Policies for patient access to clinical data via PHRs: current state and recommendations

Abstract

Objective

Healthcare delivery organizations are increasingly using online personal health records (PHRs) to provide patients with direct access to their clinical information; however, there may be a lack of consistency in the data made available. We aimed to understand the general use and functionality of PHRs and the organizational policies and decision-making structures for making data available to patients.

Materials and methods

A cross-sectional survey was administered by telephone structured interview to 21 organizations to determine the types of data made available to patients through PHRs and the presence of explicit governance for PHR data release. Organizations were identified based on a review of the literature, PHR experts, and snowball sampling. Organizations that did not provide patients with electronic access to their data via a PHR were excluded.

Results

Interviews were conducted with 17 organizations for a response rate of 81%. Half of the organizations had explicit governance in the form of a written policy that outlined the data types made available to patients. Overall, 88% of the organizations used a committee structure for the decision-making process and included senior management and information services. All organizations sought input from clinicians.

Discussion

There was considerable variability in the types of clinical data and the time frame for releasing these data to patients. Variability in data release policies may have implications for PHR use and adoption.

Conclusions

Future policy activities, such as requirement specification for the latter stages of Meaningful Use, should be leveraged as an opportunity to encourage standardization of functionality and broad deployment of PHRs.

Introduction

Several healthcare delivery organizations provide personal health records (PHRs) that make clinical information available to patients via an online patient portal application.¹ These applications support care coordination and chronic disease management, and seek to improve patient engagement and patient–provider communication.^1–3 Online PHR portals have been described as a critical component of an information technology infrastructure necessary to support the patient centered medical home model of care.^{4 5}

A Meaningful Use Stage 1 ‘menu-set’ requirement calls for healthcare providers and organizations to provide patients with timely electronic access to their health information, subject to a clinician's discretion to withhold certain information. Stage 2 and 3 preliminary specifications make timely patient access a mandatory requirement, and further indicate that patients should be able to filter or organize information (eg, by encounter, type of data, etc). These forthcoming requirements portend a likely deployment of PHR portals on a large scale across the nation.

Background and significance

To realize the anticipated benefits of PHR adoption from the perspective of healthcare consumers, it is imperative that the technology meets their expectations.^5–7 Patient engagement, acceptance, and awareness of PHRs are strongly influenced by the functions provided by the application and by what data are made available from existing clinical information sources such as electronic health records (EHRs).^{6 8} One study that analyzed patients' perception and knowledge of PHRs in a community-based setting found a potentially problematic pairing: patients had low levels of familiarity with PHRs, yet high expectations for PHR functionality such as electronic communication with providers and integration of self-entered and institutional clinical data.⁹ Patients expect clinical data from an ambulatory or inpatient encounter (such as laboratory test results, radiographic and other studies, physician notes, etc) to flow smoothly to the PHR portal. To meet this expectation, healthcare delivery organizations must make decisions about what data should be made available, and how and when they can be accessed.

The current biomedical literature provides an incomplete picture of healthcare organizations' responses to the demand for PHRs and the variable organizational policies and system functionalities that impact the types of patient data that are made accessible online. A comparison of the PHR policies of seven early adopter healthcare organizations based on the PHR's incorporation of patient preferences demonstrated a wide variety of patient-centered PHR policies and decision-making structures in 2007.^{10 11} Variability among PHR policies may increase complexity and impact patient adoption.⁸ However, analysis of the variability among organization's PHR policies, in the context of the organization's institutional expertise and experience, may drive the development of best practices and serve as a guide for the early majority, late majority, and laggard adopter health care organizations.¹¹ To realize the potential value of PHRs, a better understanding of barriers, facilitators, and ‘best practices’ for implementation are needed.³

We conducted structured interviews with representatives from a diverse set of organizations to summarize the capabilities of existing PHRs and the policies for making data available to patients.

Methods

The study design was a cross-sectional survey administered by telephone semi-structured interview during December 2010 and January 2011. Our inclusion criteria were large medical centers and large ambulatory care organizations in the USA with established PHRs and a documented track record of usage of the PHR for a minimum of 12 months. We excluded healthcare organizations that do not provide patients with electronic access to their data via a PHR.

The list of medical and ambulatory care centers invited to participate was developed based on a review of the literature, identification of organizations by PHR experts, and snowball sampling, where we asked potential participants to identify other institutions with PHRs.¹² Once the list was compiled, we identified an appropriate representative of the medical or ambulatory care center and invited that individual to participate in the voluntary telephone survey via an emailed letter. Additionally, the survey questions were distributed with the email to allow for participants to prepare data ahead of the scheduled interview. Follow-up emails were sent when no response was received. Institutional Review Board approval was obtained. The survey was administered over the telephone and verbal consent was obtained. The interviews were audio-recorded and the recordings were used to verify the integrity of the data collected in the access database after each interview.

The survey consisted of four sections in which we aimed to understand: (1) the general use and functionality of the PHR; (2) the types of data that are made available to patients; (3) the time frame for releasing data to patients; and (4) the presence of explicit governance for decision making about these policies (see online appendix A). The first section asked questions about the number of accounts and usage log data. Representatives were asked about: (1) the number of active accounts; (2) the number of unique users who logged in to access any information (eg, educational resources) on the system per month; (3) the total number of logins accessing any information on the system per month; (4) the number of unique users who logged in to access clinical data per month (see online appendix A for a list of clinical data); and (5) the total number of logins accessing clinical data per month.

The results were analyzed by descriptive statistics to identify the degree of variability in data access policies across institutions. The medical and ambulatory care centers were grouped according to their key characteristics and compared according to the reported PHR functionalities and implementation policies.

Results

Overview of organizations and PHR access, use, and functionality

We invited 21 medical and ambulatory care centers to participate. Seventeen (81%) agreed to participate and four did not reply to our invitation email or subsequent follow-up emails. Non-responders overall did not differ from the organizations responding, but included one large multi-state integrated healthcare system. Seven of the institutional representatives were physician leaders who held the title of Chief Medical Information Officer or Medical Director/Clinical Lead for Information Services or the PHR application. Ten of the representatives were information services leaders who held the title of Chief Information Officer or Manager/Director of Information Services or the PHR application. Table 1 describes the key characteristics of the participant organizations and PHR usage statistics organized by the type of healthcare organization.

Table 1.

Key characteristics of the participant organizations and PHR usage statistics

Type of healthcare organization	Number of healthcare organizations, N (%)	Time PHR has been live	User accounts	Unique users/month*	Total logins/month*
Academic medical centers	5 (29)	3–11 years	17 000–145 000	5200–17 000	1700–150 000
Pediatric academic medical centers	2 (12)	1–7 years	133–2000	NA	NA
Integrated healthcare systems	7 (41)	2–12 years	45 600–1 130 900	2000–42 800	5000–925 000
Ambulatory care organizations	3 (18)	3–10 years	800–267 000	400–72 600	NA

^*Ranges of available data are reported. Some institutions could not provide all categories of usage statistics. NA indicates the range was not reportable because data were available from only one (or none) of the organizations.

PHR, personal health record.

Initially, many of the organizations implemented PHRs with limited functionality or access through pilot projects and incrementally increased the functionalities of their PHR and the patient populations that were offered access to it. In some cases, PHR access was conditional on a primary care provider using an EHR. Eleven (65%) of the 17 institutions internally developed part or all of their PHR. Of those 11 PHRs, four had been in service for 5–8 years and another four had been in service for 9–12 years. Five of the 11 systems had transitioned or were in the process of transitioning to vendor systems or a combination of an internal and a vendor system. For example, one medical center internally developed a PHR for five chronic care populations in 2004 and in 2010 began phasing in a vendor PHR as the same vendor's EHR was implemented incrementally throughout the medical center. All but one of the institutions that used a vendor system added their own branding (naming, logos, etc) to the system.

Overall, the functionalities provided by the PHRs were consistent among the healthcare organizations surveyed. All sites provided reference or educational material that was internally developed or provided through a variety of vendors such as Healthwise, UpToDate, Google Health, Microsoft HealthVault, MedlinePlus, Lab Tests Online, KRAMES, and Emmi Solutions videos. One of the academic medical centers utilized medical librarians to personalize the website's reference and educational material based on the patient's demographics, ICD-9 code history, reading level, and season of the year.

All sites provided message-oriented functionality, that is, the capability for the patient to communicate securely with the provider and staff at the organization. Eight of the 17 sites reported that patients could send their primary care provider a message directly, while the remaining nine sites provided functionality for patients to send messages directly to a triage team or to clinical staff who notified the provider that a message was present. Two sites included caveats that a clinician had to initiate messaging with a patient. The majority of sites allowed for prescription renewal and appointment requests online, with five sites moving toward direct appointment scheduling online. Additional examples of message-based functionality included a 24 h consulting nurse service, billable structured e-visits, referral requests, prescription refills (different from prescription renewals), medication reminders, precertification for medications, and messaging with genetic counselors. Additionally, 70% of the PHRs allowed patients to pay their bills online.

All representatives reported that their institution's PHR is adapted for low health literacy levels, however the approaches varied. Some PHRs translated terms from the EHR or provided links to external educational resources for laboratory tests or diagnoses, while others simply tried to use patient friendly terms or an appropriate reading level (defined by the organization) for the PHR content that was not linked to the EHR, such as general website information. One organization explained that they decided to provide the medical terminology for a diagnosis instead of translating it to a simplified patient friendly term because important information may be lost in translation, which may hinder the patient searching for medical diagnoses online.

There was wide variability in patient use of PHRs among the organizations. For patients with accounts, the ambulatory care centers had the largest percentage of users per month (between 26% and 50%). The integrated healthcare systems had the lowest percent of patients with accounts who accessed the PHR per month (4%). The data demonstrated wide variability in users' actions as well. For example, in some cases users accessed the PHR website, perhaps for educational information, but did not log in to access clinical data, and in other instances users logged in to access clinical data multiple times per month.

Types of clinical data available

The list of clinical data elements available in PHRs sponsored by the surveyed health organizations is presented in table 2. For many of the organizations, the process of PHR development and decision making involved a staged approach. Therefore, at each organization, we determined whether each data type was (1) ‘available,’ (2) ‘in development and available by policy’ (ie, although the data were not yet available, a decision had been taken to make the data available and the technology was in development), (3) ‘not available and no policy decision yet’ (ie, the organization had yet to discuss if and when that data type should be made available), or (4) ‘specifically withheld according to policy’ (that is, the organization had decided to withhold that data type from the PHR, typically because it was deemed sensitive data or required interpretation by a healthcare professional).

Table 2.

List of data elements and their availability in the PHR

Data types	Available (% of total cohort)	Available by policy but not completed (%)	Not available and no policy decision yet (%)	Specifically withheld according to policy* (%)
Laboratory results	16 (94)	1 (6)	0	0
HIV results	3 (18)	0	1 (6)	13 (76)
Genetic test results	7 (41)	0	6 (35)	4 (24)
Medication data	15 (88)	1 (6)	1 (6)	0
Encounter type and date	14 (82)	0	3 (18)	0
Allergy data	14 (82)	0	3 (18)	0
Immunization data	12 (70)	2 (12)	3 (18)	0
Radiology reports	11 (65)	2 (12)	3 (17)	1 (6)
Problem list	10 (59)	3 (18)	4 (23)	0
Other diagnostic reports	7 (41)	1 (6)	9 (53)	0
EKG tracings	5 (29)	0	12 (71)	0
Clinical notes	4 (24)	4 (24)	7 (41)	2 (12)
Psychiatric notes	1 (6)	0	8 (47)	8 (47)
Discharge summaries	5 (29)	3 (18)	8 (47)	1 (6)
Operative reports	3 (18)	1 (6)	13 (76)	0
Pathology reports	4 (23)	1 (6)	9 (53)	3 (18)

^*Decisions made for data release for each type of data element per institutional representative.

PHR, personal health record.

Our survey results indicated that organizations with internally developed systems had made fewer decisions for the release of clinical data elements compared with organizations with vendor systems: 51% (49/96) versus 78% (138/176). However, organizations with internally developed systems withheld fewer data elements than vendor systems: 8% (8/96) versus 15% (27/176). Additionally, of the systems that were operational for more than 5 years, 52% (50/96) of the data elements were still not available and had no policy decision yet compared to 20% (35/176) of the data elements for systems that had become operational within the last 5 years.

The majority of the problem lists made available were based on a clinician maintained EHR problem list. Of the sites that did not make a problem list available, most were not yet maintaining a clinician documented problem list in their EHR. However, providing patients with their problem list also highlights a broader issue of understanding what the data provided mean. One hospital representative stated: ‘You need to think about the context in exposing content such as the problem list. Clinicians and patients perceive it differently. Pregnancy does not mean it is a problem pregnancy because it is on the list. So we decided to rename it to ‘your condition’ list.’

Another respondent summarized a general guideline used by his institution to determine what data types should be made available: ‘If it is deemed sensitive or better communicated personally then it is not communicated through the PHR.’ In contrast, another institution followed the principle that the data are owned by the patient and, therefore, no data should be withheld. However, to date this institution only releases medication data and is conducting pilot testing for releasing other data types, with planned time delays for laboratory data. One other institution has made all data available; yet this availability includes the constraint that anything containing potentially sensitive results, including radiology and pathology reports, is available only upon provider release. In some cases state law influenced the data made available to patients. For example, California and Washington have strict restrictions on the types of data, specifically sensitive patient data, which can be released in a PHR.

Across the institutions, clinical notes are one of the last data types made available. Interestingly, the most cited ‘contentious issue’ was clinician resistance and anticipated worry about making clinical notes available to patients. Survey participants whose institutions made clinical notes available, however, reported that clinicians' anticipated worry of releasing any ‘contentious’ data types had not materialized into problematic situations once the data were released.

Timing of releasing data

Table 3 shows the variability in the timing of data release for data types that are made available by institutions. The time delays before a data type is released to the patient vary between institutions and within institutions depending on the type of data, with a range of 1–14 days. The delay for most laboratory results is between 1 and 3 days, with one institution having a 10-day delay. The time delay for radiology results ranges from 1 to 7 days and the range for pathology results ranges from 7 to 14 days. One academic medical center delays the release of all data until 24 h after hospital discharge and 48 h after an outpatient appointment. Sometimes delays are in terms of business days to allow providers time to review the data. Most institutions used a combination of the options in table 3 for making data available, depending on the type of data. For example, one institution made about 350 ‘routine or common’ laboratory results available immediately, approximately 6600 laboratory results that are performed less frequently or require interpretation available with a time delay, all radiology results available with a longer time delay, and all clinical notes available only upon provider release.

Table 3.

Lag times for data made available

Data types (n=total organizations that make data type available or functionality in development)	Available instantly (%)*	Time delay (%)*	Only upon provider release (%)*	Time delay or provider release (%)*
Laboratory results (n=17)	5 (29)	8 (47)	0	4 (24)
HIV results (n=3)	2 (66)	0	1 (33)	0
Genetic test results (n=7)	6 (86)	0	1 (14)	0
Medication list (n=16)	15 (94)	1 (6)	0	0
Encounter type and date (n=14)	13 (93)	1 (7)	0	0
Allergy data (n=14)	14 (100)	0	0	0
Immunization data (n=14)	13 (93)	1 (7)	0	0
Radiology reports (n=13)	5 (38)	4 (31)	3 (23)	1 (8)
Problem list (n=13)	9 (69)	0	1 (8)	0
Other diagnostic reports (n=8)	5 (63)	1 (13)	2 (25)	0
EKG tracings (n=5)	4 (80)	1 (20)	0	0
Clinical notes (n=8)	6 (75)	0	2 (25)	0
Psychiatric notes (n=1)	0	0	1 (100)	0
Discharge summary (n=8)	6 (75)	1 (13)	1 (13)	0
Operative reports (n=4)	2 (50)	1 (25)	1 (25)	0
Pathology reports (n=5)	1 (20)	2 (40)	2 (40)	0

^*Percent of organizations that made each type of data available to patients, or were in the process of doing so at the time of the interview.

Governance

Only 50% (8/17) of the organizations had explicit governance in the form of a written policy that outlines the data types made available to patients. Almost 90% (15/17) of the organizations enabled a proxy, such as a family member, to have access to a patient's data. Excluding one organization that only cares for adult patients, 88% of the organizations had a policy for dealing with access to minors' data. In some cases, the policies for access to minors' data was implicit in the functionality (eg, all data access was turned off for patients between 14 and 17 years of age) or the policy was an organization-wide health information management policy and not PHR specific.

Eighty-eight percent (15/17) of the organizations used a committee structure for the decision-making process and included senior management and information services. All of the organizations included clinicians as decision-makers or sought input from clinicians related to data access and functionalities of the PHR. Seventy-one percent (12/17) sought patient input in the form of user feedback on the system and 35% (6/17) included patient representation on decision-making committees (one organization sought patient input through both methods). Approximately 50% or fewer of the organizations sought input for decision-making processes from other hospital services or experts: legal (9/17), health information management (7/17), privacy (5/17), compliance (3/17), risk management (3/17), access services (2/17), and product business owner (1/17).

Discussion

We surveyed a broad sample of healthcare organizations that provide patients with PHR access. Our findings suggest that PHRs are still evolving. They are maturing in the functionalities offered, and some PHRs have a large number of users. We noted that several organizations that initially developed applications internally have switched or are preparing to switch to commercially available PHRs.

Among the survey participants, there was diversity in the set of data that was made available to patients via PHRs and the timing for releasing information. One reason for the diversity may be a difference in guiding principles. For example, some organizations subscribed to the philosophy that ‘the patient owns the data’ and that most information should be available instantly upon demand. Other organizations maintained that the same data should be withheld for a time to allow providers an opportunity to review and communicate the information. Our results highlight that organizational data release policies must consider questions beyond technological requirements to maintain the privacy and security of health information, such as the ethical question of ‘who owns the data?’¹³

The diversity may also reflect the relatively sparse information in the biomedical literature on the potential benefits of making data available to patients. For example, 95% of hospital patients in one survey reported a desire to review their medication list for accuracy, and felt that their participation in reviewing medications has the potential to reduce errors.^{14 15} However, evidence is scarce regarding the benefits or disadvantages of providing patients with access to other types of data, such as pathology reports, operative notes, and genetic test results. Others have questioned whether presenting patients with information about psychiatric diagnoses might impede therapy or decrease patients' trust in clinicians.¹³ It is also important to note that some states (eg, Washington and California) have specific laws preventing the release of sensitive data such as HIV test results and genetic testing.

Our results suggest that institutions are at different levels in the evolutionary path of PHR deployment. Many organizations that reported high utilization of their online portal had been using it for many years. Other factors that may be associated with the volume of use include the types of data made available, the presence of specialty functions such as messaging capabilities and structured e-visits, and the level of internet access and health literacy within the targeted patient population.⁷ Additionally, we found that some institutions choose to implement a PHR from the same vendor who supplied their EHR and the implementation of these two systems was coupled using a site-by-site, phased-in approach. These findings raise the question of whether in the future most institutions will use a tethered PHR from their EHR vendor, build their own PHR, or use a data release model (eg, HealthVault).

A large number of organizations plan to develop and implement PHRs in the near future¹ and knowledge of the successful elements identified by early adopter organizations and the rationales behind their policy decisions will be critical for late adopters. One such lesson, a consistent theme among the institutions surveyed, was that, per report of the institutional representative, clinicians are wary of making their notes available to patients. According to several of the institutional representatives whose online portals contain physician notes, the clinicians' initial concerns were overcome, and most were supportive of clinical notes being shown to patients. It is interesting to compare this finding with the results of the ongoing, multi-site OpenNotes project, which is providing patients with electronic access to their clinical notes and evaluating the expectations and subsequent experiences of patients and their providers.¹⁶ Further research is needed to identify and understand clinicians' perceptions of PHR data release both before and after implementation.

Among the institutions surveyed, we found several types of data that were not available to patients via the online portal, and for which a policy decision had not yet been made regarding the future availability of the data. Some of these data were specialty-specific, such as EKG tracings, operative reports, and pathology reports. While there are many possible reasons why these data were not available through the various portals, it is possible that some medical subspecialties are more resistant to the idea of sharing data with patients than others. Further research is needed to determine the relationship between the evolutionary path of data release and patterns of clinician adoption.

As PHR adoption progresses, the online data access policies of healthcare organizations will indirectly impact the types of data contained in PHRs that are not linked to a specific institution, such as Microsoft HealthVault. We know that a lack of information access makes patients feel alienated and anxious and that over time it is likely that consumers will increasingly expect direct and fast access to their health records.^{17 18} In the ‘non-tethered’ PHR model, patients must grant permission for a provider to transfer their data. The policies of the provider or the provider's organization will impact the release of data. Therefore, non-tethered PHRs must have a model that accommodates the data release policies of the organizations from which they are receiving data, and then make those policies known to their users. As the use of PHRs grows, the lack of standardization in data available and data release policies may have a significant impact on patients' knowledge, engagement, and health.

The results of our study highlight an important gap between the current practices of organizations that support PHRs and a set of standardized ‘best practices’ for making data available to patients online. While studies assessing the impact of PHRs on patients' behavior and outcomes is limited, we know that patients do report wanting to see their health information, and that informed and engaged patients have higher satisfaction and better health outcomes.^{5 14 15 19–23} In addition to patients' and clinicians' concerns and expectations regarding online access to data, healthcare delivery organizations that provide PHR portals must address a variety of new and evolving legal, privacy, and regulatory issues. Among these issues are how to deal with proxy access to a patient's data (eg, for children or elders), and how to accommodate access for adolescents. Healthcare delivery organizations must also plan for online patient-to-provider messaging, anticipate liability issues related to data availability, and prepare for possible changes in reimbursement structures. All of these policy topics highlight that within a large organization, electronic data access and integrated data exchange have cultural as well as technological barriers.⁷ Therefore, appropriate provider engagement related to workflow issues, the release of sensitive health information that requires clinical interpretation, and reimbursement for electronic interactions is critical to the adoption and meaningful use of EHRs and PHRs.^{5 7 8 24 25} The development of new knowledge surrounding PHR adoption and meaningful use will likely originate from the organizations surveyed in this study that have already struggled with organizational policies and challenges.

To be eligible for the federal ‘Meaningful Use’ Stage 1 incentive payments, healthcare organizations must provide patients with their data within 48 h of a request. Interestingly, some institutions have data release policies that require provider release or use a lag time for data release that is greater than 48 h. For example, the Stage 1 criteria do not indicate what data should be made available. Future stages of Meaningful Use will likely specify the method and content of data to be made available. Perhaps institutional policies will change as additional stages of Meaningful Use criteria are finalized, and hopefully, the early adopter institutions can provide valuable input in this process. Standardization through Meaningful Use may help reduce variability in online data access methodologies, and provide healthcare organizations with a structure upon which they can base their policy decision making. Even so, the provocative policy questions identified through our research may be broader than the aims of the Meaningful Use incentive program.

Limitations of the structured telephone survey data include the potential that the survey was not a representative sample of all healthcare organizations with PHRs. For example, it is possible that some eligible healthcare organizations were not identified. However, the high response rate and the identification of eligible organizations from the literature, PHR experts, and snowball sampling lend strength to the data collected. An additional limitation is that the data collected originated from a single representative of each institution and may reflect the biases of the participants (eg, the clinician perspective may be under-represented). Moreover, the researchers did not have direct access to data such as user accounts and logins.

Conclusion

In summary, a majority of the healthcare organizations that have implemented online PHR portals at this time generally appear to be institutions with sufficient financial, intellectual, and human capital resources as evidenced by their ability to support internal development and maintenance, PHR governance, and continuing implementation and deployment efforts. This descriptive study increased our understanding of current PHR practices. Broadly, many of the PHR policies are similar in nature, with variability at the level of data types made available and the methods and timing for release of that data. Future research is needed to determine best practices. Knowledge about the reasoning and rationale behind the similarities and differences between existing policies will be useful in the development of best practice guidelines and for the evaluation of the impact of PHRs on patient outcomes and health disparities. Meaningful Use and patients' increasing and appropriate expectations for online access to their health data will result in another wave of institutions embarking on the development of PHRs and may provide an opportunity to reduce the variability in data release policies. To achieve high quality patient care, healthcare institutions' decision making and policy formation should be supported with guidance and best practices for PHR policy development and implementation.