Policy Statement: The Health Information Technology (HIT) Director has the authority to suspend or terminate the participation in the North Dakota Health Information Network (NDHIN) of any Participant or Authorized User.
Emergency Suspension
If the Vendor discovers a breach or suspicious transactions and considers it necessary to take immediate action, it may suspend access to the NDHIN immediately. The Vendor shall notify the NDHIN of the action, reason for its action, and collaborate with the HIT Director to address the situation.
Authorized User Suspension or Termination
Upon the HIT Director, or designee completing a preliminary investigation and the HIT Director determining that there is a substantial likelihood that an Authorized User’s acts or omissions create an immediate threat or will cause irreparable harm to another party, including, but not limited to, a Participant, an Authorized User, the NDHIN, Vendor, or an Individual whose health information is exchanged through the NDHIN; the HIT Director, or designee may suspend, to the extent necessary to address the threat, the Authorized User’s NDHIN access.
A Participant may suspend, limit, or revoke the access authority of its Authorized User on its own initiative upon a determination that the Authorized User has not complied with the Participant’s privacy policies, the NDHIN policies, or the terms of the user agreement, if it is determined by the Participant to be necessary to protect the privacy of Individuals or the security of the system. The Participant must immediately notify the HIT Director, or designee, of any action limiting access of an Authorized User.
The Participant responsible for the Authorized User shall take necessary steps to resolve the problems. Once resolved, the Participant shall notify the HIT Director, or designee, and may request reinstatement of the Authorized User's access.
The Participant must immediately notify the HIT Director, or designee, of any change to an Authorized User’s job responsibilities or a change of employment status or staff privileges, including every change in an Authorized User’s access whether it opens, expands, restricts, or terminates the Authorized User’s access to the NDHIN.
Participant Suspension Process
The HIT Director, or designee, shall immediately but within twelve hours of suspending a Participant’s access provide notice of the suspension to all Participants and provide a written summary of the reasons for the suspension to the suspended Participant. The Participant shall use reasonable efforts to respond to the suspension notice with a detailed plan of correction or an objection to the suspension within three business days or, if such a submission is not reasonably feasible within three business days, then at the earliest practicable time.
Within five business days after submission of the Participants plan of correction, the HIT Director, in collaboration with Vendor shall review and either accept or reject the plan of correction. If the plan of correction is accepted, the HIT Director will, upon completion of the plan of correction, reinstate the Participant’s access and provide notice to all Participants of the reinstatement. If the plan of correction is rejected, the Participant’s suspension will continue, during which time the HIT Director, Vendor, and the Participant shall work in good faith to develop a plan of correction that is acceptable to all. If agreement cannot be reached, either party may appeal the dispute to the Health Information Technology Advisory Committee (HITAC).
Appeal Process
A Participant may appeal, in writing, the HIT Director’s decision to suspend or terminate its participation in the NDHIN to the HITAC. The Committee shall review the written material from the Participant, Vendor, HIT Director, or any affected party. The Committee may hold a meeting with the parties to gather additional information. The Committee shall issue a final determination, in writing, and the decision shall be provided to all Participants.
Termination of Participation Agreement
Upon any termination of the Participation Agreement the terminated party shall cease to be a Participant and neither it nor its Authorized Users shall have any rights to use the NDHIN (unless the Authorized Users have an independent right to access the NDHIN through another Participant).
Effects of Termination
Upon termination of the Participant Agreement Clinical Portal and Communicate accounts of users will be disabled, as will Required Public Health Reporting to the North Dakota Department of Health, and HIE Data Feeds (Interfaces) will be disabled.
If at the date of termination of service outstanding fees are owed by the Participant, NDHIN will continue attempts to collect those fees.
Reactivation of Participation
Upon request for reactivation of Participation, the reactivated party must pay any outstanding fees. Interfaces disabled at Participant Termination will not be reactivated, but rather will be completely rebuilt at the current cost.
Disposition of Health Information upon Termination
At the time of termination, another Participant that received health information, may, at its election, retain the information in accordance with its document and data retention policies and procedures, applicable law, and the terms and conditions of the Participation Agreement and these policies.
The NDHIN shall retain an audit trail for a terminated Participant for at least six years.
Upon termination the NDHIN may no longer access or transmit any health information to and from the terminated Participant.
Except as retained by other Participants, Vendor must delete or destroy any health information of the terminated Participant and certify the destruction to the Director and Participants.
Governing Law
In the event of a dispute between or among the parties to the NDHIN, the laws of the State of North Dakota will govern. Any action to enforce a Participation Agreement or participation in the NDHIN must be adjudicated exclusively in the state District Court of Burleigh County, North Dakota.
Participant Policies/Remote Access
Each Participant shall establish and enforce policies and procedures regarding Authorized User access to Patient Data (including Remote Access), the conditions that must be met and documentation that must be obtained prior to allowing an Authorized User access to Patient Data.
Policies shall include procedures for taking disciplinary actions for its Authorized Users or members of its workforce in the event of a breach or non-compliance with the NDHIN policies.
The Participant may suspend, limit, or revoke the access authority of an Authorized User on its own initiative upon a determination that the Authorized User has not complied with the Participant’s policies or the NDHIN policies. The Participant shall inform the HIT office immediately, and in any case within twenty-four hours, of any revocation or suspension of access to the NDHIN.