Musings on the Value of Project HealthDesign from Regulatory and Assurance Counsel

by Deven McGraw

With this, my last Project HealthDesign blog post, I wanted to share, on behalf of myself and my colleagues at Manatt, some final thoughts about our experience as Project HealthDesign’s Regulatory and Assurance Counsel, providing assistance to each of the five research teams and helping bring the experience of Project HealthDesign into current and important policy conversations about how to achieve a more patient-centered, digital health care system.  

We began our involvement with Project HealthDesign with a keen appreciation of the fact that the health care system today does not appropriately recognize the critical role that a patient’s personal experience and day-to-day activities play in achieving optimum health and wellness. Over the past three years, it has been an honor to help the Project HealthDesign research teams and National Program Office communicate to the broader policy community the important  lessons learned from their experience.  Patients are experts at their personal experience; clinicians are experts at clinical care.  To achieve better health outcomes, both patients and clinicians will need information from both domains—and technology can play a key role in bridging this information gap.

Project HealthDesign took this message straight to the heart of the policy debate over how to improve our nation’s health care system, including testifying before federal policymaking bodies charged with charting the future of health IT and patient engagement.  As a result of Project HealthDesign’s efforts, the Federal Health IT Policy Committee’s meaningful use workgroup included in its preliminary recommendations for Stage 3 meaningful use of electronic health record (EHR) criteria a requirement that patients be provided with the ability to report patient-generated data to providers and hospitals. Observations of daily living (ODLs) were specifically mentioned on the list of acceptable types of patient-generated data.  The experience of the Project HealthDesign research teams helped bring the discussion of meaningful patient engagement using technology out of the theoretical and into the practical -- and the possible.  

In addition to influencing national health care policy, Project HealthDesign also generated best practices to help health care providers in the field begin incorporating ODLs into clinical care.  It is not hard to envision an environment in which health care providers routinely encourage patients to use mobile devices to collect and share clinically relevant information such as ODLs. As reimbursement models for health care providers move toward paying for outcomes and episodes of care, shared savings incentives, and capitation, there will be greater incentives for providers to more actively engage patients in daily self-management and care coordination.  Project HealthDesign research teams provide roadmaps for how this can be done. 

One area where Project HealthDesign generated and disseminated best practices was in health information security.  Patients’ use of mobile devices to generate and communicate health information triggers unique security risks, and the tools frequently used by patients are not typically equipped with high-end security tools.  When health care providers handle electronic, identifiable health information, they are subject to the HIPAA Security Rule. But HIPAA regulates providers, not patients. In an article published in the Journal of Healthcare Information Management, we sought to allay health care providers’ privacy and security concerns by developing best practice recommendations for providers to help their patients safeguard the health information they create and share through mobile devices. 

Another area where we seek to provide best practice recommendations is with respect to provider concerns about potential liability for failing to pay sufficient attention to patient-generated electronic health information.  In a forthcoming paper, we highlight Project HealthDesign’s experience that that setting clear expectations with patients about the sharing of patient-generated data – and honoring those expectations - helped alleviate liability concerns. 

By exploring practical ways to digitally capture and integrate patient-recorded observations of daily living into clinical care and testing this with real patients and real providers, Project HealthDesign’s interdisciplinary research teams have contributed groundbreaking work that will help the policy and clinical practice communities shape important improvements to the health care system.

While our involvement with Project HealthDesign may be coming to a close, we are proud to have been associated with Project HealthDesign’s important message: that a paradigm shift to a more patient-centered health care system requires that patient generated data be captured, interpreted, and incorporated into clinical care – and that we must begin now to lay the necessary groundwork for that change.

 

ONC Seeking Public Input on Consumer eHealth Strategy

Robert D. Belfort, Manatt, Phelps & Phillips, LLP, Proje­ct HealthDesign Regulatory and Assurance Advisory Group

            The Office of the National Coordinator for Health Information Technology (“ONC”) is currently seeking public input to update the Federal Health IT Strategic Plan (the “Strategic Plan”). The Strategic Plan outlines goals and strategies for the nationwide shift to electronic health records (“EHRs”) and electronic health information exchange, and for creation and spread of new health information technologies.  ONC has partnered with researchers at Cornell University to provide Planning Room, a website that makes it easy for the public to offer their thoughts, experiences, and suggestions on the Strategic Plan (or anything else on which ONC seeks feedback).

            From now through May 9, 2013, the topic for discussion is one that all of us at Project HealthDesign care about: Consumer eHealth.  In the Planning Room, ONC has set forth several discrete topics for feedback from the public, including identifying useful health information, decreasing health disparities through health IT and patient-generated health data.  ONC will use the feedback it receives from the public to update the consumer eHealth section of the Strategic Plan.

            For those of you who are wondering what ONC has done on the topic of consumer eHealth to date, there is an article in the February edition of Health Affairs that provides a summary.  ONC staff authored the article, which is entitled “A National Action Plan to Support Consumer Engagement via eHealth.”  The article lays out ONC’s “Three A’s” strategy to increase consumer engagement in eHealth.  The three prongs of the strategy are to:

• increase patients’ access to their health information (“Increase Access”);
• enable consumers to take action with that information (“Enable Action); and
• shift attitudes so that patients and providers think and act as partners in managing health and health care using health IT (“Shift Attitudes”).

            Of the three prongs, ONC has the greatest direct influence on consumers’ access to their health data, which it supports through the Medicare and Medicaid EHR Incentive Programs and the Blue Button Pledge Program.  Initiatives in the second prong support the development of an ecosystem of tools and services that help consumers’ take action using their health information.  The final prong of the Three A’s strategy supports the evolution of consumers’ and providers’ expectations about roles relative to each other, leading toward a less hierarchical, more collaborative partnership, enabled by eHealth.  For example, patients need to feel comfortable requesting electronic access to their health records, asking providers questions, sharing their own health knowledge, and weighing in on treatment options.  According to ONC, a cultural shift among patients and providers is necessary to support these kinds of behaviors.

            Now that you have a sense of ONC’s consumer eHealth goals and strategy, we encourage you to go to the Planning Room and share with ONC anything that you learned from Project HealthDesign that you think may help them.  It is extremely easy to provide feedback.  You don’t have to submit formal comments; just post a comment in the thread on www.planningroom.org.  It will show up immediately and a forum moderator will likely respond with a thought provoking follow-up question or – at the very least – a sincere “thank you” for helping ONC develop a Strategic Plan that promotes advances in consumer eHealth.

Read more posts about legal and policy issues

 

HHS Issues Request for Information; Asks for Strategies to Increase Patient Engagement

 Robert D. Belfort,  Manatt, Phelps & Phillips, LLP, Proje­ct HealthDesign Regulatory and Assurance Advisory Group

On March 6, 2013, the U.S. Department of Health and Human Services (HHS) issued a news release announcing its 2013 agenda to bring down costs and improve quality of care through implementation of health information technology.  Specifically, the new release introduced HHS’s latest plan to “accelerate health information exchange (HIE) and build a seamless and secure flow of information essential to transforming the health care system.”  In the release, HHS indicated it will, among other things:

• Set aggressive goals for 2013: HHS is setting the goal of having 50 percent of physician offices using electronic health records (EHRs) and 80 percent of eligible hospitals receiving meaningful use incentive payments by the end of 2013.
• Increase the emphasis on interoperability: HHS will increase its emphasis on ensuring electronic exchange across providers.  It has started that effort by issuing a request for information (RFI) seeking public input about a variety of policies that will strengthen the business case for electronic exchange across providers to ensure patients’ health information will follow them seamlessly and securely wherever they access care.
• Enhance the effective use of electronic health records through initiatives like the Blue Button initiative.  Medicare beneficiaries can access their full Medicare records online today. HHS is working with the Veterans Administration and more than 450 different organizations to make health care information available to patients and health plan members.  HHS is also encouraging Medicare Advantage plans to expand the use of Blue Button to provide beneficiaries with one-click secure access to their health information.
• Implement Meaningful Use Stage 2:  HHS is implementing rules that define what data must be able to be exchanged between Health IT systems, including how data will be structured and coded so that providers will have one uniform way to format and securely send data.

      In its Request For Information (RFI), HHS requested feedback from the public on various ways to accelerate electronic HIE.  One of the RFI’s focus areas is consumer and patient engagement.  According to the RFI, “CMS wants to encourage beneficiary engagement in their care through improved beneficiary access to their personal health information and better electronic communication between beneficiaries and their health care team. There are several ways CMS could encourage beneficiary access to their information through the use of new measures or patient-reported care experiences, new technology tools, and new financial models.”  The specific options that CMS holds out as examples in the RFI are:

1. Incorporating new measures into Medicare Advantage Program consumer assessment surveys (CAHPS);
2. Blue Button availability to all CMS beneficiaries;
3. Payment and service delivery model testing under the Affordable Care Act, such as demonstration of incentives for consumers to more actively participate in their health; and
4. Direct access to lab results from laboratories.

CMS posed the following specific question in the RFI:  “What CMS and ONC policies and programs would most impact patient access and use of their electronic health information in the management of their care and health? How should CMS and ONC develop, refine and/or implement policies and program to maximize beneficiary access to their health information and engagement in their care?”

What are the lessons we have learned from Project HealthDesign that should be brought to bear on this question?  Post them below or submit comments directly to ONC.  The RFI can be accessed here  http://www.ofr.gov/OFRUpload/OFRData/2013-05266_PI.pdf

Read more posts about legal and policy issues

New HIPAA Rules Clarify Patients' Right to Access Their Health Data

Deven McGraw, Project HealthDesign Regulatory and Assurance Advisory Group, Center for Democracy & Technology

Last month, the Administration released long-awaited final regulations to implement most of the improvements to federal health privacy protections enacted by Congress in the HITECH provisions of the 2009 economic stimulus legislation. As described earlier this month in iHealthBeat, the regulations include strengthened prohibitions against use of patient data without consent for marketing communications; extension of federal privacy and security protections to contractors (and subcontractors) of doctors, hospitals and insurers; improved right of individuals to be notified of breaches of their health data; and clarity regarding an individual’s right to receive digital copies of her health information.  This blog post will focus specifically on the rights of patients under HIPAA to access their data.

The HIPAA Privacy Rule has always provided individuals with the right to access and obtain copies of health information maintained in provider or health plan records.  Under the existing regulations, when a patient makes such a request, the provider or plan has up to 30 days to provide the requested access or copy; however, the provider or plan can take up to an additional 60 days if the information requested is stored off-site.  Patients can also be charged a reasonable, cost-based fee for copies of their information, covering the costs of both the labor and supplies.  State law frequently sets maximum rates to be to be paid by patients for copies of their medical records.  Although this right of access has been part of the Privacy Rule since it was first implemented, many patients have faced obstacles in trying to obtain timely copies of their health information.

The Privacy Rule covers identifiable health information in both paper and digital form, so this right of patient access has always applied to information kept in electronic as well as paper medical records.  However, in HITECH, Congress made it clear that when a patient’s information is stored electronically, patients have the right to obtain an electronic copy and to have that copy sent at their request to another person or entity, like a doctor, a caregiver, or a personal health record or mobile health app. 

The new regulations released last month implement this mandate and also clarify how this right to digital data can be exercised.  Patients have the right to an electronic copy “in the form or format they request” – but only if the provider or plan is capable of producing the copy in the requested format.  If the data isn’t “readily producible” in the format requested by the patient, the provider or plan and the patient are expected to come to an agreement on an acceptable, machine-readable digital format.  In other words, patients cannot demand that their providers run out and purchase new technology in order to produce data in a specific, desired format; however, providers must have the capability of providing patients with some type of machine readable, electronic copy of their data.  HHS suggests that MS Word, Excel, text, HTML or PDF are among the possible options.  The patient can also choose to obtain a paper copy if none of the provider’s digital formats meets the patient’s needs. 

The new rules still allow providers and plans to ask patients to submit written requests for copies of their health information, although this is not required by the Privacy Rule.  However, if the patient wants to have the electronic copy transmitted directly to a third party, the new rules require that this request be in writing, be signed by the patient, and clearly identify designated recipient and where the information is to be sent.  (The writing and signature can be digital.)  Per existing requirements of the HIPAA Privacy and Security rules, providers or plans sending identifiable health information per a patient’s request must take steps to verify the identity of the patient, send the right records, and implement safeguards to protect the information in transit.

Of note, although the Security Rule requires providers and plans to implement safeguards for transmitting identifiable health information, patients also have the right to get their copies through unencrypted e-mail if they so choose – a point that was clarified in the material accompanying the new regulations.  Providers and plans are first required to advise patients of the risk of receiving information through unsecure channels; but if the patient opts for the unsecure method, she has the right to receive her information in this way.  (This advice on the risks of unsecure e-mail does not have to be extensive; it is enough to notify the patient there is “some level of risk that the information in the e-mail could be read by a third party.” ) Some patients prefer the convenience of having their data sent directly to them at their regular e-mail address; others will welcome the option of having a secure method.  HHS makes clear in the new regulations that the patient has the right to choose.

Patients can still be charged for digital copies of their data – but only for the labor costs associated with preparing the copy (not including fees for “retrieval”).  If the patient chooses to purchase supplies (like a flash drive) from the provider or plan, there may be a reasonable charge imposed for those. 

Although the new regulations make important clarifications to HIPAA’s patient access right, providers and plans can still take a fairly long time to respond to patient requests for data:  up to 30 days, and an additional 30 days for information stored off-site.  HHS encourages faster response times but noted a need to set the outer boundaries at a level that would enable entities to comply regardless of the nature of the patient’s request or the location of the data.   As noted in a previous blog post, the requirements for Stage 2 will provide some patients with more timely, on-line access to relevant digital health information. However, these requirements apply only to entities participating in the Meaningful Use program, and those entities are only required to make this access available to a portion of their patients.  The HIPAA access rules provide the baseline for all providers using digital records and for some patients will constitute the only available pathway for obtaining copies of their data. 

The final rules are effective March 26, 2013; entities covered by the rule have another 180 days to come into compliance with most provisions.  Until the effective date, the existing HIPAA rules on patient access remain in place. 

Read more posts about legal and policy issues

 

HIPAA New Omnibus Rule Impacts Patient Data Privacy, Security

Sara Koliner, Policy Analysis Project Assistant, Project HealthDesign National Program Office

Last week, Bloomberg BNA’s Health IT Law & Industry report provided an insightful overview of the new Omnibus Rule issued by the Department of Health and Human Services to modify HIPAA. This final rule, created in response to the Health Information for Economic and Clinical Health (HITECH) Act, finalizes proposed rule changes regarding privacy, security, and breach notification requirements. While we encourage you to read the entire report, we would like to specifically highlight the rule’s modifications to individuals’ electronic access to their medical records.

As Project HealthDesign legal and policy consultant Robert Belfort et al. explain in their summary for Bloomberg BNA, this particular rule builds on the “right to an electronic copy on any PHI [Protected Health Information] maintained in an EHR” outlined in the HITECH Act. The limitation of the prior requirement to Electronic Health Records left a wide range of protected, electronically-maintained health information unaccounted for, creating a potential for disparate access requirements between EHRs and otherwise. The Omnibus Rule extends the right to an electronic copy to “all protected health information maintained in one or more designated record sets electronically, regardless of whether the designated record set is an EHR.” Should a copy of this information not be readily producible, it should be provided in a standard digital form (such as a .txt, .pdf, or .doc file).

Allowable fees are also identified. Covered entities will be able to charge a “reasonable, cost-based fee” for costs involved with the providing the service, such as supplies (such as a CD), labor, and postage, if necessary.  To clarify, “labor” would not include the cost of retrieval, and costs associated with the digital infrastructure or system maintenance would not be permissible.

Perhaps the most beneficial modification to consumers is the removal of the 60 day window within which requested health information maintained off-site must be delivered. Now, covered entities must respond to all requests within 30 days (maintaining the possibility of a one-time 30 day extension if necessary). Especially when technology has advanced to the point of near-instantaneous information delivery, this amendment incentivizes healthcare providers to meet the demands of the modern consumer. Furthermore, increasing the timeliness of health data delivery will significantly improve patient engagement, paving the way for information to flow more readily in both directions.

Aside from some exemptions, the Omnibus Rule requires compliance by September 23, 2013. Increasing the convenience and ease of access to protected health information is an important step in encouraging use among patients. We are happy to see HHS making strides in this direction.

 

Read more posts about legal and policy issues

ONC Releases Draft Health IT Action and Surveillance Plan

Robert D. Belfort,  Manatt, Phelps & Phillips, LLP, Proje­ct HealthDesign Regulatory and Assurance Advisory Group

Just before the holidays, on December 21, 2012, the Office of the National Coordinator for Health IT (ONC) released its draft “Health IT Patient Safety Action and Surveillance Plan.”  ONC released the Plan in response to a November 2011 Institute of Medicine (IOM) report called, “Health IT and Patient Safety, Building Safer Systems for Better Care.” I wrote a blog about the IOM’s report, which you can read here.

IOM released its November 2011 report in response to a request by ONC for recommendations about what a comprehensive health IT safety policy should look like.  Among other recommendations, IOM suggested that the federal government create a new independent watchdog agency, along the lines of the National Transportation Safety Board, to accept reports on patient deaths, serious injuries or potentially unsafe conditions associated with health IT. 

ONC stopped short of taking the IOM’s recommendation.  Instead, in its draft Plan, ONC proposed to leverage existing federal agencies’ authorities and private sector safety programs to increase knowledge about health IT safety among health care professionals and improve how health IT makes care safer.  The draft Plan prescribes a list of actions that are organized under three strategies:  (i) Learn: increase the quantity and quality of data and knowledge about health IT safety; (ii) Improve: target resources and corrective actions to improve health IT safety and patient safety; (iii) Lead: promote a culture of safety related to health IT.

Below are some highlights from the draft Plan:

• ONC will work with developers on a code of conduct that commits developers to (i) work with Patient Safety Organizations or similar entities to report, aggregate, and analyze health IT-related safety events; (ii) support providers in reporting safety events; and (iii) collaborate with private sector efforts to make comparative user experience with different EHR systems more available.
• ONC will leverage ONC-ACB surveillance and live testing to ensure EHR safety features are functional in live environments and that developers address safety complaints.  ONC will continue to incorporate safety into its standards and certification criteria.
• ONC will monitor health IT adverse event reports to the FDA’s Manufacturer and User Facility Device Experience (MAUDE) database.
• The Agency for Healthcare Research and Quality (AHRQ) and ONC will work with providers and PSOs to incorporate AHRQ Common Formats into providers’ health IT and reporting systems. AHRQ Common Formats allow for easy, real-time reporting and aggregation of patient safety events and risks.
• AHRQ, in collaboration with ONC, will work with PSOs, providers, and developers to add a focus of health IT to their collection, aggregation, analysis, and mitigation of providers’ adverse event reports. AHRQ will also provide guidance to PSOs on how they can work with providers to use health IT to improve reporting and mitigate health IT risks.
• The Centers for Medicare & Medicaid Services will align its safety standards for health care facilities, its interpretive guidance, and surveyor trainings to add a focus on health IT and patient safety.

Reactions to ONC’s proposed Plan are only beginning to trickle in.  Some stakeholders are suggesting it doesn’t go far enough while others are calling the proposal a necessary step in the right direction.  We thought it was interesting that, while the IOM’s report included an entire chapter devoted to the safety of health IT tools “designed to engage and support patients in health-related decision making and management of their own personal health information” (see chapter 5 “Patients and Families Use of Health IT: Concerns about Safety”), ONC’s proposed Plan includes no such references.  The IOM report specifically noted patients’ ability to use personal health records (PHRs) and other tools to record and share “activities of daily living.” It did not offer up a silver bullet for avoiding patient safety risks created by PHRs and other patient engagement tools but it noted that one important way to ensure patient safety is for health care providers to manage patient expectations about how information they include in a PHR or other patient engagement tool will be used. According to IOM, health professionals, patients and their families need to develop “a shared understanding of appropriate use of patient-centered, validated data.”

Do you think that ONC’s proposed Plan should include more of a focus on the unique patient safety challenges associated with PHRs and other health IT tools that enable patients to generate and share health information?  You have until February 4th to provide public comments, which can be submitted to [email protected].

You can read the draft Patient Safety Plan here:  http://www.healthit.gov/sites/default/files/safetyplanhhspubliccomment.pdf

 

Read more posts about legal and policy issues

Hurricanes and Health IT

Robert Belfort, Manatt, Phelps & Phillips, LLP, Proje­ct HealthDesign Regulatory and Assurance Advisory Group

As you are probably aware, we’ve been having some severe weather events back here on the East Coast.  First Hurricane Sandy, then a Nor’easter (named Athena), which dumped snow on top of an already soggy eastern seaboard.  While the 24-hour news was replete with stories about Hurricane Sandy’s devastation, including downed subway lines, flooding and widespread power outages, some of the most disturbing stories were of New York City hospitals forced to evacuate patients in the middle of the storm.

Storied Bellevue Hospital, probably the most widely known hospital in New York City’s public hospital system, had to evacuate hundreds of patients to other hospitals after sustaining damage to its backup generators.  Bellevue is located at 1st Avenue and 27th Street in what was, at the time, flood-stricken lower Manhattan.  News reports showed hospital staff taking patients down scores of flights in dark stairwells in a perilous effort to move the patients to safety.  New York University Langone Medical Center undertook  a similar, dangerous exercise when a transformer cut power to the facility and its backup generators failed due to flooding. 

A key point that commentators have been making with regard to the value of health IT is that a natural disaster or other crisis in one part of the country does not have to place a healthcare facility’s data in jeopardy.  NYC’s Health and Hospital Corporation (“HHC”), operator of Bellevue Hospital, among others, proved the point during the storm.  HHC’s hospitals use electronic health records (“EHRs”) and HHC runs two redundant data centers, at Jacobi Medical Center in the north Bronx and in Carlstadt, NJ.  At one point, the Carlstadt site had four feet of water in the parking lot, so HHC relied completely (and successfully) on the Jacobi data center.   NYU Langone Medical Center’s EHRs were also backed up at a remote location and were not lost in the storm.  This is a contrast to Hurricane Katrina, in which so many patients’ medical records were still on paper and were lost during the storm.  These contrasting experiences suggest that fully redundant data centers should be established in geographically dispersed locations so that if one data center is affected by a storm or crisis, operations can be immediately transferred to the other data center with little to no interruption or loss of data access.

Another key lesson learned from Sandy is that emergency patient transfer problems can be minimized if hospitals participate in electronic health information exchange (“HIE”).  Many of the patients that had to be evacuated to other institutions in NYC were critical care patients for whom the evacuating hospitals likely had detailed EHRs chronicling their ailments and treatment regimens.  In the harried evacuation process, it is unlikely these records traveled with the patients.  Had all of the hospitals been participants in an active HIE network or otherwise been linked up to exchange information electronically with one another, clinicians in the receiving hospitals could have easily accessed the health records for the displaced patients. Furthermore, facilities that still had power but lost access to EHR data for one reason or another could potentially have retrieved electronic records on their own patients via an HIE during the storm.

The Executive Director of the New York eHealth Collaborative, the non-profit organization charged with building New York’s statewide health information network, summed up the situation well. He said that, looking back seven years, Hurricane Katrina became the storm that demonstrated the need for digital health records because so many paper-based medical records were lost. When the flood waters inundated hospitals, their patients’ medical histories pretty much vanished. Now, Hurricane Sandy could be the storm that underscores the importance of having a health information exchange and a tested emergency plan.

What were your thoughts watching the news reports during Hurricane Sandy? How could health IT and HIE have helped ease or prevent some of the health care-related hardship caused by the storm?

Suspension of EHR Incentives – Election Year Politics or Potential Reality?

Deven McGraw, Project HealthDesign Regulatory and Assurance Advisory Group, Center for Democracy & Technology

Usually in the weeks before a presidential election, Congress is officially in recess; many elected officials are in their home districts or states campaigning for re-election (and also weighing in on the presidential race); and typically there are few congressional developments worth noting.

But this year has been a bit of an exception – at least for those of us who follow health reform and health information technology issues.  This week, a group of Republican members of Congress and Republican senators sent letters to HHS Secretary Kathleen Sebelius raising serious concerns about the Meaningful Use electronic medical record incentive program.

The letter from key House Republicans – Rep. Dave Camp (R-MI), Chairman of the House Ways & Means Committee, and Rep. Wally Herger (R-CA), Chairman of that Committee’s Subcommittee on Health; and Rep. Fred Upton (R-MI), Chairman of the House Energy & Commerce Committee, and Rep. Joe Pitts, Chairman of that Committee’s Subcommittee on Health (R-PA) – raises “serious concerns” that the Stage 2 final rules for Meaningful Use are too weak. Specifically, the letter points out that the requirements for exchange of clinical health information among health care professionals, such as to support transitions in care, are very low. 

The letter from key Senate Republicans – Sens. John Thune (R-SD) and Tom Coburn (R-OK) of the Senate Finance Committee, and Sens. Richard Burr (R-NC) and Pat Roberts (R-KS) of the Senate Health, Education, Labor and Pensions Committee – stresses concerns about EHR use causing increased utilization of, and billing for, health care services. The letter from House Republicans also notes this concern.  Both letters also raise concerns about the lack of interoperability among EHRs. 

The letter from Senate Republicans requests an extended briefing with administration officials to hear their responses to the concerns in the letter.  In contrast, the letter from House Republicans urges Secretary Sebelius to “immediately suspend the distribution of [EMR] incentive payments until your agency promulgates universal interoperable standards;” to “significantly increase” the Stage 2 Meaningful Use objectives; and to “take steps to eliminate the subsidization of business practices that block the exchange of information between providers.”

Are these letters just typical election year politics?  The issues raised in both letters echo concerns raised by other stakeholders.  The signatories to the House Republican letter are the Chairmen of the most important health committees and subcommittees in the House; signatories to the Senate Republican letter are members of the two relevant health committees in that chamber.  All who have an interest in the successful implementation of the HITECH EHR incentive program would be well served to monitor these developments closely.

Read more posts about legal and policy issues

 

Federal Government Finalizes Stage 2 Meaningful Use Requirements

Robert Belfort, Proje­ct HealthDesign Regulatory and Assurance Advisory Group, Manatt, Phelps & Phillips, LLP

The Centers for Medicare and Medicaid Services (CMS) and the Office of the National Coordinator for Health IT (ONC) recently released a final regulation setting forth the requirements for Stage 2 of Meaningful Use under the Medicare and Medicaid Electronic Health Record Incentive Program (the “Final Rule”).  In the Final Rule, CMS adopted a number of provisions that require eligible professionals and hospitals to increase their efforts to share data electronically with patients.  As a result, the Final Rule is likely to encourage greater patient engagement in health care, something the Robert Wood Johnson Foundation advocated in comments it submitted on the proposed rule.  Here is a relevant excerpt from RWJF’s comments::

We are encouraged by efforts in the proposed rule regarding patient and consumer engagement, especially regarding secure messaging; direct, downloadable access to patient data; patient reminders; inclusion of family health history; and provision of patient education. Nevertheless, we would like to see the required percentages higher than proposed in some cases. In addition, as our Project HealthDesign makes clear, patients now expect to engage with their personal health data in apps and on mobile devices of their choosing. We expect this trend to increase significantly. Further, patients will almost certainly expect that the flow of information be in two directions. In other words, patients will reasonably expect they will have both access to personal health data but also the ability to provide personal data to their health professionals.

RWJF’s full comments are available here.

The chart below lists the “patient engagement” requirements in the Final Rule:

Stage 2 Objectives		Stage 2 Measures
Eligible Professionals (EPs)	Eligible Hospitals (EHs) and Critical Access Hospitals (CAHs)
Provide patients the ability to view online, download and transmit their health information within 4 business days of the information being available to the EP.		1.  More than 50% of all unique patients seen by the EP during the EHR reporting period are provided timely (within 4 business days after the information is available to the EP) online access to their health information, subject to the EP’s discretion to withhold certain information.   2. More than 5% of all unique patients seen by the EP during the EHR reporting period (or their authorized representatives) view, download, or transmit to a third party their health information
	Provide patients the ability to view online, download and transmit information about a hospital admission.	1. More than 50% of all patients who are discharged from the inpatient or emergency department (POS 21 or 23) of an EH or CAH have their information available online within 36 hours of discharge   2.  More than 5% of all patients (or their authorized representatives) who are discharged from the inpatient or emergency department (POS 21 or 23) of an EH or CAH view, download or transmit to a third party their information during the reporting period.
Provide clinical summaries for patients for each office visit		Clinical summaries provided to patients or patient-authorized representatives within 1 business day for more than 50% of office visits
Use certified EHR technology to identify patient-specific education resources and provide those resources to the patient	Use certified EHR technology to identify patient-specific education resources and provide those resources to the patient	Patient-specific education resources identified by the certified EHR technology are provided to patients for more than 10% of all unique patients with office visits seen by the EP during the EHR reporting period.   More than 10% of all unique patients admitted to the EH’s or CAH’s inpatient or emergency department (POS 21 or 23) are provided patient-specific education resources identified by the certified EHR technology.
Use secure electronic messaging to communicate with patients on relevant health information		A secure message was sent using the electronic messaging function of certified EHR technology by more than 5% of unique patients (or their authorized representatives) seen by the EP during the EHR reporting period.

Also of note to Project HealthDesign:  the Final Rule includes a new “menu set” requirement that eligible professionals and hospitals record a patient’s family history.

Stage 2 begins in 2014.  In the Stage 1 meaningful use regulations, CMS established an original timeline that would have required Medicare providers who first demonstrated meaningful use in 2011 to meet the Stage 2 criteria in 2013. The Stage 2 Final Rule gives providers more time to meet the Stage 2 requirements. A provider that attested to Stage 1 of meaningful use in 2011 would attest to Stage 2 in 2014, instead of in 2013.  Therefore, providers are not required to meet Stage 2 meaningful use before 2014.

Since the Medicare and Medicaid EHR Incentive Programs began in January 2011, more than 120,000 eligible healthcare professionals and more than 3,300 hospitals have qualified to participate –23,000 more than the federal government had hoped to enroll by now, according to the U.S. Department of Health and Human Services, which oversees the programs.

The Final Rule – along with a fact sheet describing it -  are available at  http://www.hhs.gov/news/press/2012pres/08/20120823b.html

Read more posts about legal and policy issues.

No Sleepy Summer for Project HealthDesign’s Policy Efforts

Deven McGraw, Proje­ct HealthDesign Regulatory and Assurance Advisory Group, Center for Democracy & Technology

Ordinarily August is a slow month for federal policy, particularly in an election year. Congress goes on recess, and it is a popular month for family vacations. But August has been a month of milestones for Project HealthDesign:

ODLs Being Considered for Inclusion in Stage 3 of Meaningful Use

On August 1, the federal Health IT Policy Committee met to begin deliberations on potential meaningful use and EHR certification criteria for Stage 3 of the EHR incentive program. The Policy Committee’s meaningful use workgroup presented preliminary recommendations for Stage 3 criteria; under consideration is a requirement that patients be provided with the ability to report patient-generated data to providers and hospitals. Observations of daily living (ODLs) are specifically mentioned on the list of acceptable types of patient-generated data.

Although the Policy Committee is just beginning to deliberate the proposed Stage 3 criteria, the presence of ODLs on the initial list of options for provider incorporation of patient-generated data into the EHR is a significant development. The testimony of Nikolai Kirienko, co-director of Project HealthDesign’s Chronology.MD team, and Patti Brennan, Project HealthDesign national program director, at the Policy Committee’s recent hearing on patient-generated data helped make the case for having ODLs as an option for incorporating patient-generated data to meet Stage 3 meaningful use.

Policy Committee deliberations about Stage 3 criteria will continue into the fall, and a formal Request for Public Comment on proposed criteria is planned for release in November 2012. It will be critical for proponents of including patient-generated data such as ODLs into clinical workflows to continue to weigh in on Stage 3 discussions.

Project HealthDesign Spotlighted at Briefing on Capitol Hill

On August 13, Project HealthDesign was the topic of a briefing sponsored by the Alliance for Health Reform, the Bipartisan Policy Center, and the Robert Wood Johnson Foundation. The briefing was carried live by C-SPAN 2 and featured Stephen Downs (Robert Wood Johnson Foundation), Stephen Rothemich (Project HealthDesign’s BreathEasy team; Virginia Commonwealth University), and Deven McGraw (Project HealthDesign’s Regulatory and Assurance Advisory Group; Center for Democracy & Technology) — as well as Joy Pritts (Chief Privacy Officer, Office of the National Coordinator for Health IT).

The briefing, which took place in the Dirksen Senate Office Building, was well attended. Those present were particularly interested in hearing more about how clinicians in the BreathEasy project incorporated ODLs into clinical workflows, and how the health care system can financially support innovative models of care like those in Project HealthDesign.

The briefing also provided an opportunity to draw attention to “Lessons from Project HealthDesign: Strategies for Safeguarding Patient-Generated Health Information Created or Shared through Mobile Devices” (pdf), a new paper from Project HealthDesign’s Regulatory and Assurance Advisory Group (Manatt, Phelps & Phillips, LLP, and the Center for Democracy & Technology), which was published in late July by the Journal of Healthcare Information Management (JHIM). The paper draws on the experiences of the five current Project HealthDesign grantee teams and the approaches they used to implement device and security precautions.

Read more posts about legal and policy issues.