New HIPAA Rules Clarify Patients' Right to Access Their Health Data

Deven McGraw, Project HealthDesign Regulatory and Assurance Advisory Group, Center for Democracy & Technology

Last month, the Administration released long-awaited final regulations to implement most of the improvements to federal health privacy protections enacted by Congress in the HITECH provisions of the 2009 economic stimulus legislation. As described earlier this month in iHealthBeat, the regulations include strengthened prohibitions against use of patient data without consent for marketing communications; extension of federal privacy and security protections to contractors (and subcontractors) of doctors, hospitals and insurers; improved right of individuals to be notified of breaches of their health data; and clarity regarding an individual’s right to receive digital copies of her health information.  This blog post will focus specifically on the rights of patients under HIPAA to access their data.

The HIPAA Privacy Rule has always provided individuals with the right to access and obtain copies of health information maintained in provider or health plan records.  Under the existing regulations, when a patient makes such a request, the provider or plan has up to 30 days to provide the requested access or copy; however, the provider or plan can take up to an additional 60 days if the information requested is stored off-site.  Patients can also be charged a reasonable, cost-based fee for copies of their information, covering the costs of both the labor and supplies.  State law frequently sets maximum rates to be to be paid by patients for copies of their medical records.  Although this right of access has been part of the Privacy Rule since it was first implemented, many patients have faced obstacles in trying to obtain timely copies of their health information.

The Privacy Rule covers identifiable health information in both paper and digital form, so this right of patient access has always applied to information kept in electronic as well as paper medical records.  However, in HITECH, Congress made it clear that when a patient’s information is stored electronically, patients have the right to obtain an electronic copy and to have that copy sent at their request to another person or entity, like a doctor, a caregiver, or a personal health record or mobile health app. 

The new regulations released last month implement this mandate and also clarify how this right to digital data can be exercised.  Patients have the right to an electronic copy “in the form or format they request” – but only if the provider or plan is capable of producing the copy in the requested format.  If the data isn’t “readily producible” in the format requested by the patient, the provider or plan and the patient are expected to come to an agreement on an acceptable, machine-readable digital format.  In other words, patients cannot demand that their providers run out and purchase new technology in order to produce data in a specific, desired format; however, providers must have the capability of providing patients with some type of machine readable, electronic copy of their data.  HHS suggests that MS Word, Excel, text, HTML or PDF are among the possible options.  The patient can also choose to obtain a paper copy if none of the provider’s digital formats meets the patient’s needs. 

The new rules still allow providers and plans to ask patients to submit written requests for copies of their health information, although this is not required by the Privacy Rule.  However, if the patient wants to have the electronic copy transmitted directly to a third party, the new rules require that this request be in writing, be signed by the patient, and clearly identify designated recipient and where the information is to be sent.  (The writing and signature can be digital.)  Per existing requirements of the HIPAA Privacy and Security rules, providers or plans sending identifiable health information per a patient’s request must take steps to verify the identity of the patient, send the right records, and implement safeguards to protect the information in transit.

Of note, although the Security Rule requires providers and plans to implement safeguards for transmitting identifiable health information, patients also have the right to get their copies through unencrypted e-mail if they so choose – a point that was clarified in the material accompanying the new regulations.  Providers and plans are first required to advise patients of the risk of receiving information through unsecure channels; but if the patient opts for the unsecure method, she has the right to receive her information in this way.  (This advice on the risks of unsecure e-mail does not have to be extensive; it is enough to notify the patient there is “some level of risk that the information in the e-mail could be read by a third party.” ) Some patients prefer the convenience of having their data sent directly to them at their regular e-mail address; others will welcome the option of having a secure method.  HHS makes clear in the new regulations that the patient has the right to choose.

Patients can still be charged for digital copies of their data – but only for the labor costs associated with preparing the copy (not including fees for “retrieval”).  If the patient chooses to purchase supplies (like a flash drive) from the provider or plan, there may be a reasonable charge imposed for those. 

Although the new regulations make important clarifications to HIPAA’s patient access right, providers and plans can still take a fairly long time to respond to patient requests for data:  up to 30 days, and an additional 30 days for information stored off-site.  HHS encourages faster response times but noted a need to set the outer boundaries at a level that would enable entities to comply regardless of the nature of the patient’s request or the location of the data.   As noted in a previous blog post, the requirements for Stage 2 will provide some patients with more timely, on-line access to relevant digital health information. However, these requirements apply only to entities participating in the Meaningful Use program, and those entities are only required to make this access available to a portion of their patients.  The HIPAA access rules provide the baseline for all providers using digital records and for some patients will constitute the only available pathway for obtaining copies of their data. 

The final rules are effective March 26, 2013; entities covered by the rule have another 180 days to come into compliance with most provisions.  Until the effective date, the existing HIPAA rules on patient access remain in place. 

Read more posts about legal and policy issues

 

Joint ONC Committee Hearing Focuses on HealthIT and Patient Engagement

Sara Koliner, Policy Analysis Project Assistant, Project HealthDesign National Program Office

On Tuesday, January 29th, the HIT Policy Committee and HIT Standards Committee hosted a joint hearing on health information exchange (HIE). The hearing, divided into four panels, assessed the current state of HIE through the testimony of a number of distinguished speakers and fostered discussion about what next steps the Office of the National Coordinator for Health IT (ONC) should take to address business, technical, and regulatory barriers.

Of considerable interest was the final panel, Consumer-Mediated Exchange, moderated by physician Paul Tang, who served as chair of Project HealthDesign’s National Advisory Committee. The panel featured testimony by Jeff Donnell, MaryAnne Sterling, Neal Patterson, and Alan Blaustein.

Jeff Donnell began with a salute to how far patient engagement has come in the past six years:

Meaningful Use Stage One placed patient engagement squarely on the map, and Stage 2 requirements -- including view/download/transmit and the modest five percent patient participation threshold -- have moved patient engagement from a check box item to a health IT strategy imperative.

The panelists touched on some issues that have been discussed among Project HealthDesign grantee teams. First, for patient generated data to be useful, it requires clinical buy-in: Consumers don’t just need easy access to their information, providers need to consume it. Jeff Donnell offered a memorable quote:

From a technical point of view, it’s not difficult. There’s policy and standards work, but much of it is education. We encounter providers that are so fearful of patient-generated data — but then we talk to them about, “how do you handle patient-generated data now? I mean you’re having a patient fill out a paper form in a waiting room, and then you’re having someone rekey it in, are you saying that that data collected in probably the worst possible environment is better than a patient bringing it in from multiple sources and making it accessible? . . . A lot of it is fear of the unknown. I believe that that is where the ONC can help.

The speakers addressed concerns over the interaction between the Health Insurance Portability and Accountability Act (HIPAA) and data transmitted outside of the EHR system. In varying contexts, participants called for the creation of mechanisms to allow for the flow of information among consumers, caregivers and healthcare providers.

One salient point that came up frequently was the notion that consumers are the keys to solving the barriers to interoperability. Aside from technical concerns, current business often models impede the movement of data because data liquidity might appear to harm profitability. However, if individuals are given control of their own information, a new business model might arise – One in which consumers are part of the health care system rather than just being served by the system.

As Alan Blaustein pointed out, it is important that the consumer be engaged. When asked what opportunities and challenges existed to enable consumer-mediated exchange in the next two years, he responded:

The greatest challenge of the consumer-mediated exchange in the next two years is a clear communications strategy that explains the value to the healthcare consumer.   The consumer-mediated exchange must be communicated as a first step to the overall engagement of the healthcare consumer in their healthcare experiences.  Otherwise these efforts will be simply seen as an additional burden on the healthcare consumer, particularly if the healthcare consumer now thinks that she is primarily responsible for moving a particular file from Point A to Point B with nothing more at stake.

Furthermore, the culture of our healthcare system will need to begin changing and the healthcare consumer must be invited into the conversation.  Countless times we get calls at CarePlanners from clients whom the system has largely ignored, where their facts and opinions were not considered.  That requires far more change and self-evaluation than can possibly be rectified in the coming two years.

This isn’t to say that consumer-mediated exchange is a replacement for HIE. Rather, it should serve to complement and accelerate the entire HIE expansion, creating a combined synergy that’s essential to improving healthcare nationwide. Read testimony transcripts and listen to the entire hearing here: http://www.healthit.gov/policy-researchers-implementers/hitpc-hitsc-health-information-exchange-public-hearing