Consent-to-Share California's Opportunity to Modernize Cross-Sector Data Sharing OCTOBER 2023 AUTHORS Robby Franceschini, JD, MPH Timi Leslie Daniel Stein Kristine McCoy, MD, MPH Adam Pertman About the Authors Contents Robby Franceschini, JD, MPH, is Director of Policy at BluePath Health. His expertise encompasses Medi- 3 Executive Summary Cal, telehealth, and health information exchange (HIE). 3 Introduction Timi Leslie is President of BluePath Health and the Methods..................................................... 5 Executive Director of Connecting for Better Health and has over 30 years of experience in the health Policy Initiatives Driving the Need care industry advising organizations on business for Consent-to-Share................................. 5 strategy, technology innovation, partner relations, Data Exchange Framework (DxF)...... 5 product management and system implementation. CalAIM .............................................. 5 Daniel Stein is President of the Stewards of Change Institute, a unique not-for-profit think tank focused 6 Requirements for Effective on advancing interoperability across the spectrum of Consent-to-Share human services, healthcare, education, and justice. Clarity on the Legal Landscape ................ 6 Dr. Kristine McCoy, MD, MPH, is a family physician, CalAIM Waiver of State Senior Consultant for Stewards of Change Institute, Privacy Laws .......................................7 and Independent Consultant on the intersection between health care and social services. State Health Information Guidance (SHIG) ............................... 7 Adam Pertman is a Senior Consultant and Editor for Stewards of Change Institute and also serves Robust Digital Identity as the Communications Director for the National Management Strategy .............................. 8 Interoperability Collaborative. Health Data Standards That Enable Consent .................................................... 9 About the Foundation 11 Scaling Consent-to-Share The California Health Care Foundation is an indepen- dent, nonprofit philanthropy that works to improve Authorization to Share Confidential the health care system so that all Californians have Medi-Cal Information (ASCMI) Pilots ......11 the care they need. We focus especially on mak- Promising Regional Consent-to- ing sure the system works for Californians with low Share Practices in California and incomes and for communities who have traditionally Other States .............................................11 faced the greatest barriers to care. We partner with leaders across the health care safety net to ensure 18 Recommendations they have the data and resources to make care more 20 Conclusion just and to drive improvement in a complex system. For more information, visit www.chcf.org. 21 Appendices CHCF informs policymakers and industry leaders, 34 Endnotes invests in ideas and innovations, and connects with changemakers to create a more responsive, patient- centered health care system. Executive Summary included in this paper are essential to realizing California's potential to attain efficient, ethical, and California is leading the way in dismantling barri- holistic care for its residents. ers to health care and social services delivery by promoting essential cross-sector collaboration to Recommendations include: maximize health and wellbeing. Whether a pro- fessional is looking to support physical or mental 1. Devise and launch communication and educa- health, educational achievement, housing stability, tion efforts to accelerate the adoption of state or crime and recidivism reduction, they need to see legal interpretations regarding consent-to-share the full picture of a person to provide the best care. and ensure their alignment with sub-regulatory Having access to data enables the delivery of indi- guidance. vidualized and coordinated whole-person care. 2. Advance efforts to develop consent-to-share Today, most of the vital information needed to pro- technology, technical standards, and policy. vide individuals with coordinated services exists but is physically and legally sequestered. That means 3. Prioritize the development of a standardized professionals are often unable to work with a com- consent form that is informed by findings from prehensive understanding of a person's health and the Authorization to Share Confidential Medical social history. Information (ASCMI) pilot. Several state-supported initiatives providing 4. Establish statewide consent management health, nutrition, education, safety, and housing programs in parallel with the execution of the recognize that formal bridges must be made to Strategy for Digital Identities and in partnership coordinate the delivery of services. As a result, with agencies beyond the California Health and California has a unique opportunity to bring the Human Services Agency (CalHHS). necessary financial, technical, and operational resources to develop a more streamlined and sys- tematic statewide approach to data sharing across health and social services. To take advantage of this Introduction opportunity, California should develop a state-led Individuals have the right to informed consent, a strategy to establish the legal, technical, and policy concept grounded in the principle of autonomy frameworks that permit health and social services that is foundational to American biomedicine and organizations to routinely and securely share action- other fields, to understand the services offered to able information. them, decide which treatments or services they receive, and know how entities may use their This paper examines the essential policy, legal, information.1 Unlike other types of consent, which and technical components that must be recon- may refer to express permission from a patient to ciled to scale consent management services from receive a treatment or service or to participate in promising county-level pilots to a state-wide a research study, consent-to-share provides per- information exchange. The basis for this strategy mission for health and social services organizations is rooted in informed consent and its ability to facil- to exchange patient information with each other. itate appropriate data sharing, enabling the state Ideally, consent-to-share should be dynamic, to enhance service delivery and improve health meaning individuals can provide or revoke consent outcomes. The comprehensive recommendations at any time, and granular, meaning individuals can Consent-to-Share www.chcf.org 3 indicate preferences for which data are accessible various critical services. This resharing is not only to providers at specific points in time. inefficient; it can also be retraumatizing. There are different levels of consent that inform The California state government has recently made how patients can specify authorization to share or major financial investments to launch projects access information. These levels may include gen- that require service integration and coordination, eral consent to share all records, consent to share thereby necessitating data sharing and consent-to- potentially sensitive records (e.g., behavioral health, share. At the forefront are two health care initiatives, incarceration history, or sexual health), or privacy the Data Exchange Framework (DxF) and California control over sharing individual fields within records. Advancing and Innovating Medi-Cal (CalAIM). The Additionally, individuals may prefer to control who DxF, CalAIM, and similar California efforts in educa- is able to access different parts of their health data. tion and other sectors hold the promise of narrowing For example, they may want to limit access to their disparities for those who are most vulnerable and pregnancy status or their address at an emergency in need of a broad array of services and supports. shelter for domestic violence victims to specific Obtaining and making accessible individual-level professionals. consent-to-share information expedites care delivery for individuals and families in California. In California and across the nation, today's approach to consent-to-share includes a patchwork of poli- This paper explores the concept of consent-to- cies, procedures, and laws across health and social share, with findings and recommendations that services, resulting in information silos and uncoor- emanate primarily from a health care perspective dinated care. Furthermore, the interpretation and and can be extended to many whole-person care application of laws governing consent-to-share initiatives for Californians. Specifically, this paper are piecemeal and uneven; thus, in practice, they aims to: are typically viewed as overly burdensome and complex to navigate. Too often, that means organi- 1. Explain the need for consent-to-share practices zations choose not to share information even when in California. it is legally permissible to do so, or when workflows for obtaining consent-to-share information are 2. Explore the steps needed to implement available. consent-to-share. The resulting information gaps are particularly 3. Describe scalable consent-to-share projects and apparent for populations that experience the great- practices that test and refine the use of univer- est health and social needs, such as individuals sal consent forms and consent management experiencing homelessness, aging adults, and low- systems. income individuals and families. Indeed, because they must serve as their own information conduits, 4. Provide recommendations to improve and the burden falls most heavily on those for whom it advance consent-to-share in California. is the most challenging to effectively advocate for their own needs, including by having to repeatedly share sensitive information about themselves or legal dependents to determine their eligibility for California Health Care Foundation www.chcf.org 4 Methods Implementation of the DxF involves governing BluePath Health and Stewards of Change Institute policies and procedures (P&Ps) that include con- conducted a literature review of the state of policy sent-to-share, and lack of consent management and practice related to consent-to-share both in has been noted as a barrier to obtaining necessary California and in other states across the country. demographic information for historically marginal- They also conducted semi-structured interviews ized groups.4 Notably, the P&Ps apply across both with subject matter experts, including attorneys, health and social services providers and include program leads, government funders, and technol- references to existing state and federal legal ogy experts with experience working to address requirements for consent in the form of a Privacy consent-to-share in cross-sector data-sharing pro- Standards and Security Safeguards P&P.5 grams. Interviewees who agreed to list their names CalAIM and affiliations are listed in Appendix 1. CalAIM is a suite of policies and programs crafted with the goals of providing whole-person care, Policy Initiatives Driving the Need addressing social determinants of health, improv- for Consent-to-Share ing care quality, and reducing health care system complexities.6 Key CalAIM initiatives that hinge on Consent-to-share is a key consideration for each of consent-to-share policies include the new Enhanced the policies and programs California develops to Care Management (ECM) benefit, which provides facilitate the exchange of health and social services care management to specific high-need popula- information. CalAIM and the DxF are major drivers tions and introduces new Community Supports of California's data sharing solutions that provide (CS), such as housing and nutrition, that Managed the foundation for the integration of consent-to- Care Plans (MCPs) can choose to provide to their share into policy and practice. members. CalAIM also includes the development of a Population Health Management (PHM) ser- Data Exchange Framework (DxF) vice.7 PHM is intended to collect, integrate, and In 2021, Assembly Bill 133 (AB-133) called on the analyze health and social needs information in a California Health and Human Services Agency single repository. Importantly, DHCS indicates that (CalHHS) to create the DxF as "a first-ever, statewide PHM must be able to support intake and screening, data sharing agreement that aims to accelerate and including "collecting and tracking consent informa- expand the exchange of health information among tion," informing users "about data collection and health care entities, government agencies, and usage practices," and helping beneficiaries deter- social services programs beginning in 2024."2 The mine what personal and health information they are eight principles that guide the DxF emphasize willing to grant their providers (clinical and insur- how consent-to-share is essential to the success- ance) access.8 ful implementation of secure and productive information exchange.3 They also clarify expecta- tions for all organizations and state agencies as they embark on the work needed to fulfill requirements set forth by AB-133. Consent-to-Share www.chcf.org 5 Requirements for protections. In addition, both the State Health Information Guidance (SHIG) and the CalAIM Data Effective Consent-to- Sharing Authorization Guidance provide summa- Share ries of privacy laws that have implications for the sharing of information across sectors, as well as an analysis of laws governing criminal justice, housing, Clarity on the Legal Landscape and nutrition program data. Yet, even with the A variety of federal and state privacy and confiden- SHIG and Data Sharing Authorization Guidance, tiality laws impact the ability to share information many interviewees expressed that organizations within and across sectors in California. These laws continue to hesitate to exchange data due to the stipulate safeguards based on the information's multitude of laws on privacy and their conflicting content or source (e.g., relating to a mental health interpretations. condition or HIV status or coming from a publicly funded substance use disorder program). Most fed- The table below highlights the consent provisions eral laws set a floor for safeguarding privacy but of key laws as they are generally applicable to do not preclude states from providing additional California's population. Table 1: Key Health and Education Privacy Laws LAW WHO IT APPLIES TO CONSENT PROVISIONS HIPAA "Covered entities," including most Allows disclosure of most protected Health Insurance Portability and health care providers, health plans, health information (PHI) without the Accountability Act health care clearinghouses, and their individual's authorization for the "business associates," as defined in purposes of treatment, payment, and (Federal) the law operations, as defined in the law 42 C.F.R. Part 2 "Federally assisted" programs "who Requires a patient's written consent hold themselves out as providing, before a program can disclose and provide, substance use disorder protected records that include specific (Federal) diagnosis, treatment, or referral for information related to the patient, as treatment" well as the specific records that are to be shared. Includes exceptions to the written consent rule, such as medical emergencies and reports of alleged child abuse, among others FERPA "Educational agencies or institutions" Generally, prohibits educational Family Educational Rights and Privacy like public schools or school districts agencies from releasing information Act that receive funds from programs in the "educational record" including administered by the U.S. Department health information without written (Federal) of Education authorization from the adult student or from the parent of minors Information Blocking Rule, issued by "Actors," including health care provid- Requires actors to provide access to, the Office of the National Coordinator ers and developers of health care exchange, or use electronic health for Health Information Technology information technology information (EHI) as permitted by (ONC) HIPAA unless other laws require specific authorization that has not been given, or the patient requests (Federal) that their information not be shared California Health Care Foundation www.chcf.org 6 LAW WHO IT APPLIES TO CONSENT PROVISIONS CMIA "Providers of health care," including Does not require authorization to use Confidentiality of Medical Information businesses "organized for the purpose or disclose information for specified Act of maintaining medical information in purposes, including diagnosis, treat- order to make the information avail- ment, payment, research, or other (California) able to an individual or to a provider specified purposes of health care," among others Center for Data Insights and Innovation Signatories to the Data Sharing Incorporates and references exist- (CDII) Data Sharing Agreement Agreement ing federal and state law related to (California) privacy Lanterman-Petris-Short Act State hospitals, developmental Generally, prohibits the disclosure, (California) centers, and certain public and private without a patient's authorization, of institutions that provide mental health data related to the provision of invol- services untary and some voluntary services AIDS Public Health Records State and local public health agencies Prohibits the disclosure of public Confidentiality Act health records containing PHI related to HIV or AIDs without a patient's written authorization, except as (California) required by law Women, Infants, and Children (WIC) State and local WIC agencies Requires certain notices of uses, disclosures, and recipients of WIC information when shared for non-WIC (Federal) purposes Sources: Code of Federal Regulations, Title 34 § 99.10, Title 42 § 2.12, Title 45 § 160.103, Title 45 § 164.512, Title 45 § 171.102, Title 45 § 171.103; California Civil Code § 56.05-06 and § 56.10(c); "California Health and Human Services Data Exchange Framework: Single Data Sharing Agreement," California Health and Human Services, November 3, 2022; "CalHHS Data Exchange Framework Policy and Procedure: Privacy Standards and Security Safeguards." California Health and Human Services, July 5, 2022; California Welfare & Institutions Code §§ 4000-4390, 6000-6008, § 5328(a)(25), § 5675; California Health & Safety Code § 1250.2, § 121025. CalAIM Waiver of State Privacy Laws published the CalAIM Data Sharing Authorization To expedite the integration of CalAIM ECM and CS Guidance (PDF) that provides a summary of privacy into Medi-Cal's existing delivery system, the state laws, guidance, consent practices, and specific use legislature granted DHCS the ability to waive spe- cases to assist organizations as they navigate the cific state privacy and confidentiality laws requiring CalAIM landscape.10 authorizations for the use or disclosure of specific information.9 Those include but are not limited to the Confidentiality of Medical Information Act, the State Health Information Guidance (SHIG) Lanterman-Petris-Short Act, and statutes relating The State Health Information Guidance (SHIG) to the disclosure of HIV test results and substance is a comprehensive resource compiled and pub- use information. The waiver does not apply to fed- lished by CDII that helps organizations clarify and eral laws or certain other state laws, such as those interpret federal and state laws impacting the dis- related to combatting discrimination or to Medi-Cal closure and sharing of information related to health enrollees accessing their own records. It will be criti- and social services.11 CDII formally reviews and cal to study the effects of waiving specific laws to updates the SHIG annually through subject matter inform future efforts to improve consent-to-share expert contributors and a multi-stakeholder advi- both for and beyond the Medi-Cal population. In sory group. The SHIG summarizes federal and state addition to the waiver of state privacy laws, DHCS laws, provides situation guidance according to key Consent-to-Share www.chcf.org 7 groupings (such as treatment and coordination of services information is exchanged, it corresponds care, operations, and public health), and breaks to the correct unique individual.12 The Strategy, down specific details according to scenarios that published in July 2022, outlines how CDII will provide easy-to-follow flowchart graphics and cor- develop secure digital identities by supporting responding narratives. a statewide person index for use by both private and public organizations in California while priori- The SHIG's five volumes include: tizing consumer privacy and addressing the need for coordinated person identity matching services. $ Sharing Behavioral Health Information in The Strategy's approach incorporates select patient California demographics from standard formats and data sets to build a unique digital identity that can be $ Sharing Health Information to Address Food maintained and utilized statewide. The Strategy and Nutrition Insecurity in California also recommends developing a consent registry $ Sharing HIV/AIDS Information in California (statewide or regional) that is parallel to the state- wide person index and recognizes that a dynamic $ Sharing Health Information of People Living with statewide consent registry is fundamentally neces- Intellectual and/or Developmental Disabilities in sary to preserve consumer privacy in the context of California expanding the exchange of health and social ser- $ Sharing Minors and Foster Youth Health vices information.13 Information in California Separately, in 2023, CalHHS released a Request A sample decision tree from volume five is shown in for Information (RFI) "to identify potential solutions Appendix 3. Currently, the SHIG awaits updates to to establish and manage the digital identities of incorporate the DxF, the CalAIM privacy law waiver, individuals for the purpose of linking their internal and the information contained in the DHCS CalAIM health and social services information to the correct Data Sharing Authorization Guidance. person within and across CalHHS departments."14 The RFI seeks a shared technology service to link unique identities across health and social services Robust Digital Identity Management for use by CalHHS departments, as well as to merge Strategy identities that are deemed to represent the same Health and social services information is stored in individual. The RFI closed in July 2023; there is not separate records systems and maintained in dis- yet public information about the submissions or parate formats. As a result, providers typically do next steps in this process. Although the RFI does not know whether individual data exists, where it not seek information regarding consent or consent is, or how to access consent-to-share preferences. management functionalities from respondents, it Additionally, some individuals can have multiple holds the potential to assist CalHHS in pursuing a records with slightly different patient identifiers, statewide person index and consent registry as out- creating even more difficulty when providers need lined in its July 2022 Strategy. access to patient information. To bridge these gaps, AB-133 mandated the development of the Strategy for Digital Identities (Strategy) to ensure that when health and social California Health Care Foundation www.chcf.org 8 Health Data Standards That Enable of global health data standards, each with its own Consent approach to consent. These data standards include: Beyond legal requirements, health data standards $ Health Level 7 (HL7) V2 suite of health IT mes- are also needed to govern technical consent-to- saging standards share practices, including how data are collected, stored, tracked, categorized, and shared. These $ HL7 Clinical Document Architecture (CDA®) health data standards enable consent management suite of standards services to govern how information is represented $ HL7 Fast Healthcare Interoperability Resources so that it is universally recognized and accommo- (FHIR®) suite of standards dates granular technical consent solutions. Consent management services provide software solutions $ Integrating the Healthcare Enterprise (IHE) that function as electronic registries and enable a Profiles for health IT systems. centralized approach to: HL7 is the global health IT standards-development $ Storing consents from a specific jurisdiction (city, organization dedicated to providing standards for county, region, or state) the exchange, integration, sharing, and retrieval of electronic health information. IHE is a health care $ Tracking and authorizing users of the consent industry initiative to promote the coordinated use management service of established standards to improve the way com- $ Providing necessary and timely notifications of puter systems in health care share information. relevant patient changes These two organizations drive the global definition of standards for health care information exchange. $ Allowing individuals to access and change their Electronic health records systems and health infor- consent preferences as desired mation exchanges implement their solutions based on standards from one or both organizations. Currently, electronic health records, care manage- ment systems, and other software systems do not HL7 V2 is used by 95% of health care organiza- always have the technical ability to parse and con- tions in the U.S. and across 35 other countries.15 strain data sharing at the level required to provide HL7 CDA is a newer, document-oriented standard, access to specific types of information. As a result, which is often used to exchange patient records individuals may not be able to provide differing lev- using IHE profiles and/or DirectTrust Direct Secure els of consent that can limit portions of their records Messaging, a national data exchange network. A from being shared, and providers may have to newcomer to the health IT standards world is HL7 maintain separate record keeping systems to align FHIR, which enables streamlined implementation of with different legal regimes. Greater granularity health care applications using contemporary inter- for privacy preferences regarding the sharing of net protocols. health data is needed to increase individuals' pri- vacy, trust, and autonomy. Different types of information exchange require dif- ferent standards; standards required for consent Consent-to-share is supported by global standards management are outlined in the table below. for the transfer of clinical and administrative health data. The structure and format of electronic health information, however, is governed by specific suites Consent-to-Share www.chcf.org 9 Table 2: Consent Management Data Standards HEALTH DATA STANDARDS PURPOSE SCOPE HL7 Composite Privacy Consent Defines security and privacy system Outlines criteria in broad terms Directive - Domain Analysis Model requirements for health care organiza- without mentioning a specific format tions HL7 Healthcare Privacy and Security Defines a classification system for Focuses on classification and labeling Classification System (HCS), Release 1 labeling and segmenting protected of data health information HL7 Services Functional Model: Illustrates a model for consent Includes various types of data Consent Management Service, management services and Application exchange standards, including HL7 Release 1 Programming Interfaces (APIs) to V2, CDA, FHIR, and IHE comply with privacy regulations HL7 CDA® R2 Implementation Guide: Provides a standard for exchanging Concentrates on the exchange of Privacy Consent Directives, Release 1 signed consents and generating rules consent directives and their comput- associated with them able representations (narratives, signed documents, statements) HL7 FHIR Consent Resource Introduces a standard for represent- Specifically designed for FHIR-based ing patient agreements, restrictions, systems engaged in the content and or prohibitions related to data access representation of consent and sharing IHE BPPC (Basic Patient Privacy Provides a mechanism for recording Centered on IHE-based exchanges Consent) patient privacy consents and enforcing and consent management them for IHE information exchanges IHE PCF (Privacy Consent on FHIR) Expected to define how to represent Similar to IHE BPPC but tailored to (Currently under development) patient privacy consents and access FHIR-based systems control when a FHIR API is used for IHE-based exchanges Sources: "HL7 Version 3 Domain Analysis Model: Composite Security and Privacy, Release 1," HL7 International, May 1, 2020; "HL7 Healthcare Privacy and Security Classification System (HCS), Release 1," HL7 International, August 8, 2014; "HL7 Services Functional Model: Consent Management Service, Release 1," HL7 International, July 13, 2021; "HL7 CDA® R2 Implementation Guide: Privacy Consent Directives, Release 1," HL7 International, January 12, 2017; "Resource Consent - Content," HL7 International, March 26, 2023; "Basic Patient Privacy Consents," Integrating the Healthcare Enterprise (IHE) Wiki, November 19, 2021; "Privacy Consent on FHIR (PCF) Home," Integrating the Healthcare Enterprise (IHE), August 4, 2023. Privacy control over sharing individual fields HL7 DS4P provides a flexible mechanism for indi- within records necessitates technical support viduals to express their privacy preferences as for granular privacy so that individuals can indi- well as their authorized exceptions to those pref- cate preferences for which data are accessible to erences. Standardized, consistent approaches to which providers and when. Such granular privacy the semantics and syntax necessary to do this work is supported by HL7 Data Segmentation for Privacy across systems are in early stages. This often leaves (HL7 DS4P) standards for both CDA documents organizations to develop their own varying and and FHIR.16 HL7 DS4P enables a record or docu- individual implementations. In light of this, the Shift ment to be "tagged" or "marked" with privacy Task Force - an independent group of more than assertions that express the data classification and 200 expert stakeholders - was formed in 2020 to indicate possible redisclosure restrictions placed "improve functionality and standardize efforts to on individual fields within the record or document. granularly identify and protect sensitive electronic Assurance that data can be properly marked with protected health Information (ePHI) to promote the patient's privacy requirements may increase equitable interoperability."17 the sharing of important, sensitive information. California Health Care Foundation www.chcf.org 10 In sum, patients and providers need electronic Form, a voluntary release-of-information document health records, care management platforms, and that supports the sharing of Medi-Cal members' other technologies to apply data standards that physical, mental, and social health data through a allow for granular consent management. Though standardized process. these standards exist, health and social services organizations require clear guidance and encour- DHCS selected three regional initiatives to con- agement to incorporate them into their systems. duct pilot projects.18 These initiatives worked in partnership with county government, MCPs, and community-based organizations (CBOs) to test and suggest improvements for the form's efficacy Scaling Consent-to-Share and accessibility through a consent management A uniform approach to consent-to-share processes service.19 The ASCMI pilot participants were 2-1-1 and health data sharing networks for obtaining, San Diego Community Information Exchange, storing, and retrieving consent-related information Manifest MedEx, and Serving Communities Health are both essential to achieving scale. Important Information Organization. See Appendix 2 for the considerations include: ASCMI consent form and Appendix 5 for more details on individual projects. $ the use of a universal consent form The pilots aimed to demonstrate providers' abili- $ the implementation of a governance model that ties to access the consent management service includes individuals with lived experiences and online and/or via their existing EHR systems to oversees participation upload signed ASCMI forms, check if a member's $ the type of information to be shared signed form is on file, and amend members' con- sent on their behalf. The pilots were also intended $ the permitted uses of shared information to assess Medi-Cal members' abilities to amend $ the benefits and risks of sharing information their own consents by accessing the management service online. $ the revocability of consent Pilot participants and other interviewees are eager A uniform approach has not yet been established to learn from the ASCMI's evaluation results and at the federal or state level. However, promising repeatedly point to the pilots as critical conceptual programs have been implemented in California and concrete breakthroughs in centering consent- and elsewhere. Taken together, these test cases to-share, which they say was lacking during DHCS's form the basis of a scalable, statewide consent- Whole Person Care20 and Health Homes initiatives.21 to-share strategy. Promising Regional Consent-to- Authorization to Share Confidential Share Practices in California and Medi-Cal Information (ASCMI) Pilots Other States From January to June 2023, DHCS administered Tables 3 and 4 summarize key functionality and the CalAIM Authorization to Share Confidential processes such as how consent decisions are pre- Medi-Cal Information (ASCMI) pilots to test a sented to individuals, how consents are stored and Universal Authorization for Release of Information Consent-to-Share www.chcf.org 11 accessed, and what funding streams have been and other states highlight the importance of used to create and maintain the consent process. technology solutions to enable efficient consent-to- These varied consent-to-share efforts in California share in states and local communities. Table 3: Promising Practices within California SAN DIEGO 2-1-1 ALAMEDA CARE CONNECT SONOMA CONNECT Program In 2014 San Diego launched The Alameda County Whole Sonoma Connect is a coalition Description its Community Information Person Care (WPC) pilot initia- of cross-sector organizations Exchange (CIE) after three years tive spanned from 2016 to 2021. that have partnered to deliver of planning. CIE is a multidisci- During WPC, Alameda Care a community response to plinary network of partners that Connect provided enhanced Adverse Childhood Experiences use standard authorization and care coordination and outreach (ACEs) and trauma by consent management services to the most-vulnerable connecting individuals to the to allow data-sharing across Medi-Cal members, including resources they need." A key health and social services those who were unhoused or tool of Sonoma Connect is the partner organizations for care frequent users of crisis services. Resource Connection Network, coordination. The data sharing system has which operates off a technology been expanded to meet the platform provided by health County's program planning software vendor NinePatch. needs, to accommodate CalAIM's billing requirements, and to include data for those who are uninsured. Participants Over 133 organizations are As of April 2023, 55 organi- The project's planning and members of the San Diego zations representing 246 ongoing implementation Community Information programs and over 1,900 users involves 98 organizations Exchange. were accessing the shared from 46 multi-sector organiza- community health record (CHR). tions (FQHCs, CBOs, County Office of Education, etc.) that identify challenges for CBOs and develop a county network approach to providing care. Types of Data $ Food $ Demographic $ Adverse Childhood Shared $ Housing $ Medical and behavioral Experiences $ Transportation health $ Social Determinants of Health $ Social services Data from screening tools $ Justice-involvement $ Housing $ Medical information $ Health $ Food $ Data from other participant $ Education agencies $ Financial $ Transportation $ Employment $ Employment $ Incarceration $ Income $ Disability California Health Care Foundation www.chcf.org 12 SAN DIEGO 2-1-1 ALAMEDA CARE CONNECT SONOMA CONNECT Developing the Levels of consent were created Development of the consent- The consent procedure was Consent Form to enable care coordination to-share process was led by a initially drafted by community across the diverse CIE Partner Data Governance Committee health center network Aliados Network of providers. The with members from the County, Health based on a templated consent form was created, CBOs, and local health plan document provided by shared, and edited by the representatives. NinePatch. It was then edited CIE core governance body, to reflect considerations includ- which worked with local CBOs ing California state and current and their participants who federal law, HIPAA protec- may ultimately complete the tions, emerging data exchange consent. practices, and input from the Action Team. Obtaining The CIE is an opt-in model. Consent is gathered via the The consent form is completed Consent A participant can provide HCSA Information Sharing during intake and the client consent, or opt in, at participat- Agreement (ISA), which is avail- can give consent based on ing organizations across the able online via the CHR or in three tiers: a) participating in CIE Partner Network as they paper form. Once granted, Resource Connection Network access services through the consent is valid for only one (RCN) team-based care; b) 2-1-1 client portal. Consent year, and participants can participating in RCN team- may be provided electroni- revoke or change their consent based care with either full RCN cally, telephonically, verbally, at any time. Only one consent network-wide authorizations, or through paper copy, and is required to enable sharing only team-member approval, consent forms have been trans- across all relevant participating or only client approval; or c) lated into eight languages. providers, rather than one by not participating in RCN team- The CIE's standard consent one. based care. If the client chooses aligns with the authorizations the "client approval" option, of other organizations, such they are able to determine as local hospitals and the San whether information is shared Diego Regional Taskforce on with specific organizations or Homelessness' Joint Multi-Party individual care team members. Agreement, and/or is included They can decline consent in other partners' intake packets initially and give it later, or they for individuals to complete can revoke consent at any time. while they opt in for care. Accessing Consent information can only The executed consent form is The consent forms are public Consent be shared when a person viewable within the CHR client in PDF form. The same is true Documents is seeking services from an record. Authorized CHR users of the revocation form. At this organization in the CIE Partner from partner organizations time, the portal does not allow Network. Clients can revoke with viewing rights can see and individuals to access or modify consent through those organi- access the client consent. their consent documents, but zations and through a client it does allow a new consent portal where they can view document to be sent from any information and choose to participating organization to opt-out. The CIE has varying the individual via fax, SMS, or levels of permissions at the field email. level for partner organizations. Consent-to-Share www.chcf.org 13 SAN DIEGO 2-1-1 ALAMEDA CARE CONNECT SONOMA CONNECT Governance CIE has a local shared gover- Once the policy and legal The community governance nance infrastructure comprised teams drafted the ISA, Alameda model includes a multi-sectoral of key stakeholders across the County engaged with individu- community leadership board community through its CIE als with lived expertise and and venues for other commu- Advisory Board. Additionally, a health literacy expert to nity members to provide CIE hosts Network Partner provide user experience and ongoing input. The Action Meetings and other working design feedback. Alameda Team, charged with platform groups, including community County Care Connect (AC3)'s implementation, has 98 partici- voice and data governance Consumer Fellows team pants, including community working groups, to ensure reviewed the consent form, members and representatives clients and community providing input and recommen- from 46 organizations. members play a direct role dations based on their lived designing and advising how experience. Resulting changes the CIE functions within the included a more comprehensive community. summary in the form's introduc- tion, altering language about the implications of not signing to feel less threatening, and providing more details about the programs and services covered by the agreement. Funding and Sustainable and ongoing Alameda County received $177 Sonoma Connect relies on Investment blended funding includes million from DHCS for develop- grants provided by California's annual organizational member- ment of the AC3 WPC pilot, ACEs Aware program and by ship fees and per-member which funded many services the state's American Rescue per-month (PMPM) rates; grant, and infrastructure develop- Plan Act. foundation, and government ments including this data funding; and other sources. sharing system. What's Next Continuing to center consent Revising the current ISA to Moving beyond the pilot to on client choice, allowing reflect new authorization broad implementation and for client access and control requirements under the CARES adding in data sharing with rights; growing data integra- Act Notice of Proposed Rule care coordination platforms and tions, specifically with local HIE, Making, revising Confidentiality HIEs. EHRs and others; and exploring of Substance Use Disorder opportunities to expand use (SUD) Patient Records. cases for consent and integrate into the system of care. Consent Web-based CIE system; Homegrown NinePatch Management Salesforce Service ASCMI partici- Yes No No pant? Sources: "Whole Person Care Promising Practices: A Roadmap for Enhanced Care Management and In Lieu of Services," Department of Health Care Services, December 2020; "Sonoma Connect," Sonoma Connect/ Sonoma Unidos, accessed September 12, 2023; "CIE ​​ Partners," CIE San Diego, accessed September 12, 2023; Emma Beers, Alana Kalinowski, Jennifer Martinez, and Cristi Iannuzzi, "How to Share Data: Proven Strategies for Strengthening Cross- Sector Collaboration between Health and Homeless Systems of Care," NHSDC Fall 2022 Conference, 2022; "CIE Authorization Forms," CIE San Diego, accessed September 12, 2023. Note: For Sonoma Connect's consent and revocation forms, see Appendix 6 and Appendix 7. Table 4: Promising Practices Outside of California California Health Care Foundation www.chcf.org 14 WASHINGTON VIRGINIA MICHIGAN Program The Washington Health Care Arlington County, VA pioneered Michigan Health Information Description Authority (HCA) anticipates its Shared Authorization to Network Shared Services rolling out their Electronic Use and Exchange Information (MiHIN) is a Health Information Consent Management (ECM) program. The purpose is to Network based in Michigan that program in May 2024. It will facilitate effective service deliv- acts as the foremost authority be focused on state Medicaid ery for authorization among on patient identity and identity participants "with SUDs participating organizations. It management for their network [substance use disorders], gives individuals a wide variety partners. Among its many mental health conditions, and of choices about what informa- functionalities, MiHIN utilizes other sensitive conditions [that] tion is shared with whom. It multiple patient identifiers need their health information to also allows them to authorize in their active care relation- be exchanged securely among ongoing exchange of infor- ship service (ACRS) to collect, a diverse care team in a manner mation instead of a one-time provide, and manage consent. with which they can understand disclosure. and participate." The Commonwealth of Virginia has a similar Authorization to Use and Exchange Information for statewide use that was approved by the State Attorney General on 3/10/2008. Participants Health care providers and County government including Connected to MiHIN are 148 Apple Health (Washington social services, justice, health hospitals, 665 outpatient Medicaid) clients diagnosed care, housing, and shelter facilities, 298 skilled nursing with a substance use disorder agencies, as well as a wide facilities, and 44 physician variety of CBOs. The individual organizations. may also add additional organi- zations to which their data can be released. Data Shared The initial use case contem- The form allows for fine-grained $ Admission, Discharge, plates the sharing of substance consent for types of data such Transfer (ADT) Notifications use disorder services consent- as financial information, and $ Death notifications to-share data for care includes multiple other slots so coordination. Future use cases individuals can specify exactly $ Health claims include: what they wish to disclose. $ Health and social services $ Consents to share other information types of data related to health and social needs; $ Consents for transitions of medical services from Dept. of Corrections to Medicaid providers $ Advance directives $ Consent for sharing with a medical proxy or guardian Consent-to-Share www.chcf.org 15 WASHINGTON VIRGINIA MICHIGAN Developing the Washington State HCA has The form resulted from a multi- The state of Michigan requires Consent Form created a standard form that year, multi-stakeholder process all providers to accept a providers will be asked to use. supported by the Arlington standard consent form. Community Foundation. However, providers are not bound to utilize this form when it is not presented by the patient, so most practices choose to use their own. Obtaining HCA's ECM will offer flexible The form is presented to Patients can provide and revoke Consent options for obtaining consent: individuals by staff members consent, but MiHIN recognizes (1) a signed paper form of the Arlington County that the privacy and security scanned into the ECM solution Department of Human Services notices that patients sign when and made available through (DHS) or other participat- they receive care supersede an EHR integration and/or the ing agencies. These staff are MiHIN's abilities to block infor- ECM web portal access; (2) responsible for explaining the mation sharing. MiHIN has a digital signature provided intent, risk, and benefits of the included a "contest period" through the ECM web applica- authorization, and are regularly when patients can seek to tion, accessed on a tablet in trained on it. The authoriza- revoke consent to ensure fully- a clinical setting, through a tion is routinely offered by informed decision-making. link send to a patient's email DHS to all persons applying for address or accessed within a Medicaid. patient portal; or (3) a digital signature provided through the ECM mobile application using a patient, medical proxy or guardian's smartphone. The initial workflow at the ECM go-live may be constrained to the scanned paper form. When a patient registers for an optional ECM Wallet account, the system will provide current and historical access to their forms, whether a consent request was signed, denied, or revoked. Individuals can revoke or request a change to previ- ously authorized consent forms through the ECM system. California Health Care Foundation www.chcf.org 16 WASHINGTON VIRGINIA MICHIGAN Accessing The system can display whether There is no specific electronic MiHIN manages a consent Consent there is an active, valid consent platform. Instead, the form repository that works with the Documents on file based on with whom the allows individuals to elect ACRS to facilitate the sharing of patient consents to share their whether their information can data between network partners. information, and an active form be disclosed electronically, on They tag sensitive data and permitting data sharing based paper, or verbally. Consent also limit the flow of information to on why a patient consents to facilitates the work of county a separate, smaller network. share health information for a case review teams. specific purpose. For patients with a treatment relationship with the provider, the system can be queried for active consent forms on file for an individual patient or for a list of the provider's patients. The search result will be null if there is not an established treatment relationship or the provider is not named as a permitted recipient. Governance HCA, the Office of the CIO The process is now self-govern- For technical and policy in Washington State, and the ing. DHS maintains the form expertise, MiHIN includes Washington Health and Human and responds to organizations "State Agency Partners, The Services Enterprise Coalition who wish to be included or State Health Information will provide oversight, with retracted. Technology Commission contractual terms and obliga- (HITC), the Board of Directors, tions in place with the prime Executive Management Team vendor (CodeSmart) and the and the Operational Advisory vendor's technology solution Committee (MOAC) and its task sub-contractor (Midato Health). forces" within their governance HCA facilitated significant model. stakeholder engagement during the planning of the ECM program, resulting in the agency's published guide for sharing substance use disorder data in Washington State. Source of Centers for Medicare & Arlington County DHS and the The Health Information funding/ Medicaid Services (CMS) 90% Arlington County Foundation Technology for Economic and Level of Federal matching funds put in-kind resources into Clinical Health (HITECH) Act, Investment launching the project, with ONC HIT State Cooperative voluntary participation by the Agreement, and other federal community at large. funding; state funding to develop specific use cases; and funding from local partnerships. Consent-to-Share www.chcf.org 17 WASHINGTON VIRGINIA MICHIGAN What's Next The HCA states that "additional Developing a recorded train- MiHIN is currently pilot- types of consents to be consid- ing on the authorization; ing their Electronic Consent ered in later phases include Management Service (eCMS) creating the infrastructure for physical and behavioral health, in inpatient facilities and tribal services, genetic testing, streamlined electronic data SUD clinics. They anticipate advance directives, and sharing among partners such widespread adoption of the social determinants of health as the Allegheny County, service throughout the network (SDOH)." PA DHS Data Warehouse, by the end of 2023. including a consent manage- ment service; and a content- mediated shared repository for proof of income and proof of identity. Consent CodeSmart (prime vendor) There is no management Homegrown Management and Midato Health (technology service or central registry for Service solution sub-contractor) the consent. Each organization obtains a form as needed to either request or disclose infor- mation. Sources: "Electronic Consent Management (ECM)," Washington State Health Care Authority, September 2023; "Washington State Health and Human Services Enterprise Coalition," Healthier Washington Collaboration Portal, Accessed October 6, 2023; "Sharing Substance Use Disorder Information: A Guide for Washington State," HCA, October 2021; "Shared Authorization to Use and Exchange Information," Arlington County, 2019; "Authorization to Use and Exchange Information," Commonwealth of Virginia, March 10, 2008; "Our Network," Michigan Health Information Network (MiHIN)," accessed September 12, 2023; "Annual Report," Michigan Health Information Network (MiHIN), 2022; Interview with Carol Robinson, Midato Health; "Michigan Behavioral Health Standard Consent Form," Michigan Health & Human Services, accessed September 12, 2023; "Governance Model," Michigan Health Information Network, accessed September 12, 2023; "About Michigan Health Information Network," Michigan Health Information Network, accessed September 12, 2023. Recommendations $ Utilize existing guidance to expedite consent- to-share policy alignment. CDII and DHCS Standardized consent policies and practices are have made considerable investments in the essential to multiple ongoing California initiatives, production and management of the SHIG and including the DxF and CalAIM, and require support the DHCS CalAIM Data Sharing Authorization to reduce service delivery fragmentation. Current Guidance. These efforts should provide the and emerging health data standards and technol- basis for broad-scale education and commu- ogy can improve consent-to-share across health nication to both agencies and the public. This and social services systems; however, success also may include clear guidance as to how Qualified requires statewide leadership and meaningful stake- Health Information Organizations (QHIOs) holder engagement. A unified consent-to-share handle consent management for Data Sharing strategy will help California achieve its vision of Agreement (DSA) signatories, collaborative coordinated care across health and social services. updates to privacy policies, longer-term work related to the AB-133 waiver of state privacy Recommendation 1: Devise and launch a commu- laws for CalAIM ECM and CS, and a deter- nication and education effort to accelerate the mination as to whether more permanent and adoption of state legal interpretations regarding expansive changes to California law are needed. consent-to-share and to ensure the alignment of these interpretations in sub-regulatory guidance. California Health Care Foundation www.chcf.org 18 works across programs and populations. DHCS Recommendation 2: Advance efforts to develop and CDII should also consider how they can consent-to-share technology, technical stan- adopt model consent language in statute to dards, and policy. provide assurances that such language complies with all applicable laws. $ Participate in standards-setting efforts. CalHHS, CDII, and other state agencies should Recommendation 4: Establish statewide consent formally participate in and monitor the con- management programs in parallel with the exe- sent-to-share activities of the ONC, which is cution of the Strategy for Digital Identities and in expected to take on a broader federal role in partnership with agencies beyond CalHHS. this area, as well as in efforts taking place in the European Union and elsewhere, through stan- $ Emphasize consent-to-share as critical to dards bodies such as HL7. statewide identity management. With the $ Ensure state guidance documents mention recent release of the identity management and enforce the latest standards. This work RFI, CDII is exploring strategies to offer record should translate into continuous updates to matching and patient linking. However, the guidance documents such as the DxF P&Ps, request does not include patient consent or the SHIG, and the CalAIM Data Sharing authorization. Implementation of the Strategy Authorization Guidance to include recommen- for Digital Identities should include the con- dations or requirements for technical standards current availability of a statewide consent that can advance consent-to-share and make management service or network of services. clear to stakeholders how consent collection, $ Ensure cross-sector collaboration by including storage, and sharing should occur. other state agencies. Several non-CalHHS state departments could contribute to the realiza- Recommendation 3: Prioritize the development tion of the Strategy for Digital Identities and of a standardized consent form by using the find- development of shared services across state ings from the ASCMI pilot to inform the process. agencies given their privacy and confidentiality laws are related, including Education, Aging, $ Convene a learning community based on and Housing and Community Development. ASCMI pilot findings. DHCS and CDII should CDII should engage these agencies in consent use the ASCMI pilot experience to convene management-related work to efficiently share a structured learning community of state and financial and technological resources. county level agencies and departments, along with health information organizations, to share $ Establish sustainable funding mechanisms. experiences and incorporate learnings from CDII should work with DHCS to seek 90/10 ASCMI and other test cases into improved federal matching funds to support statewide consent-to-share practices. consent-to-share activities and/or recognize aspects of the PHM Service that may satisfy $ Ensure that any standardized consent form is consent management requirements. developed to encompass relevant programs and populations. DHCS and CDII should con- tinue working to develop a consent form that Consent-to-Share www.chcf.org 19 Conclusion Enhancing consent-to-share policy and practice in California is not only essential to providing high- quality, whole-person care, but is also critical to the success of CalAIM and other initiatives that look to address health and social needs through cross-sector data sharing. As state legislators and agency leaders look to continuously improve California's data-sharing policy landscape and make financial investments in information technology infrastructure, management of consent-to-share must be a priority. Medi-Cal's historic CalAIM ini- tiative and CDII's DxF makes this work especially urgent. Learning from current pilots and promising practices, creating scalable solutions, and widely disseminating and utilizing state interpretive guid- ance will all contribute to a collective, unified, and statewide consent-to-share strategy. California Health Care Foundation www.chcf.org 20 Appendix 1. Interviewees Adam Dondro, CalHHS Aleida Kasir, Community Health Center Network Amie Miller, California Mental Health Services Authority Amy Anderson and Beth Paul, Aliados Health Andrea Frey, Hooper, Lundy & Bookman PC Angie Bass, Velatura Public Benefit Corporation Bill York and Camey Christenson, 2-1-1 San Diego Carol Robinson, Midato Health Cheryl Northfield, C&C Advisors Daniel Chavez, Serving Communities Health Information Organization DeeAnne McCallin, CDII, CalHHS Elizabeth Este, Breaking Barriers Erica Galvez, Manifest MedEx Harman Basra, Community Action Partnership Jaffer Traish, findhelp Jana Wright and Alex Lipton, Unite Us Jennifer Martinez, Wellbrook Partners Jonah Frohlich, Manatt Health Karen Farley and Linnea Sallack, California WIC Association Kimberly Lewis, National Health Law Program Lisa Bari, Jolie Ritzo, and Jessica Little, Civitas Networks for Health Michelle (Shelley) Brown, Attorney, Solo Practitioner Neil Batlivala, Pair Team Rosario Trejo and Michelle Charime, Downtown Women's Center Sristi Sharma and Elison Alcovendaz, California DHCS Tim Pletcher and Emily Mata, Michigan Health Information Network Consent-to-Share www.chcf.org 21 Appendix 2. ASCMI Form State of California - Health and Human Services Agency Department of Health Care Services Authorization to Share Confidential Medi-Cal Information (ASCMI) Version 1.0 [Pilot] December 2022 Disclaimer: The ASCMI Form is intended to be used solely by ASCMI Pilot participants. DHCS makes no representation about the suitability of this form for uses outside of the ASCMI Pilot. The ASCMI Form, including attachments, are subject to change. First Name Last Name Date of Birth Mailing Address City State Zip Code Residential Address City State Zip Code Phone Number(s) Email Beneficiary Identification Card (BIC) By signing this form, you authorize certain organizations and individuals to use and share your health and other confidential information for the purposes described in section 1. 1. Purposes By signing, you authorize your health and other confidential information to be shared only to: (a) Provide you with, refer you to, or help you access healthcare treatment, benefits, programs, social services, case management, community resources, and other supports ("Services") to meet your needs. (b) Identify, support, coordinate, improve, and arrange payment for Services that may be provided to you. (c) Help Medi-Cal provide better care through evaluation, reporting, and population health management. 2. Types of Your Information that You Authorize to be Shared By signing, you authorize the below types of health and other confidential information about you to be shared only for the purposes stated above. (a) Protected health information (PHI), including information regarding your health care, medical history, lab test results, and current or future conditions and treatments. DHCS 0303 (03/2023) Page 1 of 4 California Health Care Foundation www.chcf.org 22 State of California - Health and Human Services Agency Department of Health Care Services Authorization to Share Confidential Medi-Cal Information (ASCMI) (b) Mental health information, including current and past diagnoses and treatments of your mental health conditions. This does not include psychotherapy notes, which are only shared if you separately consent. (c) Substance use disorder information, including your current and past alcohol or drug use diagnoses, medications, treatment, lab tests, trauma history, facility discharges. This includes substance use disorder information about you that comes from a substance/alcohol use disorder provider subject to federal substance use confidentiality regulations (42 C.F.R. Part 2) if you check the box at the end of this form. (d) Individualized Education Programs, and other information about social services provided in schools. (e) Medi-Cal eligibility/enrollment information, which includes income and certain other demographic and geographic information pertaining to your eligibility for Services and benefits. (f) Housing/homelessness information, including your housing status, history, and supports. (g) Limited criminal justice information, including booking data, dates and location of incarceration, and supervision status. Your consent does not apply to your criminal history, charges, and immigration status. 3. Sources and Recipients of Your Information By signing, you agree to allow a health information exchange or community information exchange ("HIE/CIE") facilitate the exchange of your health and other confidential information with and between your care partners from which you have received, are receiving, or will receive benefits, treatment, or services (""Your Care Partners"). Information may be shared only for the purposes in part 1. Your Care Partners may include the following: (a) Healthcare providers, such as hospitals, clinics, physicians, pharmacies, and behavioral health providers. (b) Managed care plans (MCPs), which administer Medi-Cal benefits and pay for services you receive under Medi-Cal. (c) Certain community-based organizations (CBOs) that must comply with federal health care privacy laws, including some medically tailored meal providers, housing providers, and asthma remediation providers. DHCS 0303 (03/2023) Page 2 of 4 Consent-to-Share www.chcf.org 23 State of California - Health and Human Services Agency Department of Health Care Services Authorization to Share Confidential Medi-Cal Information (ASCMI) (d) School-based providers of health or social services, such as nurses, social workers, and counselors. (e) State health agencies, specifically, the California Departments of Health Care Services, Public Health, Social Services, and Developmental Services. (f) County agencies, including mental health plans, human/social services or welfare departments, drug Medi-Cal organized delivery systems, and health and public health departments. (g) Providers & case managers at correctional facilities, such as those at jails, prisons, and youth correctional facilities, only for the purposes in part 1 of this form. You do not consent to the use of your information for criminal investigations or prosecutions, sentencing, parole or probation monitoring, immigration enforcement, or family court proceedings. Your Care Partners and their contractors agree to obey all applicable laws protecting your information. 4. Expiration, Revocation, or Change of This Form Once signed, this form will be effective until the first of the following occurs: (a) 24 months from the date on which you were last enrolled in Medi-Cal; (b) you revoke this form; or (c) you make any change to this form, and the modified form becomes effective. 5. Your Rights You understand that: (a) you can revoke this form at any time through the consent management service portal or by sending a revocation request signed by you or your representative to the HIE/CIE. ; (b) a revocation is effective when received but may not apply to information already shared based on your past executed form, which may not be recalled or deleted; (c) you may decline to sign this form and doing so will not affect your treatment or care, your eligibility for or ability to receive Services, or the payment for Services; (d) you have a right to receive a copy of this form; (e) the information you authorize for release could be re-disclosed by Your Care Partners, but only in compliance with this form and applicable law; and (f) you may obtain a list of Your Care Partners to which your information has been disclosed by contacting the HIE/CIE. DHCS 0303 (03/2023) Page 3 of 4 California Health Care Foundation www.chcf.org 24 State of California - Health and Human Services Agency Department of Health Care Services Authorization to Share Confidential Medi-Cal Information (ASCMI) Each of these rights extend to your representative if authorized by you under applicable law. 6. Sharing Information Without Your Consent You understand that even if you do not sign this form, under federal and state privacy laws some of Your Care Partners may share your confidential information for treatment, payment, and other purposes, but providers subject to federal substance use confidentiality laws generally may not share your substance use disorder information without your consent. 7. Authorization By signing this form, I authorize certain organizations and individuals to use and share my health and other confidential information for purposes described in part 1 of this form. Also, if I voluntarily include my phone number above, I consent to the receipt of texts or calls to communicate with me about my consent choices and how my information may be shared (standard message and data rates may apply). ☐ By checking this box, I also authorize the disclosure of substance use disorder information about me that comes from providers subject to federal substance use confidentiality regulations (42 C.F.R. Part 2). If you are signing on your own behalf, fill out the 1st line. If you are signing on behalf of someone else, fill out the 2nd line. If you are signing on behalf of a minor aged 12-17, the minor should fill out the 1st line and you should fill out the 2nd line. Beneficiary's Name Beneficiary's Signature Date (mm/dd/yyyy) Representative's Name Representative's Signature Date (mm/dd/yyyy) Source: "ASCMI Form (PDF)" Department of Health Care Services, updated March 2023. DHCS 0303 (03/2023) Page 4 of 4 Consent-to-Share www.chcf.org 25 Appendix 3. Sample from SHIG Guidance State Health Information Guidance Volume 5.1 Graphic – Behavioral Health Provider to Social Services Case Manager – SUD Behavioral Social Services Health (BH) Case Manager Provider A SSCM needs a foster youth s SUD health information Start for treatment or coordination of care purposes SUD patient- Is the BH provider Is the SUD program Is the SSCM identifying subject to 42 C.F.R. Part Yes licensed by Yes employed by the SUD Yes information 2 regulations? Cal. DHCS ? program? may be shared No No No Is the SSCM SUD patient- SUD patient- and BH provider identifying identifying Yes in the same facility/ Information information may be treatment may be shared shared with an program? authorization No Is the SSCM Yes employed by a No Qualified Service Organization that provides services to the SUD treatment program? Source: "State Health Information Guidance 5.1 Sharing Minors and Foster Youth Health Information in California," California Health and Human Services, page 80, April 2023. Update 2023 Page 80 of 129 California Health Care Foundation www.chcf.org 26 Once Enrollees are identified and authorized for the ECM benefit, MCPs identify the providers each Enrollee has engaged with and determine the most appropriate provider for ECM assignment based on that Enrollee's physical health, behavioral health, and social needs, including cultural and linguistic competency. After assignment is confirmed,4. Appendix MCPs are required to share Enrollee Assignment Files with ECM providers. ECM Providers then use available information to reach out to and engage with Consent in a Given Care Context Enrollees qualifying for the ECM benefit. Use Case 2-1: Data Exchange: Enrollee Information File Function: Enrollee engagement for ECM services Originating Entity: MCP Receiving Entity: ECM Provider Use Case 2-1 Visualization Legal Rationale When the Enrollee has not signed an authorization that allows for disclosure from the Source: "CalAIM Data Sharing Authorization Guidance," Department of Health Care Services, March 2022. MCP to the ECM Provider, data-including physical health and behavioral health information not subject to 42 C.F.R. Part 2, housing history, incarceration status, Medi- Cal redetermination dates, and demographic data-potentially may be disclosed from the MCP to the ECM Provider under HIPAA if the ECM provider is a health care provider, since the disclosure is being made for a treatment purpose to a health care provider. If the ECM Provider is not a health care provider under HIPAA and the Enrollee has not consented to disclosure, the treatment exception under HIPAA may not apply. HIPAA does permit a health plan to disclose PHI for care coordination purposes to organizations that are not HIPAA covered entities if those organizations act as a business associate of the health plan. MCPs, in consultation with their legal counsel, should consider whether it is appropriate to enter into business associate agreements with their ECM providers that are not covered entities. 26 Consent-to-Share www.chcf.org 27 Appendix 5. ASCMI Pilot Program Descriptions $ San Diego County: Awarded to 2-1-1 San Diego Community Information Exchange with partners San Diego County Health and Human Services Agency, San Diego Behavioral Health Services, San Diego Medical Care Services, San Diego Advancing and Innovating Medi-Cal Unit, McAlister Institute, Metropolitan Area Advisory Committee on Anti-Poverty, People Assisting the Homeless, Integrated Health Partners, San Diego Health Connect, San Ysidro Health Center, and Health Net. The San Diego ASCMI Pilot had the following specific goals: 1) expand data sharing options for San Diegans to include substance use data for purposes of care coordination; 2) complete technology builds and process changes to facilitate expanded data sharing and consent refinement; 3) develop and implement community consent management and referral workflow training; and 4) collect and disseminate pilot project learnings and implications for scalability. $ San Joaquin County: Awarded to Manifest MedEx (MX) with partners San Joaquin County Department of Behavioral Health Services, Health Plan of San Joaquin, San Joaquin County Whole Person Care, and Health Net. The San Joaquin ASCMI Pilot collaborated with providers including San Joaquin County Whole Person Care, San Joaquin County Behavioral Health Services Access Clinics, TeleCare Corp, and Community Medical Centers to test the ASCMI form and consent management portal in San Joaquin County. MX received feedback from stakeholders on the applica- tion of the ASCMI form which was conveyed to DHCS and incorporated into the portal development, helping providers and patients feel more comfortable signing the ASCMI form. An example of an adjustment based on feedback was MXs addition of a consent recipient field on its portal, which makes the portal compliant with Title 42's Confidentiality of Substance Use Disorder Patient Records requirements. MX also broke up the consent options so patients could consent to the sharing of individual types of data. This helped patients feel comfortable and in control of their choices, resulting in higher signing metrics. More than 90% of patients who were asked to sign the ASCMI form consented to sharing data, and nearly half consented to disclosing SUD data. The pilot provided insights on success factors for shaping a full roll out that can be proactively addressed prior to the next phase, including the most productive types of training to technological adjustments, such as IP whitelisting. Participants were eager to participate in the pilot and see a real need for consent management forms as a means of improving data sharing for all Californians, not just those enrolled in Medi-Cal. $ Santa Cruz County: Awarded to Serving Communities Health Information Organization (SCHIO) with partners Santa Cruz County Behavioral Health Services, Central California Alliance for Health, HSA FQHC, Front Street, Salud Para la Gente, and Janus of Santa Cruz. The Santa Cruz ASCMI pilot tested the use of the ASCMI form and community-based consent registry by allowing the new form to be introduced and executed on paper, on a tablet-based system hosted by the provider organization, or on a mobile app downloaded to the Medi-Cal enrollees' own device. In the latter case, the Medi-Cal member had the ability to not just review the consent, but also to sign, change, and revoke it. The tablet and mobile platform used the FHIRed App, developed by the Dell Medical School under a LEAP grant from the ONC. The consent registry, based on consents executed in any of the three modalities, was hosted by the SCHIO platform, which was configured to prominently share and display the status of ASCMI consent as well as a running timeline of the patient's consent decisions. California Health Care Foundation www.chcf.org 28 Appendix 6 Sonoma Connect Consent Form Resource Connection Network (RCN) Consent to Share Personal Information Purpose: "So we can serve you better together" Sonoma Connect | Sonoma Unidos is a group of community members and organizations working together to create the Resource Connection Network (RCN). This system's purpose is to allow people to connect to the resources they need when they need them. This helps by supporting the referral process between community agencies who work together by sharing information that will better your care. Information shared in the Resource Connection Network will lower duplication of screening and eligibility questions. This document asks for your permission to share your information in the Resource Connection Network. Signing this document will only share your relevant personal information with participating organizations that are a part of your desired care team. Why is this important? Sharing this information helps us connect you to resources that can support your health and overall wellbeing. We have heard from the community that there are many helpful resources in Sonoma County. Still, many of them are hard to access or not connected to each other. When your information is shared with your care team, it is easier to coordinate your care and improve the quality of services offered to you. The goal is to give you and your family the best possible support. Consent-to-Share 1 www.chcf.org 29 Client Information First Name: __________________________ Last Name: __________________________ Previous Name: ________________________ Date of Birth: ________________________ Medi-Cal CIN (Optional): _________________ Signing this form is your choice. If you agree and sign this form, you are giving permission for your information to be shared with (to and from) the following types of organizations: • Health care providers • Behavioral health providers • Community organizations (for • County Departments (for example, Dept. Of Health example, food banks, legal services) Services and Human Services Dept) • Social services providers • Housing and Homeless providers • Health plans • Organizations involved with the justice system • Wellness organizations Your information from the types of organizations above may also be shared with Substance Use Disorder (SUD) providers. SUD providers can only receive it to help coordinate your care, resources, and human services. Note: This authorization does not allow SUD Providers to share your SUD information. By signing your name below, you agree that your current and future care team may disclose your health information, records, social services information, and other data to the Resource Connection Network. Such data may be shared between the Resource Connection Network participating organizations found here. At your request, you may also receive a printed copy of these organizations for your record by reaching out to your Resource Connection Network care team. Signing this form is your choice. No matter what you choose, it will not change your eligibility to receive services. Service providers that take part in the Resource Connection Network agree to only access and share information that is needed to serve you and are required to protect your information even if it is no longer protected under applicable privacy laws. 2 California Health Care Foundation www.chcf.org 30 Information that may be shared includes: • Your personal demographics (for example, your name, date of birth, gender, and contact information). • Your housing information (for example, your type of housing, housing status, reason for housing status). • Your employment and financial needs. • The social services that you receive or may be eligible to receive (for example, CalFresh, Medi-Cal, and other public benefits). • This form will apply to data from all services you receive within the Resource Connection Network providers and partners. Substance Use Disorder (SUD) information protected by Federal law 42 C.F.R. Part 2 is not included as part of this authorization. Under California law, your explicit permission is required in order to share mental health and/or HIV test results with other providers or digital systems. This specially protected information will not be shared with participating providers via the network, therefore consent to release this information is not applicable to this form. Your care providers may ask you to complete a separate consent to share this information, as needed, to treat you or provide services to you. Your Rights: • You may refuse to sign this form. Your refusal will not affect your ability to receive treatment, payment, or eligibility for benefits otherwise available to you. • You have a right to receive a copy of this form. • You may revoke (take back) or change your consent/permission at any time. You can start this process by talking with any of your Resource Connection Network providers. Your service provider may contact the tenant admin to revoke or change consent at your request, or you can submit a change request in writing to the following address : 1310 Redwood Way Ste 135, Petaluma, CA 94954. If you want to change what information can be shared, you can complete a new authorization/form to reflect any change(s). If you decide not to share sensitive information, it will not affect the services you receive from your providers, but you may receive more limited care coordination services through the Resource Connection Network. • Any information previously shared with current or past treating providers cannot be recalled and your cancellation of sharing only applies to information shared after notification of the cancellation. • Your cancelation of consent will take effect when the Resource Connection Network is notified, except to the extent that others have already acted dependent upon this authorization. • You are entitled to receive a copy of this form and the current list of participating organizations. You can also receive and review a copy of your health and social services information that is shared by this form. 3 • Signing this form does not change what Personal Health Information can be shared under State and Federal Laws. If you choose not to sign this form: If you decide not Consent-to-Share to sign this form, you will still receive medical services, treatment, or otherwww.chcf.org services. It will,31 however, limit the actions that the network of providers that collaborate on the Resource Connection Network • Signing this form does not change what Personal Health Information can be shared under State and Federal Laws. If you choose not to sign this form: If you decide not to sign this form, you will still receive medical services, treatment, or other services. It will, however, limit the actions that the network of providers that collaborate on the Resource Connection Network can do together to help you, and we will not be able to coordinate these services for you at this time. Please call 707-792-7900 for information regarding RCN privacy practices.  Some information shared under this Authorization may be re-shared with others under certain conditions and may no longer be protected by State and Federal confidentiality laws. Certain information may require my written permission to be redisclosed, unless specifically permitted or required by law.  I understand that treatment, payment, enrollment, or eligibility for benefits may not be conditioned on my signing of this form. However, I understand that the Resource Connection Network providers and organizations may not be able to coordinate my services without a signed form.  This form expires on (date or event): ______________________ o This form will remain in effect for one year from the date of my signature or until I withdraw authorization.  I have read this form or have listened to it read to me. I authorize the use and sharing of my health and social services information as described above. Client Name : ___________________________________________ Client Signature: _________________________________________ Client or Legal Representative (Required) If the form is signed by a person other than the client, please include the name and relationship to the client: _________________________________________ ____________________________________ Full Name Relationship Today's Date: ________________________________ Month / Day / Year (Required) Source: "Resource Connection Network (RCN): Consent to Share Personal Information," Sonoma Connect. 4 California Health Care Foundation www.chcf.org 32 Appendix 7 Sonoma Connect Consent Revocation Form Resource Connection Network Revocation of Information Sharing Authorization Form Last Updated 06/22/23 The purpose of this form is to obtain authorization to revoke client consent in the Resource Connection Network system. In the client's profile, user will upload signed document into the Document Vault and select revoke consent next to the client's consent form. For questions regarding revoking consent please email Harman Basra, Network Manager, hbasra@aliadoshealth.org Client Name: Date of Birth: Medi-Cal CIN (If known): I wish to revoke my authorization. (Please send to your Care Team member) Signature of Client or Client's Legal Representative: / / Month Day Year If signed by Client's Legal Representative, state relationship and authority to do so: Source: "Resource Connection Network Revocation of Information Sharing Authorization Form," Sonoma Connect, 2023. Consent-to-Share www.chcf.org 33 Endnotes 1. "5. Social Workers' Ethical Responsibilities to the Social Work 8. DHCS finalized a vendor for the PHM Service contract in Profession," NASW Code of Ethics: Ethical Standards, National 2022 and planned to test the PHM Service in the first quarter Association of Social Workers (NASW), 2021; T. L. Beauchamp and launch and scale the service in the third quarter of 2023, and J.F. Childress, Principles of Biomedical Ethics (Oxford: however, testing has not yet begun and the envisioned Oxford University Press, 1979). design for consent management has not yet been articulated. "Invitation for Proposal 21-10375 Population Health 2. "Data Exchange Framework," Center for Data Insights and Management Service," DHCS, September 7, 2022; "CalAIM Innovation (CDII), 2023. Population Health Management Service Advisory Group," 3. Data Exchange Framework Guiding Principles (PDF), California DHCS, December 5, 2022. Health and Human Services (CalHHS) and CDII, July 1, 2022. 9. Lauren Larin and Julie Silas, "How to Share Data: Practical 4. Lisa Bari and Shruti Kothari, "Why Health Data Sharing Needs Guide for Health and Homeless Systems of Care" (PDF), To Be A Priority For LGBTQ+ Advocacy," Health Affairs, California Health Care Foundation (CHCF), May 2022; August 14, 2023. California Advancing and Innovating Medi-Cal Act, Welfare and Institutions Code § 14184.102. 5. CalHHS Data Exchange Framework Policy and Procedure: Privacy Standards and Security Safeguards (PDF), CalHHS, July 10. CalAIM Data Sharing Authorization Guidance (PDF), DHCS, 5, 2022. March 2022; CalAIM Data Sharing Authorization Guidance Version 2.0 (PDF), DHCS, June 2023. 6. "Medi-Cal Transformation: Our Journey to a Healthier Claifornia for All," Department of Health Care Services 11. "State Health Information Guidance (SHIG)," CDII, April 2023. (DHCS), August 10, 2023. 12. California Assembly Bill 133 (AB-133), 2021. 7. To implement both ECM and CS, MCPs contract directly 13. Strategy for Digital Identities (PDF), CalHHS, July 1, 2022. with community-based and other local/county social services organizations that have their own interpretation of consent-to- 14. "RFI #50040755 CalHHS Person Identity Matching Solution," share policies related practices. As such, these two programs Cal eProcure, June 28, 2023. form the basis of the use cases for data sharing outlined in 15. "HL7 Version 2 Product Suite," HL7 International, accessed the CalAIM Data Sharing Authorization Guidance published September 11, 2023. in March of 2022 applicable to adults only. This Guidance concludes that the vast majority of necessary data sharing 16. "HL7 Implementation Guide: Data Segmentation for Privacy for the purposes of coordination with local and county (DS4P), Release 1," HL7 International, May 13, 2014; "Security jails and housing systems operating federal HUD Housing Label DS4P Home Page," HL7 International, August 12, 2021. Management Information Systems (HMIS) is permissible without explicit consent-to-share under both federal and state 17. Chethan Sarabu et al., "Shifting into Action: from Data law, as amended by AB-133. However, the Guidance notes Segmentation to Equitable Interoperability for Adolescents the ongoing exception of substance use disorder treatment (and Everyone Else)," Appl Clin Inform 14, no. 3 (2023): information that is protected by 42 C.F.R. Part 2 and that there 544-554. are other provisions, including county laws and organizational 18. "CalAIM ASCMI Pilot," DHCS, accessed September 7, 2023. policies of housing organizations for example, that do require explicit consent-to-share. A newer version of the Guidance 19. In addition to utilizing the ASCMI form, the pilot stipulated that is currently available for review and comment accounts the development of a "consent management service that is for the broader set of information sharing needed to achieve accessible to members, ECM providers, Community Supports the full vision of CalAIM, given the expansion of ECM and providers, physical and behavioral health providers, hospitals CS to children, youth and incarcerated populations. Much and others via electronic health record (EHR) system and/or of this care coordination will require explicit consent-to- website." This service must have the capabilities to be able share as it involves collaborative care with schools under the to securely store individual consent using the ASCMI form, Family Educational Rights and Privacy Act and Individuals allow ECM and CS providers to view patient-client consent, with Disabilities Education Act provisions and their California and allow individuals to amend their consent at any time. counterpart the California "Pupil Records" Law, as well as "RFI 22-006 Authorization to Share Confidential Medi-Cal compliance with the federal Child Abuse Prevention and Information (ASCMI) Form," Cal eProcure, November 4, 2022. Treatment Act and the similar California welfare codes, and 20. "Whole Person Care Pilots," DHCS, accessed October 10, privacy guidelines for U.S. Department of Agriculture nutrition 2023. programs. See Appendix 4 for a visual of how consent works in a given care context. 21. "Health Homes Program," DHCS, accessed October 10, 2023. California Health Care Foundation www.chcf.org 34