Interoperability & Data API Guidelines

The procedure page aims to outline guidelines for the implementation of Interoperability FHIR standards (as defined by DHCS/CalAIM initiatives) within San Mateo County’s BHRS system. The adoption of FHIR is crucial for enhancing interoperability, data exchange, and communication among various stakeholders within the behavioral health domain. 

Interoperability Objectives 

1. Facilitate seamless data exchange: FHIR implementation will enable the secure and efficient exchange of patient data between different healthcare entities within the county behavioral health system. 

2. Improve care coordination: By standardizing data formats and protocols, FHIR will support better coordination of care among behavioral health providers, primary care physicians, social services agencies, and other relevant entities. 

3. Enhance patient outcomes: Access to comprehensive and up-to-date patient information through FHIR will enable providers to make more informed decisions, leading to improved patient outcomes and quality of care. 

4. Ensure data privacy and security: The policy emphasizes compliance with relevant privacy and security regulations, such as HIPAA, to safeguard patient information during its exchange and utilization.

Infrastructure and Framework (FHIR) 

The document outlines a structured approach for implementing FHIR standards within the county behavioral health system, including technical specifications, data mapping, and integration with existing health IT infrastructure.  San Mateo County BHRS Infrastructure for FHIR is provided through our primary health care system: Netsmart. 

Governance and Oversight 

County understands that establishing governance structures and oversight mechanisms is crucial for managing FHIR implementation projects, ensuring compliance with policies, and resolving any issues or disputes that may arise. 

In observance of that need, San Mateo County relies on the guidance provided by state regulators, DHCS, county health division leadership, and county health governance committees.  San Mateo BHRS is also fully engaged in adherence to the privacy policies parameters outlined by DHCS and SUD privacy policy directed by 42 CFR Part 2.  

Link to San Mateo County BHRS: General HIPAA, Privacy and Security control/release of information release pages 

Connecting with San Mateo County BHRS Patient and Provider API’s 

County works with Netsmart to provision 3rd party access upon request. Netsmart provides the County the capability to manage this entirely. 

For full documentation, API syntax, configurations, technical requirements, parameters, and API handling: these items can be found on the Netsmart FHIR Developer Portal https://careconnect.netsmartcloud.com/ 

Prospective partners will have to engage by reaching out to bhrs-it-support@smcgov.org 

County observes and supports FHIR standard v4.0.1 protocol.  

The policy defines interoperability requirements for software vendors, healthcare providers, and other stakeholders involved in the exchange of behavioral health data. 

How to Connect with county FHIR API: 

1. A request would be made to BHRS-IT-Support@smcgov.org to initiate process for review to initiate and establish connection to our FHIR API. 
2. A county software vendor security review and assessment will likely need to be completed with vendor.   
3. County will partner with vendor and our Netsmart system to provision/de-provision 3rd party access upon request or need.  

All API vendor/partners are expected to adhere to the following data sharing policy/procedure guidelines: 

1. Security Risk Analysis: 
   • Compliance to ISD/HIT Security assessments, establish county software business operating agreement, and audit reviews as determined to be needed 
2. Risk and Notification: 
   • If a determination is made that continued access or security is deemed unacceptable, county will notify the third-party application provider of the decision and remove access temporarily or permanently.  
   • Remediation is to be reviewed at the discretion of county ISD/HIT governance 
3. Decision to Deny/Discontinue: 
   • If, after security reassessment, county reasonably determines that the security risks remain unacceptable, proceed with the decision to deny or discontinue the third-party application’s connection to the API. 
4. Notification of Decision: 
   • Notify vendor and county partners/stakeholders, including affected users, healthcare providers, and the organization’s internal IT and security teams, about the decision to deny or discontinue API access for the specific third-party application. 
5. Documentation: 
   • Documentation of all policy and procedure decisions to enable, remove, or terminate data share agreements are documented for HIPAA retention requirements. 
6. Compliance: 
   • Adherence to privacy and security to BHRS privacy guidelines in regards to data sharing should be mirrored in FHIR API standards. Vendor compliance ensures that sensitive patient information is shared securely and in accordance with consent guidelines mandated by federal and state regulation: meeting the highest standards of confidentiality and data protection. Our policy emphasizes the responsible use of FHIR API, safeguarding mental health and SUD data through member consent and against unauthorized access and ensuring a trusted and interoperable healthcare environment. 

Patient Access API 

Claims and Encounter Data: 

Encounter data is mapped and referenced directly through Netsmart’s Avatar system via the FHIR portal. 

Member Claims information is populated using 835 data available in Netsmart Cal-PM and MSO modules. Only data electronically received and posted via an 835 will be listed in the EOB resource.  

• In Netsmart’s Cal-PM module, this will be once the 835 file has been posted in the “835 Health Claim Payment/Advice” form.  
• In Netsmart’s MSO module, this is available once an 835 is generated for the inbound 837. 
• All data referenced within Netsmart’s interoperability calls to their modules in reporting and output is real-time 

Provider Access API 

Provider Data and 274 Provider Directory Data Requirements: 

San Mateo County BHRS commits to adhering to the 274 Provider Data Requirements set forth by state and federal regulatory agencies for Mental Health and DMC-ODS.  Data is kept real-time and reflected immediately upon requested provider updates.  This 274 data table is directly updated and entered through Netsmart’s Avatar system. 

For the Fast Healthcare Interoperability Resources (FHIR) Provider Access API, this data is directly configured to be mapped from our 274 Provider data file. This ensures the accuracy, security, and interoperability of shared provider data, emphasizing compliance with FHIR standards. We prioritize maintaining up-to-date and complete information, implementing proper security and data handling measures.  We also comply with independent, state, and federal regulatory agencies for audit and review of our reported provider data annually. 

As noted, for full API data and documentation pertaining to Patient and Provider API config items can be found on the Netsmart FHIR Developer Portal https://careconnect.netsmartcloud.com/ 

Security and Access Controls 

BHRS actively takes the following steps to help protect the privacy and security of their health information:  

• Compliance to privacy and data sharing guideline measures set forth by DHCS, federal, and state governing bodies 
• Regularly set audits for controls of data and privacy by governing boards and independent auditors 
• Secure internal health data, HIPAA compliant vendor communications, and multifactor authentication 
• Multiple tiers of software security monitoring and required vendor security software assessments/clearances  
• Disaster and data loss recovery plans regularly reviewed and audited 
• Employ secure network communication protocols 

General HIPAA-Covered Entities, Non-entities and Oversight Agencies 

HIPAA (Health Insurance Portability and Accountability Act) covers entities that handle protected health information (PHI).  

Covered entities include: 

1. Healthcare Providers: Doctors, hospitals, clinics, psychologists, and pharmacies. 
2. Health Plans: Health insurance companies, HMOs, company health plans, and government programs like Medicare and Medicaid. 
3. Healthcare Clearinghouses: Entities that process nonstandard health information into a standard, interoperable format. 

Entities or individuals that generally are not covered by HIPAA include: 

1. Employers: Employers, except in certain situations related to employee health plans. 
2. Life Insurers: Companies providing life insurance. 
3. Schools: Most schools, unless they provide healthcare to students through a separate healthcare provider. 

Oversight Responsibilities: 

• Office for Civil Rights (OCR): Part of the U.S. Department of Health and Human Services (HHS), OCR enforces HIPAA privacy and security rules for covered entities. It investigates complaints and conducts audits to ensure compliance. 
• Federal Trade Commission (FTC): The FTC plays a role in enforcing privacy and security standards for non-HIPAA-covered entities, such as mobile health apps and health-related websites. It promotes consumer protection and addresses deceptive or unfair practices. 

Submitting a Complaint to OCR: If you believe your rights under HIPAA have been violated, you can file a complaint with OCR: 

• Online: Visit the OCR Complaint Portal on the HHS website. 
• Mail: Send a written complaint to the appropriate regional OCR office. 

Submitting a Complaint to FTC: To file a complaint against non-HIPAA-covered entities, you can use the FTC Complaint Assistant: 

• Online: Visit the FTC website and use the Complaint Assistant tool. 
• Phone: Call the FTC’s Consumer Response Center. 

In both cases, providing detailed information about the incident will help the agencies investigate and address the complaint effectively. Keep in mind that the OCR and FTC work collaboratively to ensure comprehensive oversight and protection of health information privacy.