Who’s Seen My Health Care Information?

Proposed Changes to HIPAA Privacy Rule Would Help Patients Learn the Answer

Robert Belfort, Project HealthDesign Regulatory and Assurance Advisory Group, Manatt, Phelps & Phillips, LLP

On May 27, the United States Department of Health and Human Services (HHS) issued a proposed regulation (the Proposed Rule) that would amend the Health Insurance Portability and Accountability Act’s (HIPAA) Privacy Rule to provide patients with more information about who has accessed their protected health information (PHI). The Proposed Rule is the latest in a series of regulatory changes HHS is making in response to the Health Information Technology for Economic and Clinical Health (HITECH) Act .

Some of you may already be familiar with HIPAA’s “accounting of disclosures” provision. The provision requires health plans and health care providers, upon request, to give patients a list of the disclosures of their PHI. This “accounting” must describe, among other things, when the PHI was shared, for what purpose and who received it.

Under existing rules, accountings do not have to include the most common disclosures that covered entities make:  those for treatment, payment and health care operations.  Many covered entities have claimed that even this limited accounting obligation is burdensome. But privacy advocates have argued that the routine disclosures should be accounted for as well, especially if they are made using electronic record systems that have the capacity to automatically track disclosures.

The Proposed Rule weighs in on the side of the privacy advocates by requiring covered entities to give patients an “access report” that lists who has accessed their PHI in an electronic designated record set (that is medical records, billing records or other information that is used by covered entities to make payment or treatment decisions and that is maintained electronically) for any purpose, including treatment, payment and health care operations.

• If a patient requested an access report, a covered entity would have to include the following information:
• The date and time of access;
• The name of the natural person (if available) or the name of the entity accessing the electronic designated record set information;
• A description of what information was accessed (if available); and
• A description of the action by the user, if available (e.g., create, modify, access or delete).

There is significant debate about how difficult it will be for covered entities to provide this new access report. HHS has stated that covered entities are already supposed to be electronically tracking much of the information required in the new access report under the HIPAA Security Rule in order to generate required audit trails. But the extent to which covered entities actually do this is unclear.

In a nod to concerns expressed by covered entities, the Proposed Rules would also streamline the Privacy Rule’s current accounting of disclosures provision. For example, the Proposed Rule excludes research disclosures from the accounting requirement in response to complaints that it is difficult for providers to track the large number of records accessed in many research projects.

From the Project HealthDesign perspective, it is important to know that today, very few patients take advantage of their right to know who has seen their health information. Indeed, covered entities often point to the small number of accounting requests to support their arguments that the accounting requirement is unduly burdensome. But as patient-generated information like observations of daily living (ODLs) become more integrated into clinical health records, patients may take greater notice of their right to know who sees their health information and for what purposes.

For a more detailed summary of the Proposed Rule, please read the summary I wrote with my colleague Susan Ingargiola.

Read more posts about legal and policy issues.

Incentives for Research Participants in Personal Health Information Technology Studies

Katherine Kim, M.P.H., MBA, iN Touch Principal Investigator, San Francisco State University
Holly Logan, iN Touch Project Coordinator, San Francisco State University

I was recently asked whether we were using incentives to motivate our participants to use iN Touch. In designing our incentive strategy we combined our team’s experience with youth and the advice of the Project HealthDesign National Advisory Committee. We wanted to promote participation in research but we didn’t want incentives to be an external motivator for health goal attainment. We also wanted to minimize participants’ disappointment if they were selected for the control group.

Our strategy is to provide iPod Touches to all intervention group participants, which they will keep upon completion of the project. Control group participants are randomly selected to receive either an iPod Touch or an iPod Shuffle, but are guaranteed to receive one of these items. In addition, we offer a $10 gift card from Target or iTunes for each focus group or interview. The 13- to 18-year-olds prefer iTunes and the 18- to 24-year-olds usually select Target. We do not provide any incentives for use of the application, collection of observations of daily living (ODLs) or visits with a health coach or clinician.

We wondered how other research projects were approaching the use of incentives so we did a little research. AHRQ recently published an excellent report on the impact of consumer health informatics applications.¹ That was a good starting point. We conducted a quick review of 12 randomized clinical trials that showed a positive relationship between the use of personal health information technology and either health outcomes or intermediate outcomes. This is what we found:

Three papers didn’t report on incentives, four reported giving no incentives, and five gave incentives. Here is a summary of the five papers that reported on incentives:

• An Internet self-help application for test anxiety for college students provided a $5-10 incentive for filling out pre and post surveys.²
• An Internet weight loss intervention for African-American adolescent girls provided a subsidy for the purchase of a computer and compensation for time for completing each of four assessments (adolescents received a gift valued at ~$10, parents received $30).³
• A computer-aided behavioral weight loss program for adult women offered a pedometer and $9 per appointment.⁴
• A computer-based health information support system for HIV/AIDS patients offered an incentive for each of three surveys (no amount stated).⁵
• A comparison of computer-tailored counseling and email counseling for overweight/obese adults offered $25 for first visit, $50 for second visit and discounts on meal replacement drinks.⁶

This mini-review showed that detailed incentive strategies were inconsistently described in clinical trials of personal health information technology. We’d love to know more about what others in the field are doing and what the impact of incentives are on behavior or adoption of technology.

References

1. Gibbons MC, W. R., Samal L, Lehmann CU, Dickersin K, Lehmann HP, Aboumatar H, Finkelstein J, Shelton E, Sharma R, Bass EB. (2009). Impact of Consumer Health Informatics Applications. Evidence Report/Technology Assessment No. 188. (Prepared by Johns Hopkins University Evidence-based Practice Center under contract No. HHSA 290-2007-10061-I). Rockville, MD: Agency for Healthcare Research and Quality.

2. Orbach G, Lindsay S, Grey S. A randomized placebo-controlled trial of a self-help Internet-based intervention for test anxiety. Behav Res Ther 2007; 45(3):483-96. 134. March S, Spence SH, Donovan CL. The Efficacy of an Internet-Based Cognitive-Behavioral Therapy Intervention for Child Anxiety Disorders. Journal of Pediatric Psychology 2008.

3. Williamson DA, Walden HM, White MA et al. Two-year internet-based randomized controlled trial for weight loss in African- American girls. Obesity (Silver Spring) 2006; 14(7):1231-43.

4. Adachi Y, Sato C, Yamatsu K, Ito S, Adachi K, Yamagami T. A randomized controlled trial on the long-term effects of a 1-month behavioral weight control program assisted by computer tailored advice. Behaviour Research and Therapy 2007; 45(3):459-70.

5. Gustafson DH, Hawkins R, Boberg E et al. Impact of a patient-centered, computerbased health information/support system. American Journal of Preventitive Medicine 1999; 16(1):1-9.

6. Tate DF, Jackvony EH, Wing RR. A randomized trial comparing human e-mail counseling, computer-automated tailored counseling, and no counseling in an Internet weight loss program. Archives of Internal Medicine 2006; 166(15):1620-5

Learn more about the iN Touch project.
Read more posts from the iN Touch team.

Planning for Evaluation: What to Take and What to Leave Behind

Lucia Rojas-Smith, M.P.H., Dr.P.H., BreathEasy Evaluation Lead, RTI International

Summer arrived in Maryland over the holiday weekend with searing temperatures in the 90s, high humidity and a plague of black biting flies. I don’t ever recall seeing spring leave in such a huff without so much as an “until we meet again.” My only mental escape was to begin planning for my annual retreat to Deer Isle, Maine. The escape was short-lived as I also needed to finalize the BreathEasy evaluation protocol and write this post about it before the weekend was over. It occurred to me, as I was pulling weeds in the sweltering heat, that planning for evaluation and planning for a trip are really very similar. In planning an evaluation or a trip, what you take and what you leave behind set the stage for the journey. If you’ve planned well, your chances of achieving your goal without undue stress are exponentially enhanced. If planning goes by the wayside, you may find yourself buying an overpriced pair of dress shoes (assuming you can even find a department store two hours before the wedding) or wearing running shoes with your suit and becoming the butt of family jokes for years to come.

As I pack for a trip, every single item in my suitcase is put in and taken out at least twice. Each item has to pass three criteria: 1) It must be essential; 2) It must complement at least two other outfits; 3) The amount of space it takes up must be commensurate to its utility. The criteria for selecting the final measures for the evaluation are essentially the same. All items that make the final cut must: 1) Be critical to the measuring of the process or outcome; 2) Complement other items to form a more cohesive understanding of the process or outcome; 3) Be worth the burden of collection.

Good evaluation, much like packing well, involves trade-offs, so identifying what is critical involves careful attention to a logic model and revisiting assumptions periodically. We began developing the evaluation many months ago. Over that time, we became quite attached to all the measures we selected, because each represented something important to each member of the evaluation team. It was hard giving them up! However, we now have a much clearer sense than we did at the beginning of the project of what the BreathEasy application will do and how it will be used. As we weighed the pros and cons of dropping each item, we had to ask: Do we really think BreathEasy will lead to this outcome or engage this process and, if so, why? Is it even the most important outcome or process? Without a logic model and a set of explicit selection criteria it would have been very difficult for us to make the cuts in a reasoned fashion. Even so, we may have more measures than we can collect, so the decisions become even more focused on the critical pathways to key outcomes.

Deciding what to bring and what to leave behind is largely determined by what you want to do once you reach your destination. The BreathEasy application, we hypothesize, will lead clinicians to make better – or at least more timely — treatment decisions, which will result in improved asthma-related health outcomes for their patients. The health outcome measures easily make the critical list, but as we envision how BreathEasy will be used by clinicians it becomes obvious that we have to understand how the application will impact communication and clinical workflow. If we reach the end of the journey and cannot explain why clinicians changed (or didn’t change) their treatment practices, the whole trip would be a bust.

However, capturing communication and workflow in a clinical setting or, as Co-Investigator Stephen Rothemich says, “following the bouncing ball” is a daunting task. We developed a laundry list of measures for our clinician baseline and follow-up surveys, but concluded that these items were impractical and highly imperfect methods of capturing a complex process that changes daily and from patient to patient.

So, short of following clinicians around the office with clipboards for six months, what is the alternative? The alternative is leveraging the analytics from the BreathEasy dashboard and developing a process to document communications among the nurses, doctors and patients in response to BreathEasy. The timestamp and unique user identification number allows us to readily track the frequency and duration of BreathEasy use by clinicians. More granular information is captured in a message abstraction form that nurses complete after they review the dashboard. The form is designed to track each communication to a physician or patient to its final disposition. We will be able to assess, for example, how many dashboard reviews resulted in prescription refills or calls to the patients, as well as the reasons for the calls. We’ve tried to keep the form simple, but we recognize that it may be burdensome to complete – especially if there are multiple points of communication and interaction involving the physician, nurse and patient that need to be documented.

We also recognize that the message abstraction form may overlook some key step or process. Another truism of trip planning applies here as well: some of the best moments on a trip are unplanned, and being open to the moment is as essential as a guidebook or GPS.  BreathEasy is moving into uncharted waters; we can’t possibly plan for or foresee every possible impact it will have on communication and workflow. Validating our hypotheses about these processes may be gratifying, but it’s the prospect of learning something new and unexpected that makes the trip memorable.

Learn more about BreathEasy.
Read more posts from the BreathEasy team.

Project HealthDesign Update on Pioneering Ideas Blog

Libby Dowdall, Communications Coordinator, Project HealthDesign National Program Office

Visit the Pioneering Ideas blog today for an update about Project HealthDesign, titled "Noodles of ODLs." Read an excerpt below then visit the original post to read the rest and watch video updates from Steve Downs, Patricia Flatley Brennan and Anind Dey.

"Patients participating in Project HealthDesign studies are using technology to track personally meaningful information about their daily feelings, thoughts, moods and behaviors — or observations of daily living (ODLs) — and sharing this information with providers. Currently, nearly all of our project teams are beginning the testing phase, recruiting patients and providers to participate in the studies. Part of their task is to figure out which ODLs are relevant to share; another job is to share them in ways that are meaningful to all involved."

The Process of Making Sense of ODL Data

Matthew Lee, Embedded Assessment Lead Researcher, Ph.D. Student in Human-Computer Interaction, Carnegie Mellon University 

One of the many reasons observations of daily living (ODLs) are interesting is because people don’t normally pay much attention to them as they live their everyday lives. If ODLs easily lent themselves to simple mental accounting, we would not need special sensors or mobile applications to log them. Thus, when we present ODL data back to the user, they often encounter an odd feeling that mixes familiarity (because, after all, the data show their own behaviors) and unfamiliarity (because they have never seen this particular behavior logged and presented this way). This showcasing of the mundane allows people to explore and attempt to make sense of this new kind of data. Is there a process by which people explore their own ODLs?

We had a chance to understand this process in our pilot study with two elders and four months of sensor data about their medication adherence. We gave them each a special pillbox to use that could keep track of when they picked it up and opened the pillbox doors. When we showed them their data, our participants went through a process that involved three basic steps: 1) looking for anomalies, 2) explaining these anomalies, and 3) confirming their explanations with the details in the data. When first presented with their data, our participants wanted to find the anomalous behavior — in this case, instances of days when they did not take their pills. The visualization we used actually made it rather difficult to find these days where no pill-taking event occurred, but nonetheless our users were persistent in finding the days with missing pills. After finding these anomalies, they wanted to find an explanation for why they might have missed their pills. They first tried to find a benign explanation such as being away on travel, but they also looked for explanations that might show their own forgetfulness and lack of structure in their routines. And finally, after coming up with possible explanations for why they might have missed their pills on one occasion, they were able to use the low-level details in the data to confirm their explanations.

We observed one instance with a study participant that illustrates the process involved in making sense of ODL data: As she reviewed the data, the participant noticed that she had missed her evening pills on a Friday evening two weeks prior. She thought back and explained that she visited her nephew that day and had probably taken her evening pills with her and took the pills at her nephew’s home. She then looked at the detailed view of the data for the pillbox for that day and noticed that she had the door open for 20 seconds in the morning — much longer than she thought was normal. She reasoned that she must have been taking her evening pills from that box and filling her travel pillbox in those 20 seconds.

This same sense-making process, which involves identifying anomalies, explaining them and confirming them with other or more detailed streams of data, can also apply to other times when people are exploring their ODLs for the first time. Granted, our example focuses on only one data stream, pillbox activity, but this process may very well be expanded and developed to account for multiple streams of data and different types of ODLs.

For more details on this process of making sense of ODL data, read our CHI 2011 paper.

Learn more about the Embedded Assessment project.
Read more posts from the Embedded Assessment team.

Creating an ODL Prescription [Video]

Libby Dowdall, Communications Coordinator, Project HealthDesign National Program Office

 

Deryk Van Brunt, Chronology.MD principal investigator, describes the social contract between a patient and a clinician that would comprise an ODL Prescription. This prescription, or joint agreement, would allow patients and clinicians to choose which observations of daily living (ODLs) the patient will track between clinical visits, as well as the frequency, duration and method of ODL capture.

Learn more about the Chronology.MD project.
Read the most recent post from the Chronology.MD team.

ODL Prescriptions and Patient Data Capture - Is Provider Liability an Issue?

Deryk Van Brunt, Dr.P.H., Chronology.MD Principal Investigator, University of California, Berkeley, Healthy Communities Foundation
Kathleen Morrison, M.P.H., Chronology.MD Project Manager, Healthy Communities Foundation

We live in a country where the American Trial Lawyer’s Association is one of the biggest contributors to political campaigns — to whichever party is in office. Although several attempts at federal legislative overhaul of our medical malpractice system have been introduced in the last 25 years, none has succeeded. The threat of medical malpractice lawsuits can influence the way providers practice medicine. One consequence is the practice of “defensive medicine,” which often results in more expensive care — including unnecessary tests and procedures, as well as recommended protocols. Although attempts have been made to reduce the fear and threat of malpractice liability in the medical profession (e.g., clinical guidelines, best practices, etc.), the reality is that this threat remains quite salient for many providers.

It should come as no surprise, therefore, that liability was a significant concern in the early phases of the design of our technology. On Pioneering Ideas, Steve Downs recently mentioned the Crohnology.MD ODL Prescription (read his post). The concept of the ODL Prescription, put forward here by Dan Bernstein, Nikolai Kirienko, Deryk Van Brunt and Kathleen Morrison, was developed out of a collaboration between iMedic8 and the Healthy Communities Foundation and has been embraced by the Crohnology.MD team.

The ODL Prescription is an agreement between patients and providers that details which biometrics and observations of daily living (ODLs) will be captured between visits. An ODL Prescription is the outcome of a patient/provider negotiation and represents a balance between collecting what’s important to both parties while also considering what’s most relevant in managing the patient's health. The ODL Prescription identifies which ODLs the patient will track and designates how often and when they will be collected. This patient ODL data will be captured and viewable by the patient, and it will then be shared with the provider during the next clinical appointment.

Some members of our team were concerned about the liability risk to our participating providers. For example, is it possible that once a patient logs ODL data, then the provider could be liable if a negative outcome were to result? And what if clues in the patient’s ODL data had pointed toward the negative result?

Our clinical partner, Dr. Jonathan Terdiman, quickly put the liability fears to rest. From his perspective, the ODL information that would be shared at the time of the clinical visit does not represent new information beyond what was previously being discussed; the information is just being captured and shared more thoroughly and reliably. Because the ODL data will only be shared with the clinician at the time of the clinical visit, this data is, in effect, no different from any other information a patient discusses with his or her provider at the time of the clinical appointment. The key element is that initially the system will not even allow the physician to retrieve and see the data between visits. This data workflow will be reinforced once we make our clinicians and patients aware of this protocol. Because there is an understanding that the data will not be shared between appointments, nor reviewed by the clinicians outside of the appointments, we see the ODL data as a visually enhanced — and perhaps more comprehensive — patient narrative.

This approach does, however, raise questions for future versions of our system — and other systems — as we consider sharing the ODL data in real time. Certainly, if a patient’s ODLs indicate that a situation is urgent and requires immediate clinical attention, then that data could be used to inform the clinician of the situation and to instruct the patient to seek treatment immediately. In such a case, would the clinical team be held responsible and liable if they do not act upon this data? The answer will likely relate to the expectations established and agreements made between the patient and his or her care team.

In the meantime, the ODL Prescription will allow our Chronology.MD patients to collect data that may be both clinically and personally significant, allowing us to evaluate whether the information positively impacts the efficiency and value of the patient narrative.

Learn more about the Chronology.MD project.
Read more posts from the Chronology.MD team.