Falling short: how state laws can address health information exchange barriers and enablers

Abstract

Objective

Research on the implementation of health information exchange (HIE) organizations has identified both positive and negative effects of laws relating to governance, incentives, mandates, sustainability, stakeholder participation, patient engagement, privacy, confidentiality, and security. We fill a substantial research gap by describing whether comprehensive state and territorial HIE legal frameworks address identified legal facilitators and barriers.

Materials and Methods

We used the Westlaw database to identify state and territorial laws relating to HIEs in effect on June 7, 2016 (53 jurisdictions). We blind-coded all laws and addressed coding discrepancies in peer-review meetings. We recorded a consensus code for each law in a master database. We compared 20 HIE legal attributes with identified barriers to and enablers of HIE activity in the literature.

Results

Forty-two states, the District of Columbia, and 2 territories have laws relating to HIEs. On average, jurisdictions address 8.32 of the 20 criteria selected in statutes and regulations. Twenty jurisdictions unambiguously address ≤5 criteria in statutes and regulations. None of the significant legal criteria are unambiguously addressed in >60% of the 53 jurisdictions.

Discussion

Laws can be barriers to or enablers of HIEs. However, jurisdictions are not addressing many significant issues identified by researchers. Consequently, there is a substantial risk that existing legal frameworks are not adequately supporting HIEs.

Conclusion

The current evidence base is insufficient for comparative assessments or impact rankings of the various factors. However, the detailed Centers for Disease Control and Prevention dataset of HIE laws could enable investigations into the types of laws that promote or impede HIEs.

BACKGROUND AND SIGNIFICANCE

Health information technology (HIT) infrastructure is critical to sustaining long-term health care innovation. To support HIT infrastructure, the Health Information Technology for Economic and Clinical Health (HITECH) Act’s Meaningful Use regulations promote adoption of interoperable electronic health record systems and incentivize the exchange of health information among health care providers. Further, the Office of the National Coordinator for Health Information Technology supports the creation of health information exchanges (HIEs) to facilitate the sharing of patient health data among providers and across health care settings (note that we use the abbreviation “HIE” to refer exclusively to organizations that facilitate information exchange among health care providers, as opposed to the act of exchanging data).¹

Traditionally, unaffiliated entities stored health information in disparate systems, or “data siloes.” HIEs are electronic platforms that break down data silos by sharing and receiving patient data across multiple organizations. Critically, HIEs have the potential to advance instances of coordinated and calculated episodes of patient care and improve the quality of health care, while reducing duplication of care and waste.² By supporting HIT infrastructure, HIEs can enable future HIT applications like precision medicine and learning health systems that demand data portability, while maintaining appropriate privacy and security protections.^3,4

Accordingly, there has been significant momentum behind increasing their implementation and use throughout the United States. In 2014, 76% of US hospitals were exchanging data via HIE, representing an 85% increase in exchange activity since 2008 and a 23% increase since 2013.⁵ Use by independent and community providers, however, remains lower, with 39% of office-based physicians reporting HIE usage in 2012.⁶

Despite the potential benefits, HIEs are underutilized, full integration remains elusive, and several barriers prevent their implementation and operation, including issues relating to governance, resource deficiencies, stakeholder involvement, patient privacy and consent, and data protection.^2,7,8 Researchers have identified and advocated for select HIE attributes to promote implementation and operation. HIE laws relate to many of these issues.

Law is a barrier to and enabler of HIEs

HIT is heavily regulated.^9–13 A myriad of federal laws, including the Health Insurance Portability and Accountability Act, HITECH, the Privacy Act, and the Common Rule research protections, regulate uses of health information.^14–16 Still, the federal framework is relatively simple in comparison to the state framework of >2300 state statutes and regulations relating to electronic health information.^9,17 In addition to the persistence of antiquated laws, overlapping, conflicting, and inconsistent state and federal laws add complexity and threaten efforts to promote information exchange nationally.^9,17–19 In 2007, few states had enacted or considered legislation designed to eliminate information exchange barriers, but the number of states considering legislative changes increased in the years leading up to, and following, HITECH.¹⁹ This highly complex legal framework threatens to stall innovation.^9,20–23

HIEs are especially vulnerable in this highly complex legal framework. Many laws protect the same health information HIEs share, but HIE-specific laws can permit certain activities. Moreover, state-controlled or -operated HIEs often require specific legislation to define their scope of authority. States with privately operated HIEs often have laws that establish a governance framework to ensure that they are operating responsibly in their jurisdictions. Further, laws can promote HIE utilization with incentives or mandates, and establish requirements for privacy and security. Abundant research on HIE implementation and operation identifies law as having both positive and negative effects on HIE success.² Despite this recognition, a substantial research gap exists in the role of a comprehensive HIE legal framework to support HIEs in the United States.

Barriers and enablers identified in the literature

In this section, we will address several factors cited in literature as barriers to or enablers of HIE implementation. Then, we describe how states address these factors in their laws.

Governance

Oversight, policies, procedures, and operational mechanisms are key components of successful HIEs.²⁴ A formalized HIE governance body can clarify resource priorities and facilitate operations.²⁵ Alternatively, an insufficient governance structure can impede statewide HIE implementation and is considered a threat to HIE sustainability.^2,25

Statewide HIE implementation case studies suggest that appointing a nongovernmental state-designated entity (SDE) improves technical and market expertise as well as impact on the state budget.^26,27 Accordingly, those researchers recommend SDE or a state-SDE partnership governance structure over a state-only governance approach.^26,27 Many who favor a state-governed model allege that supporting the governance entity with appropriate statutes and regulations “would eliminate or address many of the issues and limitations of existing [HIE] models.”²⁸

Privacy, confidentiality, and security

Privacy, confidentiality, and security are critical issues among providers and patients.^29,30 While legal privacy or confidentiality protections can intuitively seem counterproductive with regard to increased data exchange, at least 2 studies indicate that these laws might promote HIE implementation and operation.^29,31 The studies suggest that privacy and confidentiality laws might encourage critical patient support.^29,31 Similarly, laws with security requirements have been cited as important to address stakeholder concerns.³² Still, overly restrictive privacy, confidentiality, or security requirements can be burdensome to patients and providers.³³

Participation incentives and mandates

The Agency for Healthcare Research and Quality (AHRQ) identifies a “lack of critical mass electronically exchanging data” as a top barrier to widespread HIE implementation.² Laws and policies that incentivize or even mandate HIE participation aim to address critical mass deficiencies. Financial incentives are frequently cited as necessary to overcome initial cost barriers, promote widespread implementation, and increase provider participation rates.^29,32,34,35 Beyond financial incentives, some studies identify HIE-related liability immunity laws as incentives for participation by eliminating the concern of future legal costs.³⁶

Mandates are a stronger policy lever and may be necessary to combat health care providers’ economic interest in withholding data from competitors. Information-blocking practices hurt patient-friendly benefits, such as decreases in unnecessary hospital admissions, radiological exams, and lab tests.^37,38 In a congressional report, researchers recommended mandates for provider contributions to HIEs and penalties for refusing to contribute.^32,34

HIE participation beyond providers: public health, payers, clinical research, and patients

HIEs must demonstrate and maintain their value to ensure long-term sustainability. An HIE’s value increases as it becomes more useful to additional stakeholders.^35,38,39 Consequently, researchers recommend policies that permit expanded HIE use by public health agencies, providers, pharmacies, and laboratories.^40–42 Other research suggests that laws and policies supporting health care payer engagement can enhance HIE operation and value by promoting insurance coverage, better case management, reduction of unnecessary medical services, efficient Medicaid prior authorization, quality improvement, and cost reductions.^41,43–45

HIEs can also promote clinical research and health care practice. Researchers recommend laws and policies facilitating research uses of HIE data to support clinical studies.⁴⁶ Moreover, increased use of HIE by clinical researchers could improve clinical practice. Several scholars argue that HIEs can serve as a platform for a “learning health system” that integrates the clinical evidence base at the point of care.^47–49

Patients are perhaps the most important and invested HIE stakeholder group. HIEs can benefit patients by improving access to their health information, increasing care coordination, decreasing health care costs, and providing personalized health care reminders and alerts.⁵⁰ However, surveys of HIE informants suggest that patient-centered HIE tools require further developments in law and policy.⁵⁰

Funding and financial sustainability

Funding and long-term sustainability are critical HIE issues. Legislative authorizations constrain state-controlled or -operated HIEs, so they need a specific legal authority to receive grants and private donations, or require participant fees. Without these laws, state HIEs are limited in their financial strategic planning.

OBJECTIVE

This research identifies states that are addressing these factors in their laws. It addresses a substantial research gap in how comprehensive state law frameworks support HIEs.

METHODS

We followed accepted policy surveillance research guidelines.^51,52 We identified statutes and regulations relating to HIEs in effect on June 7, 2016, using the Westlaw legal database. We limited jurisdictions to US states, territories, and the District of Columbia with statutes and regulations in Westlaw. We included laws if they related to HIEs, ie, organizations that facilitate access to identifiable health information among different entities for the purpose of patient treatment.

We used general and targeted search terms to identify HIE laws. Table 1 includes a list of all search terms used to identify relevant laws in all included jurisdictions. We identified the terms in Table 1 through a literature review and a preliminary review of HIE laws. To supplement the searches in Table 1, we searched Westlaw using approximately 150 US HIE trade names, using Google and Wikipedia articles for the Health Information Exchange and Regional Health Information Organization (accessed June 6, 2016).

Table 1.

Search terms used for all jurisdictions

Search terms
adv: SD(“health information exchange”)
adv: SD(“health information organization”)
adv: SD(“HIE”)
adv: SD(“HIO”)
adv: SD(“RHIO”)
adv: SD(“record locator service”)
adv: SD(“master patient index”)
adv: SD(“clinical data repository”)
adv: SD(“continuity of care document”)
adv: SD(“clinical decision support”)
adv: SD(“health information network”)
adv: SD(“electronic health record network”)
adv: SD(“health records exchange”)
adv: SD(“health data exchange”)
adv: SD(“health information partnership”)
adv: SD(“learning health system”)
adv: SD(“clinical data exchange”)
adv: SD(“health information highway”)
adv: SD(“health information system”)
adv: SD(“e-health partnership”)
adv: SD(“health information initiative”)
adv: SD(“e-health network”)
adv: SD(“medical information network”)
adv: SD(“clinical information exchange”)
adv: SD(“health data organization”)

We developed our coding scheme through a 4-stage iterative process: (1) question development, (2) question testing using a sample of legal provisions, (3) question adequacy analysis, and (4) question revision. We developed initial draft questions based on significant HIE features and functions identified by the literature and an initial review of laws in 10 jurisdictions. We repeated the question revision process 4 times. We coded each jurisdiction on the finalized coding criteria, consisting of 80 questions.

Prior to the final revision, we tested the questions on a trained legal researcher who had not interacted with the researchers during the coding process. This served as a check on potential convergence bias between blinded coders developed from research process interactions. We then revised the questions to reduce the likelihood that other researchers would interpret coding questions differently when evaluating the same law.

Two independent blinded researchers coded legal provisions within each jurisdiction. Researchers coded data in a custom Microsoft Access database. After coding sessions, researchers analyzed and corrected coding discrepancies in peer-review meetings. We recorded consensus codes in the master database. Blinded coders had initial agreement on 87.6% of the questions.

We performed 2 additional validation steps to lessen the likelihood that laws outside our scoping criteria would invalidate our findings. First, we evaluated laws that more generally relate to the act of exchanging health information (as opposed to an HIE entity). Second, we examined laws that primarily relate to electronic health records but implicate an HIE as identified by a study of electronic health information laws by Schmit et al.⁹

The literature identifies at least 9 broad legal themes believed to be important to the function and future of HIEs. Since our coding questions relate to types of provisions observed in the laws (in addition to legal issues discussed in the literature), not all of the 80 coding questions relate to legal issues discussed in the literature. Therefore, we selected and matched 20 coding questions that most closely relate to the 9 broad legal themes reflected in the literature (See Table 2).

Table 2.

Legal themes reflected in HIE literature and associated assessment questions

Legal theme	Coding question
Governance	Does the law authorize implementation of a statewide HIE?
	Who retains control over the statewide HIE’s operations?
Participation Incentives and Mandates	Does the law incentivize HIE participation (excluding funds to be spent solely on HIE creation or implementation)?
	Does the law provide immunity from liability for the HIE/health information organization or its participants?
	Does the law mandate that any providers must access or contribute to HIE data?
Funding and Sustainability	Does the law address HIE funding?
	Does the law specify funding sources to cover initial HIE implementation costs?
	Does the law specify funding sources for long-term operability?
HIE Participation and Use	Does the law authorize state and local health authorities to access the HIE?
	Does the law authorize any other state agency or entity (other than public health) to access the HIE?
	Does the law authorize medical labs to convey medical test results through HIE?
	Does the law authorize pharmacists and pharmacies to access the HIE (eg, for the purposes of filling prescription drug orders and documenting other pharmaceutical care)?
	Does the law authorize educational or other research institutions to access HIE data through an HIE portal or user interface (excluding research requiring express consent for the use of an individual’s information)?
	Does the law authorize payers to access HIE data?
Patient Engagement	Are patients authorized to access their HIE data electronically through a portal or user interface (ie, excluding access to e-mailed, faxed, or mailed copies of their records)?
	Does the law include provisions that address public transparency of HIE activities, including but not limited to public participation in HIE policy and public disclosures of policies, operations, and activities?
Privacy	Does the law require privacy protections for HIE (excluding direct reference to state or federal privacy laws)?
	Is patient consent required for disclosure of patient data in the HIE?
Confidentiality	Are there express duties for providers or other HIE users to protect patient data from unauthorized access/disclosure?
Security	Does the law address administrative, technical, or physical safeguards to secure HIE data (excluding direct references to state or federal laws)?

RESULTS

We identified HIE laws in 42 states, the District of Columbia, and 2 territories (Puerto Rico and the US Virgin Islands). Eight states do not have HIE laws (Alabama, Georgia, Hawaii, Indiana, Michigan, Montana, South Dakota, and Tennessee). On average, jurisdictions address 8.32 of the 20 criteria selected in statutes and regulations. Twenty jurisdictions unambiguously address ≤5 criteria in statutes and regulations (Table 3).

Jurisdiction	Participation Incentives and Mandates			Funding and Sustainability			Privacy		Confidentiality	Security
	Participation incentives	Legal immunity	Provider mandates	HIE funding	Implementation funding sources specified	Long-term funding sources specified	Specific HIE privacy protections	Patient consent requirements	Specific HIE confidentiality duties	Specific security requirements
AK	Nonfinancial			Yes	Yes	Yes	Yes	Opt-Out	Yes	Yes
AL
AR		Both		Yes		Yes	Yes	Opt-In	Yes
AZ							Yes	Opt-Out	Yes	Yes
CA	Nonfinanciala			Yes	Yes	Yes	Yes	Opt-Ina	Yes	Yes
CO	Financial						Ambiguousb		Ambiguousb	Ambiguousb
CT	Financial		Yes	Yes	Yes	Yes	Yes			Yes
DC				Yes	Yes	Yes
DE		Both	Yes	Yes		Yes	Yes	Ambiguousc	Yes	Yes
FL		HC Provider					Yes	Opt-In	Yes
GA
HI
IA	Both	HC Provider		Yes	Yes	Yes	Yes	Opt-Out	Yes	Yes
ID				Yes	Yes	Yes
IL	Financial	HC Provider		Yes	Yes	Yes	Yes	Opt-Out	Yes	Yes
IN
KS	Both	Both		Yes			Yes	Opt-Out	Yes	Ambiguousb
KY	Both	HIE	Yes	Yes	Yes	Yes	Yes		Yes	Ambiguousb
LA	Financial			Yes	Yes
MA	Both		Yes	Yes	Yes	Yes	Yes	Opt-In		Yes
MD	Financial	Ambiguousd	Yes	Yes			Yes	Opt-Out	Yes	Yes
ME		HC Provider					Yes	Opt-Out	Yes	Ambiguousb
MI
MN	Financial		Yes	Yes	Yes	Yes	Yes	Opt-In		Yes
MO
MS		Both		Yes	Yes	Yes	Ambiguousb			Ambiguousb
MT
NC		HC Provider	Yes	Yes		Yes	Yes	Opt-Out		Yes
ND	Financial	HC Provider	Ambiguousc	Yes	Yes	Yes	Yes	Opt-Out	Yes	Yes
NE
NH		Both		Yes	Yes	Yes	Yes	Opt-Out	Yes	Yes
NJ
NM	Nonfinancial	Both					Yes	Opt-Out	Yes
NV		HC Provider		Yes	Yes	Yes	Yes	Ambiguousc	Yes	Yes
NY	Both		Yes				Yes	Opt-In	Yes	Yes
OH		Both					Yes	Opt-Out	Yes	Yes
OK							Ambiguousb	Opt-In	Ambiguousb	Ambiguousb
OR							Ambiguousb		Ambiguousb	Ambiguousb
PA				Yes	Yes	Yes	Yes	Opt-Out	Yes	Ambiguousb
PR		Both		Yes	Yes	Yes	Ambiguousb		Ambiguousb	Yes
RI		HC Provider		Yes	Ambiguous*	Yes	Yes	Opt-In	Yes	Yes
SC
SD
TN
TX	Both	Both	Yes	Yes	Yes	Yes	Yes	Voluntary (not specified)	Yes	Yes
UT		Both					Yes	Opt-Out	Yes	Yes
VA
VI		Both					Yes	Opt-Out
VT	Both		Yes	Yes	Yes	Yes	Yes		Ambiguousb	Yes
WA	Financial			Yes	Yes	Yes	Yes			Yes
WI	Financial			Yes	Yes		Yes	Voluntary (not specified)
WV		Both	Yes	Yes	Yes	Yes	Yes	Opt-Out	Yes	Yes
WY

^aLegal provisions for HIE pilots.

^bCoded “Ambiguous” if the law only references “privacy,” “security,” or “confidentiality” without any additional specific guidance.

^cCoded “Ambiguous” if the law either satisfies the coding criteria or not, depending on differing reasonable interpretations of the terms of the law.

^dCoded “Ambiguous” if the law addresses novel theories of liability or causes of action without specificity.

Table 3.

Differences in state and territorial HIE laws (June 2016)

Jurisdiction	Governance		HIE Participation and Use						Patient Engagement
	Law authorizes statewide HIE	Entity granted HIE operational control	Health authority access	Other state agency access	Medical lab access	Pharmacy access	Research institution access	Payer access	Patient access	Public transparency
AK	Yes	SDE	Yes	Yes	Ambiguousa	Ambiguousa		Yes	Yes	Yes
AL
AR	Yes	SDE	Ambiguousb	Ambiguousb	Yes	Yes		Yes
AZ									Yes	Yes
CA	Yes	State option	Yesc	Yesc	Ambiguousa,c	Ambiguousa,c	Ambiguousb	Yesc	Ambiguousb	Yes
CO						Ambiguousa
CT	Yes	SDE	Yes		Yes	Yes	Yes		Yes	Ambiguousd
DC	Yes	SDE	Yes				Yes
DE	Yes	SDE	Yes	Yes	Yes	Yes		Yes	Yes	Yes
FL	Ambiguousd	Ambiguousd						Yes
GA
HI
IA	Yes	Ambiguousd	Yes	Yes		Yes	Yes	Yes	Yes	Yes
ID	Yes	State entity	Yes							Yes
IL	Yes	State entity	Yes	Yes	Yes		Yes	Yes		Yes
IN
KS	Yes		Yes		Ambiguousa	Ambiguousa		Yes		Yes
KY	Yes	State entity	Yes	Yes	Yes	Yes		Yes	Yes	Yes
LA			Yes			Yes
MA	Yes	State entity	Yes	Yes		Ambiguousa		Yes	Yes
MD	Yes	SDE	Yes		Yes	Yes		Yes	Yes	Yes
ME	Yes	SDE						Yes
MI
MN	Yes	SDE	Yes	Yes		Yes		Yes		Yes
MO			Yes	Yes	Ambiguousa	Ambiguousa		Yes
MS	Yes	SDE			Yes	Yes		Yes
MT
NC	Yes	State entity	Yes	Yes	Ambiguousa	Ambiguousa	Yes	Yes
ND	Yes	State entity	Yes	Yes	Ambiguousa	Ambiguousa	Ambiguousb	Yes	Yes
NE	Ambiguousd		Yes			Yes
NH	Yes	SDE	Yes		Ambiguousa	Yes			Yes
NJ	Yes
NM					Ambiguousa	Yes
NV	Yes	State option			Ambiguousa	Yes		Yes	Yes
NY	Yes	State entity	Yes	Yes	Yes			Yes		Yes
OH					Ambiguousa	Ambiguousa		Yes		Yes
OK	Yes	State entity	Yes	Yes	Yes	Ambiguous
OR					Yes	Yes
PA	Yes	State entity	Yes		Yes	Yes		Yes		Yes
PR	Yes	SDE	Ambiguousb		Ambiguousa	Ambiguousa		Ambiguousb
RI	Yes	SDE	Yes		Yes	Yes			Yes	Yes
SC	Ambiguousd		Yes
SD
TN
TX	Yes	SDE	Yes	Yes	Yes	Yes		Yes
UT	Ambiguousd		Yes	Yes	Yes	Ambiguousa		Yes
VA								Yes
VI			Yes	Yes	Ambiguousa	Ambiguousa	Ambiguousb
VT	Yes	SDE	Yes	Yes				Yes	Yes	Yes
WA	Yes	SDE	Yes		Yes	Yes		Yes	Yes	Yes
WI	Yes	SDE	Yes	Yes		Yes		Yes
WV	Yes	SDE	Yes		Yes	Yes		Yes	Yes	Yes
WY			Yes

^aCoded “Ambiguous” if the law authorizes the use of an HIE for “treatment” or to “facilitate health care,” unless otherwise mentioned (includes criteria under b and d).

^bCoded “Ambiguous” if the law references potential HIE participants in a “legislative declarations” or “legislative findings” section but does not clearly indicate that a participant would actually use the HIE (includes criteria under d).

^cLegal provisions for HIE pilots.

^dCoded “Ambiguous” if the law either satisfies the coding criteria or not, depending on differing reasonable interpretations of the terms of the law.

Thirty-one states address the creation of a statewide HIE in law. Nine of those states leave control of the statewide HIE to a state entity, 17 have designated a non-state entity (SDE) to control the statewide HIE, and 2 states have reserved the option to control the HIE. The remaining states have laws with ambiguous language relating to governance structure.

Thirty-one states address privacy with specific legal provisions. Five states use the term “privacy” but do not specifically detail the extent of privacy rights. Twenty-five states give patients a choice regarding participation in the HIE, with 16 states describing an opt-out consent procedure, 8 states describing an opt-in procedure, and 2 states ambiguously describing a voluntary HIE. Only 23 states impose specific confidentiality duties on HIE users, and 5 states mention confidentiality without providing additional specific requirements. Twenty-three states address security with specific language. Eight states use the term “security” but do not specifically describe required security measures.

Only 19 jurisdictions address HIE participation incentives, with 9 addressing financial incentives, 3 addressing nonfinancial incentives, and 7 addressing both financial and nonfinancial incentives. Twenty-one states provide some form of HIE liability immunity: 8 provide immunity to providers, 1 provides immunity to the HIE, and 12 provide immunity to both providers and the HIE. Eleven states have established HIE participation mandates for health care providers.

Thirty-two states have authorized public health officials to use the HIE, and 18 states have authorized other government agencies to access the HIE. Sixteen states have authorized medical laboratories and 20 have authorized pharmacies to use the HIE. Only 5 states have unambiguously authorized the use of the HIE for research. Twenty-eight jurisdictions have authorized payer use of the HIE.

Fifteen states have laws that authorize patients to use the HIE to access their records or communicate with their providers, and 18 states have laws that increase public transparency or otherwise promote public engagement in HIE activities.

Just over half the jurisdictions (28) address HIE funding in the law. Twenty-two have identified funding sources for implementation and 24 have identified long-term funding sources.

DISCUSSION

The AHRQ evidence report on HIEs posits the question: How can HIE be implemented so as to result in the greatest benefit for patients, clinicians, and health systems with the least cost and harm?² State laws defining the legal authority and restrictions of HIEs are part of the answer. The AHRQ report identifies laws as both positive and negative influencers of HIE success.² Unfortunately, few states have laws that reflect recommendations in the literature. Moreover, we identified 8 states that do not have any statutes or regulations relating to HIE and are not using statutes or regulations to support it.

Governance: designate an entity to operate HIE

Several researchers conclude that adopting a statewide HIE would ensure that comprehensive patient records will be accessible wherever patients receive care in the state.²⁵ However, only 31 of the 53 jurisdictions (58.4%) have laws establishing a statewide HIE. Other HIE researchers recommend that states use an SDE or a state-SDE partnership governance framework to take advantage of private sector technical expertise and market shrewdness, to lessen state budget pressures and constraints.²⁶ However, only 17 states have laws that give an SDE operational HIE control, while 2 states reserve the option to control the HIE and 2 states are ambiguous on HIE control. Moreover, 9 of the 31 states with a statewide HIE law assign control to a state entity, contrary to the researchers’ recommendations.

Privacy, confidentiality, and security: establish HIE-supporting protections

Privacy, confidentiality, and security are important issues concerning both providers and patients.^29,30,32 Moreover, evidence suggests that laws that protect health information might promote HIE implementation and operation.^29,31 About 60% of states have laws addressing privacy, while fewer than half of all states address confidentiality or security with specific language. Interestingly, several states have laws that only reference privacy (5), confidentiality (5), or security (8) without describing any specific legal requirements. At best, unspecific laws encourage patient support by creating an illusion of legal protections. At worst, ambiguous laws create confusion among providers and HIEs about what the law actually requires, creating imagined barriers to data exchange.

Participation incentives and mandates: implement laws to encourage critical mass use

The absence of a “critical mass” of users exchanging data is the most commonly cited HIE barrier.^2,53–55 If few users are exchanging data, it is less likely that an individual search will be successful in finding relevant health records, and fewer health care providers will find the HIE useful in their daily practice. Consequently, an HIE’s value is largely dependent on widespread use and participation. Incentives, both financial and nonfinancial, are widely cited as legal mechanisms that can promote HIE participation.^{2,27,31,41,56,57} Yet, only 19 states offer incentives, with 9 states addressing financial incentives, 3 states addressing nonfinancial incentives, and 7 states addressing both.

Additional evidence suggests that legal immunity can incentivize HIE participation. For example, a case study of Texas’s statewide HIE identifies liability concerns as a barrier to HIE participation and recommends granting legal immunity to incentivize participation.³⁶ Only 21 states grant legal immunity to HIEs or health care providers, with 1 state providing immunity to the HIE, 8 states providing immunity to health care providers, and 12 states providing immunity to both providers and the HIE.

Participation mandates provide a strong policy lever to increase the number of users, improve HIE value, and prevent information-blocking behaviors. For example, hospitals in competitive markets might be less willing to share patient data with outside entities.⁵⁸ Some studies suggest that states might need laws to mandate HIE use and prevent deliberate efforts to block information exchange.^{2,31,32,34,38,57} However, only 11 states have legal mandates for providers to use HIEs.

HIE uses and participants: data use restrictions stall HIT’s social benefits

Numerous studies suggest that an HIE’s value increases when a variety of participants (eg, public health authorities, laboratories, and pharmacies) add new functionalities and services.^35,38,39 Only 32 states address public health uses of HIE data via law, and 18 states address HIE use by other government agencies through law. The numbers for laboratories and pharmacies are even lower. Only 16 states address HIE use by laboratories and 20 states address pharmacy use. However, ambiguously worded laws can authorize laboratory and pharmacy use in 12 and 13 states, respectively.

Research uses of HIEs hold significant promise for the future of HIT.^2,46,49 However, state laws might pose a significant barrier to such usage. Only 5 states address HIE use for research. Moreover, stringent protections for identifiable health information are notoriously vexatious to health data analytics.

While data protections are important, restrictions on health data use stall socially beneficial research and HIT applications. Meanwhile, data analytics of private data flourishes in other fields, such as government surveillance, political campaigns, and commercial marketing, without similar protections. Utilizing HIE infrastructure to facilitate precision medicine, patient-centered outcomes research, and comparative treatment effectiveness research would improve access to data and accelerate clinical research. Moreover, HIE infrastructure could be critical to the creation of a true learning health system capable of gaining knowledge from each patient encounter and giving health care providers treatment options supported by the best evidence available for each patient.^47–49

Payers are significant HIE stakeholders and are often required to shoulder the cost of HIE operations on the assumption that they will derive many of the cost-saving benefits.⁴⁴ Payer representatives surveyed in 2016 suggested that allowing greater payer access and participation in HIE would increase the value by enabling greater health care gap identification, quality measurement, and population analytics, and by helping to reduce the per capita cost of health care.⁴⁴ However, laws are silent on payer participation in HIEs in all but 28 states.

Patients are also a critical stakeholder group. Increasing patient involvement in HIE activities has the potential to improve an HIE’s value to both providers and patients.⁵⁰ While research suggests that patient-centered HIE tools require legal and policy developments, fewer than 1 in 3 states have laws that authorize patients to use an HIE to access their records or communicate with their providers.⁵⁰ In some cases, HIE sustainability is linked to patient marketing efforts.^2,59 However, only 18 states have laws that increase public transparency or otherwise promote public engagement in HIE activities.

Despite the apparent value of including a diverse array of stakeholders in HIE activities, there is evidence supporting a simplified approach to HIE. A retrospective study of NHS.net in the United Kingdom suggests that complexity in stakeholder arrangements might impede HIE implementation.⁶⁰ However, a barrier to initial implementation should not necessarily be considered a perpetual barrier to long-term HIE operation, sustainability, and development. Moreover, long-term sustainability will likely depend on business models that can leverage the value created by multiple stakeholder groups (eg, researchers, public health, payers), and laws authorizing or restricting stakeholder involvement will be consequential.

Funding and financial sustainability: empower HIEs to achieve sustainability

Insufficient HIE funding is a well-recognized barrier to HIE adoption and long-term sustainability. Researchers recommend models where multiple stakeholders, including payers, contribute to HIE financing.⁶¹ Others recommend subscription fee models that take into account hospitals’ and providers’ capacity to support HIE sustainability without being overly burdensome.⁴¹ The AHRQ report emphasizes that HIE “requires considerable investment by sponsors, which have included governments as well as health care organizations.”²

While the federal HITECH Act provided a substantial but short-term boost to HIE funding, HITECH monies are dwindling. As of 2012, 74% of HIEs were dependent on grant funding and struggling to develop models for financial sustainability.⁶¹ A substantial drop in federal funding could prove disastrous to HIEs in states without a viable sustainability plan.³² Despite this pressure, only 28 jurisdictions have laws addressing HIE funding, and only 24 jurisdictions have laws identifying funding sources for long-term sustainability.

States without HIE laws

We found 8 jurisdictions without HIE laws. Implementing new laws is not easy. Political obstacles, competing legislative priorities, and the absence of compelling evidence are all barriers to implementing new HIE laws. Moreover, legislation is one of many strategies to support HIEs.

While existing literature suggests that some laws enable HIEs, there are other relevant factors. For example, a viable business plan is critical for an HIE’s success. While laws can shape the boundaries of permissible economic activities, daily business decisions can have more immediate impact on an HIE’s sustainability.

There is also a growing body of literature suggesting that complex legal frameworks can impede emerging technologies like HIT.^9,20–23 While some empirical studies have demonstrated positive associations between laws and HIE outcomes, these studies are narrow and do not examine the comprehensive legal framework. Consequently, there is a plausible alternative hypothesis that HIEs are more likely to succeed in states with less complex legal frameworks. Until now, no study has comprehensively measured HIE legal frameworks to test this hypothesis against the existing recommendations in the literature.

Limitations

Many factors are relevant to the impact of a law. Differences in interpretation, implementation, organizational capacity, funding, enforcement, legal awareness, cultural acceptance, and political priorities can all affect the impact of identically worded laws across different jurisdictions. Moreover, changes to laws will likely affect well-established HIEs differently than newly emerging HIEs. Future research using these data to evaluate the impact of laws on HIEs should carefully consider these factors.

We used recommendations reported in the literature as the basis for our comparisons, but the existing evidence base has “very significant limitations.”² Few of the literature’s recommendations have been systematically and rigorously tested as called for by the AHRQ evidence report.² Consequently, it is possible that some recommendations overestimate the power of law to fix the difficult issues associated with HIE. For example, Indiana is one of the 8 jurisdictions without HIE laws, yet the Indiana Health Information Exchange is one of the largest and has operated successfully since 2004.⁶² This underscores the need to evaluate the impact of these laws rigorously using scientific legal research methods.

CONCLUSION

This study reveals that many states have not addressed critical HIE issues via law. The AHRQ evidence report highlights many ways that law can be a facilitator for or barrier to HIEs, but the report also cautions that the current evidence base does not permit comparative assessments or impact rankings of the various factors.²

This new Centers for Disease Control and Prevention (CDC) dataset of HIE laws addresses the current evidence gap. It contains data on 80 legal attributes related to HIEs; we report only 20 attributes in this paper. We believe that all legal attributes contained in this dataset will have value to future empirical research on HIE effectiveness and implementation. However, the existing literature lacks specificity to explore the implications of legal variations between jurisdictions meaningfully.

Comparative impact studies using these data could provide insight on the specific types of laws that tend to promote or impede HIE use. While measuring HIE success is difficult, quantitative and qualitative measures of HIE utilization exist, including interoperable exchange capability, usage reports, care coordination, and reductions in duplicated procedures.^63–65 Future research should explore whether implementing certain types of laws that promote stakeholder HIE participation, incentivize HIE use, establish specific HIE models (ie, public, private, hybrid), or contain specific data protections are related to improvements in HIE utilization and sustainability metrics over time.

FUNDING

This work was supported by the US Centers for Disease Control and Prevention, Office for State, Tribal, Local, and Territorial Support, Public Health Law Program.

COMPETING INTERESTS

The authors have no competing interests to declare.

CONTRIBUTORSHIP

CDS and SAW contributed to the conception and design of the work; the acquisition, analysis, and interpretation of data for the work; and drafting the work and revising it critically for important intellectual content. BAK contributed to the analysis and interpretation of data for the work and revising the work critically for important intellectual content. All authors provided final approval of the manuscript version to be published and agree to be accountable for all aspects of the work in ensuring that questions related to the accuracy or integrity of any part of the work are appropriately investigated and resolved.