The Five Critical Key Components of the Health Information Environment
(First Component)

1. The establishment of the Standards and Policy Entity (SPE):
   1. The SPE is a public-private collaborative entity that identifies and specifies the detailed implementation rules, including business rules, for the standards and policies that make up the Common Framework. It identifies and recommends the technical standards and information policies essential for establishing privacy, security and interoperability. The SPE is responsible for the identification, specification, interpretation, and dissemination of these standards and policies.
   2. Given the unusually sensitive nature of health information and the complexity of the technical standards and policies needed to guide its use, it is imperative that a single entity — the SPE — be responsible for decisions related to both domains so that they can be closely integrated. While the SPE must be the authority regarding matters in both domains, it may delegate pieces of its work requiring particular expertise to other entities. The SPE's policy recommendations for use, access, privacy and security of health information are essential for the success of the Health Information Environment. These policies inform users, policy makers and sub-network developers who implement the technical standards recommended by the SPE.
   3. Without this, every entity that has to interact with the network will be unable to do so reliably and consistently—multiple and differing approaches to core aspects at the regional level would create undue burden on patients and providers that cross sub-networks, public and private payers, large delivery organizations, labs, PBMs, pharmacy chains, vendors who supply applications, etc.
   4. The SPE must not be disproportionately dependent on any of its stakeholders for its funding and must operate independently.
   5. The SPE requires public and private support.
   6. The SPE's governance and administration must be transparent, accountable, and reflect the participation of all stakeholders, including representatives of the general public who are able to participate on an equal footing. The SPE administration includes a mechanism or formal process that reflects the participation of sub-networks and regional organizations.
   7. The SPE must protect the public good and ensure that consideration be given to enforcement functions.
   8. The SPE must be established and funded as soon as possible in order to continue the work of defining the Common Framework under which all the sub-networks will operate. Once the initial set of policies and standards are in place, and with proper incentives, the Health Information Environment will begin to grow and evolve organically and continually.
   9. The SPE must strive for maximum cost-effectiveness by building on existing standards and policy work (no "rip and replace"), establishing legitimate yet efficient processes and minimizing the negative economic impact of any new requirements it defines. As a general principle, the SPE should seek existing solutions and minimal modifications, creating new solutions only as a last resort. Even so, some change will be required to ensure interoperability across the boundaries of existing standards. The extent of such change must be determined using a defined process. To do so effectively requires close and continuous interaction with standards development organizations (SDOs) and other potential sources of relevant models for its own work.
   10. The requirements for interoperability will be specified in a suite of profiles or use cases defined and detailed by the SPE and premised on the Common Framework. The use cases will be specified via the selection of candidate suites or profiles of standards, for which detailed implementation and technical guides will be made available. The SPE must balance what is practical to implement with the needs of the nation.
   11. The SPE may be an existing organization or a new organization modeled after other quasi-governmental or public-private organizations. Immediate, near-term efforts need to include an analysis of both the public and private sectors for viable models. These efforts should be completed in no more than one year. The analysis of organizational models could be conducted by the Institute of Medicine (IOM), an agency of the NRC such as the CSTB, a new specially appointed Commission/Task Force, or other existing entity with the appropriate stature and credibility.
   12. The SPE must vigilantly guard against an accretion of duty or scope over time: its mission must always be to define and maintain the minimum framework necessary for the successful operation of the Health Information Environment.