The initial driver of patient privacy in the U.S. was HIPAA, enacted in 1996. In the original HHS privacy rule, a core component of HIPAA's purpose was the ability to protect patient privacy while at the same time allowing the sharing of personal health information to facilitate patient care. As technology becomes more widely used in healthcare, a serious divide has now emerged between advocates of patient privacy versus the essential flow of data which will improve patient care. As electronic health records (EHRs) become more ubiquitous in physician practices, and the setting up of regional health information exchanges (HIEs) becomes more commonplace, the debate between privacy and the sharing of information for the purpose of enhancing patient care, putting the patient at the center of the healthcare equation, and lowering the costs of care delivery will only intensify.
Unintended Consequences
The American Health Information Management Association (AHIMA) states it this way: "While AHIMA believes an individual's control over this data flow is valid, data flow restrictions in the HHS proposal create unintended repercussions for data integrity, data processing and other elements within the current US reimbursement system." Getting patient privacy and security right is one of the most important pieces of the healthcare technology puzzle; striking a balance between not jeopardizing patient privacy and gaining the benefits of sharing health information in both an aggregated and patient-specific way will be one of the most challenging dynamics in American healthcare going forward.
The Tiger Team, created by the Office of the National Coordinator (ONC) to explore this conundrum and to form a set of guidelines, has established a core set of values regarding patient privacy and trust as they relate to patient records:
• The relationship between the patient and healthcare provider is the foundation for trust in health information exchange.
• As key agents of trust for patients, providers are responsible for maintaining the privacy and security of their patients' records.
• Ultimately, to be successful in the use of health information exchange to improve healthcare, we need to earn the trust of both consumers and physicians.
The Importance of Trust
While these values sum up the importance of trust in the relationship between physician and patient, they only lightly touch upon the role of health information exchange as the next big step in driving home many key goals of health reform and the successful use of health information technology. Health information exchange becomes the critical channel for delivering improved outcomes, safety and efficiency in healthcare, whether the environment is a hospital, an integrated delivery network, a community or a state. And while trust is essential to the patient/physician relationship, as well as the foundation of future health information exchange, trust is a qualitative variable that somehow must be embedded into policy and technology solutions in order for healthcare technology to effectively address the core problems of healthcare inefficiency, hazard and excess.
Opt-In or Opt-Out
As guidelines continue to be developed, it will be important to consider the mechanisms of how patients will determine the exchange of their health information. It will also be important for policymakers to examine the balance between efficiency in how patient data is collected and distributed, and certain key aspects of patient privacy. If restrictions are too severe, the goals of ARRA and HITECH will be in jeopardy. Patients will be driven by policy to "sit on" their data, which will nullify the ability of the healthcare system "at large" to achieve its goals of improving patient care and safety through the sharing of data, as well as reducing overall healthcare costs. If data is exchanged too readily without appropriate security measures, patient privacy will certainly be in jeopardy. This dichotomy is the essential conundrum.
Opt-out most closely resembles the state of fair and controlled information exchange as it exists today. Opt-out protects patient privacy and enables the sharing of health records unless the patient specifically opts out. This approach would not put a crimp on the expansion of regional health information exchanges, which will enable physicians and organizations in an area to have access to critical patient data in order to improve an individual’s patient care as well as to identify, in the aggregate, any troublesome health trends that would require attention. The opt-out provision requires that the patient is given an adequate amount of time to make a decision about consent, including the situation of an urgent need of care. It also requires a clear explanation of consent choice that must be provided by the physician or hospital as well as the consequences of opting out.
Opt-in, on the other hand, would stop the sharing of patient information unless the patient opts in to the system enabling the transmission of health data. This option would not only severely restrict health information exchange, and limit the ability of health information technology to improve patient care and reduce costs in regions and nationally, it would nullify many of the benefits of health information technology, particularly the multi-organizational and multi-community benefits of HIEs.
The ONC is still deliberating a final ruling on information exchange. While patient privacy must be attended to, clearly the critical exchange of patient information through HIEs is a central and key component to achieving the reforms of ARRA and the HITECH Act. There are numerous studies that point to health information technology as providing the necessary tools which enable improved patient safety and the improved efficiencies desperately needed to lower healthcare costs. Let us not throw out the baby with the bathwater. Let us move forward with a rational, forward-thinking approach that will ultimately get us to where we want and need to be.
Gary Zegiestowsky is CEO of Informatics Corporation of America.
