Musings on the Value of Project HealthDesign from Regulatory and Assurance Counsel

by Deven McGraw

With this, my last Project HealthDesign blog post, I wanted to share, on behalf of myself and my colleagues at Manatt, some final thoughts about our experience as Project HealthDesign’s Regulatory and Assurance Counsel, providing assistance to each of the five research teams and helping bring the experience of Project HealthDesign into current and important policy conversations about how to achieve a more patient-centered, digital health care system.  

We began our involvement with Project HealthDesign with a keen appreciation of the fact that the health care system today does not appropriately recognize the critical role that a patient’s personal experience and day-to-day activities play in achieving optimum health and wellness. Over the past three years, it has been an honor to help the Project HealthDesign research teams and National Program Office communicate to the broader policy community the important  lessons learned from their experience.  Patients are experts at their personal experience; clinicians are experts at clinical care.  To achieve better health outcomes, both patients and clinicians will need information from both domains—and technology can play a key role in bridging this information gap.

Project HealthDesign took this message straight to the heart of the policy debate over how to improve our nation’s health care system, including testifying before federal policymaking bodies charged with charting the future of health IT and patient engagement.  As a result of Project HealthDesign’s efforts, the Federal Health IT Policy Committee’s meaningful use workgroup included in its preliminary recommendations for Stage 3 meaningful use of electronic health record (EHR) criteria a requirement that patients be provided with the ability to report patient-generated data to providers and hospitals. Observations of daily living (ODLs) were specifically mentioned on the list of acceptable types of patient-generated data.  The experience of the Project HealthDesign research teams helped bring the discussion of meaningful patient engagement using technology out of the theoretical and into the practical -- and the possible.  

In addition to influencing national health care policy, Project HealthDesign also generated best practices to help health care providers in the field begin incorporating ODLs into clinical care.  It is not hard to envision an environment in which health care providers routinely encourage patients to use mobile devices to collect and share clinically relevant information such as ODLs. As reimbursement models for health care providers move toward paying for outcomes and episodes of care, shared savings incentives, and capitation, there will be greater incentives for providers to more actively engage patients in daily self-management and care coordination.  Project HealthDesign research teams provide roadmaps for how this can be done. 

One area where Project HealthDesign generated and disseminated best practices was in health information security.  Patients’ use of mobile devices to generate and communicate health information triggers unique security risks, and the tools frequently used by patients are not typically equipped with high-end security tools.  When health care providers handle electronic, identifiable health information, they are subject to the HIPAA Security Rule. But HIPAA regulates providers, not patients. In an article published in the Journal of Healthcare Information Management, we sought to allay health care providers’ privacy and security concerns by developing best practice recommendations for providers to help their patients safeguard the health information they create and share through mobile devices. 

Another area where we seek to provide best practice recommendations is with respect to provider concerns about potential liability for failing to pay sufficient attention to patient-generated electronic health information.  In a forthcoming paper, we highlight Project HealthDesign’s experience that that setting clear expectations with patients about the sharing of patient-generated data – and honoring those expectations - helped alleviate liability concerns. 

By exploring practical ways to digitally capture and integrate patient-recorded observations of daily living into clinical care and testing this with real patients and real providers, Project HealthDesign’s interdisciplinary research teams have contributed groundbreaking work that will help the policy and clinical practice communities shape important improvements to the health care system.

While our involvement with Project HealthDesign may be coming to a close, we are proud to have been associated with Project HealthDesign’s important message: that a paradigm shift to a more patient-centered health care system requires that patient generated data be captured, interpreted, and incorporated into clinical care – and that we must begin now to lay the necessary groundwork for that change.

 

Patti Brennan: We need new policies for a new era of patient-centered care

WendySwanberg, Project HealthDesign Communications Project Assistant

Last week, national program director Patti Brennan held a briefing in Washington, DC, to speak with policy makers about the many insights that have emerged from the work of Project HealthDesign. While it's nearly impossible to summarize the findings of a project that's been evolving for nearly a decade, Patti does a beautiful job in this brief video.

We're at an important juncture in the future of healthcare and health technology, and a critical point for policymakers to attend to the knowledge gained by in-depth research like that conducted by Project HealthDesign's project teams.  Patti stresses four key considerations:

• The EHR is not enough

• We need safe and trustable ways to manage clinically-generated data and patient-generated data

• We need practice-permissive policies that support the use of patient-generated data and enable inter-visit care actions

• We need to expand the concepts of confidentiality and privacy to better fit the data landscape

These ideas have been germinated over the Project's duration, and we've chronicled much of their history on our website. In the months ahead,we invite you to explore the rich content on our website, and to keep the conversation going!

 

 

Maintaining the Patient Perspective in Patient-Centered Outcomes

Sara Koliner, Policy Analysis Project Assistant, Project HealthDesign National Program Office

Last week, the Patient-Centered Outcomes Research Institute (PCORI) approved 51 awards as part of its second cycle of funding in support of the development of a National Patient-Centered Clinical Research Network, part of the “Accelerating Patient-Centered and Methodological Research” Priority for Research.

Studies in Comparative Effectiveness Research (CER) rely on dense and nuanced information in order to accurately assess the quality of one treatment over another. The studies approved by PCORI, especially those concerning the assessment of prevention, diagnosis, and treatment options, cannot rely on coarse measurements such as mortality rates or a running list of potential side effects to inform medical providers and policymakers about the quality of life lived by treated patients. Instead, studies such as this could benefit from the real-time collection of the patient’s observations during treatment — information that Observations of Daily Living (ODLs) readily provide.

For example, a PCORI-funded University of Pennsylvania study has proposed to investigate the comparative effectiveness between two treatments for inflammatory bowel diseases, including Crohn’s disease. In order to quantify patient preferences for relevant treatment outcomes, a discrete choice experiment will be implemented using known attributes (e.g. the risk of serious infection, treatment failure requiring surgery, etc.). While these attributes of a treatment are important to informed decision making, they do not capture the entirety of patient-preference, especially with regard to unpredicted effects experienced during treatment.

The Project HealthDesign team, Chronology.MD, also focused on individuals with Crohn’s disease, but with the focus on their experiences during the study, rather than just the clinical outcomes. By giving patients a way to self-monitor through the collection of ODLs, the team made an enlightening observation (discussed in a blog post last year):

“Overall, the ODLs that the patients felt were the most personally relevant to track were (in order of most frequently cited): abdominal pain, weight, energy, journal, stress, daily activity, medications, sleep, lab tests, and trigger foods. […]Patients in the 25-34 years age group were more likely to report abdominal pain and weight as the two most relevant ODLs for them to share with their providers; patients in the 35-44 age group reported that the journal and abdominal pain were most relevant to share; and patients in the 45-54 age group unanimously reported stress and energy as the two most relevant ODLs to share with their providers.”

We already know that patient-defined, patient-generated ODLs provide incomparable insight into a person’s health experiences on the individual scale—but that’s only half the story. The translation of these personal cues into values that can be compiled, cross-listed, and categorized brings patient-level data to the scale of a population. Through the amalgamation of individual-level data, the Chronology.MD team could see that a 30-year-old patient with Crohn’s Disease may prioritize weight over stress as an indication of health, while a 50-year-old may more likely do the opposite. When attempting to assess the effect of a treatment—especially in terms of quality of life—researchers must take these (in this case, age-related) preferences into account. Patient-centered outcomes rely on the perspectives, vocabularies, and concerns of real patients, not just the outcomes that clinicians are concerned about.

As we wrap up our eight year project and look to the future, it is important to also stress how much value remains to be produced by ODLs in the research agenda of patient-centered outcomes. Mobile technology and application software have never been more ready to be utilized by those working outside the confines of the traditional clinical research lab, and we are excited to see how patient-defined, patient-generated data illuminates the Comparative Effectiveness Research field.

Changing Health Paradigms: A personal perspective

Linda Brei, Project HealthDesign Communications Consultant

In the late 1970s I had my first experience working for a health care related grant with the Community Care Organization (CCO) project, funded by the Kellogg Foundation.  Wisconsin was one of five states selected to demonstrate how Title 19 dollars could be used to pay for in-home care vs. nursing homes for rehabilitation services.  Eventually the results of these demonstrations found their way into public policy decisions and helped to change contemporary thinking about the value of delivering health care to patients in their homes.  

Moving forward thirty years, I found myself working for another program, this one funded by The Robert Wood Johnson Foundation, that has the potential to support an even greater paradigm shift in our thinking about patient care in non-clinical settings.  Project Health Design began with the goal of creating a vision of how Personal Health Records (PHRs) could become a valuable tool to facilitate patient-clinician communications.  By the close of Project HealthDesign’s first grantee projects, the Program had created intriguing visions of how individual patients could use electronic devices to capture and share health information with their clinicians.  As the project teams looked at what data could be valuable to clinicians, the concept of using Observations of Daily Living - patient generated, recorded and often interpreted data - emerged.  This simple concept – that individuals can become active participants in managing their own health if they identify and then pay attention to cues from their daily lives – can be transforming.  These observations can be used by the individuals alone or shared with a clinician, care giver or even family member in a team effort manage the individual’s health.

For me personally, the idea of ODLs was affirming and empowering.  I am a migraine sufferer. Thinking I could perhaps avoid migraines if I could find what triggers them, I kept food diaries and looked at hormonal cycles with the hope of finding the root cause and mitigating if not completely avoiding a headache.  Had my simple attempt at finding a cause for my headaches worked, a clinician would probably have believed my primitive research and pursued some sort of treatment.  But, this wasn’t the case.  When I was assigned to write about ODLs, it occurred to me I might try to identify cues rather than causes and then take preventive action.  This helped me uncover an elusive, personal and complex set of warning signs to which I could pay attention and act upon. 

What Project HealthDesign brings to me and hopefully to the greater effort of managing health vs. curing illness is a sense that health is complex and nuanced.  It is individual and terribly personal.  No physician, however skilled, will know what trips my triggers unless I have a way to tell her; tests and exams only talk about a snapshot in time.  But a skilled clinician in tandem with a very good set of ODL’s and an engaged patient offers something much more promising.  And what that combination seems to promise is fewer unnecessary drugs, fewer emergency calls, more personal responsibility, less expense, more targeted treatments and more prevention. 

Unfortunately, we are moving way too slowly.  There are a multitude of “complexities” around privacy and technology issues, and about how clinicians can recover their facilities costs if they replace a clinic visit with a quick ODL review and text message.  The public debates around policy doctrines such as Meaningful Use have been ongoing for years. Project HealthDesign, among others, has provided thoughtful direction about privacy and other policy concerns.  The nation is at a crossroads about how to deliver good healthcare at reasonable costs, and we have tools that promise to deliver a good chunk of that.  It seems to me we need to begin to bring these tools to the public, realizing that any system of controls will only be perfected through, ironically, using it meaningfully.  So, let’s just do it!

Linda Brei is an independent communications and marketing consultant. Through her firm, Kalliope, LLC, Linda works with businesses and non-profits, particularly in the areas of science and medicine.

Expanding the definition of "patient engagement"

Wendy Swanberg, Communications Project Assistant, National Program Office

This past February, the leading health policy journal Health Affairs devoted an entire issue to the theme of “patient engagement” – the concept that patients can have direct involvement in their own health care.  Policymakers are starting to see patient engagement as something new and powerful, with one healthIT consultant calling it the “blockbuster drug of the century.”

There’s a growing contingent of patient advocates, led by people like Dave deBronkart/ePatient Dave, who are vigorously calling for patients to be equal partners in the health care decisions that impact their lives.  At Project HealthDesign, we’re in full agreement with that idea, and we’ve been working since 2006 to bring patients’ voices squarely into the health care conversation.

As the Health Affairs issue makes clear, “patient engagement” is an evolving concept.  We’re having a national conversation about the role patients should play in health decision-making at a number of levels, from the day-to-day management of illness to the very structure of the healthcare system itself.   But even with this new attention to patients' voices and values, the conversation can still sound like a one-way transmission of medical instructions, laced with a kind of health-paternalism.

At Project HealthDesign, we want to broaden the dialogue and expand the definition of “patient engagement.”  It needs to be a two-way conversation, between parties of equal status.  Clinicians and providers are the trained experts in health care, but patients are the experts in their own lives and their own bodies. Working together, both can do much more to improve health care than either group could do alone.

As our project enters its final weeks, we invite you to explore the work we’ve done and listen to the conversations it has generated – including this second installment of our interview with ePatient Dave. 

 

 

Watch our first ePatient installment, Envisioning the Patient-Centered EHR

ONC Seeking Public Input on Consumer eHealth Strategy

Robert D. Belfort, Manatt, Phelps & Phillips, LLP, Proje­ct HealthDesign Regulatory and Assurance Advisory Group

            The Office of the National Coordinator for Health Information Technology (“ONC”) is currently seeking public input to update the Federal Health IT Strategic Plan (the “Strategic Plan”). The Strategic Plan outlines goals and strategies for the nationwide shift to electronic health records (“EHRs”) and electronic health information exchange, and for creation and spread of new health information technologies.  ONC has partnered with researchers at Cornell University to provide Planning Room, a website that makes it easy for the public to offer their thoughts, experiences, and suggestions on the Strategic Plan (or anything else on which ONC seeks feedback).

            From now through May 9, 2013, the topic for discussion is one that all of us at Project HealthDesign care about: Consumer eHealth.  In the Planning Room, ONC has set forth several discrete topics for feedback from the public, including identifying useful health information, decreasing health disparities through health IT and patient-generated health data.  ONC will use the feedback it receives from the public to update the consumer eHealth section of the Strategic Plan.

            For those of you who are wondering what ONC has done on the topic of consumer eHealth to date, there is an article in the February edition of Health Affairs that provides a summary.  ONC staff authored the article, which is entitled “A National Action Plan to Support Consumer Engagement via eHealth.”  The article lays out ONC’s “Three A’s” strategy to increase consumer engagement in eHealth.  The three prongs of the strategy are to:

• increase patients’ access to their health information (“Increase Access”);
• enable consumers to take action with that information (“Enable Action); and
• shift attitudes so that patients and providers think and act as partners in managing health and health care using health IT (“Shift Attitudes”).

            Of the three prongs, ONC has the greatest direct influence on consumers’ access to their health data, which it supports through the Medicare and Medicaid EHR Incentive Programs and the Blue Button Pledge Program.  Initiatives in the second prong support the development of an ecosystem of tools and services that help consumers’ take action using their health information.  The final prong of the Three A’s strategy supports the evolution of consumers’ and providers’ expectations about roles relative to each other, leading toward a less hierarchical, more collaborative partnership, enabled by eHealth.  For example, patients need to feel comfortable requesting electronic access to their health records, asking providers questions, sharing their own health knowledge, and weighing in on treatment options.  According to ONC, a cultural shift among patients and providers is necessary to support these kinds of behaviors.

            Now that you have a sense of ONC’s consumer eHealth goals and strategy, we encourage you to go to the Planning Room and share with ONC anything that you learned from Project HealthDesign that you think may help them.  It is extremely easy to provide feedback.  You don’t have to submit formal comments; just post a comment in the thread on www.planningroom.org.  It will show up immediately and a forum moderator will likely respond with a thought provoking follow-up question or – at the very least – a sincere “thank you” for helping ONC develop a Strategic Plan that promotes advances in consumer eHealth.

Read more posts about legal and policy issues

 

If Specificity Is the Solution, ODLs Are Key

Sara Koliner, Policy Analysis Project Assistant, Project HealthDesign National Program Office

Mobile apps have proven to be valuable tools for collecting ODLS in this last round of Project HealthDesign. While the benefits are clear, however, creators of mobile apps must contend with a complicated interplay of safety, cost, usability, and accessibility in order to produce high quality software. Weakening these foundations can lead to misuse by consumers, or rejection by practitioners. On the other hand, overabundance of requirements can stall progress and hinder the utility of these applications.

A few weeks ago, the Healthcare Information and Management Systems Society (HIMSS) held its 13^th annual conference in New Orleans, LA. In one notable e-session, presenters Katharina Steininger and David Rückel outlined the values of key stakeholders in mobile health applications, and thus the priorities that should be used in applications themselves. A copy of their slideshow is available here.

In “Mobile Health Applications—Strategic Stakeholders’ Perspectives,” Steininger and Rückel name key stakeholders in mobile health applications: patients, practitioners in private practices, emergency medical services and mobile homecare, hospitals and nursing homes, application developers, and statutory and private health insurances. While the stakeholders often have common aims such as higher quality care and improved security, their priorities are unique and often contradictory.

The solution here is specificity: choose your stakeholders, and this will define your priorities. While the presenters describe doctor-to-patient and doctor-to-doctor style applications, they leave out the most relevant setting: patient-to-doctor communication.

Project HealthDesign teams inherently centered themselves around patients by designing mobile apps to use the data that embodies specificity: ODLs. By incorporating Observations of Daily Living, developers automatically look to the values of patients, and so produce a more effective application. Applications like BreathEasy even provided a separate dashboard for clinicians, allowing both the smartphone and computer-based portals to serve the exact needs of targeted users.

A final note on the importance of specificity: On Tuesday, March 19, the Energy and Commerce Committee hosted a hearing regarding the regulation of mobile health applications. In view of whether mobile health applications should be considered medical devices, gray areas indeed exist in applications that intend to replace monitors already used in the clinical setting. Applications dedicated to the capture of ODLs, on the other hand, add entirely unique patient-defined and patient-generated data to the workflow. The specifically non-clinical nature of ODLS requires a different framing of the quality question—one that addresses both the reliability from the patient’s perspective and accountability on the part of the clinicians. If quality standards are to be applied to this type of mobile app, they will have to be quite different from the standards currently used for clinical care metrics: if not necessarily relaxed, they must account for the idiosyncrasies of data shaped at the level of the individual.

Ingenuity and flexibility are essential to the development of quality mobile applications. As long as developers remain keyed into the patient perspective, they should be encouraged to use these faculties as effectively as possible.

Read more posts about legal and policy issues

HHS Issues Request for Information; Asks for Strategies to Increase Patient Engagement

 Robert D. Belfort,  Manatt, Phelps & Phillips, LLP, Proje­ct HealthDesign Regulatory and Assurance Advisory Group

On March 6, 2013, the U.S. Department of Health and Human Services (HHS) issued a news release announcing its 2013 agenda to bring down costs and improve quality of care through implementation of health information technology.  Specifically, the new release introduced HHS’s latest plan to “accelerate health information exchange (HIE) and build a seamless and secure flow of information essential to transforming the health care system.”  In the release, HHS indicated it will, among other things:

• Set aggressive goals for 2013: HHS is setting the goal of having 50 percent of physician offices using electronic health records (EHRs) and 80 percent of eligible hospitals receiving meaningful use incentive payments by the end of 2013.
• Increase the emphasis on interoperability: HHS will increase its emphasis on ensuring electronic exchange across providers.  It has started that effort by issuing a request for information (RFI) seeking public input about a variety of policies that will strengthen the business case for electronic exchange across providers to ensure patients’ health information will follow them seamlessly and securely wherever they access care.
• Enhance the effective use of electronic health records through initiatives like the Blue Button initiative.  Medicare beneficiaries can access their full Medicare records online today. HHS is working with the Veterans Administration and more than 450 different organizations to make health care information available to patients and health plan members.  HHS is also encouraging Medicare Advantage plans to expand the use of Blue Button to provide beneficiaries with one-click secure access to their health information.
• Implement Meaningful Use Stage 2:  HHS is implementing rules that define what data must be able to be exchanged between Health IT systems, including how data will be structured and coded so that providers will have one uniform way to format and securely send data.

      In its Request For Information (RFI), HHS requested feedback from the public on various ways to accelerate electronic HIE.  One of the RFI’s focus areas is consumer and patient engagement.  According to the RFI, “CMS wants to encourage beneficiary engagement in their care through improved beneficiary access to their personal health information and better electronic communication between beneficiaries and their health care team. There are several ways CMS could encourage beneficiary access to their information through the use of new measures or patient-reported care experiences, new technology tools, and new financial models.”  The specific options that CMS holds out as examples in the RFI are:

1. Incorporating new measures into Medicare Advantage Program consumer assessment surveys (CAHPS);
2. Blue Button availability to all CMS beneficiaries;
3. Payment and service delivery model testing under the Affordable Care Act, such as demonstration of incentives for consumers to more actively participate in their health; and
4. Direct access to lab results from laboratories.

CMS posed the following specific question in the RFI:  “What CMS and ONC policies and programs would most impact patient access and use of their electronic health information in the management of their care and health? How should CMS and ONC develop, refine and/or implement policies and program to maximize beneficiary access to their health information and engagement in their care?”

What are the lessons we have learned from Project HealthDesign that should be brought to bear on this question?  Post them below or submit comments directly to ONC.  The RFI can be accessed here  http://www.ofr.gov/OFRUpload/OFRData/2013-05266_PI.pdf

Read more posts about legal and policy issues

BreathEasy goes to the mHealth Summit

Barbara L. Massoudi, MPH, PhD, BreathEasy Principal Investigator

I recently presented the BreathEasy project at the mHealth Summit, sponsored by HIMSS, as part of a panel on Pulmonary Disease Management. In addition to BreathEasy, one of the other panelists presented on asthma – the M-CHESS project at the University of Wisconsin, Madison. M-CHESS is part of a larger study, The Center for Health Enhancement Systems Studies (CHESS), with a goal to optimize individuals' health behaviors, quality of life, and access to services through research and development of innovative health systems.

Like BreathEasy, M-CHESS was focused on self-management of asthma in inner-city patients using a smartphone. M-CHESS recruited 218 teens and randomized them to two groups – experimental, and control for a study period of 12 months, and then a follow-up of 12 months. All participants were provided with smartphones; the experimental group also received access to the M-CHESS interface, featuring an interactive, Internet-based asthma education program, peer support mechanisms and automated reminders for asthma control medicines and data collection. Researchers used the Asthma Control Test (ACT) to measure how well an individual’s asthma symptoms are being managed. Initial analysis shows a significant effect of M-CHESS on the change in ACT scores across the first 60 days on study (p=.011). On average, the M-CHESS group showed a 2% improvement in ACT score per day of study over the control group. Ongoing analysis will examine whether the drop-off in improvement of symptom control is related to a decline in use of the M-CHESS application and attempt to identify specific subgroups for which M-CHESS may provide the greatest benefit in asthma symptom control.

The two other panelists presented on tuberculosis (TB) projects. The University of San Diego presented on a project that used mobile phones for conducting directly observed therapy via video upload (VDOT) in the US and Mexico. Overall, patients liked using the phone to upload videos, and the compliance rate with timely uploads was high. VDOT represents an additional option to resource intensive traditional, in-person DOT.

Researchers from the University of Utah presented on their TextTB randomized control pilot study which looked at the acceptance and feasibility of a patient-driven mobile phone intervention to support TB treatment adherence in Argentina. Patients were asked to text in when they had taken their medication. Overall, adherence and acceptability of the intervention was relatively high, but mobile phone feasibility issues such as lost messages, modem issues, and running out of SMS credits caused some difficulties for some participants. Further research is needed to evaluate the potential for this method of reporting once these issues have been addressed.

Overall, the panel was very interesting – with findings from all participants providing valuable lessons for future work in mobile health apps. Next, we’ll report on our attendance at the Health IT for the Underserved Conference.

 

** The mHealth Summit research sessions are archived here – scroll down to Wednesday, December 5, “Pulmonary Disease Management.” Barbara Massoudi’s presentation begins about 50 minutes in.

 

Learn more about BreathEasy.
Read more posts from the BreathEasy team.

 

Project HealthDesign's new video series: Conversations with e-PatientDave

Project HealthDesign has long advocated for imagining personal health records as patient-centered records, and for including the patient's voice in the health care conversation. One of the more intriguing patient "voices" belongs to Dave deBronkart, better known as "ePatient Dave."

For those who don't know him, Dave deBronkart survived Stage IV kidney cancer, and he credits his survival to the vast store of patient knowledge he discovered after his diagnosis. Since his recovery, Dave has been a tireless champion of patients and patients' rights. (He writes a regular blog: e-PatientDave, A Voice of Patient Engagement). In February, Project HealthDesign met with Dave for a lengthy interview -- about everything from the value of patient insight, to the power of raw data, to the insights gained by those who have come close to dying.  

Over the next three months, as Project HealthDesign winds to a close, we'll be posting pieces of our interview with this remarkable and energetic man. Here is the first installment, Envisioning the Patient-Centered EHR.

 

 

New HIPAA Rules Clarify Patients' Right to Access Their Health Data

Deven McGraw, Project HealthDesign Regulatory and Assurance Advisory Group, Center for Democracy & Technology

Last month, the Administration released long-awaited final regulations to implement most of the improvements to federal health privacy protections enacted by Congress in the HITECH provisions of the 2009 economic stimulus legislation. As described earlier this month in iHealthBeat, the regulations include strengthened prohibitions against use of patient data without consent for marketing communications; extension of federal privacy and security protections to contractors (and subcontractors) of doctors, hospitals and insurers; improved right of individuals to be notified of breaches of their health data; and clarity regarding an individual’s right to receive digital copies of her health information.  This blog post will focus specifically on the rights of patients under HIPAA to access their data.

The HIPAA Privacy Rule has always provided individuals with the right to access and obtain copies of health information maintained in provider or health plan records.  Under the existing regulations, when a patient makes such a request, the provider or plan has up to 30 days to provide the requested access or copy; however, the provider or plan can take up to an additional 60 days if the information requested is stored off-site.  Patients can also be charged a reasonable, cost-based fee for copies of their information, covering the costs of both the labor and supplies.  State law frequently sets maximum rates to be to be paid by patients for copies of their medical records.  Although this right of access has been part of the Privacy Rule since it was first implemented, many patients have faced obstacles in trying to obtain timely copies of their health information.

The Privacy Rule covers identifiable health information in both paper and digital form, so this right of patient access has always applied to information kept in electronic as well as paper medical records.  However, in HITECH, Congress made it clear that when a patient’s information is stored electronically, patients have the right to obtain an electronic copy and to have that copy sent at their request to another person or entity, like a doctor, a caregiver, or a personal health record or mobile health app. 

The new regulations released last month implement this mandate and also clarify how this right to digital data can be exercised.  Patients have the right to an electronic copy “in the form or format they request” – but only if the provider or plan is capable of producing the copy in the requested format.  If the data isn’t “readily producible” in the format requested by the patient, the provider or plan and the patient are expected to come to an agreement on an acceptable, machine-readable digital format.  In other words, patients cannot demand that their providers run out and purchase new technology in order to produce data in a specific, desired format; however, providers must have the capability of providing patients with some type of machine readable, electronic copy of their data.  HHS suggests that MS Word, Excel, text, HTML or PDF are among the possible options.  The patient can also choose to obtain a paper copy if none of the provider’s digital formats meets the patient’s needs. 

The new rules still allow providers and plans to ask patients to submit written requests for copies of their health information, although this is not required by the Privacy Rule.  However, if the patient wants to have the electronic copy transmitted directly to a third party, the new rules require that this request be in writing, be signed by the patient, and clearly identify designated recipient and where the information is to be sent.  (The writing and signature can be digital.)  Per existing requirements of the HIPAA Privacy and Security rules, providers or plans sending identifiable health information per a patient’s request must take steps to verify the identity of the patient, send the right records, and implement safeguards to protect the information in transit.

Of note, although the Security Rule requires providers and plans to implement safeguards for transmitting identifiable health information, patients also have the right to get their copies through unencrypted e-mail if they so choose – a point that was clarified in the material accompanying the new regulations.  Providers and plans are first required to advise patients of the risk of receiving information through unsecure channels; but if the patient opts for the unsecure method, she has the right to receive her information in this way.  (This advice on the risks of unsecure e-mail does not have to be extensive; it is enough to notify the patient there is “some level of risk that the information in the e-mail could be read by a third party.” ) Some patients prefer the convenience of having their data sent directly to them at their regular e-mail address; others will welcome the option of having a secure method.  HHS makes clear in the new regulations that the patient has the right to choose.

Patients can still be charged for digital copies of their data – but only for the labor costs associated with preparing the copy (not including fees for “retrieval”).  If the patient chooses to purchase supplies (like a flash drive) from the provider or plan, there may be a reasonable charge imposed for those. 

Although the new regulations make important clarifications to HIPAA’s patient access right, providers and plans can still take a fairly long time to respond to patient requests for data:  up to 30 days, and an additional 30 days for information stored off-site.  HHS encourages faster response times but noted a need to set the outer boundaries at a level that would enable entities to comply regardless of the nature of the patient’s request or the location of the data.   As noted in a previous blog post, the requirements for Stage 2 will provide some patients with more timely, on-line access to relevant digital health information. However, these requirements apply only to entities participating in the Meaningful Use program, and those entities are only required to make this access available to a portion of their patients.  The HIPAA access rules provide the baseline for all providers using digital records and for some patients will constitute the only available pathway for obtaining copies of their data. 

The final rules are effective March 26, 2013; entities covered by the rule have another 180 days to come into compliance with most provisions.  Until the effective date, the existing HIPAA rules on patient access remain in place. 

Read more posts about legal and policy issues

 

Joint ONC Committee Hearing Focuses on HealthIT and Patient Engagement

Sara Koliner, Policy Analysis Project Assistant, Project HealthDesign National Program Office

On Tuesday, January 29th, the HIT Policy Committee and HIT Standards Committee hosted a joint hearing on health information exchange (HIE). The hearing, divided into four panels, assessed the current state of HIE through the testimony of a number of distinguished speakers and fostered discussion about what next steps the Office of the National Coordinator for Health IT (ONC) should take to address business, technical, and regulatory barriers.

Of considerable interest was the final panel, Consumer-Mediated Exchange, moderated by physician Paul Tang, who served as chair of Project HealthDesign’s National Advisory Committee. The panel featured testimony by Jeff Donnell, MaryAnne Sterling, Neal Patterson, and Alan Blaustein.

Jeff Donnell began with a salute to how far patient engagement has come in the past six years:

Meaningful Use Stage One placed patient engagement squarely on the map, and Stage 2 requirements -- including view/download/transmit and the modest five percent patient participation threshold -- have moved patient engagement from a check box item to a health IT strategy imperative.

The panelists touched on some issues that have been discussed among Project HealthDesign grantee teams. First, for patient generated data to be useful, it requires clinical buy-in: Consumers don’t just need easy access to their information, providers need to consume it. Jeff Donnell offered a memorable quote:

From a technical point of view, it’s not difficult. There’s policy and standards work, but much of it is education. We encounter providers that are so fearful of patient-generated data — but then we talk to them about, “how do you handle patient-generated data now? I mean you’re having a patient fill out a paper form in a waiting room, and then you’re having someone rekey it in, are you saying that that data collected in probably the worst possible environment is better than a patient bringing it in from multiple sources and making it accessible? . . . A lot of it is fear of the unknown. I believe that that is where the ONC can help.

The speakers addressed concerns over the interaction between the Health Insurance Portability and Accountability Act (HIPAA) and data transmitted outside of the EHR system. In varying contexts, participants called for the creation of mechanisms to allow for the flow of information among consumers, caregivers and healthcare providers.

One salient point that came up frequently was the notion that consumers are the keys to solving the barriers to interoperability. Aside from technical concerns, current business often models impede the movement of data because data liquidity might appear to harm profitability. However, if individuals are given control of their own information, a new business model might arise – One in which consumers are part of the health care system rather than just being served by the system.

As Alan Blaustein pointed out, it is important that the consumer be engaged. When asked what opportunities and challenges existed to enable consumer-mediated exchange in the next two years, he responded:

The greatest challenge of the consumer-mediated exchange in the next two years is a clear communications strategy that explains the value to the healthcare consumer.   The consumer-mediated exchange must be communicated as a first step to the overall engagement of the healthcare consumer in their healthcare experiences.  Otherwise these efforts will be simply seen as an additional burden on the healthcare consumer, particularly if the healthcare consumer now thinks that she is primarily responsible for moving a particular file from Point A to Point B with nothing more at stake.

Furthermore, the culture of our healthcare system will need to begin changing and the healthcare consumer must be invited into the conversation.  Countless times we get calls at CarePlanners from clients whom the system has largely ignored, where their facts and opinions were not considered.  That requires far more change and self-evaluation than can possibly be rectified in the coming two years.

This isn’t to say that consumer-mediated exchange is a replacement for HIE. Rather, it should serve to complement and accelerate the entire HIE expansion, creating a combined synergy that’s essential to improving healthcare nationwide. Read testimony transcripts and listen to the entire hearing here: http://www.healthit.gov/policy-researchers-implementers/hitpc-hitsc-health-information-exchange-public-hearing

 

HIPAA New Omnibus Rule Impacts Patient Data Privacy, Security

Sara Koliner, Policy Analysis Project Assistant, Project HealthDesign National Program Office

Last week, Bloomberg BNA’s Health IT Law & Industry report provided an insightful overview of the new Omnibus Rule issued by the Department of Health and Human Services to modify HIPAA. This final rule, created in response to the Health Information for Economic and Clinical Health (HITECH) Act, finalizes proposed rule changes regarding privacy, security, and breach notification requirements. While we encourage you to read the entire report, we would like to specifically highlight the rule’s modifications to individuals’ electronic access to their medical records.

As Project HealthDesign legal and policy consultant Robert Belfort et al. explain in their summary for Bloomberg BNA, this particular rule builds on the “right to an electronic copy on any PHI [Protected Health Information] maintained in an EHR” outlined in the HITECH Act. The limitation of the prior requirement to Electronic Health Records left a wide range of protected, electronically-maintained health information unaccounted for, creating a potential for disparate access requirements between EHRs and otherwise. The Omnibus Rule extends the right to an electronic copy to “all protected health information maintained in one or more designated record sets electronically, regardless of whether the designated record set is an EHR.” Should a copy of this information not be readily producible, it should be provided in a standard digital form (such as a .txt, .pdf, or .doc file).

Allowable fees are also identified. Covered entities will be able to charge a “reasonable, cost-based fee” for costs involved with the providing the service, such as supplies (such as a CD), labor, and postage, if necessary.  To clarify, “labor” would not include the cost of retrieval, and costs associated with the digital infrastructure or system maintenance would not be permissible.

Perhaps the most beneficial modification to consumers is the removal of the 60 day window within which requested health information maintained off-site must be delivered. Now, covered entities must respond to all requests within 30 days (maintaining the possibility of a one-time 30 day extension if necessary). Especially when technology has advanced to the point of near-instantaneous information delivery, this amendment incentivizes healthcare providers to meet the demands of the modern consumer. Furthermore, increasing the timeliness of health data delivery will significantly improve patient engagement, paving the way for information to flow more readily in both directions.

Aside from some exemptions, the Omnibus Rule requires compliance by September 23, 2013. Increasing the convenience and ease of access to protected health information is an important step in encouraging use among patients. We are happy to see HHS making strides in this direction.

 

Read more posts about legal and policy issues

ONC Releases Draft Health IT Action and Surveillance Plan

Robert D. Belfort,  Manatt, Phelps & Phillips, LLP, Proje­ct HealthDesign Regulatory and Assurance Advisory Group

Just before the holidays, on December 21, 2012, the Office of the National Coordinator for Health IT (ONC) released its draft “Health IT Patient Safety Action and Surveillance Plan.”  ONC released the Plan in response to a November 2011 Institute of Medicine (IOM) report called, “Health IT and Patient Safety, Building Safer Systems for Better Care.” I wrote a blog about the IOM’s report, which you can read here.

IOM released its November 2011 report in response to a request by ONC for recommendations about what a comprehensive health IT safety policy should look like.  Among other recommendations, IOM suggested that the federal government create a new independent watchdog agency, along the lines of the National Transportation Safety Board, to accept reports on patient deaths, serious injuries or potentially unsafe conditions associated with health IT. 

ONC stopped short of taking the IOM’s recommendation.  Instead, in its draft Plan, ONC proposed to leverage existing federal agencies’ authorities and private sector safety programs to increase knowledge about health IT safety among health care professionals and improve how health IT makes care safer.  The draft Plan prescribes a list of actions that are organized under three strategies:  (i) Learn: increase the quantity and quality of data and knowledge about health IT safety; (ii) Improve: target resources and corrective actions to improve health IT safety and patient safety; (iii) Lead: promote a culture of safety related to health IT.

Below are some highlights from the draft Plan:

• ONC will work with developers on a code of conduct that commits developers to (i) work with Patient Safety Organizations or similar entities to report, aggregate, and analyze health IT-related safety events; (ii) support providers in reporting safety events; and (iii) collaborate with private sector efforts to make comparative user experience with different EHR systems more available.
• ONC will leverage ONC-ACB surveillance and live testing to ensure EHR safety features are functional in live environments and that developers address safety complaints.  ONC will continue to incorporate safety into its standards and certification criteria.
• ONC will monitor health IT adverse event reports to the FDA’s Manufacturer and User Facility Device Experience (MAUDE) database.
• The Agency for Healthcare Research and Quality (AHRQ) and ONC will work with providers and PSOs to incorporate AHRQ Common Formats into providers’ health IT and reporting systems. AHRQ Common Formats allow for easy, real-time reporting and aggregation of patient safety events and risks.
• AHRQ, in collaboration with ONC, will work with PSOs, providers, and developers to add a focus of health IT to their collection, aggregation, analysis, and mitigation of providers’ adverse event reports. AHRQ will also provide guidance to PSOs on how they can work with providers to use health IT to improve reporting and mitigate health IT risks.
• The Centers for Medicare & Medicaid Services will align its safety standards for health care facilities, its interpretive guidance, and surveyor trainings to add a focus on health IT and patient safety.

Reactions to ONC’s proposed Plan are only beginning to trickle in.  Some stakeholders are suggesting it doesn’t go far enough while others are calling the proposal a necessary step in the right direction.  We thought it was interesting that, while the IOM’s report included an entire chapter devoted to the safety of health IT tools “designed to engage and support patients in health-related decision making and management of their own personal health information” (see chapter 5 “Patients and Families Use of Health IT: Concerns about Safety”), ONC’s proposed Plan includes no such references.  The IOM report specifically noted patients’ ability to use personal health records (PHRs) and other tools to record and share “activities of daily living.” It did not offer up a silver bullet for avoiding patient safety risks created by PHRs and other patient engagement tools but it noted that one important way to ensure patient safety is for health care providers to manage patient expectations about how information they include in a PHR or other patient engagement tool will be used. According to IOM, health professionals, patients and their families need to develop “a shared understanding of appropriate use of patient-centered, validated data.”

Do you think that ONC’s proposed Plan should include more of a focus on the unique patient safety challenges associated with PHRs and other health IT tools that enable patients to generate and share health information?  You have until February 4th to provide public comments, which can be submitted to [email protected].

You can read the draft Patient Safety Plan here:  http://www.healthit.gov/sites/default/files/safetyplanhhspubliccomment.pdf

 

Read more posts about legal and policy issues

Drawing from within: Implantable devices yield new types of patient generated data [Video]

Project HealthDesign National Program Office

We are in the final six-month stretch of Project HealthDesign, and we’re trying to share some of our project’s most relevant and dynamic findings with respect to patient-generated data. We learned through our recent grantees’ research that familiar consumer electronic devices, like cell phones and tablets, can help patients capture observations of daily living and personal insights, and allow them to easily share these data with their clinicians. 

There’s another type of patient-generated data out there. We’ve learned from conversations with people whose health lives depend on implantable devices like cardiac defibrillators and insulin pumps, that data derived from these devices  provide important information not only about how the device is performing but also about the patient’s health state.  It is timely to figure out how to make data acquired through such implantable devices accessible and useful to patients as well as clinicians and researchers. 

In this video, Patricia Flatley Brennan offers some compelling thoughts about the need to imagine and harness this novel patient-device data to make sure it serves the ultimate health interest of patients.  Device makers and federal bodies who regulate these devices should pay particular attention. While watching this video, keep these questions in mind:  How can we ensure that patient-device data are 1) understandable to and accessible by both patients and clinicians; 2) completely secure from disruption and tampering, and 3) regulated carefully and fittingly? 

Project HealthDesign wants your input on this important matter. If you have thoughts, suggestions, ideas about all types of patient-generated data, post your comments below or send them to [email protected]