HHS rules give patients ‘unprecedented’ access to health data
Patients will soon have what HHS called “unprecedented” secure and free access to their health information.
Two rules finalized by the HHS Office of the National Coordinator for Health Information Technology (ONC) and CMS — meant to carry out the interoperability and patient access provisions under the 21st Century Cures Act — will allow patients to access their health data using apps so that they can make better health care decisions.
“These steps will dramatically improve American patients’ experience in health care,” Secretary Alex Azar said in a conference call with reporters. “This is truly a major milestone and historic day in health care.”
Cris Ross, MBA, MS, chief information officer at the Mayo Clinic in Minnesota, explained how the access to data envisioned by HHS differs from what is currently allowed through the online portals that many health systems and insurance companies provide patients.
“A portal provides a way for an organization to share everything they know or as much as they choose to share with the patient,” he said in an interview. “Now, with the final rules, health systems are required to provide an interface so that a patient can come to their health care systems with essentially any app, receive their information and combine their information from many providers into one place.”
Will patients take advantage?
Christopher Longhurst, MD, MS, chief information officer at the University of California San Diego Health, co-authored a paper that described how patients at 12 “geographically diverse” health systems were able to download their electronic health information via technology similar to what is proposed in the HHS rules.
The results, published in JAMA Network Open, suggested that patients will not rush to take advantage of the technology, Longhurst told Healio Primary Care.
“The demand on the consumer side for this data has yet to be demonstrated,” he said. “It's a bit of a chicken and egg. Is that because consumers are not going to find as much value in this data as people think? Or is it because the data is not yet widely available enough and when it is consumers will want the access?”
However, despite the findings, Ross said patients should embrace the technology.
“A significant percentage of our patients have signed up for our online portal and other data that we make available to them,” he said. “We know that our patients want to receive information and use it elsewhere. They access their information all the time.”
Ross noted that some health systems might experience difficulty meeting the rules’ security requirements.
“The tricky bit will be authenticating patients are who they say they are before their records are released,” he continued. “The government is requiring protections similar to those that are in place for other consumer products like banking and travel reservations.”
Ross also suspected that system security will be an ongoing issue as the rules are implemented.
“As professionals, we need to continue to evolve how we protect privacy and security all the time,” he said. “I would expect that we'll continue to put things in place that provide even more protection than these rules require.”
HHS and CMS officials said that payers involved in Medicare Advantage, Medicaid and CHIP must begin providing the technology by Jan. 1, 2021. Longhurst and Ross had differing opinions on whether that was enough time for the technology to be implemented.
“Since most of the hospital and clinic groups are using electronic health record systems already, EHR vendors should be prepared to provide at least technical capability to meet this rule,” Ross said. “Though meeting the deadline may be a challenge for some health systems, I'm optimistic that most will make a strong, good faith effort towards implementing these rules.”
Longhurst said he had concerns about the “unintended consequences” of the short deadline.
“Eight and a half months is a quick turnaround time,” he said. “I’m worried that reassigning engineering resources to the government effort will slow down progress in other areas. We could also inadvertently create cybersecurity risks.” – by Janel Miller
CMS. CMS Interoperability and Patient Access final rule. https://www.cms.gov/Regulations-and-Guidance/Guidance/Interoperability/index. Accessed March 10, 2020.
ONC. ONC’s Cures Act Final Rule supports seamless and secure access, exchange, and use of electronic health information. https://healthit.gov/curesrule. Accessed March 10, 2020.
Disclosures: Azar, Longhurst and Ross report no relevant financial disclosures.