West Virginia WIC Policy and Procedure 5.15 Effective Date: 3/6/2026 5.15 West Virginia Health Information Network Authorized Users, Access, and Audits

POLICY:

The West Virginia Department of Health and Human Resources (DHHR), Bureau for Public Health (BPH), Office of Nutrition Services (ONS) and the West Virginia Health Information Network (WVHIN) requires all qualified West Virginia WIC staff (Authorized Users) to access only relevant participant information, when authorized by the participant, parent, guardian, and maintain participant confidentiality. The Office of Nutrition Services (ONS) – West Virginia WIC State Agency will approve users of and monitor all authorized users accessing the WVHIN. The State Agency will also be responsible for annual training, ensuring compliance with the WVHIN policies and applicable law. DEFINITIONS:

WVHIN Continuance Document (Attachment #3): The document utilized to request activation, deactivation, or alteration of an Authorized User’s WVHIN access roles.

West Virginia Health Information Network (WVHIN): The WVHIN provides health care professionals a secure network to share medical information and data.

PROCEDURE:

A. WVHIN Authorized Users

1. Nutritionist/Nutrition Associates (CPA) and WIC staff who are qualified to serve as a Medical Liaison (ML) are eligible to become WVHIN Authorized Users.

2. Authorized Users must be approved by the State Agency.

3. To determine the utilization of WVHIN Authorized Users, the Local Agency Director needs to use Attachment #1: Framework and Decision Tree for WVHIN Usage.

4. Any individual that a Local Agency Director wishes to have WVHIN access must fill out Attachment #4: WVHIN Continuance Document

5. Authorized users must first complete a Training Checklist (Attachment #2) and an WVHIN Authorized User Assessment (Attachment #3) with a passing score of 80% or higher.

B. WVHIN Participant Data Access and Confidentiality

1. Only Authorized Users can access the WVHIN.

Page 1 of 3

West Virginia WIC Policy and Procedure 5.15 Effective Date: 3/6/2026 5.15 West Virginia Health Information Network Authorized Users, Access, and Audits

2. WVHIN data may be used to verify birth.

3. The WVHIN should only be accessed to collect the relevant participant data needed to complete the WIC certification, mid-certification follow-up or high-risk follow-up appointment.This information is limited to: Heights and Weights, Hemoglobins, birth, immunizations and Lead (if available). No other information should be accessed.

a. Participant data cannot be altered.

b. Participant data must be accessed in compliance with HIPAA Notice and Privacy Practices.

c. Participant data retrieved from the WVHIN cannot be shared with any programs or organizations that do not have access to the WVHIN.

4. If a WIC participant, parent, guardian, chooses to opt out of WIC authorization access to WVHIN, WIC staff must document this as a Crossroads Family Alert.

a. The participant, parent, guardian, or caretaker may opt into WIC authorization access to WVHIN at any time.

b. WIC staff will not access WVHIN participant data for any reason if the participant, parent, guardian, or caretaker has opted out.

c. WIC benefits must not be withheld if a participant, parent, guardian, or caretaker opts out of the WVHIN.

5. The Authorized User will document all completed and process ARHI and RSAF Forms according to Policy 5.16 and Policy 3.09.

C. Unauthorized Use of the WVHIN

1. Unauthorized WIC staff use of the WVHIN includes:

a. An Authorized User accesses data for someone other than a WIC participant. b. An Authorized User accesses data for a WIC participant who has opted out of the WVHIN. c. A WIC staff member who is not an Authorized User accesses the WVHIN.

2. The State Agency will investigate all identified potential occurrences of unauthorized use.

a. The State Agency will notify the Local Agency Director and the WVHIN of potential unauthorized use.

Page 2 of 3

West Virginia WIC Policy and Procedure 5.15 Effective Date: 3/6/2026 5.15 West Virginia Health Information Network Authorized Users, Access, and Audits

3. At the completion of the investigation, the State Agency will report its findings to the WVHIN, who can terminate or suspend any user.

D. State Agency Monitoring

1. The State Agency Program Integrity Coordinator, and other State Agency monitoring staff, will conduct a monthly audit, reviewing ten percent (10%) of the participant records.

a. Participant records include the review of the Authorized User Report, the ARHI Form, RSAF Form and WVHIN data (see Policy 3.09 & 5.16).

2. The State Agency is responsible for annual training, ensuring compliance with the WVHIN policies and applicable law. This training will be completed via a training checklist (Attachment #2). This checklist must be completed, the assessment passed with a score of 80% or higher, and a Training Acknowledgement Form (Attachment #5) returned to the State Agency. The State Agency Research Coordinator, the State Agency Quality Improvement Coordinator, or other HIE administrator will be responsible for keeping these records filed on the Shared Drive.

Note: The Local Agency Director must fill out the WVHIN Continuance Document (Attachment #4) listing the individuals that they wish to have WVHIN access. This form must be completed prior to authorization being given.

ATTACHMENTS: Attachment #1: Framework and Decision Tree for WVHIN Usage. Attachment #2: Training Checklist Attachment #3: WVHIN Authorized User Assessment Attachment #4: WVHIN Continuance Document Attachment #5: Training Acknowledgement Form

Page 3 of 3