An HHS advisory committee has approved several models for strengthening the privacy and security of health information exchange that will allow patients to either opt-in or opt-out of taking part in the exchange of the data.
A privacy and security 'tiger team' developed a list of factors that will activate the need to obtain patient consent, including when the individual's health information is no longer under control of the patient or the patient's provider and when a third party retains the patient's information for future use, said Paul Egerman, software entrepreneur and co-chair of the tiger team.
The tiger team's mission is to come up with solutions to thorny privacy and security challenges in health information exchange in programs funded by the Office of the National Coordinator for Health IT.
Health information exchange is "a voluntary process where there are opportunities for patients to say if they don't want to participate in exchange and opportunities for providers to not participate," Egerman said at a July 21 meeting of the Health IT Policy Committee. "Ultimately, with health information exchange of electronic health records, we need to earn the trust of consumers and physicians that it is occurring correctly."
When factors trigger the need for a decision, ONC should require as a matter of policy consumer choice in information exchange, Egerman said. Among meaningful choice rules, consumers should be given time or have advanced notice to decide to give their consent and be able to make the choice outside of the urgent need for care.
Tiger team members could not agree on using one or the other model for consumer choice, and so recommended both be available.
"We had spirited discussion on this topic," Egerman said.
Ultimately there may not be a default policy, said Deven McGraw, tiger team chair and director of the Health Privacy Project at the Center for Democracy and Technology. Instead, the committee may consider "endorsing choice in certain circumstances as a requirement and that the choice fulfill certain elements and, from there, there just may be some judgment calls that the agency may have to make given all the rich discussion that we've had," she said.
Education and outreach about consumer choice will be critical for physicians, said Dr. Neil Calman, CEO of the Institute for Family Health in New York. "Once education is provided, individual physicians may have different options about how they would deal with the actual consent," he said.
Health information exchange is based on the trust in the relationship between patient and provider, Egerman said. "Providers hold that trust and are ultimately responsible for maintaining the privacy and security of their patients' records," he said.
Patient expectations must also be considered, McGraw said, and patients "should not be surprised to learn what happens to their data."
Next month, the tiger team will offer the committee another set of recommendations covering consent with more sensitive information, Egerman said. In September, the committee will vote on the combined package of consumer choice recommendations.
