Credit: Visual Generation/Getty Images
The Centers for Medicare and Medicaid Services has long championed interoperability as a cornerstone of providing better care, improving patient empowerment, and reducing administrative burden.
Healthcare delivery organizations and their affiliated services increasingly share electronic protected health information, or ePHI, so they can collaborate more effectively, ultimately improving patient outcomes.
Simultaneously, patients increasingly use applications and services that fall outside the security and privacy requirements outlined in HIPAA.
The new CMS Interoperability Framework seeks to harmonize protections across covered entities, business associates and the patient-facing applications, labs, and clinics that fall outside HIPAA’s boundaries.
For example, research projects that the home diagnostics market will reach around $11 billion by 2034, expanding at a CAGR of 5.3%. While patients use these technologies to gain control over their health and monitor conditions, these products collect, manage, or transmit sensitive patient ePHI yet fall outside HIPAA’s protections.
Further, as these technologies are outside of HIPAA’s requirements, the manufacturers do not need to report data breaches to the Office for Civil Rights. For patients, covered entities, and business associates, these technologies are an unknown data breach risk.
The Framework offers health networks and stakeholders an opportunity to mitigate this risk. As the healthcare ecosystem continues to expand, all healthcare organizations and stakeholders, regardless of HIPAA status, can leverage formal, structured compliance and security/privacy frameworks to build trust into their data sharing initiatives.
The Catalyst: Shared missions aligned to business strategies and patient needs
According to the CMS, the Interoperability Framework exists as a call to action so that health data networks can create data exchanges that place patients and providers first. CMS seeks to offer this shared infrastructure and clear criteria to enable alignment, execution, and momentum.
While mapping to the Interoperability Framework is currently voluntary, healthcare organizations have strong incentive for adoption by advancing:
- Mission-driven goals. Providing patients seamless access to their own data, improving care coordination, and reducing friction for providers
- Business objectives. Differentiating organizations by showcasing compliance with transparent, CMS-back interoperability criteria so early adopters can position themselves as digital health leaders to build trust across patients, providers, and payers
- Future-proofing strategies. Enabling early adopters to prepare for the voluntary framework’s evolution into a regulatory requirement
By encouraging early adopters and publishing metrics, CMS creates consistency across networks, applications, payers, and providers that enables transparency and accountability.
The Change of State: Raising the bar beyond baselines across the extended ecosystem
Rather than using the stick of regulatory compliance, the Framework enables CMS to dangle the carrot of patient expectations and peer pressure to drive progress. In the already highly regulated healthcare industry, HIPAA sets a legal minimum that covered entities and business associates must meet.
Meanwhile, the Framework goes beyond these basic baselines to establish shared security validation across networks, EHR systems, providers and patient-facing applications.
Where HIPAA is a compliance regime that an agency enforces, the Framework is voluntary and optional. Where HIPAA applies narrowly to covered entities and business associates, the Framework extends expectations further into the healthcare ecosystem to include patient-facing apps, delegated vendors, and cross-network exchanges.
While HIPAA allows for varied security program implementations, the Framework explicitly requires certification against a formal compliance framework for a standardized external validation layer.
At its foundation, the Framework builds upon the regulatory requirements set out in the HIPAA Security Rule and Privacy Rule, ensuring patients maintain the rights to their data with secure access across these diversified data sharing networks.
Building New Bonds: Compliance frameworks enable extended ecosystem validation
Formal compliance and security/privacy frameworks act as the binding agents between formal regulatory requirements and voluntary Interoperability Framework adoption. By connecting these aligned initiatives, organizations can demonstrate that they consistently apply and externally validate policies, practices, and governance.
As the healthcare ecosystem expands beyond traditional HIPAA-defined participants, compliance and security/privacy frameworks drive consistency and assurance across this growing partner and attack surface.
- Identify risk to implement appropriate controls. When all organizations across the healthcare ecosystem complete standardized risk assessments, they comprehensively align their risk mitigation strategies. By combining validated controls and standardized testing, all organizations can address security and privacy gaps proactively. From identity assurance to audit logging, these processes reduce the likelihood of data breaches, compliance violations, and reputational damage, especially when exchanging data at scale.
- Create consistent, standardized baselines for ecosystem alignment. With a detailed compliance framework applied across all participants, healthcare providers and their non-HIPAA partners create consistent baselines that apply to all participants, including providers, payers, networks, and applications. By reducing inconsistencies around safeguard implementations, the healthcare ecosystem can create seamless, secure cross-network interoperability while maintaining a standard level of data security and privacy, regardless of partner HIPAA status.
- Streamline audits to reduce cost. Compliance and security/privacy frameworks harmonize various standards, regulations, and industry best practices, giving organizations a way to streamline their security and privacy initiatives. By leveraging these formalized compliance and security/privacy frameworks, all interoperability partners can align policies, processes, and controls more efficiently. As audits become increasingly important across the interoperable ecosystem, eliminating duplicative efforts creates clarity for teams while streamlining vendor and partner assessments.
- Leverage audits for trust and assurance. As the healthcare ecosystem continues to expand beyond traditional definitions of provider and business associate, audits become key documents for procurement and legal departments. As they engage in third-party due diligence and craft contracts, formal compliance and security/privacy frameworks offer the highly prescriptive yet threat adaptive controls requirements that mitigate ecosystem risk. When organizations use them to validate data security and privacy practices, they deliver documented and verified assurance for patients, partners, and regulators that builds confidence throughout the ecosystem.
- Continuously iterate compliance strategy to future-proof security and privacy. Compliance and assurance requirements evolve alongside the threat landscape, as evidenced by important role access management plays in connected healthcare systems. Since frameworks are more agile than regulations and standards, organizations can use them to re-evaluate their security and privacy posture while responding to emerging cyber trends. By embedding formal compliance and security/privacy frameworks into operations, the healthcare ecosystem can implement new controls that address evolving risks, better positioning them to adapt to upcoming CMS requirements or state and federal regulatory changes.
Harmonizing regulatory compliance and voluntary interoperability
The CMS Interoperability Framework enables secure data flows that empower patients by embedding trust into how organizations design their systems. By recognizing the value of shared, high-assurance standards, the Framework transforms compliance from a box-checking exercise into a way to advance the digital health ecosystem.
By leveraging formal compliance and security/privacy frameworks and certifications, healthcare stakeholders streamline compliance by reducing redundant audits while shaping a connected and secure future built on validated assurance.
Ryan Patrick is executive vice president for third-party risk management customer solutions at HITRUST.
