TEXAS HEALTH SERVICES AUTHORITY

JULY 2013

HI ETex as L egal Fram ework

The legal framework established in state and federal law as well as by the THSA in conjunction
with the HIEs will ensure health information exchange in Texas is timely, private, and secure.

Ensuring Statewide Health

Information Exchange is Private and
Secure through Law and Policy
OUR MISSION
We will promote and
coordinate the
development of a seamless
electronic health
information infrastructure
to improve the quality,
safety, and efficiency of the
Texas health care sector
while protecting individual
privacy.
OUR VISION
We will be recognized as a
trusted leader in the
development of electronic
health information
exchange infrastructure
that enhances health care
quality and efficiency for all
patients.

Purpose
The purpose of this document is to provide consumers, health care providers,
HIEs, and other stakeholders with informa:on about the legal framework
behind HIETexas, the state-wide HIE that will allow HIE-to-HIE connec:vity
within Texas and allow connec:vity between Texas HIEs and the na:onal
eHealth Exchange.

Summary
HIETexas is the state-level shared services to allow local and other HIEs within
Texas to communicate with each other and with the na:onal eHealth Exchange.
These services will allow providers to send and receive clinical data outside their
local HIE; exchange informa:on within a secure and conden:al technical
framework; send and receive pa:ent consent and authoriza:on informa:on;
and provide access to data from state and federal agencies. HIETexas state-
level shared services will support the private and secure ow of health
informa:on to ensure that the right informa:on is available to the right health
care providers at the right :mes.
Because pa:ents health informa:on is sensi:ve, HIEs must ensure that
pa:ents privacy rights are protected. Addi:onally, because health care
providers are sensi:ve to these issues, the par:es involved must establish a
trust rela:onship for health informa:on exchange to work properly.
The purpose of the legal framework behind HIETexas is to establish trust
between the par:es and to ensure that informa:on is shared only in a secure
and appropriate manner.
The chart on the following page shows and explains the four main aspects or
pillars of the HIETexas legal framework.
State and Federal Medical Privacy Law;
Business Associate Agreement;
State-Level Trust Agreement; and
Par:cipa:on Agreement.

The THSA intends for this chart to allow interested par:es to beMer understand
the legal and private backbone of HIETexas and allow for beMer transparency of
HIETexas processes. Each of the four outside boxes of the chart represents one
of the main pillars of the legal framework. The bullet points highlight key
provisions in each pillar. The text boarding the pillars describes the rela:onship
between adjacent pillars.

THSA | 221 E. 9TH, SUITE 201 | AUSTIN, TEXAS 78701 | WWW.HIETEXAS.ORG

TEXAS HEALTH SERVICES AUTHORITY

State & Federal

Medical Privacy
Law

FOCUS ON COMPLIANCE WITH PRIVACY/SECURITY LAWS

State-Level Trust
Agreement

HIPAA National set of standards to

protect privacy & security of health
information

HITECH Act Updates HIPAA in

response to increase in HIT; creates
incentive payments for uses of EHR
technology
Texas Medical Records Privacy Act

(Ch. 181, THSC) Strengthens

protections in HIPAA and HITECH
Texas Health Services Authority
(Ch. 182, THSC) Created to develop
state-level HIE infrastructure
Texas Identity Theft Enforcement
& Protection Act (CH. 521, B&C
Code) Addresses state-level breach
notice requirements
ONC HIE Program Information
Notice 003 Provides guidance for
privacy/security of HIE framework

Allows for the sharing of protected

health information between the HIEs
and the THSA
Describes the permitted and required
uses of protected health information
received from the HIEs by the THSA,
including any limits placed on the HIEs
by their participating providers
Provides that the THSA will not use or
further disclose the protected health
information other than as permitted by
the HIEs and their participating
providers or as required by law
Requires the THSA to use appropriate
safeguards to prevent unauthorized
use or disclosure of the protected
health information

Agreement deRining relationship and

responsibilities that all HIETexas

participants owe to each other

Modeled after the eHealth Exchanges
Data Use and Reciprocal Support
Agreement (DURSA) for seamless
compliance at state and federal level
DeRines breach notiRication
parameters for HIETexas participants
to send to each other (separate and
distinct from breach notice
requirements to consumers and the
government under state and federal

medical privacy law)

Joinder Agreement acts as signatory

page to the State-Level Trust

Agreement

DeRines the business relationship

between the THSA and the HIEs
ConRirms that the THSA runs HIETexas
and has the authority to allow or
disallow access to HIETexas for the
HIEs
DeRines the terms of participation in
HIETexas, including requirement that
HIEs sign the State-Level Trust
Agreement and have a Business
Associate Agreement with the THSA
Discusses any fees/costs between the
parties
Sets a term or time frame for the HIEs
participation in HIETexas
Explains how and why an HIE would
have its access to HIETexas suspended
or terminated

FOCUS ON HIETEXAS PARTICIPATION REQUIREMENTS

THSA | 221 E. 9TH, SUITE 201 | AUSTIN, TEXAS 78701 | WWW.HIETEXAS.ORG

Business
Associate
Agreement

ESTABLISH THE RELATIONSHIP BETWEEN HIES AND THE THSA

ENSURE PROTECTION OF CONSUMERS PRIVACY

JULY 2013

Participation
Agreement