Northern Virginia Regional Health Information Organization Legal Documents Committee Executive Summary - Report for December 1, 2006 Meeting The purpose of this Memorandum is succinctly on one page to present the results of four meetings of the committee for presentation on December 1, 2006. The committee discussed matters involving organizational structure, participant and contributor relationships, privacy and security, and interactions with other health information organizations.

1. Organizational Structure - After consideration of several organizational structures, a Virginia non-member corporation qualifying as a Section 501(c)(3) tax exempt organization under the Internal Revenue Code found favor. This approach would combine benefits that would include providing comfort, as a charitable organization can more easily, to patients whose medical information would appropriately and carefully be shared; providing encouragement to contributors of funding with respect to due and proper fiscal operations; providing an enhanced sense of stability to participants sharing information; and providing inspiration to other health information organizations with respect to collaborative endeavors. Qualification will require a charitable mission serving the public interest, and avoidance of lobbying and support for political candidates. Informal information from governmental sources indicates there currently is a delay in reviewing and processing tax exemption applications for regional health information organizations while the Internal Revenue Service ponders the nature and purpose of such organizations and how they would comply with applicable federal tax exempt organizational law under Section 501(c)(3). The committee welcomes the impending presentation and review of the reports of other committees, so that issues relating to patient safety, finance, outreach and education, and infrastructure can be addressed by the Legal Documents Committee in the most responsive and complementary manner insofar as organizational structure and other documentation needs are concerned.

2. Participant and Contributor Relationships - No determination was made regarding whether a central data repository or separate repositories that would share information among themselves would be preferred. But an organizational structure that would permit either or both of these approaches was determined to be preferred.

3. Privacy and Security - Of significant concern is the need to assure all whose medical information is disclosed of privacy and security protections that will be maintained. Both providers and patients will need to know that procedures and technologies are in place that assure the maximum protection reasonably available. In this connect, the regulatory provisions of the Administrative Simplification subtitle of the Health Insurance Portability and Accountability Act of 1996 would be looked to as the model and foundation for compliance, enhanced by applicable more stringent Virginia and other state law.

4. Interactions With Other Health Information Organizations - The organizational structure, the operational procedures, and the technological interfaces, should be designed in a manner that would facilitate interactivity with other health information organizations including those primarily operating outside of Virginia. If and to the extent required, the laws of such other states and the documentation mandated by those laws, would be a part of the compliance program.