
b. ITI-18 –Registry Stored Query (RSQ)
c. ITI-43 –Retrieve Document Set (RDS)
i. The response may include CCD (C32), CCDA documents, any
other document format submitted by other NC HealthConnex
participants
E+/6XEPLVVLRQWR1&+,($3DUWLFLSDQWVZKRFDQQRWVHQGWKHGDWDHOHPHQWVDQGIHHGV
FRQWDLQHGLQVXEVHFWLRQ D RIWKLV$WWDFKPHQWVKDOOVXEPLWWKHIROORZLQJPHVVDJHW\SHVWRWKH
H[WHQWSRVVLEOHIRUDWDPLQLPXPDOOGDWDSHUWDLQLQJWR0HGLFDLG6WDWH+HDOWK3ODQDQG6WDWH
IXQGHGKHDOWKVHUYLFHVSURYLGHGE\3DUWLFLSDQWDVUHTXLUHGE\$SSOLFDEOH/DZ
L +/9HUVLRQ[
$'7
D 5HTXLUHG6HJPHQWV06+(913,'
E 2SWLRQDO±3'1.3939 SUHIHUUHG $/ SUHIHUUHG '*
SUHIHUUHG 35 SUHIHUUHG
258
D 5HTXLUHG6HJPHQWV±06+(913,'
E 2SWLRQDO±3925&2%517(2%; SUHIHUUHG 2%;17(
SUHIHUUHG
0HGLFDWLRQ
D 2032 ±3KDUPDF\7UHDWPHQW2UGHU
E 5'(23KDUPDF\7UHDWPHQW(QFRGHG2UGHU
F 5'623KDUPDF\7UHDWPHQW'LVSHQVH
G 5$62±3KDUPDF\7UHDWPHQW$GPLQLVWUDWLRQ
H
F ,I3DUWLFLSDQWFKRRVHVWRVXEPLWDGGLWLRQDOGDWDUHODWHGWRQRQ6WDWHIXQGHGKHDOWKFDUHVHUYLFHV
LQDGGLWLRQWRZKDWLVUHTXLUHGE\ODZ3DUWLFLSDQWVKRXOGDOVRVXEPLWWKHDIRUHPHQWLRQHGGDWD
HOHPHQWVLQ D DQG E WRWKHH[WHQWSRVVLEOH3DUWLFLSDQWPD\DOVRVXEPLWGDWDEH\RQGWKH
7DUJHWHG'DWD6WDQGDUGVIRU6WDWHIXQGHGDQGQRQ6WDWHIXQGHGKHDOWKFDUHVHUYLFHV
Onboarding Process Summary
This summary presents a high level overview of the process to connect your organization to NC HealthConnex.
These steps are subject to change based on the availability of technical resources and functionality of your
organization, your EHR vendor, and NC HIEA and SAS.
1.NC HIEA will notify SAS of the receipt of your organization’s fully executed Participation Agreement
and of the contact information you provided in Attachment 2. Please note: Failure to provide contact
information in Attachment 2 will slow the processing of your agreement and your connection to NC
HealthConnex.
2. SAS will contact your technical services contact person to verify the technical information requested
above and to gather contact information for other technical partners your organization may have.
3.NC HIEA will contact your organization to discuss your organization’s user training needs along with
clinician and patient education on NC HealthConnex.
DocuSign Envelope ID: 47B4445A-C7CA-4D2E-9075-2AFD82F82DEC
34
4. The next steps depend on the type of data connection your organization will have to NC HealthConnex.
a. For a Virtual Private Network (VPN) connection:
i. Your organization must complete a VPN connection document.
ii. SAS and your technical resources will build a VPN tunnel to your EHR and will
coordinate testing with your organization.
iii. Test Data will be sent to the Test/stage environment. Any issues will be documented
and resolved.
iv. Prior to sending data to the production environment, you will be required to provide
User Acceptance Approval.
v. Data feeds will be promoted to the production environment when all Parties are
mutually satisfied with the interface build. Your data will be validated by SAS in
collaboration with your technical resource staff and any issues will be documented and
resolved.
vi. NC HIEA will notify your organization that you have been successfully connected to
NC HealthConnex and your Participant Account Administrator will be provided user
credentials for the NC HealthConnex Clinical Portal. Training and education materials
will be made available to your organization as well.
b. For a Batch Secure File Transport Protocol (SFTP) connection:
i. Your organization will be assigned to a SAS data connector vendor, who will work with
your organization and/or EHR Vendor to build connection to NC HealthConnex. This
will require installing software on your EHR system.
ii. SAS will implement a daily secure batch transfer of data.
iii. The data connector vendor will test file transfers from your EHR to NC HealthConnex.
iv. Data will be sent to the Test/stage environment. Any issues will be troubleshooted.
v. Prior to sending data to the production environment, you will be required to provide
User Acceptance Approval.
vi. Data will be sent to the production environment when all Parties are mutually satisfied
with the interface build. Your data will be validated by SAS in collaboration with your
technical resource staff.. Any issues will be troubleshooted.
vii. NC HIEA will notify your organization that you have been successfully connected to
NC HealthConnex and your Participant Account Administrator will be provided user
credentials for the Clinical Portal, if needed. Training and education materials will be
made available to your organization as well.
c. For connections built through hubs or interfaces to the NC HealthConnex environment by your
EHR vendor, the Onboarding process will depend on your EHR vendor’s system and
capabilities, along with any previous work completed by NC HIEA and SAS with your EHR
vendor.
d. Similarly, if your organization will have HIE Data integrated into your EHR Product, you may
not require credentials to access the NC HealthConnex Clinical Portal. Further steps will need
to be taken to build and test a bidirectional data connection to your EHR Product. You and your
EHR vendor must collaborate with SAS to accomplish integration of HIE Data into your EHR
Product. This will require your organization to sign off after the integration is tested prior to
production data flowing to your EHR Product.
5. Once your connection is established and you have access to NC HealthConnex, any technical issues
your Authorized Users encounter should be directed to the SAS Help Desk at HIESupport@SAS.com.
Please also consult the Technical Support information provided in Attachment 10.
DocuSign Envelope ID: 47B4445A-C7CA-4D2E-9075-2AFD82F82DEC
35
Attachment 4
Participating Entities & Facility Locations
Please complete this Attachment if your organization has control over Participating Entities as defined in Section 2.37 that your organization is signing the
agreement and submitting HIE Data on behalf of. Please include information for all facility locations that are a part of your organization. Please only
provide the organization NPI for your Participating Entities or facilities, do not list individual provider NPIs. If you need more space, please attach a
separate document, e.g. an Excel spreadsheet, labeled “Attachment 4” to this Agreement with the information requested below.
Legal Entity Name Address Organization NPI Participant Account
Administrator Email Phone
1
2
3
4
5
6
7
8
9
10
DocuSign Envelope ID: 47B4445A-C7CA-4D2E-9075-2AFD82F82DEC
36
Attachment 5
Business Associate Agreement
This Business Associate Agreement (“BAA”) is made effective on the date of execution by both
parties of the Participation Agreement, by and between
______________________________________________________________ (name of Participant) (“Covered
Entity”) and the North Carolina Health Information Exchange Authority (“Business Associate”) (collectively the
“Parties”).
1. BACKGROUND
a. Covered Entity and Business Associate are parties to the NC HIEA Full Participation Agreement for NC
HealthConnex Access and Data Use (the “Participation Agreement”), whereby Business Associate agrees
to perform certain services for or on behalf of Covered Entity.
b. The relationship between Covered Entity and Business Associate is such that the Parties believe Business
Associate is or may be a “business associate” within the meaning of the HIPAA Privacy Rule.
c. The Parties enter into this Business Associate Addendum to the Participation Agreement with the
intention of complying with the HIPAA Privacy Rule provision that a covered entity may disclose
protected health information to a business associate, and may allow a business associate to create or
receive protected heath information on its behalf, if the covered entity obtains satisfactory assurances that
the business associate will appropriately safeguard the information.
2. DEFINITIONS
Unless some other meaning is clearly indicated by the context, the following terms shall have the following
meaning in this BAA:
a. “Electronic Protected Health Information” shall have the same meaning as the term “electronic protected
health information” in 45 C.F.R. § 160.103.
b. “HIPAA” means the Administrative Simplification Provisions, Sections 261 through 264, of the federal
Health Insurance Portability and Accountability Act of 1996, Public Law 104-191, as modified and
amended by the Health Information Technology for Economic and Clinical Health (“HITECH”) Act, Title
XIII of Division A and Title IV of Division B of the American Recovery and Reinvestment Act of 2009,
Public Law 111-5.
c. “Individual” shall have the same meaning as the term “individual” in 45 C.F.R. § 160.103 and shall
include a person who qualifies as a personal representative in accordance with 45 C.F.R. § 164.502(g).
d. “Privacy Rule” shall mean the Standards for Privacy of Individually Identifiable Health Information at 45
C.F.R. Part 160 and Part 164.
e. “Protected Health Information” shall have the same meaning as the term “protected health information”
in 45 C.F.R. § 160.103, limited to the information created or received by Business Associate from or on
behalf of Covered Entity.
f. “Required By Law” shall have the same meaning as the term “required by law” in 45 C.F.R. § 164.103.
g. “Secretary” shall mean the Secretary of the United States Department of Health and Human Services or
the person to whom the authority involved has been delegated.
h. Unless otherwise defined in this BAA, terms used herein shall have the same meaning as those terms have
in the Privacy Rule.
3. OBLIGATIONS OF BUSINESS ASSOCIATE
a. Business Associate agrees to not use or disclose Protected Health Information other than as permitted or
required by this BAA, the Participation Agreement, or as Required By Law.
b. Business Associate agrees to use appropriate safeguards and comply, where applicable, with subpart C of
45 C.F.R. Part 164 with respect to electronic protected health information, to prevent use or disclosure of
the Protected Health Information other than as provided for by this BAA.
c. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to
Business Associate of a use or disclosure of Protected Health Information by Business Associate in
violation of the requirements of this BAA.
Orange County, North Carolina by and through its "Emergency Services Department"
DocuSign Envelope ID: 47B4445A-C7CA-4D2E-9075-2AFD82F82DEC
37
d. Business Associate agrees to report to Covered Entity any use or disclosure of the Protected Health
Information not provided for by this BAA of which it becomes aware, including breaches of unsecured
protected health information as required by 45 C.F.R. § 164.410.
e. Business Associate agrees, in accordance with 45 C.F.R. § 164.502(e)(1) and § 164.308(b)(2), to ensure
that any subcontractors that create, receive, maintain, or transmit protected health information on behalf
of Business Associate agree to the same restrictions and conditions that apply to Business Associate with
respect to such information.
f. Business Associate agrees to make available protected health information as necessary to satisfy Covered
Entity’s obligations in accordance with 45 C.F.R. § 164.524.
g. Business Associate agrees to make available Protected Health Information for amendment and incorporate
any amendment(s) to Protected Health Information in accordance with 45 C.F.R. § 164.526.
h. Unless otherwise prohibited by law, Business Associate agrees to make internal practices, books, and
records relating to the use and disclosure of Protected Health Information received from, or created or
received by Business Associate on behalf of, Covered Entity available to the Secretary for purposes of
the Secretary determining Covered Entity's compliance with the Privacy Rule.
i. Business Associate agrees to make available the information required to provide an accounting of
disclosures of Protected Health Information in accordance with 45 C.F.R. § 164.528.
4. PERMITTED USES AND DISCLOSURES
a. Except as otherwise limited in this BAA or by other applicable law or agreement, if the Participation
Agreement permits, Business Associate may use or disclose Protected Health Information to perform
functions, activities, or services for, or on behalf of, Covered Entity as specified in the Participation
Agreement, provided that such use or disclosure:
1) would not violate the Privacy Rule if done by Covered Entity; or
2) would not violate the minimum necessary policies and procedures of the Covered Entity.
b. Except as otherwise limited in this BAA or by other applicable law or agreements, if the Participation
Agreement permits, Business Associate may disclose Protected Health Information for the proper
management and administration of the Business Associate or to carry out the legal responsibilities of the
Business Associate, provided that:
1) the disclosures are Required By Law; or
2) Business Associate obtains reasonable assurances from the person to whom the information is
disclosed that it will remain confidential and will be used or further disclosed only as Required By
Law or for the purpose for which it was disclosed to the person, and the person notifies the Business
Associate of any instances of which it is aware in which the confidentiality of the information has
been breached.
c. Except as otherwise limited in this BAA or by other applicable law or agreements, if the Participation
Agreement permits, Business Associate may use Protected Health Information to provide data aggregation
services to Covered Entity as permitted by 45 C.F.R. § 164.504(e)(2)(i)(B).
d. Notwithstanding the foregoing provisions, Business Associate may not use or disclose Protected Health
Information if the use or disclosure would violate any term of the Participation Agreement or other
applicable law or agreements.
5. TERM AND TERMINATION
a. Term. This BAA shall be effective as of the effective date stated above and shall terminate when the
Participation Agreement terminates.
b. Termination for Cause. Upon Covered Entity's knowledge of a material breach by Business Associate,
Covered Entity may, at its option:
1) Provide an opportunity for Business Associate to cure the breach or end the violation, and terminate
this BAA and services provided by Business Associate, to the extent permissible by law, if Business
Associate does not cure the breach or end the violation within the time specified by Covered Entity;
2) Immediately terminate this BAA and services provided by Business Associate, to the extent
permissible by law; or
3) If neither termination nor cure is feasible, report the violation to the Secretary as provided in the
Privacy Rule.
DocuSign Envelope ID: 47B4445A-C7CA-4D2E-9075-2AFD82F82DEC
38
c. Effect of Termination.
1) Except as provided in paragraph (2) of this section or in the Participation Agreement or by other
applicable law or agreements, upon termination of this BAA and services provided by Business
Associate, for any reason, Business Associate shall return or destroy all Protected Health
Information received from Covered Entity, or created or received by Business Associate on behalf
of Covered Entity. This provision shall apply to Protected Health Information that is in the
possession of subcontractors or agents of Business Associate. Business Associate shall retain no
copies of the Protected Health Information.
2) In the event that Business Associate determines that returning or destroying the Protected Health
Information is not feasible, Business Associate shall provide to Covered Entity notification of the
conditions that make return or destruction not feasible. Business Associate shall extend the
protections of this BAA to such Protected Health Information and limit further uses and disclosures
of such Protected Health Information to those purposes that make the return or destruction
infeasible, for so long as Business Associate maintains such Protected Health Information.
6. GENERAL TERMS AND CONDITIONS
a. This BAA is part of the Participation Agreement.
b. Except as provided in this BAA, all terms and conditions of the Participation Agreement shall remain in
force and shall apply to this BAA as if set forth fully herein.
c. In the event of a conflict in terms between this BAA and the Participation Agreement, the interpretation
that is in accordance with the Privacy Rule shall prevail. In the event that a conflict then remains within
this BAA, the BAA terms shall prevail so long as they are in accordance with the Privacy Rule.
d. A breach of this BAA by Business Associate shall be considered sufficient basis for Covered Entity to
terminate the Participation Agreement for cause.
IN WITNESS WHEREOF, the Parties have executed this Business Associate Agreement as of the day and
year written above.
Covered Entity:
Participant Organization Name:
By:
Authorized Signature
Name:
Title:
Date:
Business Associate:
North Carolina Health Information Exchange
Authority
By:
Authorized Signature
Name:
Title:
Date:
Dinah Jeffries
Emergency Services Director
Orange County, North Carolina by and through its "Emergency Services Department"
DocuSign Envelope ID: 47B4445A-C7CA-4D2E-9075-2AFD82F82DEC
39
Attachment 6
NC HIEA Policies and Procedures
The NC HIEA Policies are located here: https://hiea.nc.gov/providers/nc-hiea-policies
DocuSign Envelope ID: 47B4445A-C7CA-4D2E-9075-2AFD82F82DEC
40
Attachment 7
HIE Features
NC HIEA reserves the right to amend, terminate, or add additional HIE Features at any time. The availability of
HIE Features to individual Participants depends on various factors, including the technical capabilities of NC
HealthConnex and your organization. Please contact NC HIEA staff at HIEA@NC.Gov to find out more
information about our offerings and refer to the NC HIEA website for a list of updated HIE Features at:
https://hiea.nc.gov/nc-healthconnex-value-added-features.
Feature Definition
NC HealthConnex Clinical
Portal
NC HIEA will provider Authorized Users access to the Clinical Portal. This
Clinical Portal can be used to view the longitudinal patient record, set alerts and
notifications, and to access other HIE Features.
Provider Directory
NC HIEA will provide a Provider Directory to Authorized Users containing the
secure email addresses of NC HealthConnex Participants and North Carolina
providers participating in DirectTrust.
Direct Secure Messaging
NC HIEA will provide Authorized Users with an ONC-compliant Direct Secure
Messaging service, if desired. Each Authorized User will be provided with a
unique address assigned in the NC HIEA Direct domain. Users will have the
ability to append files containing Protected Health Information to their Direct
messages.
NC Immunization
Registry
If available to Participant, NC HIEA will provide one way or bi-directional
routing of patient immunization information through a common NC
HealthConnex interface with the NC Immunization Registry.
Electronic Laboratory
Reporting
When available, hospitals can send electronic laboratory reports identifying
required reportable communicable diseases and conditions to the Division Public
Health.
eHealth Exchange
When available, NC HIEA will enable Participants to query the eHealth
Exchange participants through the Clinical Portal. Approved eHealth Exchange
participants will be able to query NC HealthConnex, as well.
A connection with the Georgia Health Information Network is currently live, and
a connection the U.S. Department of Veterans Affairs will be live in early 2018.
Other eHealth Exchange participants will be added on an ongoing basis.
A disease registry is a tool for tracking the clinical care and outcomes
of a defined patient population. Data included in the registry can be
important in assisting public health authorities and clinicians with
appropriate preventive maintenance and disease management. Disease
registries will extract relevant data from the NC HealthConnex system
without any special effort required by Participants unless otherwise
noted.
Starting in June 2018, NC HIEA and the Division of Public Health will launch
the Diabetes Registry. Relevant submitted to NC HealthConnex will be included
in the Diabetes Registry. The NC HealthConnex Diabetes Registry supports
attestation for Meaningful Use Stage 3 and Modified Stage 2 for eligible
providers.
'LVHDVH5HJLVWULHV
DocuSign Envelope ID: 47B4445A-C7CA-4D2E-9075-2AFD82F82DEC
41
Feature Definition
This feature allows a Participant to subscribe to alerts for a subset of their patient
population to support care coordination. It is a file-based subscription service
which provides notifications of admission and discharge events for a custom
patient population. As an example, Clinical Notifications will allow a Participant
to know when and where their selected patient(s) has an encounter at another
participant’s facility.
Training NC HIEA offers training for Clinical Portal use, DSM, and other HIE Features as
determined by NC HIEA.
&OLQLFDO1RWLILFDWLRQV
DocuSign Envelope ID: 47B4445A-C7CA-4D2E-9075-2AFD82F82DEC
42
Attachment 8
Fee Schedule
This Fee Schedule is provided to Participant as part of this Participation Agreement and is effective on
the date of execution by and between NC HIEA and Participant and any capitalized terms which appear herein
shall have the same meaning as given in the Agreement unless otherwise noted.
NC HIEA –Bundled Services –Subscription Fees
Description Standard Price Fees
Full Participant Package $0.00 $0.00
TOTAL FEES AND INVOICING
Total subscription fees for this Fee Schedule are $0.00.
DocuSign Envelope ID: 47B4445A-C7CA-4D2E-9075-2AFD82F82DEC
43
Attachment 9
eHealth Exchange Terms and Conditions
1.1 Participation by NC HIEA in the national eHealth Exchange, through execution of the DURSA,
requires that NC HIEA replicate terms and policies found in the DURSA in NC HIEA Participation
Agreements or governance policies. Participants shall comply with the following requirements,
which shall apply solely when the parties, through NC HealthConnex, acquire, access, use, or
Disclose Protected Health Information over the eHealth Exchange. Capitalized terms not defined in
the Participation Agreement can be found in the DURSA or in the NC HIEA Privacy and Security
Policy.
1.1.1 Permitted Purposes for Transacting Message Content.The permitted purposes for which
Participants or Participant Users may legitimately Transact Message Content over the
eHealth Exchange through NC HealthConnex are as follows:
a. Treatment of the individual who is the subject of the Message;
b. Payment activities of the Health Care Provider for the individual who is the subject
of the Message which includes, but is not limited to, Transacting Message Content in
response to or to support a claim for reimbursement submitted by a Health Care
Provider to a Health Plan;
c. Health Care Operations of either:
i. the Submitter if the Submitter is a Covered Entity;
ii. a Covered Entity if the Submitter is Transacting Message Content on behalf
of such Covered Entity; or
iii. the Recipient if (a) the Recipient is a Health Care Provider who has an
established Treatment relationship with the individual who is the subject of
the Message or the Recipient is Transacting Message Content on behalf of
such Health Care Provider; and (b) the purpose of the Transaction is for
those Health Care Operations listed in paragraphs (1) or (2) of the definition
of Health Care Operations in 45 C.F.R. § 164.501 or health care fraud and
abuse detection or compliance of such Health Care Provider;
d. Public health activities and reporting as permitted by Applicable Law, including the
HIPAA Regulations at 45 C.F.R. § 164.512(b) or 164.514(e);
e. Any purpose to demonstrate meaningful use of certified electronic health record
technology by the (i) Submitter, (ii) Recipient or (iii) Covered Entity on whose
behalf the Submitter or the Recipient may properly Transact Message Content under
this Agreement, provided that the purpose is not otherwise described in subsections
1-4 of this definition and the purpose is permitted by Applicable Law, including but
not limited to the HIPAA regulations. “Meaningful use of certified electronic health
record technology” shall have the meaning assigned to it in the regulations
promulgated by the Department of Health and Human Services under the American
Recovery and Reinvestment Act, Sections 4101 and 4102; and
f. Uses and disclosures pursuant to an Authorization provided by the individual who is
the subject of the Message or such individual’s personal representative as described
in 45 C.F.R. § 164.502(g) of the HIPAA Regulations.
1.1.2 Participants must Transact Message Content over the eHealth Exchange in accordance with the
terms of the DURSA and must comply with the eHealth Exchange Performance and Service
Specifications and the Operating Policies and Procedures. These policies are available at the
DocuSign Envelope ID: 47B4445A-C7CA-4D2E-9075-2AFD82F82DEC
44
eHealth Exchange website available here: http://sequoiaproject.org/ehealth-
exchange/onboarding/.
1.1.3 Except to the extent prohibited by Applicable Law, Participants shall provide information
that is reasonably requested of it by NC HIEA or by the eHealth Exchange Coordinating
Committee for the following purposes, as described in Section 4.03 of the Restatement I to
the DURSA. Such purposes include for the Coordinating Committee: to determine whether
Participant may exchange Protected Health Information over the eHealth Exchange; to
receive and act upon reports of eHealth Exchange Breaches; to suspend or terminate the right
of NC HIEA or Participant to exchange Protected Health Information over the eHealth
Exchange; to resolve disputes pertaining to the eHealth Exchange; or to fulfill other
responsibilities delegated to the Coordinating Committee. Participant shall not be required to
disclose PHI to the Coordinating Committee in violation of Applicable Law. Any
information other than Protected Health Information provided to the Coordinating Committee
shall be labeled as confidential business information.
1.1.4 NC HIEA may voluntarily suspend or terminate, or the Coordinating Committee may
suspend or terminate, NC HIEA’s right to exchange Protected Health Information over the
eHealth Exchange. If any such suspension or termination occurs, NC HIEA will notify
Participant of the action as soon as reasonably possible. If an act or omission of Participant
is the reason such suspension or termination occurs, Participant shall cooperate with NC
HIEA to submit an appeal or a plan of correction to the Coordinating Committee, as
applicable, as quickly as practicable.
1.2 Required Alternative Dispute Resolution. Participants shall submit any disputes related to their
exchange of Protected Health Information over the eHealth Exchange to the non-binding Dispute
Resolution Process as required by the DURSA and outlined below. If all of the parties involved in
the dispute accept a proposed resolution of the dispute, Participant shall implement the terms of the
resolution in the agreed upon time frame. Following the Dispute Resolution Process, Participant may
pursue alternative remedies if it believes that the Dispute Resolution Process failed to adequately
resolve the dispute.
1.2.1 When a Dispute arises, a Participant shall send written Notice, in accordance with the Notice
provision in the DURSA, to the other Participant(s) involved in the Dispute. The notice must
contain a summary of the issue as well as a recommendation for resolution. The Participant
must send a copy of the notice to the Dispute Resolution Subcommittee (see below) for
informational purposes.
1.2.2 Within thirty (30) calendar days of receiving the notice, the Participants are obligated to meet
and confer with each other, at least once in good faith and at a mutually agreeable location
(or by telephone), to try to reach resolution (the "Informal Conference"). If the Participants
reach a resolution at the Informal Conference, they shall provide Notification to that effect to
the Dispute Resolution Committee.
1.2.3 If the Participants are unable to participate in an Informal Conference during the thirty (30)
calendar day period or to reach resolution at the Informal Conference, they have ten (10)
business days following the end of the thirty (30) calendar day period or the Informal
Conference, respectively, in which to escalate the Dispute to the Dispute Resolution
Subcommittee in writing.
a. The Dispute Resolution Subcommittee (the "Subcommittee") will be a five (5)
member standing subcommittee of the Coordinating Committee. The Coordinating
DocuSign Envelope ID: 47B4445A-C7CA-4D2E-9075-2AFD82F82DEC
45
Committee shall appoint each member of the Subcommittee for a definite term. The
members must be representative of the Participants, have diverse skill sets, and be
able to help facilitate and reach resolution on conflicts between the Participants. The
Subcommittee must have access to legal counsel to advise it on the law relevant to
matters before it.
b. In addition to appointing the five (5) members of the Subcommittee, the
Coordinating Committee must also appoint three (3) to five (5) alternates for the
Subcommittee. Alternates will serve on the Subcommittee should any of the
members have a conflict on a particular Dispute or in the event that a member(s) is
unavailable. Subcommittee members are required to declare any conflicts in
accordance with the Coordinating Committee's conflict of interest policy. Once a
Subcommittee member declares a conflict, the remaining Subcommittee members
shall decide amongst themselves whether such member must withdraw from the
Subcommittee for the dispute in question.
c. The Subcommittee must also have access to panels of subject matter experts, as
identified by the Coordinating Committee, for a variety of topics that may be
implicated by a Dispute. Each subject matter expert panel must have at least three
(3) experts on it who will rotate as advisors to the Subcommittee.
1.2.4 Once a Participant escalates a Dispute to the Subcommittee, the Subcommittee will have
thirty (30) calendar days in which to convene a meeting of the involved Participants
("Committee Meeting"). During this meeting, each Participant shall be able to present its
version of the Dispute and any information that it believes is pertinent to the Subcommittee's
decision.
1.2.5 The Subcommittee shall have the ability to request additional information from the
Participants to help it make its determination. The Subcommittee, however, shall not have
the authority to compel a response or the production of testimony or documents by the
Participants. To the extent that the Participants do respond to requests of the Subcommittee
by producing documents, Participants shall have the ability to mark the documents produced
as "Confidential Participant Information" and the Subcommittee shall treat those documents
in accordance with Section 16 of the DURSA.
1.2.6 The Subcommittee is encouraged to develop an appropriate and equitable resolution of each
submitted Dispute, considering all available evidence, the goals of the Agreement and other
relevant considerations. The Subcommittee must also have the authority to recommend
sanctions for the breaching Participant. These sanctions include developing corrective action
plans, suspension of participation rights, and termination of participation rights. The type of
sanction will depend on the nature and severity of the breach.
1.2.7 Within fifteen (15) calendar days of the Subcommittee Meeting, the Subcommittee shall
issue a written recommendation for resolution, including an explanation of the basis and
rationale of its recommendation. If either Participant is dissatisfied with the Subcommittee's
recommendation for resolution, it shall have five (5) business days in which to escalate the
Dispute to the Coordinating Committee.
1.2.8 Within twenty (20) calendar days of receiving notice of escalation from a Participant, the
Coordinating Committee shall review the Subcommittee's recommendation along with the
information on which such recommendation was based and issue a final resolution. The
Coordinating Committee may seek additional information from the Participants to aid its
resolution of the Dispute.
DocuSign Envelope ID: 47B4445A-C7CA-4D2E-9075-2AFD82F82DEC
46
1.2.9 Within seven (7) calendar days of receiving the final resolution from the Coordinating
Committee, the Participants shall determine whether to accept or reject the resolution and so
notify the Coordinating Committee.
1.2.10 The Coordinating Committee shall send a written summary of the resolution of the Dispute to
all Participants. The summary will not identify the Participants involved, but will contain
sufficient detail about the resolution to serve as an instructive resource for other Participants.
1.2.11 In no case shall a Participant be required to disclose PHI in violation of Applicable Law as
part of its participation in the Dispute Resolution Process. The decision to not disclose PHI
shall not be held against a Participant in the Dispute Resolution Process.
DocuSign Envelope ID: 47B4445A-C7CA-4D2E-9075-2AFD82F82DEC
47
Attachment 10
Technical Support
For more information on capitalized terms used in this Attachment but not defined in the Participation Agreement,
please direct any questions to the SAS Technical Support Team.
Contacting the NC HealthConnex Technical Support Team
SAS NC HealthConnex Participant Account Administrator Assignment:
■The designated NC HealthConnex Participant Account Administrator (PAA) is recognized as the point
of contact to utilize the SAS NC HealthConnex Technical Support Team and Help Desk.
■If the PAA chooses to add additional PAA that will coordinate with SAS, the existing PAA should
communicate the additional PAA’s name and contact information to the SAS NC HealthConnex Technical
Support Team at HIEsupport@sas.com. Please also communicate any future changes to administration so
that contact information will be kept up to date.
■All Authorized Users from your organization should communicate any questions they have about usage
of NC HealthConnex to their PAA. The PAA should first try to answer the question for their Authorized
Users. If they are unable to answer the question or has discovered an issue with the application, they should
then direct questions, themselves, to the SAS NC HealthConnex Technical Support Team on behalf of their
Authorized Users using one of the options below.
NC HealthConnex Technical Support Communication Options:
As a PAA, you have three options for communicating with our SAS NC HealthConnex Technical Support team:
SAS Email Support: HIESupport@sas.com
SAS Phone Support: (919) 531-2700
SAS Technical Support Form: http://support.sas.com/ctx/supportform/createForm
In the “Product” field, select “NC Health Information Exchange (HIE) -HealthConnex”
All three options are tied closely with our customer issue tracking/ticketing systems, which ensures documentation
of all issues and conversations, as well as providing timely responses and feedback. Details of how to use each
option is listed below. If you have questions about the options reach out to us. We are happy to help you determine
the best option for your organization.
Note: Please use only these three options. Avoid communication via individual email accounts and phone
extensions. This ensures that the entire team knows about all issues submitted and that all team members
have backup in case they are away from their desk or office. If you have been working with a specific Analyst
on an issue, you will be forwarded to them so they may continue to assist you (or you may request that this
occurs).
General Technical Support Hours of Operation:
■Monday through Friday 8:00 a.m. to 8:00 p.m. Eastern Time
■See details below for after-hours emergency and outage support
Information you should provide (regardless of the communication option you utilize)
■Contact name
■Contact email address
■Company name
■Company site number (it will start with “HIENCQ-#”)
■Problem description
■Steps to reproduce and demonstrate the issue
■Results the user received (for example, if there was an error message what did it state, expected results
were incorrect and how, etc.)
■Screen shots showing the error message as well as input prior to the error occurring
■Time, date and user experiencing the issue
■Client workstation details if appropriate (browser version, operating system, etc.)
DocuSign Envelope ID: 47B4445A-C7CA-4D2E-9075-2AFD82F82DEC
48
■Is it an isolated incident or on going?
■IT contact name, if applicable
Escalations:
If at any point you need to escalate an issue during regular business hours, feel free to contact Arnold Cota, Team
Lead-SAS NC HealthConnex Technical Support, at 919-531-3372 or Arnold.Cota@SAS.com. It is helpful if you
can provide your SAS supplied 10-digit Track number (see details on the 10-digit Track number below).
Severity Levels and Response Times:
Sev
Level Condition Initial
Follow-up*Update Frequency
1
Critical: A critical SAS NC HealthConnex
production system is down or does not function
at all, and there is no circumvention or
workaround for the problem; a significant
number of users are affected, and a production
business system is inoperable.
30 minutes Every day
2
High Severity: A component of SAS NC
HealthConnex is not performing, creating
a significant operational impact. There is no
circumvention/workaround for the problem.
1 hour Every 2 business
days**
Note: All Severity 1 and 2 issues occurring outside 8 am to 8 pm ET must be submitted via
phone to guarantee response times listed.
3
Medium Severity: A component of SAS NC
HealthConnex is not performing as
documented; there are unexpected results; a
workaround is available; there is moderate
operational impact.
2 hours***Every 3 business
days
4 Low Severity: No operational impact to NC
HealthConnex 1 day***As agreed upon
* For problems that are assigned to a Technical Support consultant, initial follow-up is defined
as the time between when the problem is initially reported and the specialist contacts the
customer. For problems that require further research by the consultant who initially received the
problem, initial follow-up is defined as the time between the initial contact with the consultant
and a follow-up call.
** Follow-up as agreed upon by Customer Management and SAS Technical Support
Management
*** Does not include weekend or other non-business days
DocuSign Envelope ID: 47B4445A-C7CA-4D2E-9075-2AFD82F82DEC
49
Technical Support Communication Options Details:
Email Support:
Please send all email requests or issue communication to HIESupport@sas.com.
■Your email will go directly to the SAS NC HealthConnex Technical Support Team, a new issue Track
will be created, and a 10-digit Track number will be assigned/emailed to you. This 10-digit Track number is
important and should be used in all on-going issue communication.
■You can update an existing Track by sending the existing 10-digitTrack number in the subject line to
HIESupport@sas.com or by replying to the new Track confirmation email you receive. All members of the
SAS NC HealthConnex support team are immediately notified when a Track is raised in this manner, as is
the Analyst who is currently assisting you.
■Verify that any email SPAM software will not block our e-mail responses (from either
HIEsupport@sas.com or technicalsupport@sas.com)
■Please be detailed in your problem description by including the following information:
x Steps to reproduce and demonstrate the issue
x Results the user received (for example, if there was an error message what did it state, expected
results were incorrect and how, etc.)?
x Screen shots showing the error message as well as input prior to the error occurring
x Time, date and user experiencing the issue
x Client workstation details if appropriate (browser version, operating system, etc.)
x Is it an isolated incident or on going?
■Please refrain from contacting the support team via direct email addresses. Our goal is to respond to
you as quickly as possible and document all communication around a specific issue. If you email an
Analyst directly, and that person is away or on vacation, you may experience delays in response
times. Emailing the support address guarantees the email will be handled quickly and the details of your
communication will be captured in the issue tracking system via the 10-digit Track number.
Note:All Severity 1 and 2 issues occurring outside 8 am to 8 pm ET must be submitted via phone to guarantee
response times listed above.
Phone Support:
Please use the following phone number to call the SAS NC HealthConnex Technical Support Team: (919) 531-
2700press option “2”
■You will then be prompted to enter "1" if you have a Track number (an existing issue) or enter "2" to
speak with the operator (a new issue).
x If this is an existing issue, please locate your SAS NC HealthConnex 10-digit Track number prior
to making the call and provide it when prompted.
x If this is a new issue, the Technical Support Analyst will provide a 10-digit issue Track number
during the call (be sure to ask for one if you do not receive it!).
■If you entered "1" you will be routed to the Track owner during normal business hours (8 am -8 pm
Eastern Time).
■A Technical Support Analyst will answer the call.Between 8:00 AM and 8:00 PM EST, ask to speak
with a NC HealthConnex Technical Support Representative if they do not identify themselves as such.
If after hours, and not an emergency, you can leave a message for technical support.
Note:All Severity 1 and 2 issues occurring outside 8 am to 8 pm ET must be submitted via phone to guarantee
response times listed above.
SAS Technical Support Form:
Please submit your issue via the online form at http://support.sas.com/ctx/supportform/createForm
DocuSign Envelope ID: 47B4445A-C7CA-4D2E-9075-2AFD82F82DEC
50
■Before you proceed you should:
x Report urgent or critical problems by phone (see steps above)
x Verify that any email SPAM software will not block our e-mail responses (from either
HIEsupport@sas.com or technicalsupport@sas.com)
■Enter the basic Information on the form to create a Track with SAS NC HealthConnex Technical
Support. If you want to update an existing Track you can do so at
http://support.sas.com/ctx/supportform/updateForm..
■Problem Description - Be sure to include the following information:
x Steps to reproduce and demonstrate the issue
x Results the user received (for example, if there was an error message what did it state, expected
results were incorrect and how, etc.)?
x Screen shots showing the error message as well as input prior to the error occurring
x Time, date and user experiencing the issue
x Client workstation details if appropriate (browser version, operating system, etc.)
x Is it an isolated incident or on going?
■After you supply the basic information, click “Next Page” to proceed. Otherwise click “Reset” to start
over
■Shortly after you submit the form, you will receive an automatic e-mail that:
x Confirms that you have submitted the form successfully
x Provides the 10-digit Track number that has been assigned to your e-mail request. You will use
this number to identify your issue moving forward.
Emergency Issues After-Hours
If your organization experiences a total NC HealthConnex system or operational failure; this is considered a
critical Severity 1 or 2 issue (see definitions above).
■Please have the PAA and/or your IT point of contact validate that the outage/issue is occurring for all
users and is not related to your facility’s systems or infrastructure.
■If your contract states you have 24-hour support for Emergency Issues, please call the SAS phone
support lines for assistance, 919-677-8008 -or-800-727-0025.
x The SAS operator will forward you to a live, SAS Technical Support representative who will
gather information to initiate a Track.
x Please provide after-hours contact information for the main point of contact as well as the IT point of
contact if applicable (for example, VPN /bi-directional feed usage Participants) and ensure both are
available to help triage issues at that time (both are required for emergency tickets to be addressed
after hours if you connect to the NC HealthConnex via VPN /bi-directional feed).
x The SAS Technical Support representative will then contact an on-call SAS NC HealthConnex/SSOD
Support Representative to work with your team.
x On these occasions, you should expect a call back from a SAS NC HealthConnex/SSOD Support
representative within 2 hours of your initial contact.
x During off-hours support, you may be asked to provide your SAS Site Number.
■Because SAS cannot guarantee less than 24-hour response on problems tracked electronically, you
should report Severity 1 or 2 problems by phone. If you chose to send an email or enter a Technical
Support Form, your issue will be addressed the following business-day morning.
More information about SAS technical support services and policies can be found
at http://support.sas.com/techsup/support.html.
DocuSign Envelope ID: 47B4445A-C7CA-4D2E-9075-2AFD82F82DEC
51
Attachment 11
NC HealthConnex Diabetes Registry Registration Form
Please complete this document if you would like to demonstrate your intent to submit data to the NC HealthConnex Diabetes
Registry operated by NC HIEA in collaboration with the NC DHHS Division of Public Health. The Diabetes Registry is a
tool for tracking the clinical care and outcomes of the patient population in North Carolina diagnosed with or presenting signs
or symptoms of Diabetes. Data included in the registry will be important in assisting clinicians, the State, and other health
care stakeholders with appropriate preventive maintenance and disease management. This registry will assist your organization
and your providers to meet Meaningful Use (MU) objectives, and it should be available in mid-2018.
In order to support your organization’s MU attestation, your organization will need to send out the Diabetes Registry active
engagement emails to each health care provider who is participating in the MU disease registry objective. This is an important
step so that individual providers can reference the registration confirmation emails in future audits by NC Medicaid or the
Centers for Medicaid and Medicare Services.
If you sign this form, you will receive three emails from NC HIEA. Please forward these emails to participating providers.
You will need to refer to these communications if your organization or your health care providers are audited after attesting
to Meaningful Use. The emails you should receive are as follows:
1. Registration Email: This email will demonstrate your active engagement with the Diabetes Registry by stating
that you have registered your intent to contribute to the Diabetes Registry.
2. Testing and Validation Email: This email will confirm that you are in the testing and validation process with
NC HealthConnex.
3. Live-In-Production Email: This email will state that you are submitting data to NC HealthConnex, and that
relevant data elements pertaining to patients’ diabetes diagnoses, treatments, test results, etc., will be captured
and stored in the Diabetes Registry.
Contact Person for Emails Regarding the Diabetes Registry:
Name:
Title:
Email:
Please sign below if you would like to demonstrate your intent to show active engagement with the NC HealthConnex
Diabetes Registry operated by NC HIEA in collaboration with the NC DHHS Division of Public Health
Participant Organization Name:
By:
Authorized Signature
Name:
Title:
Date:
*Please note, all data submitted to NC HealthConnex pertaining to a patient diagnosed with or showing signs of diabetes may
be included in the Diabetes Registry regardless of whether this attachment is signed.
3OHDVHQRWH 5HJLVWUDWLRQLQWKH'LDEHWHV5HJLVWU\LVYROXQWDU\,I\RXGRQRWSDUWLFLSDWHLQ0HDQLQJIXO8VHRU
RWKHULQFHQWLYHSURJUDPVSOHDVHGLVUHJDUGWKHIROORZLQJIRUP
Kyle Ronn
Quality Assurance Coordinator
kronn@orangecountync.gov
Orange County Emergency Services
Dinah Jeffries
Emergency Services Director
DocuSign Envelope ID: 47B4445A-C7CA-4D2E-9075-2AFD82F82DEC