Comments by Susan Stuard Posted on February 1, 2008

Page #	Line #	Comments/Criticisms	Suggested Alternatives
24	6-20	Required Elements for Consent Form. In order to meet their project milestones and deadlines, many HEAL 1 projects must move ahead with implementation of consent in advance of the "state approved consent form" being developed and issued. While a short list of items for the consent form are provided on page 24, it does not appear to be a comprehensive list on which HEAL 1 participants can rely to create a compliant consent form. This leaves current HEAL 1 participants in the difficult postion of trying to create, print and distribute a consent form in absence of a comprehensive list of required elements, knowing that they will incur significant costs in several months if they need to amend the form to come into compliance with the "state approve consent form."	To avoid undue administrative burden and costs to the HEAL 1 project participants, NYS DOH must issue by April 1, 2008, a comprehensive list of required elements for the "state approved consent form". This list must be comprehensive and provided in a timely fashion, even if it must be issued as guidance before the final white paper is issued. As a model, NYS DOH may want to look at the required elements of the HIPAA Notice of Privacy Practices at 45 CFR § 164.520(b).
23	1-3	IRB Waiver for Research. The current definiton of research as a Level 2 activity precludes use of a RHIO for research conducted pursuant to an Institutional Review Board (IRB) waiver. A waiver for research (including a waiver of patient consent) is granted after rigorous review by an IRB. This review includes a determination that patient confidentiality will not be compromised and that it is not feasible to contact the patients for consent for retrospective chart review.	Carve out IRB waivered research from the Level 2 definition and allow it to occur as part of Level 1 activities. Require that RHIOs create policies and procedures to govern the use of the RHIO for IRB waiver research and require that the Level 1 consent forms describe the possible use of the RHIO for this type of research
20	16-23	Deidentified Data. In its discussion of deidentified data, the white paper gives the false impression that RHIOs may not use deidentified data for the purposes of quality, population health and research until further clarification is issued.	Modfy the wording to indicate that use of deidentified data is allowable under current law and regulations. Note that the statewide collaboration process will consider and provide guidance on appropriate means to deidentify patient data.
24	34-36	Compound Authorization. The following statement may confuse the reader and should be clarified, "It may be possible to combine the HIPAA authorization and the standardized state consent form into a single document."	Clarify that per HIPAA Privacy Rule, it is only possible to have a compound HIPAA authorization in instances of research and disclosures of psychotherapy notes. See 45 CFR §164.508(b)(3).
24	40-41	Authorization Expiration Event. The requirement that "[c]onsent for Level 2 uses must be time-limited for a period specified in the notice," does not track with the HIPAA Privacy Rule potentially causing confusion and additional administrative burden.	Modify the statement to track to the HIPAA Privacy Rule which allows use of an expiration event to time limit an authorization. See 45 CFR §164.508(c)(3)(1)(iv).
32	27-32	Definition of Alcohol and Substance Abuse Information. This section effectively carves out alcohol and substance abuse information from the HIE consent form pending Federal guidance from SAMHSA.	Confirm that the information being carved out is that information governed by the Federal definition under 42 CFR Part 2 and not alcohol and substance abuse information that might be gathered in a regular medical facility that is not licensed as Federally certified alcohol and sunstance abuse treatment program.
18	8-11	Scope is SHIN-NY and RHIOs. On page 18, the scope for the HIE consent requirement is defined as just the SHIN-NY and RHIOs but other scope references in the white paper include health information exchange and similar entities (p.19, line 18) and access to HEAL funds and Medicaid data (p.26, line 32).	Clarify that the scope of the HIE consent requirement is limited to the SHIN-NY and RHIOs.