Updating HIPAA for the electronic medical record era

Abstract

With advances in technology, patients increasingly expect to access their health information on their phones and computers seamlessly, whenever needed, to meet their clinical needs. The 1996 passage of the Health Insurance Portability and Accountability Act (HIPAA), modifications made by the Health Information Technology for Economic and Clinical Health Act (HITECH), and the recent 21st Century Cures Act (Cures) promise to make patients’ health information available to them without special effort and at no cost. However, inconsistencies among these policies' definitions of what is included in “health information”, widespread variation in electronic health record system capabilities, and differences in local health system policies around health data release have created a confusing landscape for patients, health care providers, and third parties who reuse health information. In this article, we present relevant regulatory history, describe challenges to health data portability and fluidity, and present the authors’ policy recommendations for lawmakers to consider so that the vision of HIPAA, HITECH, and Cures may be fulfilled.

INTRODUCTION

The Health Insurance Portability and Accountability Act (HIPAA) of 1996 ushered in a new era for health data privacy, access, and sharing.^1–3 The act enshrined a number of rights for Americans receiving health care, including—through its Privacy Rule—the right of an individual to access their health information in the form and format they prefer, so long as a covered entity can readily produce such information. The HIPAA Privacy Rule was modified as the result of the HITECH (Health Information Technology for Economic and Clinical Health) Act of 2009, which updated the individual right of access to include electronic information maintained by covered entities and their business associates.⁴ Subsequent and related regulatory decisions have fundamentally changed the landscape for how health data are generated and stored across the country by encouraging widespread adoption of electronic health records (EHRs), patient portals, and application programming interfaces (APIs).⁵ Taken together, the Privacy Rule and the HITECH Act have encouraged an environment where Americans should have easy access to their health records.⁶

As we eclipse 10 years since passage of HITECH, Two trends are on a collision course: increasingly patients expect access to their health information on their phones, through their computers, and readily available for their clinical needs.^7–14 Meanwhile, health systems grapple with rapidly growing volumes of patient data, compounding long-standing challenges in managing such data for care, research, billing, and fulfilling patients’ information requests.^15,16 The broad nature of concepts defined in HIPAA around what should be included in health records released to patients upon request has allowed health care organizations to interpret the definitions differently and apply them inconsistently.¹⁷ These variations have led to discrepancies in the information provided to patients regarding the medical records release process and confusion over how to comply with federal and state regulations.¹⁵

In this article, we present relevant regulatory history, describe challenges to health data portability and fluidity, and present the authors’ policy recommendations for both the administration and the 116^th Congress to consider so that the vision of HIPAA and HITECH may be fulfilled. Authors include members of the American Medical Informatics Associationand the American Health Information Management Association. Policy recommendations are those of the authors, but reflect current principles the respective associations have endorsed.

BACKGROUND

The passage of HIPAA in 1996 and the subsequent modification made by HITECH marked the culmination of bipartisan efforts to protect Americans’ rights to portable health coverage as they moved between jobs, to ensure the integrity of their health data, and to access their health information in convenient ways.^1,3,18,19 Specifically, HIPAA’s Privacy Rule specifies that a patient has the right to access their protected health information in 1 or more “designated record sets,” (DRSs) maintained by a covered entity.⁵ Covered entities are generally health care providers, health plans, and health care clearinghouses.²⁰ This right to access was extended by HITECH to guarantee that if a patient’s health data are stored electronically, there is an expectation that patients be able to access their health data electronically whenever possible, or when such information is readily producible.

The US Department of Health & Human Services defines the DRS broadly as (1) medical and billing records maintained by or for a covered health care provider; (2) health plan enrollment, payment, claims adjudication, and case management records; and (3) other records that are used for medical decision-making.⁴ The Privacy Rule further states that the term “record” refers to “any item, collection, or grouping of information that includes protected health information and is maintained, collected, used, or disseminated by or for a covered entity.”^4,21,22 Guidance released by the Health and Human Services Office for Civil Rights in 2016 known as the “FAQs on Access Guidance” added detail to this expansive definition stating that the DRS may include, “medical records, billing and payment records, insurance information, clinical laboratory test results, medical images, such as X-rays; wellness and disease management program files; and clinical case notes; among other information used to make decisions about individuals.”⁴

CHALLENGES FOR HIPAA IN THE ELECTRONIC AGE

Today, defining the DRS is complicated because EHR systems may have different designs, functions, data structures, and interfaces. When HIPAA was enacted in 1996, only a handful of hospitals and few physician offices used EHRs. With the help of HITECH’s more than $34 billion in incentives, nearly all hospitals²³ and roughly 80 percent of physician offices²⁴ use an EHR system today. Further, the resulting EHR Incentive Program known as “Meaningful Use,” required providers to adopt patient portals, which allow individuals to “view, download, and transmit (to a third party)” their health information.²⁵ The Office of the National Coordinator’s (ONC) 2015 Edition Health IT Certification Criteria defined the Common Clinical Data Set (CCDS), which included vocabulary and content standards for clinical data exchange, including immunizations, unique device identifiers, assessment and plan of treatment, goals, and health concerns.²⁶ The CCDS further expanded the accessibility and availability of data exchanged by including enhanced data export and API capabilities. Unfortunately, the CCDS omits valuable information contained in all EHRs (such as clinical notes), falls well short of the DRS definition, and leaves patients without an ability to access most of their health information. The Table 1 indicates the different data contained in the different health record data sets, including CCDS, US Core Data for Interoperability (USCDI), DRS, and electronic health information (EHI).

Table 1.

Specified and Defined Health Data Record Sets. The Common Clinical Data Set (CCDS) is specified by the Office of the National Coordinator’s 2015 Edition Health IT Certification Criteria. The US Core Data for Interoperability (USCDI) is an expanded set of data specifications defined in ONC’s 2019 Notice of Proposed Rulemaking to improve the interoperability of frequently exchanged health data. The Designated Record Set (DRS) is the HIPAA Privacy Rule-specified set of protected health information that a patient has the right to access from a covered entity. Electronic Health Information (EHI) is an expanded set of health data proposed in ONC’s 2019 Notice of Proposed Rulemaking to implement various provisions of the 21^st Century Cures Act.

Data Type	CCDS	USCDI	DRS	EHI
Assessment and Plant of Treatment	X	X	X	X
Care Team Members	X	X	X	X
Clinical Notes		X	X	X
Goals	X	X	X	X
Health Concerns	X	X	X	X
Immunizations	X	X	X	X
Labs	X	X	X	X
Medications	X	X	X	X
Patient Demographics	X	X	X	X
Problems	X	X	X	X
Procedures	X	X	X	X
Provenance		X	X	X
Smoking Status	X	X	X	X
Unique Device Identifiers for Implantable Devices	X	X	X	X
Vital Signs	X	X	X	X
Pediatric Vital Signs		X	X	X
Allergies			X	X
Family History			X	X
Medical Imaging			X	X
Specimen			X	X
Molecular Sequence			X	X
Wellness and disease management profiles			X	X
Clinical Case Notes			X	X
Nutrition Order			X	X
Vision Prescription			X	X
Risk Assessment			X	X
Coverage			X	X
Coverage Eligibility			X	X
Enrollment			X	X
Claims			X	X
Payment			X	X
Account			X	X
Charge Item			X	X
Contract			X	X
Explanation of Benefits			X	X
Insurance Plan			X	X
Research Study			X	X
Research Subject			X	X
Question			X	X
Evidence Variable			X	X
Quality Measures			X	X
Medical records and billing records about individuals maintained by or for a covered health care provider;			X	X
Enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or			X	X
Other records that are used, in whole or in part, by or for the covered entity to make decisions about individuals. This last category includes records that are used to make decisions about any individuals, whether or not the records have been used to make a decision about the particular individual requesting access.			X	X
Business planning, development and management records that are used for business decisions more generally rather than to make decisions about individuals				X
A hospital's peer review files				X
Practitioner performance evaluations				X
Health plan quality control records				X
Formulary development records				X
Any other information that identifies the individual, or with respect to which there is a reasonable basis to believe the information can be used to identify the individual and is transmitted by or maintained in electronic media, as defined in 45 CFR 160.103, that relates to the past, present, or future health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual.				X

An additional challenge is that while HIPAA defines “covered entities,” federal regulations provide no definition or guidance for those software companies that leverage consumer technologies to produce and manage individually identifiable health information. These companies are known as HIPAA noncovered entities (NCEs). HIPAA NCEs may produce or maintain tools that access individuals’ health data, including medical information, exercise and personal tracking records, dietary logs, social media posts, etc.²⁷ For example, Apple Health Record and Patients Like Me represent archetypes of NCEs, but Fitbit and Facebook could also be considered HIPAA NCEs. As the line between traditional medical information systems used by covered entities and emerging consumer devices and software provided by HIPAA NCEs continues to blur, policy makers will need to consider whether current consumer protections—generally considered the purview of the Federal Trade Commission—are sufficient. For example, HIPAA’s right to access does not extend to NCEs capturing similar health data. This gap leaves patients without any right to a rapidly growing body of their own personal health data. Further, the HIPAA right of access is but one important provision that NCEs need not adhere to; none of the other Privacy and Security Rule provisions apply either.

RECENT STEPS

With enactment of the 21st Century Cures Act of 2016,^28,29 Congress sought to address a host of complaints related to EHR interoperability and further broaden what data should be available for patients to access. Specifically, Cures defines health data interoperability as (1) enabling secure exchange of electronic health information without special effort on the part of the user; (2) allowing for complete access, exchange, and use of all electronic health information under applicable state or federal law; and (3) avoiding intentional information blocking. In March 2019, ONC announced new policies enacting these provisions of the Cures Act.²⁸ The new policies included a formal proposal to adopt an expanded version of the CCDS, known as the US Core Data for Interoperability (USCDI), establishment of a new regulatory definition for “electronic health information (EHI),” and a series of policies meant to enable patients to have access to their data through APIs “without special effort” and at “no cost.”^28,30 ONC proposes to define EHI in terms that mirror the HIPAA concept of Individually Identifiable Health Information,³¹ although ONC does not reference this concept specifically. ONC clarifies that under its proposed definition, EHI is expansive and “may be provided, directly from an individual, or from technology that the individual has elected to use, to an actor covered by the information blocking provisions.”²⁸ As envisioned by ONC’s proposals, beginning in 2022, EHRs must make data included as part of the USCDI available through patient portals and via APIs. Further, the ONC proposal would require EHRs to provide patients access to all their EHI through an “EHI export,” enforced through newly proposed “information blocking” prohibitions. However, the ONC definition of EHI seems more expansive than the HIPAA-defined DRS, potentially widening the current delta between the HIPAA right of access policy and certified EHR functionality.

In the meantime, growing movements such as OpenNotes have resulted in tens of millions of patients having complete, easy access to clinic notes via patient portals.^32–35 Today, over 30 million Americans have access to their clinical notes as part of the OpenNotes movement.^36,37 Studies conducted since the original OpenNotes demonstration project continue to validate the project’s findings that note-sharing helps patients take better care of themselves without creating additional anxiety.^33,35,38 However, despite this mounting evidence,³⁹ note-sharing is not universal, and even leading institutions are reluctant to implement the concept in practice. Currently, less than 10 percent of the nation’s 5000 hospitals engage in note-sharing. At present sharing notes is subject to agreement by the health care organization hosting the web portal, and enrollment of patients in using that portal. These factors can lead to confusion among patients and doctors who experience different data availability as they move from one health system to another. While ONC’s proposed rule includes a technical specification that would allow EHRs to better exchange and integrate clinical notes among disparate EHRs as part of the USCDI, these technical updates would not encourage note-sharing directly with patients or their designated caregivers.

POLICY RECOMMENDATIONS

We believe that the existing HIPAA policies and strategies around patient access to their health data need refinement. There has been a long-standing discordance between what federal policy requires and what technology and organizational policies have delivered as part of HIPAA’s individual right of access. And while ONC attempts to align EHR functionality with HIPAA’s policy, a concerted effort to operationalize concepts devised by regulators into practice will be needed.

The broad definitions established by HIPAA were developed long before common use of EHRs, mobile apps, and other kinds of health technology that have become commonplace. As more than 96 percent of all hospitals have adopted EHRs,²³ we must rethink how to better ensure individuals’ right of access in a data-centric world. We present specific recommendations for policy makers in Table 2. If adopted, these recommendations would better align HIPAA’s rules around individual access to health data with the current realities of electronic medical records and the expectations of modern, engaged patients.

Table 2.

Authors’ recommended steps to policy makers for modernizing HIPAA

Align the HIPAA right of individual access with Health IT Certification
	Policy makers should take concerted action to align HIPAA’s right of access with Health IT certification so individuals can view, download, or transmit health information electronically to a third party and access the information via application programming interfaces (APIs). Specifically, lawmakers should revise the definition of the designated record set and require certified Health IT to provide the amended designated record set to patients electronically while maintaining computability.
Extend the HIPAA individual right of access to non-covered entities (NCEs)
	Noncovered entities managing individual health data, such as mHealth and health social media applications, should be subject to uniform right of individual access— regardless of covered entity, business associate, or other commercial or legal status.
Encourage electronic medical record data and clinical note-sharing with patients.
	Promote efforts such as OpenNotes through Medicare and Medicaid payment programs, such as the Merit-based Incentive Payment System and other innovative payment models under the oversight authority of CMS.

CONCLUSION

Federal laws and regulations stemming from HIPAA, HITECH, and Cures have made significant improvements to enshrine individuals’ rights to access their health records and direct how those records are used. However, these policies have not kept pace with advances in technology, diffusion of health IT across diverse sectors of health care, or patients’ expectations that their health information be available to them immediately and electronically.⁴⁰ Furthermore, due to ambiguity of how HIPAA and Cures concepts are defined in regulation, covered entities inconsistently implement federal regulations regarding patient access. These inconsistencies create additional confusion on the part of patients and providers. The authors present specific recommendations for policy makers to consider as they look to modernize HIPAA and HITECH. Policy makers must be thoughtful in how they define key concepts meant to deliver this foundational right to patients, and they must ensure that certified technology can operationalize policy.

AUTHOR CONTRIBUTIONS

All authors contributed equally to the text and perspectives expressed in this manuscript, and all authors reviewed and approved the final drafts.

CONFLICT OF INTEREST STATEMENT

None declared.