Paper Looks at Strategies for Protecting Patient-Generated Data on Mobile Devices

Libby Dowdall, Communications Coordinator, Project HealthDesign National Program Office

The Journal of Healthcare Information Management (JHIM) recently published “Lessons from Project HealthDesign: Strategies for Safeguarding Patient-Generated Health Information Created or Shared through Mobile Devices” (pdf), a new paper from Project HealthDesign’s Regulatory and Assurance Advisory Group. Experts from Manatt, Phelps & Phillips, LLP, and the Center for Democracy & Technology co-authored the paper, which appears in the summer issue of JHIM.

The paper draws insights from Project HealthDesign’s five Round 2 grantee teams (2010-12). In the absence of established best practices for safeguarding patient-generated data created and/or shared through mobile devices, each team implemented a unique approach to device and data security. Whereas clinical data is subject to the HIPAA Security Rule, patient-generated data is not. Even so, during their studies, several Project HealthDesign Round 2 grantee teams implemented systems or approaches in which patients shared data about their observations of daily living (ODLs) — one form of patient-generated data — with their health care providers. The resulting strategies for protecting patient-generated data should prove valuable if and when it becomes more common for patients to share with clinicians select data (or summaries of the data) they’ve generated outside of the clinical setting.

The grantee teams’ approaches inform the strategies shared in this paper. Topics include data encryption; limiting the nature and extent of the data that’s transmitted; equipping patients to assess the risks of storing and transmitting the health data they generate; and educating patients about options for protecting the data. Finally, the paper encourages health care providers to thoughtfully weight the risks of storing and transmitting patient-generated data on mobile devices with patient-generated data’s benefits for clinical care and individuals’ self-management.

Read the paper (pdf).
Learn more about our Regulatory and Assurance Advisory Group.

Update on the Status of the FDA’s Regulation of Mobile Apps

Robert Belfort, Project HealthDesign Regulatory and Assurance Advisory Group, Manatt, Phelps & Phillips, LLP

Last July, the U.S. Food and Drug Administration (FDA) issued draft guidance on how the agency intended to regulate certain mobile medical applications (apps). My colleague, Deven McGraw, described the guidance in a post last year. The draft guidance sparked heated debate. And some in Congress recently pushed to delay the FDA’s final adoption of the guidance for fear that it might stifle innovation.

The story of Congress’s brush with the proposed guidance is brief but noteworthy. During a Senate Health, Education, Labor and Pensions Committee hearing in April 2012 on the Food and Drug Administration Safety and Innovation Act, the legislation that authorizes the FDA to collect user fees from the companies it regulates, Senator Michael Bennet (D-CO) proposed an amendment that would have placed a moratorium on the FDA’s publication of the final guidance.  “I appreciate very much the work the FDA has done to receive stakeholder input, but this interaction between health information and medical devices must be handled delicately. Technology is evolving and being adopted rapidly. I think Congress must provide the proper due diligence on this issue for our constituents, including a number of startups, small businesses, and patients in my home state,” said Bennet as he described his rationale for the moratorium.

Ultimately, Congress passed the Food and Drug Administration Safety and Innovation Act without the moratorium. As enacted, the Act allows the FDA to move ahead with its plans to regulate mobile medical apps while the U.S. Department of Health and Human Services develops a report on an “appropriate, risk-based regulatory framework pertaining to health information technology, including mobile medical applications, that promotes innovation, protects patient safety and avoids regular duplication.”

Now that the specter of a moratorium is no longer, the FDA is expected to release its final guidance as soon as the end of the year. A brief refresher on the FDA’s regulation of medical devices and on the guidance, as the FDA proposed it in July 2011, is below.

1. Background on the FDA’s Regulation of Medical Devices

A product is a medical device under the federal Food, Drug and Cosmetic Act (the FDCA) if it is “an instrument, apparatus, implement, . . . including any component, part, or accessory, which is . . . [either] intended for use in the diagnosis . . . or . . . cure, mitigation, treatment, or prevention of disease, . . . [or] intended to affect the structure or any function of the body of man . . .”  The FDA has stated that for software to fall under this definition, “it is sufficient that it is intended to be used in the process of diagnosis, preventing, or treatment of medical conditions, and it is not necessary that the software actually make or recommend a final diagnosis.” The FDA evaluates intended use by looking at factors surrounding the product’s promotion and distribution.

Vendors of software that qualifies as a medical device must register as manufacturers and list their products with the FDA. The FDA classifies and regulates devices under three categories, according to the amount of potential risk associated with the device’s intended use and indications for use. Class I devices present the lowest risk and are typically exempt from the pre-market submission process, but are subject to general controls required for all devices, including registration, labeling, adverse event reporting, and good manufacturing practices. Class II devices must generally undergo the pre-market notification process. Class III devices are most stringently regulated and require pre-market approval.

2. The FDA’s Draft Guidance on Regulation of Mobile Medical Apps

The FDA’s July 2011 draft guidance document indicated that the Agency intended to apply its regulatory oversight to a subset of mobile apps called “mobile medical apps,” defined as a mobile app that meets the definition of a “device” that either is used as an accessory to a regulated medical device, or transforms a mobile platform into a regulated medical device. The FDA proposed to monitor and apply enforcement discretion to other apps that qualify as devices but do not meet the mobile medical app definition; a manufacturer may choose to register and list, and to seek the FDA approval or clearance for such apps.

The guidance also listed certain apps that the FDA does not consider to be “mobile medical apps,” including “mobile apps that are solely used to log, record, track, evaluate, or make decisions or suggestions related to developing or maintaining general health and wellness.”  Examples of health and wellness apps are provided in the guidance, and include dietary tracking logs, appointment reminders, dietary suggestions based on a calorie counter, posture suggestions, exercise suggestions, etc. In contrast, a mobile medical app is one that is intended for “curing, treating, seeking treatment for, mitigating, or diagnosing a specific disease, disorder, patient state, or any specific, identifiable health condition.”

As Deven pointed out in her post last summer, the FDA tried to draw clear lines and offered more examples of mobile medical apps in the guidance (see appendix A). However, the distinction between mobile medical apps and health/wellness apps is not always clear. Today, medical conditions are significantly improved — and even prevented — by healthy behaviors, and providers might prescribe or at least recommend particular diet or exercise protocols as part of medical treatment. Many mobile health applications in development and in active use today fall in a gray area between medical and health/wellness. Where do you think the consumer-facing health applications that the Project HealthDesign teams are testing fall?

Comments on the FDA’s draft guidance were due by October 19, 2011 and reports indicate that the FDA received no small amount of feedback. We anxiously await the final guidance and will keep everyone posted.

Read more posts about legal and policy issues.

Key Points from the Meaningful Use Workgroup Patient-generated Data Hearing

Deven McGraw, Proje­ct HealthDesign Regulatory and Assurance Advisory Group, Center for Democracy & Technology

On June 8, the Meaningful Use Workgroup of the federal Health IT Policy Committee held a hearing on patient-generated data. The purpose of the hearing was to inform the Workgroup’s consideration of possible objectives for Stage 3 of CMS’ incentive program for the meaningful use of EHRs.. Since Stage 1 of the program, the Policy Committee has signaled its interest in including patient-generated data as part of Stage 3.

Project HealthDesign was well represented at the hearing. The Workgroup heard testimony from Nikolai Kirenko, Chronology.MD co-project director and Patricia Flatley Brennan, Project HealthDesign national program director. I testified on behalf of Project HealthDesign’s regulatory and assurance advisory group.

Some of the key points of the hearing were:

• The term “patient-generated data” encompasses many different types of data, from device and sensor data (e.g., blood glucose levels or data from a pacemaker), to patient-reported data used to assess health care quality, to observations of daily living (ODLs) used by patients for better self-management and to inform their clinical care. Developing effective Meaningful Use measures and objectives that involve patient-generated data will likely require a range of approaches.

• Some high-performing health systems are already deploying models of care that include patient-generated data (including the Veterans Administration, Dartmouth, Geisinger, Partners, and the institutions participating in Project HealthDesign). However, getting other institutions and smaller ambulatory practices to adopt care models that incorporate patient-generated data may require starting with more modest, manageable steps. The objectives set for Stage 3 of Meaningful Use also should provide the foundation for adoption of more robust, patient-centered care models after the HITECH incentives have ended.

• Patient-generated data need not come directly into the provider’s EHR in order for it to be effectively utilized as part of patient care. Decisions about what to include in the EHR should preserve the role of the record in documenting and supporting clinical decision-making processes.

• Organizations that have successfully incorporated patient-generated data into clinical care have done so in accordance with specific plans. These plans document agreements between patients and clinicians about  what information will be collected and how it will be used. Consequently, Meaningful Use objectives for patient-generated data will need to be structured in a way that provides flexibility for providers and patients to come up with a plan that works for their circumstances. Dr. Brennan recommended that the Meaningful Use Workgroup focus on “providing assistance, incentives, and structures” that will enable clinicians to have a way to document their use of patient-generated data in clinical decision-making.

Read the written testimonies submitted for the hearing. 

The Meaningful Use Workgroup will be working over the summer to develop more specific recommendations on how to incorporate patient-generated data into Stage 3 of Meaningful Use, and members of the public are invited to participate in Workgroup calls. Learn more. 

Seeking Public Comment on Proposed Governance of the Nationwide Health Information Network

Deven McGraw, Proje­ct HealthDesign Regulatory and Assurance Advisory Group, Center for Democracy & Technology

On May 15, the Office of the National Coordinator for Health IT (ONC) released a formal Request for Information from the public (RFI) on governance of the Nationwide Health Information Network (NwHIN). ONC defines NwHIN as a "set of standards, services, and policies that enable secure health information exchange over the Internet." In the early years of federal health IT initiatives, the NwHIN was described as a “network of networks,” reflecting a strategy of achieving nationwide health information exchange by establishing state or regional health information exchanges and linking them together. The new definition reflects the belief that exchange does not require the building of new networks but also can be achieved through the use of common, interoperable standards in an environment of trust.

In the RFI, ONC observes that electronic exchange to date “has been governed by a patchwork of contractual relationships, procurement requirements, State and Federal laws, and industry self-regulation,” and this this patchwork has led to “asymmetries in the policies and technical standards.” In developing governance conditions, ONC hopes to establish “a consistent, baseline set of ‘rules of the road’ for electronic exchange.”

The RFI proposes "conditions for trusted exchange" (CTEs) in three areas:  safeguards (which focus on the protection of individually identifiable health information), interoperability (which focus on the technical standards needed for interoperable exchange), and business practices (sound operational and financial practices). These CTEs would impose some requirements that go above and beyond what current law requires. For example, one of the safeguard CTEs would require entities to implement security safeguards like encryption that currently are not mandatory for health care providers. ONC anticipates that the CTEs will be reviewed annually and evolve over time (some will be retired, others will be added), as exchange needs become more robust and standards are improved. The 16 proposed CTEs, and the specific questions ONC has asked the public to weigh in on, can be found in the RFI.

The entities ONC intends to govern are not individual providers but instead the intermediaries that facilitate exchange among providers and patients. Examples include state or regional health information organizations (RHIOs), health information exchanges (HIEs), and private networks established by vendors. The RFI proposes that intermediary entities be validated with respect to their compliance with the governance CTEs. Those intermediary entities that are validated are then called NwHIN Validated Entities or NVEs. The RFI also proposes oversight over the validators; ONC will remain responsible for overseeing NwHIN governance but also intends to seek and select a private-sector entity to have oversight over the validators.

NwHIN governance is proposed to be voluntary, although ONC anticipates that they could become mandatory conditions for participation in certain federal programs. The idea is to create a set of conditions for trusted exchange that intermediary entities will seek to follow – and those intermediaries will agree to exchange data with other intermediaries who have committed to following the same conditions.

Comments on the RFI are due on June 14, and can be filed electronically. The Health IT Policy Committee also will be considering comments to the RFI at its June 6 meeting. ONC expects the public comments to help shape a forthcoming proposed regulation on NwHIN governance.

Read more posts about legal and policy issues.

Implications for Patient Engagement if the Health Reform Law Falls

Robert Belfort, Project HealthDesign Regulatory and Assurance Advisory Group, Manatt, Phelps & Phillips, LLP

It is hard to escape the news coverage about the constitutional challenge to the Affordable Care Act (ACA), and the attention being paid to the case is understandable. The ACA is arguably the most far-reaching piece of domestic legislation that Congress has passed since it enacted Medicare in the 1960s. Although the focus of the legal challenge to the ACA is on the individual mandate, which requires that almost all Americans without health insurance buy individual health insurance policies or pay fines, there could be implications for patient engagement initiatives if the Supreme Court strikes down the law.

The Supreme Court heard oral arguments relating to the constitutionality of the ACA on March 26, 27 and 28. The Court’s decision is not expected until late June. The first issue confronting the Court is whether the individual mandate should be struck down because it represents an unconstitutional exercise of Congress’ power. If the Court does decide the mandate is unconstitutional, it will then consider what should happen to the ACA’s hundreds of other provisions. The answer depends on whether some or all of these provisions are deemed “severable,” meaning that they operate independently enough of the mandate to stand on their own even if the mandate falls.

The severability issue is a critical one. A number of the ACA’s payment and delivery reform provisions encourage patient engagement and care coordination, and, at least indirectly, could go a long way toward promoting the integration of patient-generated health information into care management and other health care delivery models.  These include provisions:

• establishing a Medicare hospital value-based purchasing program that pays hospitals based on performance against quality measures;
• requiring the development of similar value-based purchasing programs for other types of providers;
• gradually reducing Medicare payments that would otherwise be made to hospitals to account for preventable hospital readmissions; and
• establishing rules governing the formation and operation of Accountable Care Organizations (ACOs).

Each of these provisions attempts to reform the current health care payment system by rewarding health care providers for coordinating care and delivering better patient health outcomes – as opposed to rewarding them for the volume of services they provide. The ACO program, for example, creates financial incentives for providers to work together to treat patients across multiple care settings, including physician offices, hospitals, and in the home. An ACO consists of a group of providers that have agreed to collaborate to coordinate care for patients enrolled in Medicare Parts A and B. ACOs are intended to be patient-centered organizations, driven by the goal of delivering integrated, efficient and cost-effective care. ACOs that achieve quality targets and succeed in providing care at a cost less than what would otherwise be expected will share in savings with the Medicare program. To succeed, ACOs will likely have to find ways to better engage patients in their own health and health care. Incorporation of patient-generated health information, like observations of daily living (ODLs), could be one way of achieving this goal.

It is currently unclear whether the ACO program and other ACA payment reforms will continue to exist if the Supreme Court strikes down the entire ACA. Some have suggested that without the ACA’s payment reform provisions, health care providers will have less incentive to engage in innovative care coordination strategies, including those involving patient-generated health information. We will continue to follow the legal challenge to the ACA with great interest, and with an eye toward how it may affect the goals that Project HealthDesign supports. Please don’t hesitate to post any questions or comments about these issues below.

Read more posts about legal and policy issues.

White House Releases Report on Consumer Privacy, Calls for Legislation

Deven McGraw, Proje­ct HealthDesign Regulatory and Assurance Advisory Group, Center for Democracy & Technology

Project HealthDesign grantee teams have long recognized that the robust use by patients of technologies such as personal health records (PHRs) and mobile health applications to improve health and well-being depends on trust. Individuals need assurance that the personal data they collect and share using these technologies will be handled responsibly and with respect for its sensitivity. But health data collected by and shared through consumer-facing technologies is typically not covered by HIPAA or state health privacy laws.

At a roundtable on privacy and security protections for PHRs hosted by the Department of Health and Human Services (HHS) in 2010, Project HealthDesign grantees submitted testimony noting some of the privacy and security issues raised by their projects and the challenge of addressing these issues in an uncertain legal environment.  Failure by policy-makers to address this uncertainty chills innovation and places obstacles to widespread consumer adoption of promising health information technologies.

Securing enactment of comprehensive privacy policy is never easy, but the future is looking a bit brighter. Just last month, the White House released a report expressly acknowledging that “[p]rivacy protections are critical to maintaining consumer trust in networked technologies” and calling for stronger privacy rules to protect personal information, including health information, shared by consumers with private sector companies.

Specifically, the White House sets forth the following “Consumer Privacy Bill of Rights”:   

• Individual Control:  Consumers have a right to exercise some control over what companies collect from them and how they use it.

• Transparency:  Consumers have a right to easily understandable and accessible information about privacy and security practices.

• Respect for Context:  Companies should limit their collection, use and disclosure of personal data to those purposes consistent with the context in which consumers provided the data.

• Security:  Companies should maintain reasonable safeguards to control risks such as loss, unauthorized access, and improper disclosure.

• Access and Accuracy:  Companies should provide consumers with reasonable access to personal data collected about them and appropriate means to correct inaccuracies.

• Focused Collection:  Companies should collect only as much personal data as they need to accomplish the purposes that are consistent with the “Respect for context” principle.

• Accountability:  Companies should be accountable to enforcement authorities and consumers for adhering to these principles.

The White House also calls on Congress to enact legislation adopting the Consumer Privacy Bill of Rights as law and providing enforcement authority to both the Federal Trade Commission (FTC) and State Attorneys General. The White House also directs the U.S. Department of Commerce to convene multi-stakeholder groups to negotiate codes of conduct that would implement the Consumer Privacy Bill of Rights in ways tailored to the privacy issues raised by specific industry sectors.

Under the legislative approach advocated by the White House, these codes of conduct – when reviewed and approved by the FTC — would become safe harbors that insulate companies that follow these codes from liability. But even if Congress does not act, these codes of conduct — when companies voluntarily follow them — can be enforced by the FTC, which already has authority to force companies to comply with privacy commitments made to consumers. The Department of Commerce is expected to soon begin convening multi-stakeholder groups to develop the codes of conduct called for in the White House report.

Entities covered by existing federal data privacy laws like HIPAA would be exempt from the new legislation. However, the White House does call for review of whether existing laws could be “simplified” to benefit both consumers and companies.

To what extent would national, consensus-based policy protecting health data collected, used and shared by commercial companies reduce barriers to more widespread adoption of consumer-facing health technologies like PHRs and mobile apps?  Share your thoughts in the comments.

Read more posts about legal and policy issues.

Proposed Stage 2 Meaningful Use Rule Strong on Patient Engagement

Robert Belfort, Project HealthDesign Regulatory and Assurance Advisory Group, Manatt, Phelps & Phillips, LLP

The Centers for Medicare and Medicaid Services (CMS) and the Office of the National Coordinator for Health IT (ONC) released the proposed rule governing Meaningful Use Stage 2 under the Medicare and Medicaid Electronic Health Record Incentive Program last week. In a move that is likely to promote patient engagement, the agencies took the advice of the Health IT Policy Committee and beefed up the requirements on eligible professionals and hospitals for sharing data electronically with patients.

The patient engagement requirements in Meaningful Use Stage 1 are important but limited. For example, in Meaningful Use Stage 1:

• Eligible professionals and hospitals must provide patients electronic copies of their health information upon request and within three business days
• Hospitals must provide electronic copies of discharge instructions to patients upon request.
• Eligible professionals must provide clinical summaries of each office visit to patients upon request, but these do not have to be in electronic format.
• Eligible professionals have the option of providing at least 10 percent of their patients electronic access to their health information within four days of the information becoming available to the eligible professional. 

In the proposed rule for Stage 2, CMS and ONC are proposing to require eligible professionals and hospitals to provide patients with direct electronic access to their information. Patients will no longer have to request an electronic copy of their health information; instead they will have to be provided with a mechanism to electronically view — and securely download on demand — relevant portions of their health information.

Specifically, CMS and ONC are proposing the following patient-engagement-related objectives for Stage 2 of Meaningful Use:

For eligible professionals: 

• Provide patients the ability to view online, download, and transmit their health information within 4 business days of the information being available to the eligible professional.
• Provide clinical summaries for patients for each office visit.
• Use secure electronic messaging to communicate with patients on relevant health information.

For hospitals: 

• Provide patients the ability to view online, download, and transmit information about a hospital admission.

For both:

• Use certified EHR technology to identify patient-specific education resources and provide those resources to the patient.

Although these new objectives and their attendant measures do not hew exactly to those proposed by the Health IT Policy Committee, they are very close and represent CMS and ONC’s commitment to ensuring that health care providers use EHRs to improve not only their own access to health information but their patients’ access as well.

Further, beginning in 2014, CMS and ONC are proposing to replace the Stage 1 objectives requiring eligible professionals and hospitals to provide patients with an electronic copy of their health information/discharge instructions and with timely electronic access to their health information with the new view, download and transmit objectives proposed for Stage 2.

We think the patient engagement provisions in the proposed rule are good news for patients and that they could increase the demand for personal health records and applications that help individuals securely store, share and make use of their personal health information. We’d also like to give kudos to the Project HealthDesign team for providing the Health IT Policy Committee with valuable comments about extending the effect of meaningful use of EHRs beyond clinicians and to patients and their family members.

Of course, there is more work to be done. CMS and ONC will take public comments on the proposed rule before finalizing it. The comment period will last 60 days and we can expect a final rule sometime this summer. At that point, we’ll set our sights on Stage 3, which is scheduled to begin in 2015 and where we might see requirements that deal with accepting electronic data from patients.

The proposed rule will be published in the Federal Register on March 7, 2012. In the meantime, it is available for display or as a fact sheet.

Let us know your reaction to the new patient engagement requirements in Meaningful Use Stage 2 below.

Read more posts about legal and policy issues.

Latest Health IT Policy Developments

Deven McGraw, Proje­ct HealthDesign Regulatory and Assurance Advisory Group, Center for Democracy & Technology

A new year has started — year two of the incentive program to encourage the meaningful use of certified electronic health record technology to improve individual and population health. It’s a good time to get caught up on policy developments from the end of a very busy 2011 and provide an update on expected developments in early 2012.

On November 7, the Institute of Medicine issued a report and recommendations intended to assure the safety of EHRs. The report identifies some safety risks associated with EHRs and acknowledges the potential for safety benefits. The report also recommends the establishment of a new entity to investigate EHR safety risks and urges HHS to establish a mechanism for vendors and others to report safety-related incidents. In response to the report, ONC noted it is already in the process of developing an EHR safety and surveillance plan.

In December, the Department of Health & Human Services (HHS) announced that providers who started participating in the  meaningful use incentive program in the first year (2011) will have an additional year (until 2014) before being required to meet the more robust meaningful use Stage 2 requirements. This change, which was initially recommended by the Health IT Policy Committee, is intended to give providers a longer period of time to adjust to and implement the earliest stage of meaningful use before being required to demonstrate more robust use and exchange of health information in Stage 2.

Speaking of meaningful use, the proposed meaningful use requirements for Stage 2 are still expected to be released early in 2012. In addition, the Health IT Policy Committee has begun discussions about requirements for Stage 3, and incorporation of patient-generated data into EHRs continues to be a priority.

ONC unveiled its consumer engagement program in September, and the office is continuing to roll out initiatives to promote consumers’ use of e-health tools to improve their health:

• Earlier this month, ONC announced the Healthy New Year video challenge intended to collect short (up to two minutes) videos from consumers sharing their new year’s resolutions for the use of e-health tools to improve their health or the health of their families. The deadline to submit a video is February 16, at 5 p.m. EST. Cash prizes will be awarded to the top videos.

• On December 6, the Office of the Surgeon General and ONC launched a Healthy Apps Challenge to encourage the development and submission of technology apps that tailor health information to the needs of the consumer user and empower the public to regularly engage in and enjoy health-promoting behaviors. The deadline for entry was December 31, 2011. Winners will be announced on January 31, 2012 and finalist apps will be featured on an HHS website.

ONC also has launched efforts to gather more information about consumer concerns about e-health privacy and security. Specifically, ONC is surveying consumers (and conducting focus groups) about attitudes and preferences regarding the communication of personal health information using mobile devices. In addition, ONC will conduct annual, nationwide surveys to assess the percentage of individuals who are concerned about the privacy and security of EHRs, who report having kept any part of their medical history from their doctors due to privacy concerns, and who are concerned that an unauthorized person would see their medical information if it is sent electronically, among other key measures. ONC will assess trends in consumer privacy and security views between 2012 and 2016 and intends to compile the results into a final report.

Stay tuned for further updates.

Read more posts about legal and policy issues.

Institute of Medicine Weighs In On Health IT and Patient Safety

Robert Belfort, Project HealthDesign Regulatory and Assurance Advisory Group, Manatt, Phelps & Phillips, LLP

All of us working in health care are keenly aware of the importance of ensuring that health IT improves the quality of health care without creating a new set of patient safety risks. With the release of a new report titled “Health IT and Patient Safety: Building Safer Systems for Better Care” by the Institute of Medicine (IOM), the issue of health IT safety is now on the radar screen as a major policy challenge.  

IOM released the report in response to a request by the Office of the National Coordinator for Health IT (ONC) for recommendations about what a comprehensive health IT safety policy should look like. Among other recommendations, IOM suggested that the federal government create a new independent watchdog agency, along the lines of the National Transportation Safety Board, to accept reports on patient deaths, serious injuries or potentially unsafe conditions associated with health IT. IOM skirted the issue of whether the U.S. Food and Drug Administration should have immediate responsibility for overseeing health IT safety.

While the entire report is worth reviewing, I want to call special attention to the fact that the report includes a chapter devoted to the safety of health IT tools “designed to engage and support patients in health-related decision making and management of their own personal health information” (see chapter 5 “Patients and Families Use of Health IT: Concerns about Safety”). The chapter specifically references patients’ ability to use personal health records (PHRs) and other tools to record and share “activities of daily living.” It also cites “Project HealthDesign: Rethinking the Power and Potential of Personal Health Records” by Patricia Flatley Brennan, Steve Downs and Gail Casper.

The report doesn’t offer up a silver bullet for avoiding patient safety risks created by PHRs and other patient engagement tools. Rather, it highlights that health IT is one component in a larger sociotechnical system that includes technology, processes, organizational practices and the external environment, and that adding patients into the mix inserts an additional layer of complexity when it comes to patient safety.

The report’s key point about PHRs is summed up in the following quote: “Given the importance of clear patient-provider communications, special attention may have to be devoted to ensuring that computer-mediated interactions are not used inappropriately.” It goes on to note that one important way to ensure patient safety is for health care providers to manage patient expectations about how information they include in a PHR or other patient engagement tool will be used. According to IOM, health professionals, patients and their families need to develop “a shared understanding of appropriate use of patient-centered, validated data.”

Sound familiar? It should, because it’s consistent with the discussions we’ve been having with the current Project HealthDesign grantee teams about how to minimize health care providers’ medical malpractice liability when incorporating ODLs into clinical care assessments and decisions. In April 2010, the grantees raised a number of concerns, such as how to ensure the accuracy of patient-generated health data and whether health care providers are expected to review every piece of information that patients provide on a round–the-clock basis. These concerns are driving Manatt and CDT’s work on a set of recommendations to develop a shared set of expectations among patients and health care providers about the role of patient-generated data in clinical care.

Although we are formulating these recommendations with a focus on reducing health care providers’ legal liability — a cross-cutting policy issue that could stymie the incorporation of ODLs into clinical practice if not addressed — IOM reminds us that, at the end of the day, managing patients’ expectations about the incorporation of their ODLs into their care is also a patient safety issue.

The IOM report makes a total of 10 patient-safety related recommendations. I encourage everyone to review the recommendations and to read Chapter 5 of the report.

Read more posts about legal and policy issues.

Latest Health IT Developments Focus on Engaging Consumers in Their Own Health and Wellness

Deven McGraw, Proje­ct HealthDesign Regulatory and Assurance Advisory Group, Center for Democracy & Technology

It’s a little too early to take a victory lap, but the stars seem to be aligning for a significantly changed health care system – one that actively engages patients as partners in achieving health and wellness – within the next few years. What are the reasons for our optimism?

1. On November 2, the Centers for Medicare and Medicaid Services (CMS) released the final rule governing Accountable Care Organizations (ACOs) established under the new Medicare Shared Savings Program. Under this rule, providers in ACOs who can deliver care to Medicare beneficiaries at costs below what Medicare typically pays will be able to share a fairly significant portion of the savings. More than half of Medicare beneficiaries are treated for five or more chronic conditions a year. As a result, achieving savings for this population will depend in part on how well they are actively engaged in managing their health and wellness, such as through the use of personal health records (PHRs) and other technologies that assist patients in self care and in engaging with their clinical care teams more regularly. The Project HealthDesign grantee teams are already providing examples of how such technology can be leveraged to make a difference in individual and population health outcomes.
   
   
2. The Health IT Policy Committee has recommended that Stage 2 of meaningful use require health care professionals and hospitals to provide patients the capability to electronically view — and securely download on demand — relevant portions of their health information. This could significantly increase the demand for PHRs, applications or devices that help individuals securely store, share and make use of their personal health information. Although the official criteria for Stage 2 have not yet been set, the Obama Administration has already implemented this “Blue Button” capability  for My HealtheVet and MyMedicare.gov. I am also hearing that vendors of certified electronic health record products are already building this capability into product updates.
   
   
3. The Office of the National Coordinator for Health IT (ONC) rolled out its consumer engagement and education initiative in September. As part of that initiative, health care organizations are encouraged to “take the pledge” to provide patients with “secure, timely, and electronic access to their health information” and to encourage them to use the information to improve their health and their care. In the legislation that created the CMS EHR Meaningful Use Incentive Program, Congress also included a provision that amended HIPAA to require health care entities to provide patients with electronic copies of their health data if that data is stored electronically; entities are also required to send a patient’s copy to another provider or the patient’s PHR upon request. We expect the regulations to implement this provision to be finalized early next year.

Early in 2012 we will know more about whether these optimistic predictions will bear fruit, so stay tuned.

Read more posts about legal and policy issues.