# Presentation: 400206

## Considerations for Protecting Health Information in a Health Information Exchange

**American Health Information Community**
- Confidentiality, Privacy and Security Workgroup
- April 12, 2007

**Rhode Island’s Perspective**
*Amy Zimmerman*

## RI Health Care Landscape

- Rhode Island population = 1.1 million
- Statewide healthcare market
- Two large integrated delivery networks (IDN)
- Sophisticated health information systems
- Many small provider organizations
- Very few health information systems
- Existing collaborative healthcare quality organization (Rhode Island Quality Institute/RIQI, est. 2002)
- Governor has an “Anytime, Anywhere Healthcare” agenda

## Developing RI’s Statewide HIE

- State Government (RI Department of Health) overseeing initial HIE development (AHRQ funding)
- Governance through RIQI, a public-private partnership
- HIE management and operations to be transitioned to a state-designated RHIO (to be eligible for state funds)
- Initial HIE Scope/Features:
- Statewide Master Patient Index
- “Look up” lab results and medication history
- Initial Data Submitting Partners include:
- Largest IDN
- Public Health Laboratory
- Local Laboratory Chain
- Surescripts (Med Hx)
- Future HIE features include: Additional data types and uses, EMR interfaces, Patient Portal etc.

## Principles for Getting Started 

- Build Incrementally  (prove value, gain trust and expand)
- Leverage Existing Capacity Wherever Possible (build on community-based governance)
- Seek to Understand Diverse and Multiple Perspectives
- Directly Engage Key Stakeholders (established representative committees: Steering Committee, Providers, Consumers, Policy & Legal, Technical)
- Gather “True” Consumer Input (use focus groups)
- Strive to Exchange Complete Data by Source and Type(critical to the value proposition and adoption)
- Choose a Flexible Technical Solution to Support Various Architecture and Consent (Authorization) Management Models

## The Balancing Act of Progress

- Policy:  First address data uses and authorization (limit data uses to treatment & coordination of care only)
- Technology: Identify acceptable technical model
- Centralized vs. decentralized, federated, hybrid
- What data, what services, what technical requirements
- Operational Feasibility: Practicality of implementing
- Data submitters’ ability to filter data by type or person
- Provider work flow realities; need to access data independent of the care process
- Consumers’ desire to control access to their data, yet do not want to authorize information release at every visit

## Gather Additional Information

- Conducted consumer focus groups; identified local concerns, what is valued, what is not
- Applied Findings from National Privacy and Security Project (HISPC):
- HIPAA used more as a floor than as a ceiling; precedent for stricter privacy practices
- Impact of RI State Laws on HIE: Exceedingly strict state laws protecting STD and Mental Health data (relative to substance abuse, HIV, etc.)
- Impact of Federal laws on HIE - Definition of “Federally Funded Alcohol and Substance Abuse Treatment Program”  (CFR 42):  one that *holds themselves out* to treat, diagnose, or refer for substance abuse

## Framework for Authorization 

- Step 2 policy decision (based on state law interpretation): Business Associate Agreement (BAA) not sufficient to move data in Step 2 without patient authorization.  Implications for enabling legislation
- Step 2 impacts the technical model regarding Data Submitting Partners’ (DSP) capability to “know” patient participation status prior to release of data to HIE
- Step 3 policy decision (stricter than HIPAA): “Opt-out” model is not sufficient; Affirmative patient authorization required for disclosure through HIE

- Consent to participate (move data to HIE)

- Consent to view by authorized user

## Next Steps

- Develop and seek consensus on authorization approach
- Reassess/address operational capabilities of data submitters
- Seek agreement between legal and technical experts as to what constitutes “disclosure” and the risk associated with various approaches
- Reassess technical options; architecture, functionality, etc.
- Create standard consent materials (agreements, educational materials, training)
- Develop polices to support consent model: notification and education, role-based access, “break the glass” exceptions, auditing, breach procedures, penalties and enforcement
- Develop “supportable” data sharing agreements

## Next Steps, continued

- Consider Enabling Legislation
- Uniform authorization forms (data to HIE; data viewed through HIE)
- Consistent definitions of consent, authorization and disclosure
- Protections against subpoena
- Protections against inappropriate or coerced access to or use of data
- Handling inadvertent disclosure
- Enforcement and sanctions for misuse of data
- Provider Safe Harbor when using the HIE

## Summary 

- RI is deploying strong privacy and security solutions using a community governed approach to build an HIE
- Governance needs to be able to evolve as do priorities for the HIE
- Consensus-building among diverse stakeholders takes a long time; inclusion is the rule
- Setting limits for uses of data, at least initially, helped focus discussions and is allowing meaningful progress in a more timely fashion
- Value (business case) will be derived by having complete information by data source and data type; forcing a balance between policy and practicality

## Summary, continued 

- Need a process to assess and gain consensus on additional date uses and the implications
- Need to address consent at two levels; consent to participate and consent to view
- Need to differentiate what is legally permissible from what is desirable through policy and/or determine if legislative changes or enabling legislation is needed
- Important to recognize that some stakeholders may never be satisfied, therefore need to balance their considerations with implementation of a system that can work and benefit the overall population

## Contact Information

- Amy Zimmerman, MPH
- Director, RI Health Information Exchange Rhode Island Department of Health
- (401) 222-5942
- amy.zimmerman@health.ri.gov