Health System Transformation and the Role of Health Information Law

Increasingly, transforming the American health-care delivery system into one that is more patient-centered, value-based, and coordinated is understood to be an essential step in improving both patient and population health. For this type of system transformation to occur, health information is crucial. This installment of Law and the Public's Health examines the legal dimension of health information and considers its implications for public health policy and practice.

BACKGROUND

Experts and stakeholders have long agreed that the current health-care system is unsustainable. By 2020, health-care spending will comprise almost 20% of the gross domestic product.¹ Furthermore, an enormous and growing body of evidence suggests that, as measured by key quality indicators such as potentially avoidable hospital readmissions and patient mortality, health care is not experiencing the types of improvements that would justify this steep cost growth.^2–5

The Patient Protection and Affordable Care Act (ACA) was a seminal event in the progress toward transforming the American health-care delivery system.⁶ Many of the programs and initiatives authorized by the provisions of the ACA hold the potential to reduce the rate of cost growth, improve health-care quality, and strengthen the bonds between health care and public health as a central element of system transformation. These programs include financial and nonfinancial incentives for provider performance measurement reporting, public reporting, performance that generates desired outcomes (e.g., value-based purchasing), and new payment and care delivery models that foster greater levels of care coordination between and among providers and across settings of care.

Critical to the success of these programs and the ultimate goal of a transformed health-care system is the real-time electronic exchange of patient health information. Experts agree that greater access to patient health information is integral to improving the quality, efficiency, and safety of health-care delivery.^3,7 However, little progress has been made toward determining how patient health information, both administrative and clinical, may be electronically shared in real time between and among providers; across settings of care; and with consumers, patients, payers, and other third parties (e.g., a data aggregator or personal health record vendor). Furthermore, there is a significant amount of uncertainty about current federal and state legal requirements that protect the privacy and security of patient health information. The financial incentives for the meaningful use of electronic health records (EHRs), authorized under the 2009 Health Information Technology for Economic and Clinical Health (HITECH) Act (part of the American Reinvestment and Recovery Act),⁸ have driven measurable progress recently. But, arguably, the lack of widespread electronic health information exchange (HIE) is the greatest remaining barrier to achieving truly coordinated, patient-centered health care.

ELEMENTS OF DELIVERY SYSTEM TRANSFORMATION

Provider quality measurement and reporting

The Centers for Medicare – Medicaid Services has implemented numerous provider quality measurement and public reporting programs (e.g., the Hospital Inpatient Quality Reporting Program⁹ and the Hospital Compare website¹⁰). Most of these programs were extended under the ACA and new programs were authorized (e.g., home health and hospice).¹¹ Initially, these programs used only quality measures calculated from administrative data that could easily be extracted from claims. As clinical information has become more readily accessible from electronic sources such as EHRs, the number of available measures has grown significantly. Many private payers have developed similar programs to compare their network providers and make this information available to their enrollees.

Despite this significant progress, these measurement programs typically only assess the performance of single providers (e.g., a hospital or physician practice) in a single setting of care. They do not capture information about the quality of care a patient experiences across an episode of care that may include a physician office visit, inpatient hospital procedure, and post-acute care (e.g., physical therapy). Measures are being developed that will be able to capture the quality performance of a medical team (e.g., a physician, hospital, and rehabilitation facility) across providers and settings of care. However, the implementation of these measures is hampered by the lack of electronic exchange of patient information. Furthermore, provider performance on existing quality measures is hampered by the providers' lack of real-time access to related patient health information.

Value-based purchasing

Public and private payers also are moving beyond measuring and reporting provider quality performance to linking reimbursement to actual performance. For example, reimbursement rates for hospitals participating in the Medicare program are adjusted according to their performance on a specific set of quality measures.¹² However, similar to the quality measurement and reporting programs, these value-based purchasing programs are designed to financially incentivize higher-quality care delivered by a single hospital or single physician practice. This single-provider approach is in large part the result of the way the health-care reimbursement system was built—siloed payment structures organized by provider type. Yet, this is exactly the barrier that health-care delivery transformation is intended to break down. Only when different provider types (e.g., a medical team) responsible for the care of a single patient are held jointly accountable for the care of a patient through value-based purchasing arrangements will the system experience real change. But this change requires the electronic exchange of patient health information.

Testing and implementing new payment and care delivery models

Building on existing programs, the ACA authorized financial incentives for a number of new payment and care delivery models designed to overcome the current siloed approach to health-care delivery and reimbursement. These new models include accountable care organizations (ACOs),¹³ medical homes,¹⁴ health homes,¹⁵ readmissions penalties,¹⁶ and bundled payment demonstrations.¹⁷ All of these reforms share a common goal of aligning care delivery across providers and settings of care to achieve a more patient-centered and coordinated approach to health-care delivery. However, one of the early lessons from these programs and demonstrations is that truly achieving patient-centered care and improving the quality and coordination of care is not possible without access to patient clinical and administrative information at the point of care. For example, even though the ACA specifically authorized ACOs to receive Medicare claims data,¹³ challenges exist to build systems that can transfer real-time patient data and to design data-sharing arrangements that meet federal and state law requirements.

ENCOURAGING HIE

EHR incentive program

In addition to the financial incentives available for quality measurement and reporting and new models of care delivery that may support HIE activities, HITECH authorized significant financial incentives for eligible physicians and hospitals that can demonstrate that they are “meaningful users” of EHRs. Demonstrating meaningful use requires meeting specific performance requirements based on a set of core and optional quality measures. In addition to incentives for meaningful use, physicians and hospitals participating in the Medicaid program may elect to receive advance funds to support the acquisition and implementation of EHR systems.⁸

The EHR meaningful use incentive program has been successful in increasing the numbers of physicians and hospitals using EHRs. But there is still a fundamental lack of electronic HIE occurring across settings of care and providers. While this lack of cross-setting HIE may be improved in future stages of the EHR meaningful use incentive program, which includes measures of actual care coordination facilitated by HIE, it is still nascent. Furthermore, a significant portion of the provider community, especially post-acute care and long-term care providers, is not eligible for incentive payments in the EHR meaningful use incentive program. As such, implementation rates among these providers remain low, even though these providers are often better positioned to avoid complications and readmissions with real-time clinical information. For example, 12% of short-term acute care hospitals have a basic EHR system compared with 6% of long-term acute care hospitals, 4% of rehabilitation hospitals, and 2% of psychiatric hospitals.¹⁸ Close to one-third of all Medicare patients discharged from short-term acute care hospitals are discharged to post-acute care settings, such as rehabilitation hospitals, but there is little capacity in the system today to support electronic HIE across these settings.

BARRIERS TO HIE

Uncertainty about legal requirements

The privacy and security of patient health information is governed by a series of federal and state laws that are not always consistent and certainly not uniform. These legal frameworks include the Health Insurance Portability and Accountability Act (HIPAA),^19,20 the Privacy Act of 1974,²¹ the Common Rule,²² the Federal Information Security and Management Act,²³ federal regulations protecting patient information involving substance abuse and mental health issues,²⁴ and myriad state laws that protect the privacy and security of patient health information. Furthermore, amendments to HIPAA authorized by HITECH expand the range of entities that are subject to HIPAA and increase penalties for HIPAA violations.⁸ Experts agree that these privacy and security standards are imperfect. Furthermore, there is a high degree of uncertainty regarding the requirements, coupled with a high degree of sensitivity about the privacy and security of patient health information in general.⁷ This legal complexity has challenged the development and implementation of arrangements between entities to facilitate the exchange of patient health information in a way that complies with applicable laws and regulations.

Lack of financial incentives across systems

There are increasing opportunities for providers to secure financial incentives for improving the quality of care they provide through the use of EHRs. But these programs are largely provider-specific (e.g., inpatient hospitals, physician practice groups, and nursing homes). Arguably, provider performance in these programs will be enhanced through sharing patient information electronically with other providers who are involved in the patient's care (e.g., a hospital providing an electronic discharge summary to a nursing home at the time of discharge is likely to reduce the chance that the patient will be readmitted to the hospital, thus avoiding readmission penalties for the hospital). However, what is really needed are programs and measures that incentivize information sharing and coordination of care across settings and that link financial incentives to the collective provider team (e.g., bundled payments that must be allocated across different provider types for the care of a single patient across settings of care). It is anticipated that Stage 3 of the EHR meaningful use incentive program will promote this type of cross-setting exchange of patient health information; however, Stage 3 will begin no earlier than 2016.²⁵

Lack of uniform governance structures for data exchange

Since 2001, several efforts to define a common or uniform governance structure for electronic HIE have been launched. For example, in 2001, the National Committee on Vital and Health Statistics released recommendations for a nationwide HIE that identified a three-dimensional structure (i.e., personal health, health-care provider, and population health).²⁶ From 2005 to 2008, the U.S. Department of Health and Human Services (HHS) Office of the National Coordinator of Health Information Technology (ONC) worked to develop and implement a draft model data use and reciprocal support agreement as a framework to guide the obligations of all participants (or trusted entities) in the National Health Information Network.²⁷ In 2007, the Agency for Healthcare Research and Quality released a request for information (RFI) to gather information on stakeholder perspectives regarding the need for and potential role of data stewardship entities that would manage data in a safe and secure manner.²⁸

In May 2012, the ONC issued an RFI on a broad range of topics, including whether there should be a voluntary program to validate entities that facilitate HIE, the scope and requirements for such entities, and a process to assess readiness of these entities.²⁷ It is unclear at this point whether or when the ONC may release additional guidance on this issue, and there has been little progress toward the widespread adoption of earlier governance efforts.

LOOKING AHEAD: COMMON GOVERNANCE RULES AND CONSENT FORMS

Need for uniform governance rules

As providers, health plans, states, community collaborative organizations, and other stakeholders develop and implement models of care delivery, with increased attention to coordinating patient care supported by access to real-time patient health information across providers and settings of care, a uniform set of governance rules is needed to assist them in developing appropriate arrangements to facilitate the exchange of patient information in accordance with applicable federal and state laws. While the laws and regulations are complex and vary by state, certain core elements should be incorporated into arrangements involving the exchange of patient health information:

• (1) Clear understanding and written descriptions of roles and responsibilities for all participants. All participants should be considered trusted sources and stewards of information.

• (2) Clear understanding and written descriptions of how the patient health information will be transmitted and used, to whom the data will be returned or released, and in what format (e.g., identifiable or de-identified data, quality performance results). These activities must be allowable under applicable federal and state laws.

• (3) Creation of a data use agreement signed by all parties and applicable to all non-de-identified data that stipulates the penalties and remedies for any misuse of the data (e.g., unauthorized disclosure, loss, or misuse).

• (4) The ability of patients to authorize the use, release, or disclosure of personal health information.

Common consent forms

One common element of most privacy and security laws is the right of patients to access their data and consent to or authorize their providers and others to share their health information for specified purposes. For example, under HIPAA, there are only two required instances in which a covered entity must release protected health information: (1) to the HHS Secretary to determine compliance with HIPAA and (2) to the patient. In developing new models of care delivery facilitated by greater exchange of patient health information across providers and settings of care, a common consent form may prove a useful tool. Such a form could be used to obtain authorization to share a patient's health information across a team of providers that may or may not be directly involved in treating the patient at a given point in time. The following elements would be important to include:

• (1) A description indicating to whom the patient health information may be released,

• (2) A description of the purpose or purposes for which the patient health information may be released,

• (3) A statement that the patient may revoke the authorization at any time,

• (4) A statement that the authorization will be reviewed and renewed periodically, and

• (5) The patient's signature.

IMPLICATIONS FOR PUBLIC HEALTH POLICY AND PRACTICE

As the transformation of the U.S. health-care delivery system continues, the sensitive legal and policy issues surrounding the exchange of patient health information will become increasingly acute. Ideally, uniform governance rules and common consent forms could achieve the delicate balance between the importance of greater access to patient health information to support system transformation while preserving appropriate levels of privacy and security. These resources hold the potential to not only support providers and other stakeholders who are working toward new coordinated models of care, but also ease concern related to the use and disclosure of health data. More fundamentally, this transformation may also require revisiting the underlying laws and regulations that govern health information privacy and security to determine whether more systemic changes are needed.

If, as a matter of public health policy and practice, stakeholders and policy makers are not able to address these critical and sensitive issues, the exchange of patient health information will continue to be limited and, ultimately, progress toward a truly transformed health system will be limited as well. Furthermore, beyond the transformation of the health-care delivery system, weather-related and other public health emergencies continue to highlight the critical importance of electronic access to patient health information. In such cases, paper documents and files are lost, leaving consumers and their providers with no record of care, medical history, or even current prescription information. To ensure the public health, safety, and sustainability of the U.S. health-care system, a balanced approach is needed that enables patient health information to freely flow between and among providers, consumers, payers, and other third parties as necessary through a trusted system with appropriate privacy and security protections.