May 9, 2006

The Honorable Michael O. Leavitt

Chairman

American Health Information Community

200 Independence Avenue, S.W.

Washington, D.C. 20201

Dear Mr. Chairman:

The American Health Information Community has identified and prioritized
several health information technology applications, or "breakthroughs,"
that could produce specific tangible value for healthcare consumers. To
address one of these breakthrough areas, the Electronic Health Records
(EHR) Workgroup was formed and given the following broad and specific
charges:

> **Broad Charge for the Workgroup:** Make recommendations to the
> Community on ways to achieve widespread adoption of certified EHRs,
> minimizing gaps in adoption among providers.
>
> **Specific Charge for the Workgroup:** Make recommendations to the
> Community so that within one year, standardized, widely available, and
> secure solutions for accessing current and historical laboratory
> results and interpretations are deployed for clinical care by
> authorized parties.

The Workgroup's deliberations highlighted a number of key issues with
respect to the specific charge:

1.  The need to support all of the necessary steps in the evolutionary
    path toward a patient-centric flow of laboratory results data

2.  The urgent need for endorsed, adopted, and interoperable vocabulary,
    messaging, and implementation standards that can be applied to
    enable the exchange of laboratory results data

3.  The potential barriers posed by the Clinical Laboratory Improvement
    Amendments of 1988 (CLIA) and Health Insurance Portability and
    Accountability Act of 1996 (HIPAA) regulations that may hinder
    electronic laboratory results data exchange in a patient-centric
    manner, particularly in States that have more stringent privacy laws

4.  Technical considerations relating to privacy and security with
    respect to patient and provider authorization and authentication,
    including accurate patient identification and linkage to patient
    specific information

5.  The need for an aligned business case and incentives for the
    multiple stakeholders involved

6.  The need for assessment, monitoring, and research of the experiences
    of early adopters and identification of best practices.

This letter provides both context and recommendations for how these
issues can be addressed to enable widespread access to both current and
historical lab data in a patient-centric fashion.

**BACKGROUND AND DISCUSSION**

**Widespread EHR Adoption and Availability of Historical Laboratory
Results**

In his January 2004 State of the Union Address, President George W. Bush
highlighted the importance of information technology in health care when
he stated, "By computerizing health records, we can avoid dangerous
medical mistakes, reduce costs, and improve care." In April 2004, the
President issued Executive Order 13335, calling for widespread adoption
of interoperable EHRs within 10 years, and established the position of
National Coordinator for Health Information Technology.

The effective use of EHRs has the potential to positively influence both
the quality and cost of health care for the Nation. It presents clinical
information and comprehensive patient data to clinicians at the point of
care, facilitating more informed decisions in a shorter time frame. In
addition, the cost of care can be decreased by streamlining data
collection, decreasing the likelihood and associated cost of medical
errors, and reducing resources used for duplicative or unnecessary
information capture and testing.

Despite these benefits, the Nation has been slow to adopt EHRs, as
highlighted in the recent work of the Health IT Adoption Initiative.
This group evaluated both the quality and the results of all EHR
adoptions surveys and found that overall physician adoption was
approximately 17 percent[^1]. A recent Agency for Healthcare Research
and Quality (AHRQ)-sponsored report that reviewed 286 studies focused on
HIT adoption identified a large number of barriers to the implementation
of HIT. These barriers were classified as:

-   **Situational barriers,** including the high cost of purchasing and
    implementing EHRs as well as developing the necessary interfaces
    between EHRs and other Health Information Technology (HIT) systems
    on a custom basis

-   **Cognitive or physical barriers,** including users' physical
    disabilities and insufficient computer skills

-   **Liability barriers,** including confidentiality concerns

-   **Knowledge and attitudinal barriers.**[^2]

Another short-term barrier is the lack of comprehensive electronic data
on any one individual. Laboratory results have the unique feature of
currently existing in electronic format, though they are generally
transmitted to physician offices by fax. Since these results are a
component in 70 percent of clinical decisions, timely and easy access to
comprehensive laboratory information is of high value to clinicians.

The ability to easily access this information through an EHR at the
point of care would enhance the value of the EHR to the clinician
greatly. Unfortunately, the current environment precludes this type of
easy access to comprehensive information. Indeed, many States prohibit
labs from providing results to anyone other than the ordering clinician.
Moreover, while results exist in electronic format, they cannot be
transmitted directly to an EHR without customized and expensive
interfacing, and there are no clear technological solutions for how
patients determine the degree to which their laboratory information can
be made available to multiple providers. Addressing these barriers would
realize significant value to the purchasers and users of EHRs and,
therefore, increase adoption.

**RECOMMENDATIONS**

**I. Provider- and Patient-Centric Models**

The ultimate goal is to make laboratory data available in a
patient-centric model, where a patient's laboratory results data are
available to all authorized providers of care regardless of where or
when the information is generated. This would enable patients to benefit
from more coordinated and complete health care delivery, and it would
reduce the cost associated with duplicate and unnecessary tests. Thus,
the patient-centric model extends availability of information beyond the
existing business environment, where laboratory data results are
available in a provider-centric model (i.e., only the laboratory data
ordered by a specific provider for a specific patient are available for
review). The Workgroup recognizes that an evolutionary path from the
provider-centric model to the patient-centric model requires the
adoption and use of data standards that allow more efficient flow of
information. This will enable the suppliers and users of electronic
laboratory results data to use standards that promote interoperability
and lower costs of specialized interfaces to meet the needs of the
current environment, while adopting the tools and technologies to
support the patient-centric model as they are developed and implemented.
A patient-centric model also will require addressing both technical and
legal privacy and security issues.

> **Recommendation 1.0:** **The U.S. Department of Health and Human
> Services (HHS) should take immediate steps to facilitate the adoption
> and use of endorsed standards and incentives needed for
> interoperability of lab results within the current provider-centric
> environment. The Office of the National Coordinator for Health
> Information Technology (ONC) shall work with multiple stakeholders to
> develop a detailed workplan to achieve patient-centric information
> flow of laboratory data by March 31, 2007.**

**II. Standards**

Systems must be able to receive electronic lab test results when
requested by a patient or authorized health care provider. The lack of
easily implemented, usable standards is a primary barrier to this flow
of critical information. By incorporating Health Information Technology
Standards Panel (HITSP)-endorsed standards and implementation guides
into its certification process for EHRs, CCHIT certification can reduce
the cost of laboratory interface development, which is a significant
barrier to EHR adoption. Laboratory-to-practice connectivity has been an
elusive goal that has prevented leveraging the benefits of HIT
interoperability in the small practice setting and has frustrated
clinicians and vendors seeking to implement EHR systems. Much has been
blamed on the high cost of custom interfaces, which are estimated at
\$30,000 to \$50,000 per laboratory and \$20,000 per interface in a
group practice office.[^3]

Once HITSP has endorsed standards for laboratory results vocabulary,
messaging, and implementation, Federal health care delivery systems
should begin adopting these standards in a reasonable time frame.
Although this is not mandating their use, doing so should help to
promote further adoption within the private sector. In addition, Federal
agencies should positively incentivize adoption of HITSP-endorsed
standards and implementation guides in their contracts.

> **Recommendation 2.0: HITSP should identify and endorse vocabulary,
> messaging,** **and implementation standards for reporting the most
> commonly used laboratory test results by September of 2006, so as to
> be included in the CCHIT interoperability criteria for March 2007
> certification. HITSP should consider CLIA and HIPAA regulatory
> requirements as appropriate.**
>
> **Recommendation 2.1: Federal health care delivery systems (those
> which provide direct patient care) should develop a plan to adopt the
> HITSP-endorsed standards for laboratory data interoperability by
> December 31, 2006.**
>
> **Recommendation 2.2: Federal Agencies and Departments with health
> lines of business should include/incentivize the use of HITSP-approved
> standards in their contracting vehicles where applicable.**

**III. CLIA/HIPAA Options**

The HIPAA Privacy Rule generally permits the disclosure of protected
health information (PHI) by covered entities to health oversight
agencies, other health care providers, and other covered entities and
their business associates for purposes of disease management and chronic
care improvement. However, the HIPAA Privacy Rule does not pre-empt more
stringent Federal or State laws governing the release of such
information. Regulations promulgated under CLIA require that clinical
laboratories disclose test results only to "authorized persons" --
defined as individuals authorized under State law to order tests or
receive test results, or both, and, if applicable, the individual
responsible for using the test results and the laboratory that initially
requested the test, e.g., reference laboratories. Many States require
that clinical laboratories disclose test results only to the ordering
physician or his/her designee and are silent on disclosure of test
results to others caring for the patient.

In order for electronic historical laboratory results to be available in
a patient-centric fashion to authorized providers of care, various
architectural models (Web portals, RHIOs, etc.) must be evaluated with
respect to CLIA and HIPAA. In addition, specific guidance from CLIA
should be pursued on permitting the use of a patient's authorization as
a means of enabling the release of lab data.

> **Recommendation 3.0: By September 30, 2006, ONC should review the
> possible models for the exchange of both current and historical lab
> information and determine which would require CLIA/HIPAA guidance,
> regulatory change, and/or statute change.**
>
> **Recommendation 3.1: Based of the findings from Recommendation 3.0,
> by December 31, 2006, ONC should engage the National Governors
> Association and other State-based organizations to resolve variations
> in "authorized persons" under the various State statutes, regulations,
> policies, and practices as a resource for clinical laboratories
> seeking to define access rights to electronic laboratory data.**

**IV. Privacy and Security**

Health information can be accessed only with adequate security and
privacy mechanisms if there are clear standards and means for the
following:

-   **Identification.** Accurate identification of patients is
    particularly important in a digital environment, where it is
    essential for treatment, safety, and payment accuracy and to ensure
    that PHI is not misdirected to misidentified individuals. While the
    most accurate identification can be achieved through the use of
    unique patient identification numbers, cultural and political
    considerations make such an approach infeasible, at least in the
    near future. That being the case, other technologies, policies, and
    procedures must be developed or identified and implemented to ensure
    the lowest possible patient identification error. An alternative to
    creating unique personal identification for everyone is to define a
    national standard set of authenticating information required to
    receive health care. Unambiguously identifying patients and linking
    their information from multiple sources is a major challenge both
    within and across clinical enterprises. Unless caregivers are able
    to access linked information on a given patient across the continuum
    of care, proper and cost-effective care cannot be rendered.
    Similarly, the ability to link patient data in a secure fashion is
    critical to the anonymized use of information for national research,
    public health surveillance, and bio-preparedness.

-   **Authentication.** For the health care delivery system to realize
    the greatest benefit from digitization, clinicians and patients must
    be able to authenticate that each person using an EHR is who he/she
    says he/she is. An environment of trust based on secure
    authentication allows for buy-in from clinicians, patients, and
    other healthcare entities.

-   **Authorization.** The existence of contradictions within the
    patchwork of State privacy laws also inhibits authorized individuals
    from connecting health care information. HIPAA set a minimum
    national privacy standard, but many States have augmented those
    standards. This results in a jumble of State laws that are
    fundamentally inconsistent; what is mandated in one State is
    prohibited in another.

> **Recommendation 4.0: The Community should create a consumer
> empowerment subgroup comprised of privacy, security, clinical, and
> technology experts from each Community Workgroup. The subgroup should
> frame the privacy and security policy issues relevant to all the
> Community charges and solicit broad public input and testimony to
> identify viable options or processes to address these issues that are
> agreeable to all key stakeholders. The recommendations developed
> should establish an initial policy framework and address issues
> including but not limited to:**

-   **Methods of patient identification**

-   **Methods of authentication**

-   **Mechanisms to ensure data integrity**

-   **Methods for controlling access to personal health information**

-   **Policies for breaches of personal health information
    confidentiality**

-   **Guidelines and processes to determine appropriate secondary uses
    of data**

-   **A scope of work for a long-term independent advisory body on
    privacy and security policies.**

**V. Advancing Adoption**

As the health care industry travels this evolutionary path of adoption
from provider-centric to patient-centric historical laboratory data
exchange, it is imperative that the unique needs of and impact on all
stakeholders are carefully considered. Although much discussion has
taken place regarding the potential benefits, cost savings, cost
shifting, and increased costs of interoperable lab results data, a full
examination and development of the business case, including
identification of incentives for all stakeholders, is required.

> **Recommendation 5.0:** **HHS, in collaboration with all key
> stakeholders, should both assess the value proposition and develop the
> business case for current and historical laboratory results data
> sharing across all adoption models, considering the unique needs and
> alignment of incentives for all stakeholders**.

**VI. Assessment, Monitoring, and Research**

The provision of patient-centric laboratory data resources has the
potential to improve the quality and efficiency of patient care.
However, it is necessary to prove that these benefits are actually being
achieved in practice. It is also important to consider that
implementations may vary in their effectiveness and that best practices
need to be identified and disseminated as early as possible.

> **Recommendation 6.0: By March 31, 2007, AHRQ, in collaboration with
> the Centers for Disease Control and Prevention (CDC) and the Centers
> for Medicare & Medicaid Services (CMS), should develop a proposed
> study methodology to measure the extent and effectiveness of the
> adoption of the first stage of HITSP standards, as well as the
> adoption and utilization of aggregated patient-centric data as they
> become available.**
>
> **Recommendation 6.1: By December 31, 2007, AHRQ, in collaboration
> with the CDC and CMS, should research best practices in the
> implementation and utilization of patient-centric laboratory data
> stores and how to implement this knowledge.**

These recommendations are supported by information obtained through
research and testimony to the Electronic Health Records Workgroup, which
is contained in the supporting documents available at
<http://www.hhs.gov/healthinformationtechnology/>.

Thank you for giving us the opportunity to submit these recommendations.
We look forward to discussing these recommendations with you and the
members of the American Health Information Community.

Sincerely yours, Sincerely yours,

![](media/image2.png){width="2.502083333333333in"
height="0.46041666666666664in"}

Jonathan B. Perlin, M.D., Ph.D. Lillee Smith Gelinas, R.N., M.S.N.

Co-chair, Electronic Health Co-chair, Electronic Health

Records Workgroup Records Workgroup

[^1]: *The HIT Adoption Initiative. Report to the Office of the National
    Coordinator: an environmental scan of the current state of EHR
    adoption measurement in the United States*. Boston, MA: The George
    Washington University School of Public Health and Health Services;
    Institute for Health Policy at MGH/Partners HealthCare System;
    Division of Internal Medicine at the Brigham & Women's Hospital;
    Clinical and Quality Analysis Group of Partners HealthCare System.
    In press.

[^2]: Shekelle PG, Morton SC, Keeler EB, et al. *Costs and benefits of
    health information technology, evidence report/technology
    assessment*, no. 132. Rockville, MD: Agency for Healthcare Research
    and Quality; April 2006. AHRQ Publication No. 06-E006. Available at:
    <http://www.ahrq.gov/downloads/pub/evidence/pdf/hitsyscosts/hitsys.pdf>.
    Accessed May 8, 2006.

[^3]: Walker J, Pan E, Johnston D, Adler-Milstein J, Bates DW, Middleton
    B. *The value of health care information exchange and
    interoperability*. Health Affairs Web Exclusive. Available at:
    [http://content.healthaffairs.org/cgi/content/full/hlthaff.w5.10/DC1](http://content.healthaffairs.org/cgi/content/full/hlthaff.w5.10/dc1).
    Accessed January 19, 2005.