Seeking Public Comment on Proposed Governance of the Nationwide Health Information Network

Deven McGraw, Proje­ct HealthDesign Regulatory and Assurance Advisory Group, Center for Democracy & Technology

On May 15, the Office of the National Coordinator for Health IT (ONC) released a formal Request for Information from the public (RFI) on governance of the Nationwide Health Information Network (NwHIN). ONC defines NwHIN as a "set of standards, services, and policies that enable secure health information exchange over the Internet." In the early years of federal health IT initiatives, the NwHIN was described as a “network of networks,” reflecting a strategy of achieving nationwide health information exchange by establishing state or regional health information exchanges and linking them together. The new definition reflects the belief that exchange does not require the building of new networks but also can be achieved through the use of common, interoperable standards in an environment of trust.

In the RFI, ONC observes that electronic exchange to date “has been governed by a patchwork of contractual relationships, procurement requirements, State and Federal laws, and industry self-regulation,” and this this patchwork has led to “asymmetries in the policies and technical standards.” In developing governance conditions, ONC hopes to establish “a consistent, baseline set of ‘rules of the road’ for electronic exchange.”

The RFI proposes "conditions for trusted exchange" (CTEs) in three areas:  safeguards (which focus on the protection of individually identifiable health information), interoperability (which focus on the technical standards needed for interoperable exchange), and business practices (sound operational and financial practices). These CTEs would impose some requirements that go above and beyond what current law requires. For example, one of the safeguard CTEs would require entities to implement security safeguards like encryption that currently are not mandatory for health care providers. ONC anticipates that the CTEs will be reviewed annually and evolve over time (some will be retired, others will be added), as exchange needs become more robust and standards are improved. The 16 proposed CTEs, and the specific questions ONC has asked the public to weigh in on, can be found in the RFI.

The entities ONC intends to govern are not individual providers but instead the intermediaries that facilitate exchange among providers and patients. Examples include state or regional health information organizations (RHIOs), health information exchanges (HIEs), and private networks established by vendors. The RFI proposes that intermediary entities be validated with respect to their compliance with the governance CTEs. Those intermediary entities that are validated are then called NwHIN Validated Entities or NVEs. The RFI also proposes oversight over the validators; ONC will remain responsible for overseeing NwHIN governance but also intends to seek and select a private-sector entity to have oversight over the validators.

NwHIN governance is proposed to be voluntary, although ONC anticipates that they could become mandatory conditions for participation in certain federal programs. The idea is to create a set of conditions for trusted exchange that intermediary entities will seek to follow – and those intermediaries will agree to exchange data with other intermediaries who have committed to following the same conditions.

Comments on the RFI are due on June 14, and can be filed electronically. The Health IT Policy Committee also will be considering comments to the RFI at its June 6 meeting. ONC expects the public comments to help shape a forthcoming proposed regulation on NwHIN governance.

Read more posts about legal and policy issues.

Implications for Patient Engagement if the Health Reform Law Falls

Robert Belfort, Project HealthDesign Regulatory and Assurance Advisory Group, Manatt, Phelps & Phillips, LLP

It is hard to escape the news coverage about the constitutional challenge to the Affordable Care Act (ACA), and the attention being paid to the case is understandable. The ACA is arguably the most far-reaching piece of domestic legislation that Congress has passed since it enacted Medicare in the 1960s. Although the focus of the legal challenge to the ACA is on the individual mandate, which requires that almost all Americans without health insurance buy individual health insurance policies or pay fines, there could be implications for patient engagement initiatives if the Supreme Court strikes down the law.

The Supreme Court heard oral arguments relating to the constitutionality of the ACA on March 26, 27 and 28. The Court’s decision is not expected until late June. The first issue confronting the Court is whether the individual mandate should be struck down because it represents an unconstitutional exercise of Congress’ power. If the Court does decide the mandate is unconstitutional, it will then consider what should happen to the ACA’s hundreds of other provisions. The answer depends on whether some or all of these provisions are deemed “severable,” meaning that they operate independently enough of the mandate to stand on their own even if the mandate falls.

The severability issue is a critical one. A number of the ACA’s payment and delivery reform provisions encourage patient engagement and care coordination, and, at least indirectly, could go a long way toward promoting the integration of patient-generated health information into care management and other health care delivery models.  These include provisions:

• establishing a Medicare hospital value-based purchasing program that pays hospitals based on performance against quality measures;
• requiring the development of similar value-based purchasing programs for other types of providers;
• gradually reducing Medicare payments that would otherwise be made to hospitals to account for preventable hospital readmissions; and
• establishing rules governing the formation and operation of Accountable Care Organizations (ACOs).

Each of these provisions attempts to reform the current health care payment system by rewarding health care providers for coordinating care and delivering better patient health outcomes – as opposed to rewarding them for the volume of services they provide. The ACO program, for example, creates financial incentives for providers to work together to treat patients across multiple care settings, including physician offices, hospitals, and in the home. An ACO consists of a group of providers that have agreed to collaborate to coordinate care for patients enrolled in Medicare Parts A and B. ACOs are intended to be patient-centered organizations, driven by the goal of delivering integrated, efficient and cost-effective care. ACOs that achieve quality targets and succeed in providing care at a cost less than what would otherwise be expected will share in savings with the Medicare program. To succeed, ACOs will likely have to find ways to better engage patients in their own health and health care. Incorporation of patient-generated health information, like observations of daily living (ODLs), could be one way of achieving this goal.

It is currently unclear whether the ACO program and other ACA payment reforms will continue to exist if the Supreme Court strikes down the entire ACA. Some have suggested that without the ACA’s payment reform provisions, health care providers will have less incentive to engage in innovative care coordination strategies, including those involving patient-generated health information. We will continue to follow the legal challenge to the ACA with great interest, and with an eye toward how it may affect the goals that Project HealthDesign supports. Please don’t hesitate to post any questions or comments about these issues below.

Read more posts about legal and policy issues.

White House Releases Report on Consumer Privacy, Calls for Legislation

Deven McGraw, Proje­ct HealthDesign Regulatory and Assurance Advisory Group, Center for Democracy & Technology

Project HealthDesign grantee teams have long recognized that the robust use by patients of technologies such as personal health records (PHRs) and mobile health applications to improve health and well-being depends on trust. Individuals need assurance that the personal data they collect and share using these technologies will be handled responsibly and with respect for its sensitivity. But health data collected by and shared through consumer-facing technologies is typically not covered by HIPAA or state health privacy laws.

At a roundtable on privacy and security protections for PHRs hosted by the Department of Health and Human Services (HHS) in 2010, Project HealthDesign grantees submitted testimony noting some of the privacy and security issues raised by their projects and the challenge of addressing these issues in an uncertain legal environment.  Failure by policy-makers to address this uncertainty chills innovation and places obstacles to widespread consumer adoption of promising health information technologies.

Securing enactment of comprehensive privacy policy is never easy, but the future is looking a bit brighter. Just last month, the White House released a report expressly acknowledging that “[p]rivacy protections are critical to maintaining consumer trust in networked technologies” and calling for stronger privacy rules to protect personal information, including health information, shared by consumers with private sector companies.

Specifically, the White House sets forth the following “Consumer Privacy Bill of Rights”:   

• Individual Control:  Consumers have a right to exercise some control over what companies collect from them and how they use it.

• Transparency:  Consumers have a right to easily understandable and accessible information about privacy and security practices.

• Respect for Context:  Companies should limit their collection, use and disclosure of personal data to those purposes consistent with the context in which consumers provided the data.

• Security:  Companies should maintain reasonable safeguards to control risks such as loss, unauthorized access, and improper disclosure.

• Access and Accuracy:  Companies should provide consumers with reasonable access to personal data collected about them and appropriate means to correct inaccuracies.

• Focused Collection:  Companies should collect only as much personal data as they need to accomplish the purposes that are consistent with the “Respect for context” principle.

• Accountability:  Companies should be accountable to enforcement authorities and consumers for adhering to these principles.

The White House also calls on Congress to enact legislation adopting the Consumer Privacy Bill of Rights as law and providing enforcement authority to both the Federal Trade Commission (FTC) and State Attorneys General. The White House also directs the U.S. Department of Commerce to convene multi-stakeholder groups to negotiate codes of conduct that would implement the Consumer Privacy Bill of Rights in ways tailored to the privacy issues raised by specific industry sectors.

Under the legislative approach advocated by the White House, these codes of conduct – when reviewed and approved by the FTC — would become safe harbors that insulate companies that follow these codes from liability. But even if Congress does not act, these codes of conduct — when companies voluntarily follow them — can be enforced by the FTC, which already has authority to force companies to comply with privacy commitments made to consumers. The Department of Commerce is expected to soon begin convening multi-stakeholder groups to develop the codes of conduct called for in the White House report.

Entities covered by existing federal data privacy laws like HIPAA would be exempt from the new legislation. However, the White House does call for review of whether existing laws could be “simplified” to benefit both consumers and companies.

To what extent would national, consensus-based policy protecting health data collected, used and shared by commercial companies reduce barriers to more widespread adoption of consumer-facing health technologies like PHRs and mobile apps?  Share your thoughts in the comments.

Read more posts about legal and policy issues.

Proposed Stage 2 Meaningful Use Rule Strong on Patient Engagement

Robert Belfort, Project HealthDesign Regulatory and Assurance Advisory Group, Manatt, Phelps & Phillips, LLP

The Centers for Medicare and Medicaid Services (CMS) and the Office of the National Coordinator for Health IT (ONC) released the proposed rule governing Meaningful Use Stage 2 under the Medicare and Medicaid Electronic Health Record Incentive Program last week. In a move that is likely to promote patient engagement, the agencies took the advice of the Health IT Policy Committee and beefed up the requirements on eligible professionals and hospitals for sharing data electronically with patients.

The patient engagement requirements in Meaningful Use Stage 1 are important but limited. For example, in Meaningful Use Stage 1:

• Eligible professionals and hospitals must provide patients electronic copies of their health information upon request and within three business days
• Hospitals must provide electronic copies of discharge instructions to patients upon request.
• Eligible professionals must provide clinical summaries of each office visit to patients upon request, but these do not have to be in electronic format.
• Eligible professionals have the option of providing at least 10 percent of their patients electronic access to their health information within four days of the information becoming available to the eligible professional. 

In the proposed rule for Stage 2, CMS and ONC are proposing to require eligible professionals and hospitals to provide patients with direct electronic access to their information. Patients will no longer have to request an electronic copy of their health information; instead they will have to be provided with a mechanism to electronically view — and securely download on demand — relevant portions of their health information.

Specifically, CMS and ONC are proposing the following patient-engagement-related objectives for Stage 2 of Meaningful Use:

For eligible professionals: 

• Provide patients the ability to view online, download, and transmit their health information within 4 business days of the information being available to the eligible professional.
• Provide clinical summaries for patients for each office visit.
• Use secure electronic messaging to communicate with patients on relevant health information.

For hospitals: 

• Provide patients the ability to view online, download, and transmit information about a hospital admission.

For both:

• Use certified EHR technology to identify patient-specific education resources and provide those resources to the patient.

Although these new objectives and their attendant measures do not hew exactly to those proposed by the Health IT Policy Committee, they are very close and represent CMS and ONC’s commitment to ensuring that health care providers use EHRs to improve not only their own access to health information but their patients’ access as well.

Further, beginning in 2014, CMS and ONC are proposing to replace the Stage 1 objectives requiring eligible professionals and hospitals to provide patients with an electronic copy of their health information/discharge instructions and with timely electronic access to their health information with the new view, download and transmit objectives proposed for Stage 2.

We think the patient engagement provisions in the proposed rule are good news for patients and that they could increase the demand for personal health records and applications that help individuals securely store, share and make use of their personal health information. We’d also like to give kudos to the Project HealthDesign team for providing the Health IT Policy Committee with valuable comments about extending the effect of meaningful use of EHRs beyond clinicians and to patients and their family members.

Of course, there is more work to be done. CMS and ONC will take public comments on the proposed rule before finalizing it. The comment period will last 60 days and we can expect a final rule sometime this summer. At that point, we’ll set our sights on Stage 3, which is scheduled to begin in 2015 and where we might see requirements that deal with accepting electronic data from patients.

The proposed rule will be published in the Federal Register on March 7, 2012. In the meantime, it is available for display or as a fact sheet.

Let us know your reaction to the new patient engagement requirements in Meaningful Use Stage 2 below.

Read more posts about legal and policy issues.

Latest Health IT Policy Developments

Deven McGraw, Proje­ct HealthDesign Regulatory and Assurance Advisory Group, Center for Democracy & Technology

A new year has started — year two of the incentive program to encourage the meaningful use of certified electronic health record technology to improve individual and population health. It’s a good time to get caught up on policy developments from the end of a very busy 2011 and provide an update on expected developments in early 2012.

On November 7, the Institute of Medicine issued a report and recommendations intended to assure the safety of EHRs. The report identifies some safety risks associated with EHRs and acknowledges the potential for safety benefits. The report also recommends the establishment of a new entity to investigate EHR safety risks and urges HHS to establish a mechanism for vendors and others to report safety-related incidents. In response to the report, ONC noted it is already in the process of developing an EHR safety and surveillance plan.

In December, the Department of Health & Human Services (HHS) announced that providers who started participating in the  meaningful use incentive program in the first year (2011) will have an additional year (until 2014) before being required to meet the more robust meaningful use Stage 2 requirements. This change, which was initially recommended by the Health IT Policy Committee, is intended to give providers a longer period of time to adjust to and implement the earliest stage of meaningful use before being required to demonstrate more robust use and exchange of health information in Stage 2.

Speaking of meaningful use, the proposed meaningful use requirements for Stage 2 are still expected to be released early in 2012. In addition, the Health IT Policy Committee has begun discussions about requirements for Stage 3, and incorporation of patient-generated data into EHRs continues to be a priority.

ONC unveiled its consumer engagement program in September, and the office is continuing to roll out initiatives to promote consumers’ use of e-health tools to improve their health:

• Earlier this month, ONC announced the Healthy New Year video challenge intended to collect short (up to two minutes) videos from consumers sharing their new year’s resolutions for the use of e-health tools to improve their health or the health of their families. The deadline to submit a video is February 16, at 5 p.m. EST. Cash prizes will be awarded to the top videos.

• On December 6, the Office of the Surgeon General and ONC launched a Healthy Apps Challenge to encourage the development and submission of technology apps that tailor health information to the needs of the consumer user and empower the public to regularly engage in and enjoy health-promoting behaviors. The deadline for entry was December 31, 2011. Winners will be announced on January 31, 2012 and finalist apps will be featured on an HHS website.

ONC also has launched efforts to gather more information about consumer concerns about e-health privacy and security. Specifically, ONC is surveying consumers (and conducting focus groups) about attitudes and preferences regarding the communication of personal health information using mobile devices. In addition, ONC will conduct annual, nationwide surveys to assess the percentage of individuals who are concerned about the privacy and security of EHRs, who report having kept any part of their medical history from their doctors due to privacy concerns, and who are concerned that an unauthorized person would see their medical information if it is sent electronically, among other key measures. ONC will assess trends in consumer privacy and security views between 2012 and 2016 and intends to compile the results into a final report.

Stay tuned for further updates.

Read more posts about legal and policy issues.

Institute of Medicine Weighs In On Health IT and Patient Safety

Robert Belfort, Project HealthDesign Regulatory and Assurance Advisory Group, Manatt, Phelps & Phillips, LLP

All of us working in health care are keenly aware of the importance of ensuring that health IT improves the quality of health care without creating a new set of patient safety risks. With the release of a new report titled “Health IT and Patient Safety: Building Safer Systems for Better Care” by the Institute of Medicine (IOM), the issue of health IT safety is now on the radar screen as a major policy challenge.  

IOM released the report in response to a request by the Office of the National Coordinator for Health IT (ONC) for recommendations about what a comprehensive health IT safety policy should look like. Among other recommendations, IOM suggested that the federal government create a new independent watchdog agency, along the lines of the National Transportation Safety Board, to accept reports on patient deaths, serious injuries or potentially unsafe conditions associated with health IT. IOM skirted the issue of whether the U.S. Food and Drug Administration should have immediate responsibility for overseeing health IT safety.

While the entire report is worth reviewing, I want to call special attention to the fact that the report includes a chapter devoted to the safety of health IT tools “designed to engage and support patients in health-related decision making and management of their own personal health information” (see chapter 5 “Patients and Families Use of Health IT: Concerns about Safety”). The chapter specifically references patients’ ability to use personal health records (PHRs) and other tools to record and share “activities of daily living.” It also cites “Project HealthDesign: Rethinking the Power and Potential of Personal Health Records” by Patricia Flatley Brennan, Steve Downs and Gail Casper.

The report doesn’t offer up a silver bullet for avoiding patient safety risks created by PHRs and other patient engagement tools. Rather, it highlights that health IT is one component in a larger sociotechnical system that includes technology, processes, organizational practices and the external environment, and that adding patients into the mix inserts an additional layer of complexity when it comes to patient safety.

The report’s key point about PHRs is summed up in the following quote: “Given the importance of clear patient-provider communications, special attention may have to be devoted to ensuring that computer-mediated interactions are not used inappropriately.” It goes on to note that one important way to ensure patient safety is for health care providers to manage patient expectations about how information they include in a PHR or other patient engagement tool will be used. According to IOM, health professionals, patients and their families need to develop “a shared understanding of appropriate use of patient-centered, validated data.”

Sound familiar? It should, because it’s consistent with the discussions we’ve been having with the current Project HealthDesign grantee teams about how to minimize health care providers’ medical malpractice liability when incorporating ODLs into clinical care assessments and decisions. In April 2010, the grantees raised a number of concerns, such as how to ensure the accuracy of patient-generated health data and whether health care providers are expected to review every piece of information that patients provide on a round–the-clock basis. These concerns are driving Manatt and CDT’s work on a set of recommendations to develop a shared set of expectations among patients and health care providers about the role of patient-generated data in clinical care.

Although we are formulating these recommendations with a focus on reducing health care providers’ legal liability — a cross-cutting policy issue that could stymie the incorporation of ODLs into clinical practice if not addressed — IOM reminds us that, at the end of the day, managing patients’ expectations about the incorporation of their ODLs into their care is also a patient safety issue.

The IOM report makes a total of 10 patient-safety related recommendations. I encourage everyone to review the recommendations and to read Chapter 5 of the report.

Read more posts about legal and policy issues.

Latest Health IT Developments Focus on Engaging Consumers in Their Own Health and Wellness

Deven McGraw, Proje­ct HealthDesign Regulatory and Assurance Advisory Group, Center for Democracy & Technology

It’s a little too early to take a victory lap, but the stars seem to be aligning for a significantly changed health care system – one that actively engages patients as partners in achieving health and wellness – within the next few years. What are the reasons for our optimism?

1. On November 2, the Centers for Medicare and Medicaid Services (CMS) released the final rule governing Accountable Care Organizations (ACOs) established under the new Medicare Shared Savings Program. Under this rule, providers in ACOs who can deliver care to Medicare beneficiaries at costs below what Medicare typically pays will be able to share a fairly significant portion of the savings. More than half of Medicare beneficiaries are treated for five or more chronic conditions a year. As a result, achieving savings for this population will depend in part on how well they are actively engaged in managing their health and wellness, such as through the use of personal health records (PHRs) and other technologies that assist patients in self care and in engaging with their clinical care teams more regularly. The Project HealthDesign grantee teams are already providing examples of how such technology can be leveraged to make a difference in individual and population health outcomes.
   
   
2. The Health IT Policy Committee has recommended that Stage 2 of meaningful use require health care professionals and hospitals to provide patients the capability to electronically view — and securely download on demand — relevant portions of their health information. This could significantly increase the demand for PHRs, applications or devices that help individuals securely store, share and make use of their personal health information. Although the official criteria for Stage 2 have not yet been set, the Obama Administration has already implemented this “Blue Button” capability  for My HealtheVet and MyMedicare.gov. I am also hearing that vendors of certified electronic health record products are already building this capability into product updates.
   
   
3. The Office of the National Coordinator for Health IT (ONC) rolled out its consumer engagement and education initiative in September. As part of that initiative, health care organizations are encouraged to “take the pledge” to provide patients with “secure, timely, and electronic access to their health information” and to encourage them to use the information to improve their health and their care. In the legislation that created the CMS EHR Meaningful Use Incentive Program, Congress also included a provision that amended HIPAA to require health care entities to provide patients with electronic copies of their health data if that data is stored electronically; entities are also required to send a patient’s copy to another provider or the patient’s PHR upon request. We expect the regulations to implement this provision to be finalized early next year.

Early in 2012 we will know more about whether these optimistic predictions will bear fruit, so stay tuned.

Read more posts about legal and policy issues.

ONC Releases PHR Model Privacy Notice

Robert Belfort, Project HealthDesign Regulatory and Assurance Advisory Group, Manatt, Phelps & Phillips, LLP

As more individuals begin to use personal health records (PHRs) to manage their personal health information, it is important that they be aware of PHR companies’ privacy and security policies. This is something that we at Project HealthDesign know well. Because of a new PHR Model Privacy Notice (Model Notice) created by the Office of the National Coordinator for Health IT (ONC), we hope that others will soon appreciate the importance of knowing how PHR companies use their data.

ONC released the Model Notice on September 12, 2011. It is a standardized template that a web-based PHR company can use to inform consumers about its privacy and security policies. According to ONC, consumers should think of the Model Notice as similar to a nutrition facts label for food:  it succinctly provides important facts that consumers should know before using a PHR. The Model Notice is meant to provide information to consumers in a uniform format they can understand, compare and use to make an informed decision about which PHR they would like to use.

The Model Notice has two sections: (i) the “Release” section; and (ii) the “Secure” section. Both tell consumers what the PHR company may do with their data. The “Release” section tells consumers whether the PHR company releases their data and for what purposes (e.g., for marketing and advertising). It also describes any data release restrictions the PHR company may have in place and explains whether the PHR company will stop releasing a consumer’s data once they close or transfer their PHR. The “Secure” section includes three points to help consumers identify the PHR company’s data security practices. Specifically, it identifies that the PHR company implements security measures; whether the PHR company stores PHR data in the United States only; and whether the PHR company keeps activity logs that record who accesses a consumer’s PHR and when.

ONC was likely motivated to release the Model Notice, at least in part, because many PHRs are not covered by existing health information privacy laws and regulations (e.g., the Health Insurance Portability and Accountability Act’s Privacy and Security Rules). Thus, there are no clear rules for them to follow when handling consumers’ health information. This is a significant gap in the country’s privacy laws. Although voluntary use of a Model Privacy Notice will not solve the problem, it is a step in the right direction.

ONC released a helpful document titled, “Consumer Guide to Understanding and Using the PHR Model Privacy Notice on PHR Company Data Practices,” which does exactly what its title suggests. We recommend it for anyone who uses a PHR. Additionally, the PHR Model Privacy Notice is available for PHR companies to begin using.

Let us know what you think about the Model Notice. Does it include enough information to be helpful?  Would the participants in your projects be able to understand what it says?  Can you think of any ways that you can employ the concepts behind the Model Notice in your projects?

Tweet

Progress Made on Direct Patient Access to Lab Results

Robert Belfort, Project HealthDesign Regulatory and Assurance Advisory Group, Manatt, Phelps & Phillips, LLP

The federal government recently took an important step to advance its goal of enabling individuals to play a more active role in their health care. On September 12, 2011, the U.S. Department of Health and Human Services (HHS) released a proposed regulation that would amend the Clinical Laboratory Improvement Amendments of 1988 (CLIA) regulations and the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule to allow individuals to gain access to lab test results directly from laboratories. Although individuals could always get their lab test results from their doctor’s office, the potential for health information technology tools to facilitate broader exchange of information and the growing interest of individuals in being more active participants in their care appears to have driven HHS to propose the change.

Why Can’t Individuals Access Their Lab Test Results Directly From Labs Right Now?

Most clinical laboratories are regulated under the CLIA regulations, which provide that labs may only release test results to specified recipients, including “individuals authorized under state law to order or receive tests” and to “the individual responsible for using the test results and the laboratory that initially requested the test.” CLIA does not define “individuals responsible for using the test results.” So to whom labs can disclose test results usually depends on what state law says about who is authorized to order or receive tests. Only a few states place patients in that category. Further, HIPAA exempts the provision of clinical lab results by labs from provisions generally requiring health care providers to give patients access to their medical information.

How Would the Proposed Rule Fix the Problem?

The fix to this problem is surprisingly simple — at least as legal and regulatory changes go. HHS is proposing to add a new section to the CLIA regulations to specify that, upon an individual’s request, the laboratory may provide the individual with access to his or her completed lab test results that, using the laboratory’s authentication processes, can be identified as belonging to that individual. At the same time, HHS would remove the exceptions in the HIPAA Privacy Rule that exempt lab test results from the information that laboratories must provide to individuals upon request. If adopted, the proposed changes to the HIPAA Privacy Rule would preempt any contradictory state laws that prohibit a HIPAA-covered laboratory from directly providing access to an individual.

Rationale for Providing Individuals with Direct Access to Lab Test Results

Lab test results are critical to an individual’s efforts to take control over his or her health care. Today, however, lab test results rarely make it to individuals. A 2009 study published in the Archives of Internal Medicine indicated that health care providers failed to notify patients (or document notification) of abnormal test results more than 7 percent of the time. The National Coordinator for Health IT recently put the figure closer to 20 percent.

*****

Consumer groups like the National Partnership for Women and Families are lining up in support of the proposal. Indeed, the proposal seems consistent with Project HealthDesign’s mission of increasing individuals’ engagement in their health care. But we want to hear from the current Project HealthDesign teams and other researchers:

Is HHS’s proposed regulation to enable individuals to directly access their lab test results from labs a positive development? Do you see any potential downfalls that could result from this new policy?

View the proposed regulation.
Read more posts about legal and policy issues.

When is a Mobile App a Mobile Medical App?

FDA Guidance Regulates Mobile Medical Apps, Exempts Mobile Health and Wellness Apps

Deven McGraw, Project HealthDesign Regulatory and Assurance Advisory Group, Center for Democracy & Technology

On July 21, the U.S. Food and Drug Administration (FDA) issued guidance on how the agency intends to regulate certain mobile medical applications. The guidance does not establish legally enforceable rules but instead reflects the FDA’s current thinking on a topic and serves as a set of recommendations.

Congress has already granted the FDA authority to regulate medical devices. The agency has previously said that it considers health IT a medical device, and the agency seems to be moving toward greater enforcement of device regulations in other components of health IT, such as electronic health records. In February, the FDA released a final regulation governing medical device data systems (MDDS). The July 2011 guidance on mobile medical apps is the most recent FDA activity in this area.

What Qualifies as a Mobile Medical App?

The FDA tries to make clear that the guidance applies only to a subset of mobile health-related apps the agency is calling mobile medical apps. A mobile medical app is one that:

• Is used as an accessory to an FDA-regulated medical device (e.g., an app that enables a health care professional to view medical images on an iPad and make a diagnosis);

• Transforms a mobile platform into a regulated medical device (e.g., an app that turns a smartphone into an electrocardiography machine to determine if a patient is having a heart attack).

The “intended use” of an app is what determines whether it qualifies as a mobile medical app. To determine intended use, the FDA will look at factors such as the packaging and the manufacturer’s ads and claims about the app.

What Qualifies as a Mobile Health or Wellness App?

The FDA tries to clarify that the guidance does not apply to "mobile apps that are solely used to log, record, track, evaluate, or make decisions or suggestions related to developing or maintaining general health and wellness." Examples of health and wellness apps are provided in the guidance, and include dietary tracking logs, appointment reminders, dietary suggestions based on a calorie counter, posture suggestions, exercise suggestions, etc. In contrast, a mobile medical app is one that is intended for "curing, treating, seeking treatment for, mitigating, or diagnosing a specific disease, disorder, patient state, or any specific, identifiable health condition."

The Gray Area Between Medical Apps and Health/Wellness Apps

The FDA tries to draw clear lines here and offers more examples of mobile medical apps in the guidance (see appendix A). However, the distinction between mobile medical apps and health/wellness apps is not as clear as the guidance presumes and seems to be based on the medical model of health. Today, medical conditions are significantly improved — and even prevented — by healthy behaviors, and providers might prescribe or at least recommend particular diet or exercise protocols as part of medical treatment. Many mobile health applications in development and in active use today fall in this gray area between medical and health/wellness. For example, the current Project HealthDesign teams are testing the impact of the use of consumer-facing health applications on health outcomes for individuals with chronic conditions.

Apps that Qualify as Medical Devices

In the guidance, the FDA acknowledges other classes of mobile apps that don’t qualify as mobile medical apps but might fit within the medical device definition; these other classes of mobile apps (e.g., apps that allow individuals to self-manage their diseases or conditions) would then be subject to FDA regulation. These apps are not covered by this FDA guidance; the agency does, however, intend to monitor the performance of these apps and “determine whether additional or different actions are necessary to protect public health” (see footnote 13 of the guidance).

Mobile medical apps will be expected to meet the device regulatory requirements associated with the risk classification for the app. In brief, the FDA will place more stringent requirements on devices that the agency believes pose a potential high risk for patients; the lowest level of device regulation, reserved for devices that pose minimum risk for morbidity or mortality, involves more general controls. For apps that are clearly not mobile medical apps — or that fall into the gray area between medical apps and health/wellness apps — the FDA recommends that manufacturers voluntarily follow the FDA’s Quality Systems regulations in the design and development of their apps.

Assessing the Guidance

In general, the FDA appears to be striking the right balance with this guidance, focusing on apps that are clearly used in medical treatment and taking a “sit-back-and-wait” approach for health/wellness apps that have implications for treatment. My chief concern about this guidance, however, is the lack of clarity about what is a mobile medical app — which could be subject to regulation as a device — and what is just a health/wellness app. This lack of clarity could be a significant obstacle to innovation in the mobile app space — an area where innovation should be actively encouraged. Some of the most exciting developments in health employ mobile apps to actively engage patients in activities that promote health or that enable them to manage health conditions in more effective and less costly ways.

At a minimum, the FDA should provide more examples of the types of apps that are not considered mobile medical apps, and the agency should select some examples that fall into the gray area — apps that focus on wellness but are intended to improve or mitigate a patient’s medical condition. The agency could also provide an efficient and transparent process for updating this list of examples to try to keep reasonably apace with technological developments. Perhaps a common sense litmus test could distinguish which health apps should be more closely regulated by the FDA: If the consequences of an app malfunction would be significant, it falls into the bucket of what FDA is trying to (and arguably should) more stringently regulate.

Submitting Feedback to the FDA

The FDA has also requested feedback on the regulations; submit your comments to FDA by October 19, 2011.