Patient Control Over Health Data: Experts React

Komathi Stem

Jodi G. Daniel

Jeremy D. Sherer

Tashfeen Ekram, MD

Eileen Cianciolo

Mark Scott

Two proposed rules from the Office of the National Coordinator for Health IT (ONC) and CMS will allow patients complete access to their electronic health records (EHR) from both care providers and insurers.

The ONC rule would require that healthcare providers and vendors of EHRs make patients’ health data easily and cheaply available to them electronically. The CMS rule aims to provide easy access to health insurance records. It will require that insurers make their customers’ data easily available to them in electronic form.

The rules will give patients the right to have their medical information and their health insurance records and to share them with anyone or any organization that they choose.

In accordance with the congressional mandate from the 2016 21^st Century Cures Act, providers and vendors will adopt open application program interfaces (APIs), which allow different programs to talk to each other.

“These rules should be a focus of every healthcare executive as they may be the biggest change in operations of the healthcare system since the ACA and the most significant change in the rules regarding health information since HIPAA,” says Jodi G. Daniel, formerly of ONC, now with Crowell & Moring, where she leads the firm’s digital health practice. “Instead of the focus on protecting data through privacy and security requirements, these rules will require healthcare organizations to open up their data and make it more easily accessible.” 

New opportunities

“It will create new business opportunities in healthcare IT that are already motivating large tech companies like Amazon, Apple, and Google and others to develop products to support this opportunity for patient control and understanding of their healthcare data,” says Ed Eichhorn, a veteran medical products and services developer, and founder of Medilink Consulting Group, a medical consulting firm in Dumont, New Jersey. “Patient privacy is dictated by the HIPAA regulations. It is likely that these new rules will maintain these privacy requirements while making patient access to their data much easier.”

“This ‘consumerization’ of EHR data enables patients to easily share their real-world data with family, physicians outside the care facility where the data was generated, researchers at pharma/device/other companies, or anyone else they choose,” says Komathi Stem, CEO and founder of monARC Bionetworks, a healthcare technology company in Redwood City, California. “Historically, healthcare providers have been the guardians of EHR data and EHR vendors’ technologies barriers to alternative uses. If providers want to stay actively involved in this new data-sharing economy, they need to be willing and prepared to proactively participate in this new ecosystem that includes a more complex network of parties including tech vendors, research sponsors, and physicians outside their systems and others.”

Today, says Eichhorn, it is relatively difficult and time consuming for patients to get their own medical records or to move them from one provider to another.

“To move your data from one doctor to another or to claim it yourself you must go to the doctor’s office, and show identification to prove your identity,” he says. “You must then complete and sign an authorization form that indicates how many years of your medical data that you want and where it will be sent. By regulation, the provider is permitted to charge you $1 per page for this service. The provider has 30 days to provide a paper or an EHR to you or to the new provider. The information is provided as it exists in the file. Images, X-rays, blood work reports, and physician’s notes are provided without any expanded explanation.”

There is evidence that indicates that patients with better access to their data are more engaged, have better outcomes, incur lower costs, and enjoy a better healthcare experience, according to Stem. “Essentially, democratizing healthcare data supports healthcare executives’ pursuit of their Triple Aim goals,” she says.

Related: Mental Healthcare at Walmart: Experts React

Experts share their takeaways from the proposed rules.

Eichhorn:

“These rules could create new interesting business opportunities or disruptive market changing chaos. If you manage patient records this would create new opportunities, responsibilities, and challenges to improve transparency and clarity for patients to understand and make important medical decisions.

“Executives at EHR companies will need to develop open-source systems to meet the ONC requirements. They will need to develop new services to compete for physician and hospital business in an open source environment.

“As the open source requirements for EHRs are met, it will be easier for doctors and hospitals to move from one EHR to another than it is today. This will put new pressure on developing new features and benefits for these systems to maintain their customer bases. The CMS requirement for health insurers to provide their data to their customers who can then share this information with anyone including other insurance companies will create new competitive issues for these companies to manage in the future.”

Stem:

“Providers will continue to be challenged with increasing involvement of patients and now additional parties in the active management and use of their healthcare data. Executives need to be sure that this is taken into consideration in their short- and long-term strategic planning to ensure they aren’t left behind and remain relevant to how and why patients are using and sharing their information with those external to the traditional healthcare system. 

“This new ecosystem also integrates new data sources from everyday life (i.e., wearables, sensors, apps, and connected devices) with which many healthcare providers may not be familiar or are unprepared to utilize. This added level of complexity raises many issues which execs must be prepared to address in order to remain competitive in this new environment.

“Healthcare executives will need to identify trusted partners to make the healthcare data they are expected to provide to patients is valuable. Simply providing access does not help the patient. To glean benefits from this new rule, executives must work with experts in consolidating and presenting health data. Execs must build relationships with intermediary vendors that can package patient data to be valuable while ensuring data privacy and security for their individual patients, and their healthcare system as a whole.

“Innovative healthcare executives will identify and capitalize on positive externalities arising from this mandate to share data: supporting their providers in shared decision making with their better-informed patients; integrating digital tools such as apps and wearables into the systems they use to share data with their patients, shining a light on patients’ health outside of the snapshots captured during clinic visits and, in turn, improving care; monetizing these rich data flows, specifically through partnerships with life sciences companies who are identifying increasing value in healthcare data captured during routine clinical care.” 

Daniel:

“There is a significant policy effort under way to promote easier availably of health data. After HHS spent over $34 billion in incentives for doctors and hospitals to adopt EHRs, there is concern that we aren’t truly seeing the benefits in healthcare because the electronic health information is not easily available for treatment, care coordination and other uses that can improve the quality and reduce the cost of care. This lack of interoperability led Congress and HHS to consider what the obstacles were to interoperability and to address those.

These rules raise new compliance issues as well as new opportunities for providing better patient care.

“Healthcare organizations will have to look very carefully at their policies regarding uses of data and release of data. The ONC rule comes with oversight by the OIG and the possibility of significant penalties for not sharing data. Compliance with these rules will require healthcare organizations to revise their compliance and operations to ensure that they are not engaged in practices that may prevent, interfere with or materially discourage access, exchange or use of health information.

“Healthcare executives that have been viewing the healthcare data that they hold as an asset or a competitive advantage may need to rethink their view of their data. The government is making a clear statement that healthcare data and interoperability are a priority and that failure to make data easily available upon request is not permissible.

“There are also opportunities for these rules to add value to healthcare organizations. For example, these rules can enable healthcare providers to improve the use of their own data by making it easier to incorporate valuable technologies that access EHR data to provide better decision support tools for clinicians and patients. It can also enable a healthcare organization to have timely access to critical health information from other healthcare organizations to enable clinicians to make better treatment decisions based on a more complete picture of the health and care of their patients. 

“Healthcare executives may want to consider any challenges they have had with data access and use from their own systems and from other organizations and consider whether these rules provide opportunities to improve the information that they have to better manage patients and coordinate their care.”

Jeremy D. Sherer, associate at Hooper, Lundy & Bookman PC, focusing on healthcare technology and telemedicine:

“Through the public shaming and monetary penalties that CMS is threatening for individuals and entities that obstruct the exchange of information, the message to healthcare industry stakeholders is comply or risk penalties. At the same time, payers, providers, and healthcare technology vendors, even if they agree with the objectives of HHS (both CMS and ONC), need to communicate to HHS what they see as challenges to successfully navigate the substantial regulatory framework that will soon surround interoperability and information blocking.

“Increased operability of healthcare information raises new concerns about the privacy and security of patient health information. Indeed, the proposed rules-particularly CMS’-seems to recognize the inherent risks. Provider organizations, payers, and others in possession of patient health information will need to be vigilant in their compliance efforts as new practices emerge surrounding the interoperability of information.”

Tashfeen Ekram, MD, co-founder and chief medical officer Luma Health, a mobile patient engagement company based in San Francisco:
“Healthcare executives can expect better information sharing so they can get a clearer picture of the entire patient journey. Providers would be able to track patient outcomes when they seek care outside of their organization, whether to get a second opinion, treat a separate medical issue, or supplement the care they are receiving. Patients who have been recently discharged from the hospital would be able to capture and transfer that data to their primary care provider, for example. Providers will be expected to share patient health information, no longer incentivized to keep information under lock and key.

“Eventually, the two new interoperability rules could help calibrate the U.S. healthcare system and make patients the ultimate source of truth in their care journey, as opposed to complicated records and claims data. Healthcare executives can expect more informed patients, leading to both increased competition among care delivery organizations as well as more engaged patients.

“The provider-patient relationship will become more important than ever as providers will compete on the quality of care and experience they provide. Healthcare executives who are already focusing on improving quality of care and patient experience, and doing so in a patient-centered way, will find the new proposed rules would only support their efforts. Those who construct barriers to information sharing will fall behind, losing patients and market share over time.

“Healthcare executives should be implementing productive information sharing practices, make their price and quality metrics transparent and easily consumable to their patients, and work to actively engage patients. If they do so, they will receive the maximum benefit from these rules. The CMS and ONC proposed rules give healthcare the opportunity to be on par with other industries, empowering patients and pushing providers to prioritize their relationships with their most important customers.”

Eileen Cianciolo, chief product officer, NovuHealth, a consumer engagement company for the healthcare industry, based in Minneapolis:

“One challenge for healthcare executives will be integrating disparate and sometimes archaic systems to create value. The healthcare industry isn’t Apple; not everyone is on the same operating system or device or software version, and investments will need to be made to adequately implement API gateways to funnel healthcare information in a manner that is consistent, operable and secure.”

Mark Scott, chief marketing officer, Apixio, AI healthcare analytics company located in San Mateo, California

“If these rules are enacted, healthcare executives will need to start laying the groundwork to share healthcare data more freely with patients and other organizations, which may require technology and infrastructure investments. They’ll also need to start thinking about patient education programs to help consumers learn how to interpret and act on the information in their medical records. Otherwise, patients may start requesting unnecessary or harmful tests, treatments, and prescriptions from their physicians, adding friction and cost to their care.”