2018 DURSA Amendment Redline ? DRAFT - The Sequoia Project

Restatement III of the
Data Use and Reciprocal Support Agreement (DURSA) Version Date: September 30, 2014
| | |
Overview
Introduction In 2008, as part of the Nationwide Health Information Network Phase II
Trial Implementations, a multi-disciplinary team was assembled to develop a
comprehensive agreement that would create a legal framework using existing
law for the electronic exchange of health data. This agreement, called the
Data Use and Reciprocal Support Agreement or DURSA, was first executed by a
number of Federal agencies and non-Federal organizations (the
"Participants") beginning in November 2009. The executed DURSA contains a provision describing the creation of a
Coordinating Committee that is charged with maintaining and evolving this
Agreement. Pursuant to that charge, in 2010, the Coordinating Committee
established a Task Group to suggest revisions to the Agreement based on the
experience gained with the early implementations and to accommodate new
opportunities for the promotion and expansion of health information
exchange. This Overview was prepared to facilitate the reader's understanding of the
DURSA, and to place the DURSA into an appropriate context. What is the eHealth Exchange? The eHealth Exchange began as an initiative under the leadership of the
Office of the National Coordinator for Health Information Technology (ONC)
known as the Nationwide Health Information Network (NHIN or NwHIN). The
successful development of the eHealth Exchange allowed it to be transferred
from an ONC incubator to a public-private effort in 2012 supported by The
Sequoia Project. The eHealth Exchange is a data sharing network of
governmental and non-governmental exchange partners who share information
under a multi-purpose set of standards and services which are designed to
support a broad range of information exchange activities using various
technical platforms and solutions. The eHealth Exchange does not favor any
vendor, software, technology or particular approach to information
exchange. It is open to anyone that agrees to comply with the eHealth
Exchange Specifications and other requirements. Why is a Data Use and Reciprocal Support Agreement (DURSA) Needed? The DURSA is a legal agreement created to promote and establish trust among
the Participants in the eHealth Exchange. It codifies a common set of
trust expectations into an enforceable legal framework, and eliminates the
need for point-to-point agreements. What is the Data Use and Reciprocal Support Agreement (DURSA)?
The DURSA is the legal, multi-party trust agreement that is entered into
voluntarily by all entities, organizations and Federal agencies that desire
to engage in electronic health information exchange with each other using
an agreed upon set of national standards, services and policies developed
in coordination with through the eHealth Exchange. Office of the National
Coordinator for Health IT (ONC) in the U.S. Department of Health and Human
Services. (Those who sign the DURSA or its Joinder Agreement are known as
"Participants.") The DURSA builds upon the various legal requirements that Participants are
already subject to and describes the mutual responsibilities, obligations
and expectations of all Participants under the Agreement. All of these
responsibilities, obligations and expectations create a framework for safe
and secure health information exchange, and are designed to promote trust
among Participants and protect the privacy, confidentiality and security of
the health data that is shared.
The DURSA is based upon the existing body of law (Federal, state, local)
applicable to the privacy and security of health information and is
supportive of the current policy framework for health information exchange.
The DURSA is intended to be a legally enforceable contract that represents
a framework for broad-based information exchange among a set of trusted
entities. The Agreement reflects consensus among the state-level, federal
and private entities who were involved in the development of the DURSA
regarding the following issues: . Multi-Party Agreement
. Participants Actively Engaged in Health Information Exchange
. Privacy and Security Obligations
. Requests for Information Based on a Permitted Purpose
. Duty to Respond
. Future Use of Data Received from Another Participant
. Respective Duties of Submitting and Receiving Participants
. Autonomy Principle for Access
. Use of Authorizations to Support Requests for Data
. Participant BreachAdverse Security Event Notification
. Mandatory Non-Binding Dispute Resolution
. Allocation of Liability Risk
Will the The DURSA is an organic, living document that will evolve over
time.continue to evolve? Yes. An initial group of Participants executed the first production level
DURSA in 2009 to support the first set of electronic health information
exchange activities in production under the Agreement. Since then, other
entities wishing to transact health information electronically using the
agreed upon standards, services and policies have executed the DURSA.
Additional entities are expected to execute the Agreement over time. (The
November 2009 version of the DURSA is available at
http://healthit.hhs.gov/portal/server.pt/gateway/PTARGS_0_11673_910332_0_0_1
8/DURSA_2009_VersionforProductionPilots_20091123.pdf.) As a living
document, the DURSA is being maintained using the process described in the
Agreement. An amended and restated version of the DURSA will be available
for execution in 2014. The legal, policy, technical and business
environment has changed since the first version of the DURSA and, there is
every reason to think, that it will continue to change over time. Below is a quick summary of the DURSA versions as of 2017. Prior versions
of the DURSA can be found here: http://sequoiaproject.org/ehealth-
exchange/onboarding/dursa/ 2009- The DURSA was signed by the very first eHealth Exchange Participants.
2011- The DURSA was amended in 2011 to remove all references to "Nationwide
Health Information Network" and replace it with "Network;" modify the
composition of the Coordinating Committee to better reflect the growth of
the Network; strengthen Network security by requiring all Participants to
identity proof all Participant Users; and allow the Coordinating Committee
to adopt Operating Policies and Procedures to supplement the DURSA. 2014- The DURSA was again amended in 2014 to remove the specific
composition of the Coordinating Committee from the DURSA and include it in
a new Operating Policy and Procedure, given that the type of organizations
wishing to become Participants was changing and the expectation that the
Coordinating Committee membership would need to change over time. 2017- The DURSA is being amended and restated to incorporate a number of
revisions that eHealth Exchange has been tracking for several years. Some
of these are very substantive, such as expanding the definition of
Permitted Purposes, and others are more technical in nature. The timing of
amending the DURSA now is driven by the desire for the eHealth Exchange to
join Carequality as an Implementer. The eHealth Exchange Coordinating
Committee has explored the merits of joining Carequality and has decided
that doing so is in the best interests of eHealth Exchange. The DURSA, as
currently written, does not give the Coordinating Committee the authority
to sign the Carequality Coordination Agreement and become an Implementer.
One of the amendments being proposed is to allow the Coordinating Committee
to enter into agreements with other data sharing networks like Carequality. When the Department of Health and Human Services issues final regulations
addressing governance of the nationwide health information network, the
Coordinating Committee will likely convene another Task Group to assess how
the DURSA might need to be revised to accommodate the new regulations. Can the DURSA be Used for Other Purposes? The DURSA was developed for a specific purpose - to establish the legal
framework and to support the trust framework for health information
exchange using an agreed upon set of standards, services and policies.
Others may find this document helpful or informative for other purposes,
for instance, when addressing practical issues related to other types of
information exchange models. The DURSA is not intended to be used, however,
for other purposes outside of the purpose for which it has been created. As
a result, entities interested in using this Agreement for other information
exchange purposes are encouraged to seek their own legal counsel regarding
the applicability and appropriateness of the DURSA to other settings.
Data Use and Reciprocal Support Agreement
This Restatement I II of the Data Use and Reciprocal Support Agreement
("DURSA" or the "Agreement") is made and entered into by and between the
undersigned (hereinafter referred to individually as "Participant" and
collectively as "Participants") as of the Effective Date. WITNESSETH: WHEREAS, the Participants who previously have executed the Data Use
and Reciprocal Support Agreement dated November 18, 2009September 30, 2014,
desire to amend and restate the Agreement in its entirety in order to
accommodate developments