As a primary care physician, I think the concept of health information exchange is exciting. I’m tired of seeing patients who forget to bring their medication lists. Don’t get me started on those who really have no idea about their health history. I’d love to be able to exchange with other practices in my community, but for now I have to settle with downloading their medication list from Surescripts and digging through hospital charts and scanned records.
Several groups are trying to get private exchanges going in my area. Our state is woefully behind in the exchange game, so it’s not surprising that people are stepping up to fill the gap. The technology is there, the desire is there, but unfortunately the governance is not there. Small, medium, and large-ish independent groups are in active discussion about sharing information, but are woefully undereducated about data ownership, participation agreements, and patient consent.
A colleague of mine was involved in one of these exchanges several years ago. It ultimately folded due to lack of agreement among the four participating practices. There were no arrangements for determining “source of truth” for patient information and the database quickly became corrupt and ultimately unusable. It was a shame, because initial participation yielded outcomes that were published in peer-reviewed journals and looked truly promising.
I was excited earlier this summer when ONC issued a Request for Information on Governance of the Nationwide Health Information Network. The RFI asked for input on how to make patients and providers confident about information exchange. As someone who has had to counsel patients on why they should share their data, the idea of a national standard was enticing. I’ve also had to hold the hands of providers as well – making them understand that having “somebody else’s stuff” in their charts is not necessarily a bad thing.
The other shoe dropped earlier this month when ONC announced that it will not “continue with the formal rulemaking process at this time, and instead implement an approach that provides a means for defining and implementing nationwide trusted exchange with higher agility, and lower likelihood of regret.”
I sympathize with all the statements that Farzad Mostashari made on his blog – that there are voluntary governance bodies, that regulation may slow trusted exchange, etc. ONC hopes to “identify and shine the light on good practices” and “provide a framework of enduring principles to guide emerging governance models.” I’m afraid, though, that for some nascent exchanges, it will be too little, too late.
Who is going to shine the light on the private exchange that is sharing patient data without their consent? The providers think it’s just fine because “the patients signed the HIPAA form,” not understanding that HIPAA consents typically cover treatment, payment, and operations. A standard form may not cover the fact that all the patient’s data just got populated into a private HIE which has no provisions for filtering sensitive information or tracking patient authorization. It may not have restrictions on who can access the data or who monitors data consumption. The providers can’t even articulate whether they’re practicing in an opt-in or an opt-out state.
Some of you may think this is a fable, but it’s the reality of a practice where I was a patient last week. After figuring out what was going on, I should have billed the practice for the free consulting I gave them explaining that in their state they simply can’t just choose to populate patient data to a health information exchange without consent.
I hate over-regulation as much as anyone, but the private HIEs that are popping up are starting to feel a little too “wild, wild west.” Voluntary bodies aren’t going to help them if they’re not even aware the voluntary bodies exist.
What do you think about private health information exchanges? E-mail me.