Joint NPP OHCA sharing statement

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Every phrase carries scope

45 CFR 164.520 connects the statement to participating entities, necessary sharing, the three named purposes, and activities relating to the OHCA. Tailor the language to verified workflows instead of copying it into every joint notice automatically.

Document the covered entities and classes, sites, arrangement purpose, PHI categories, participating services, effective period, and actual flows before drafting. The public sentence should help the reader understand the coordination without suggesting that every affiliated entity can access every record. Keep activities outside the arrangement and PHI maintained under another participant role outside the statement's scope.

Classify each flow by purpose and necessity

For treatment, identify the treating participants, coordination purpose, record elements, and system path. For payment, identify the covered billing, claims, or reimbursement activity. For health care operations, name the arrangement-related function and participating entities. “Shared operations” is too vague for an access rule or audit record.

Determine whether each flow is needed for the stated arrangement activity and apply minimum-necessary requirements where applicable. Record the legal route, recipient role, fields, access period, system, frequency, logging, and owner. An OHCA relationship does not make unrestricted repository access necessary.

Map the actual flows

Record sender, recipient, PHI category, purpose, system, frequency, legal path, minimum-necessary status, participant and site scope, vendor role, and retention. Route clinical, privacy, security, and Part 2 questions to qualified owners.

Add state, Part 2, authorization, consent, research, professional, and contractual constraints at the record and purpose level. A recipient can be inside the OHCA and still need a separate route for a protected category. Maintain provenance and restriction attributes across interfaces so downstream systems do not treat imported records as unrestricted.

Vendors may support the flow under appropriate agreements and controls, but vendor access does not become participant-to-participant sharing by label. Identify the covered entity directing the work, permitted task, fields, security, return or destruction, and monitoring separately.

Build access and interface controls from the register

Translate approved flows into roles, filters, routing rules, user groups, interface mappings, and alerts. Test permitted and blocked scenarios across sites, participants, record types, former workforce, merged identities, bulk exports, downtime, and participant departure. Preserve event-level logs that show sender, recipient, record, purpose context, and time.

Review break-glass and emergency access independently. An urgent operational need should follow qualified clinical, privacy, security, and legal routes rather than a broad sharing statement. Monitor unusual volume, cross-site access, failed filters, and records without provenance.

Govern incidents and organizational change

Assign which participant detects, contains, investigates, notifies others, preserves evidence, assesses individual communication, and corrects a shared-flow incident. Keep one coordinated case with participant-specific decisions and access controls. A shared notice does not remove each entity's incident duties.

Reassess flows after new participants, sites, services, interfaces, data warehouses, analytics, payer arrangements, acquisitions, or exits. Stop access promptly when scope ends and preserve historical evidence.

Example with flow review

Twelve proposed participant-to-participant flows are reviewed. Ten fit the described OHCA purposes; one supports an unrelated employer function and one lacks purpose evidence. Statement-supported flow coverage is 10 of 12 flows.

The team removes the employer flow from the OHCA design and sends the undocumented flow to qualified review. It tests access filters, confirms the remaining ten flows map to the public statement, and records the affected systems. Approval covers those ten only.

OHCA-sharing checklist

• Verify participant, site, PHI, arrangement, and effective-period scope.
• Classify each flow as treatment, payment, or arrangement-related operations.
• Document necessity, minimum-necessary status, fields, and recipients.
• Apply Part 2, state, consent, authorization, and special-record limits.
• Build and test role, interface, export, and departure controls.
• Coordinate incidents without erasing participant duties.
• Reassess every new flow, participant, site, and service.

Owner controls

The HHS notice guidance supplies broad notice context. Use a flow register, source citation, approved statement, access rules, interface testing, participant change trigger, incident routing, and periodic audit.

Monitor approved flows, unmapped transfers, access exceptions, provenance gaps, unusual volume, participant changes, incidents, and correction age. Audit from the public statement into real systems and from sampled access events back to an approved flow. Keep retired flow versions for historical review.

Reconcile the flow register with interface catalogs, data warehouses, access groups, vendor inventories, and participant attestations. Investigate systems that appear in only one source. Before retiring a flow, remove access and scheduled transfers, preserve applicable records, and verify that downstream copies follow their continuing restrictions.