driven by federal activities. The lessons learned in the ongoing implementation of some state-sponsored HIEs (such as the North Carolina HIE) and the fluctuating nature of health care regulations at the level of the state governments themselves are leading to additional refinement. However, HIEs and RHIOs continue to struggle to achieve self-sustainability and the vast majority remain tied to federal, state, or independent grant funding in order to remain operational. Some exceptions exist, such as the Indiana HIE. Storage and gathering of information Data architecture models There are two main models for the data architecture of health information exchanges. One is a federated, or decentralized model, and the second is a centralized one. There is also a hybrid model that contains elements of both. In a centralized HIE, there is a central (or master) database that holds a complete copy of all of the records of every patient contained in the HIE. In a federated HIE, there is no master database. In a federated model, each healthcare provider is responsible for maintaining the records of their individual patients. In this model, the main function of the HIE is to facilitate the exchange of patient records among providers as the need arises. For example, if a physician in a federated HIE requests the records of a query is sent to each server in the system asking to return any records that they have pertaining to . Each federated HIE may accomplish this in a slightly different way, but the salient distinction is that in a federated model there is no central database from which a previously compiled comprehensive medical record is stored and can be downloaded. In short, in a federated HIE, records are exchanged electronically among providers when they need them. In a centralized model, all patient information is uploaded to a single database from which any provider in the HIE can download a patient's full medical record. Patient consent Exchanges in the US must operate with patient consent to comply with not only the Health Insurance Portability and Accountability Act (HIPAA), but also a variety of state and federal laws and regulations. This was clarified by the Office of Civil Rights in the January 2013 Final Omnibus Rule Update to HIPAA. There are two methods for gaining patient consent. One is explicit consent and is termed opt-in. With this method, a patient is not automatically enrolled into the HIE