New FTC Rules Protect Privacy of PHR Users

Posted August 31, 2009 by Lygeia Ricciardi

Last week the Federal Trade Commission (FTC) issued a final rule that helps to protect users of personal health records (PHRs). The rule helps users by making sure they are told if the privacy of their health information has been compromised (or “breached” in industry parlance).

According to the rule, when health information in a PHR or a related device—for example, one that uploads readings from a blood pressure cuff or pedometer into a PHR—has been leaked, the service provider or providers involved need to let users and the FTC know. In some cases involving breaches of health information that impact a large number of people, the media must be informed, too.

The FTC rule is designed to address a lack of public protections for PHR services and related applications that are offered by companies or other entities that are not traditional players in the health system (such as hospital systems and health insurance companies). Such entities (including providers of major PHR platform services, such as Microsoft’s HeathVault, Google Health, and Dossia) are not covered by HIPAA, the Health Insurance Portability & Accountability Act, but will need to comply with the new FTC rules.  

The FTC was required to develop privacy breach rules for PHRs by the federal stimulus package issued last winter (the American Recovery and Reinvestment Act). The rule was released August 25th, and will go into effect on February 22, 2010. 

HIEs are Beginning to Link Patients Directly to their Own Health Data

Posted August 18, 2009 by Lygeia Ricciardi 

Last month the eHealth Initiative (eHI) released its sixth annual survey of health information exchange and a report based on its findings, “Migrating Toward Meaningful Use: The State of Health Information Exchange.”

Among the findings is that the number of health information exchange initiatives (HIEs) continues to grow. According to the report, there are now at least 193 active initiatives, 57 of which are operational—an increase of nearly 40% over last year’s numbers. (Some HIEs refer to themselves as RHIOs or Regional Health Information Organizations.) An even greater level of growth is expected as a result of the stimulus package—the American Recovery and Reinvestment Act (ARRA).

Most HIEs are concerned primarily with the exchange of health information among health care providers, hospitals, pharmacies, and other members of the traditional health care system, such as health plans.

Interestingly, though, some—though still a small number—of HIEs have begun to include patients among those who can get access to electronic health information—in this case, to their own medical records. Fourteen HIEs have “technology available allowing patients to access their medical information,” according to eHI’s report. Most of these either have or are in the planning stages of implementing a patient portal.

What kind of access do these HIEs provide? In about half, patients can add “clinical” information to their records. Others only allow patients to comment on the existing record, or, in three cases, provide “read only” access.

Under the HIPAA Rules, physicians, hospitals, health plans, and other “covered entities” have long been required to give patients access to their own health information upon request, though until recently there were no provisions specifically requiring that such access be in an electronic form. (ARRA, which requires that patients be given electronic access by HIPAA covered entities that store the information electronically, doesn’t specify that the data be in any particular type of format.)

Independent personal health record (PHR) providers, by contrast, have platforms and services designed primarily to give patients access their own data for their own use—once they’ve figured out a way to get it into the PHR in the first place. But direct patient access to data though an HIE is still a fairly new development.

While the eHI report’s snapshot of patient access through HIEs is a far cry from Project HealthDesign’s vision of a world in which patients are able to both download their data from the health system in a “computable” form that lets them plug it directly into a variety of applications—and also send their own observations of daily living directly to their providers, it signals a positive step toward the kind of data liquidity on which that vision depends.

Though HIEs may never be the primary way patients access and download their data from the health system, any increase in patient access is a step in the right direction. See our previous discussion of this topic--and please feel free to weigh in.

Further Clarifications of “Meaningful Use” Are Needed

Posted August 2, 2009 by Lygeia Ricciardi

The definition of “meaningful use” continues to occupy attention in Washington because of the important role it will play in the allocation of the stimulus package’s $17 billion dollars geared toward the adoption of electronic health records (EHRs). To qualify for incentive payments via the Centers for Medicare and Medicaid Services, health care providers will have to demonstrate that they are using their EHRs in a “meaningful manner.”

A federal advisory committee called the Health IT Policy Committee has been working to clarify what “meaningful use” will really mean. On July 16^th it approved a set of more than two dozen recommended meaningful use objectives. These generally take the form of a single phrase, such as “maintain active medication list,” describing what providers or hospitals must do to be eligible for financial support.  Several of the objectives were revised from a previous iteration released in June, which received 720 public comments.

What changed?

Notable changes in the objectives include refinements in the criteria for computerized physician order entry (CPOE), and a tighter timeline by which health care providers are required to be able to give patients access to their own health information via personal health records (PHRs), populated “in real time” with their own health information. (The deadline was moved up by two years – from 2015 to 2013).

So what happens next?

The “objectives” approved by the committee have now been handed off to two agencies within the Department of Health and Human Services – the Office of the National Coordinator (for Health IT), and the Centers for Medicare and Medicaid Services – to be translated into much more technical, specific rules. Drafts of those rules will be released in December, when the public will again have a chance to comment on them.

Further Clarifications are Needed to Make Data “Meaningful” to Patients

In general the supportive stance the committee took on patient access to and engagement with personal health information is very positive. For instance, a stated “care goal” is to “provide patients and families with timely access to data, knowledge, and tools to make informed decisions and to manage their health.” But the next phase of work is where the rubber hits the proverbial road. Based on insights from Project HealthDesign’s first round, there are a couple of key points that still need to be articulated clearly. 

Among the objectives are several that have to do with providing patients access to an electronic copy of their health information (including lab results, a problem list, medication lists, allergies, etc.). That’s a great starting point. What’s missing, though, is the stipulation that such access be in a form that is usable by patients – a computable form consistent with the Project HealthDesign vision. 

Project HealthDesign envisions patients in the near future using their health data not just as an end in itself, but as a starting point. People will be downloading information from their clinical visits and running it through a variety of tools and applications to analyze it and mash it up with other kinds of data. For example, an allergy sufferer could track how her allergy symptoms (as measured by lung capacity in her doctor’s office) relate to pollen levels (reported by the national weather service). Merely seeing health data on a screen, or downloading it in a PDF or other “locked” file format, won’t let patients use it in many of the ways that are most meaningful to them.

As a related point, many patients will want such novel data relating to their health to flow the opposite way: back to their care team.  In its study of observations of daily living (ODLs), Project HealthDesign found that individuals identify a range of types of information that are relevant to them, including sleep patterns and social interactions. Some people choose to keep such information private, but others feel strongly that others – including health care providers, other professionals such as personal trainers, and even family members – need to understand it.

It’s not that providers should necessarily have to worry about the pollen levels in the zip codes where each of their patients live. Rather, providers should have the capacity to incorporate into their EHRs data identified and recorded by individuals as specifically relevant to them and their own health, whether or not it is “traditional health data” such as weight or glucose levels. While the Health IT Policy Committee’s objectives make reference to providers being able to “upload data from [a] home monitoring device,” they do not explicitly address the need to incorporate a wide variety of types of patient generated information into the EHR.

Customization of Care

In general the meaningful use definition process has been very positive from the perspective of strengthening patient engagement.  Let’s keep up the good work and make sure its outcomes are as effective as possible by clarifying the points above.

People are different, and the best quality health care needs to be customized to the individual. Many other industries are using information technology to tailor products and services to meet individual needs. In health care, too, technology can enable an unprecedented flow of usable, customizable information–if we make sure the systems we put in place support it.

(See our previous post on meaningful use.)