Legal Barriers to the Growth of Health Information Exchange-Boulders or Pebbles?

Policy Points: Historically, in addition to economic and technical hurdles, state and federal health information privacy laws have been cited as a significant obstacle to expanding electronic health information exchange (HIE) in the United States. Our review finds that over the past decade, several helpful developments have ameliorated the legal barriers to HIE, although variation in states' patient consent requirements remains a challenge. Today, health care providers' complaints about legal obstacles to HIE may be better understood as reflecting concerns about the economic and competitive risks of information sharing. Although the clinical benefits of exchanging patients' health information electronically across providers have long been recognized, participation in health information exchange (HIE) has lagged behind adoption of electronic health records. Barriers erected by federal and state health information privacy law have been cited as a leading reason for the slow progress. A comprehensive assessment of these issues has not been undertaken for nearly a decade, despite a number of salient legal developments. Analysis of federal and state health information privacy statutes and regulations and secondary materials. Although some legal barriers to HIE persist, many have been ameliorated-in some cases, simply through improved understanding of what the law actually requires. It is now clear that the Health Insurance Portability and Accountability Act presents no obstacles to electronically sharing protected health information for treatment purposes and does not hold providers who properly disclose information liable for privacy breaches by recipients. The failure of federal efforts to establish a unique patient identifier number does slow HIE by inhibiting optimal matching of patient records, but other action to facilitate matching will be taken under the 21st Century Cures Act. The Cures Act also creates the legal architecture to begin to combat "information blocking." Varying patient consent requirements under federal and state law are the most important remaining legal barrier to HIE progress. However, federal rules relating to disclosure of substance-abuse treatment information were recently liberalized, and development of a technical standard, Data Segmentation for Privacy, or DS4P, now permits sensitive data requiring special handling to be segmented within a patient's record. Even with these developments, state-law requirements for patient consent remain daunting to navigate. Although patient consent requirements make HIE challenging, providers' expressed worries about legal barriers to participating in HIE likely primarily reflect concerns that are economically motivated. Lowering the cost of HIE or increasing financial incentives may boost provider participation more than further reducing legal barriers.

Mello MM ，Adler-Milstein J ，Ding KL ，Savage L ... -  《-》

The 21st Century Cures Act and electronic health records one year later: will patients see the benefits?

Lye CT ，Forman HP ，Daniel JG ，Krumholz HM ... -  《-》

Opt-in consent policies: potential barriers to hospital health information exchange.

Apathy NC ，Holmgren AJ 《-》

Falling short: how state laws can address health information exchange barriers and enablers.

Schmit CD ，Wetter SA ，Kash BA 《-》

Doctors Routinely Share Health Data Electronically Under HIPAA, and Sharing With Patients and Patients' Third-Party Health Apps is Consistent: Interoperability and Privacy Analysis.

Since 2000, federal regulations have affirmed that patients have a right to a complete copy of their health records from their physicians and hospitals. Today, providers across the nation use electronic health records and electronic information exchange for health care, and patients are choosing digital health apps to help them manage their own health and health information. Some doctors and health systems have voiced concern about whether they may transmit a patient's data upon the patient's request to the patient or the patient's health app. This hesitation impedes shared information and care coordination with patients. It impairs patients' ability to use the state-of-the-art digital health tools they choose to track and manage their health. It undermines the ability of patients' family caregivers to monitor health and to work remotely to provide care by using the nearly unique capabilities of health apps on people's smartphones. This paper explains that sharing data electronically with patients and patients' third-party apps is legally consistent under the Health Insurance Portability and Accountability Act (HIPAA) with routine electronic data sharing with other doctors for treatment or with insurers for reimbursement. The paper explains and illustrates basic principles and scenarios around sharing with patients, including patients' third-party apps. Doctors routinely and legally share health data electronically under HIPAA whether or not their organizations retain HIPAA responsibility. Sharing with patients and patients' third-party apps is no different and should be just as routine.

Savage M ，Savage LC 《-》