Five years ago, I wrote a column for Urology Times describing contemporary initiatives allowing patients to gain access to their health information from providers and payers. Two pioneers of the modern movement empowering patients to access and share their information—Dave deBronkart and Regina Holliday (bit.ly/deBronkart, bit.ly/Reginaholliday)—were both touched by metastatic kidney cancer. As we consider how much has changed in the understanding and management of that disease in the last 5 years, it is worth revisiting what has changed—and what hasn’t—in granting patient access to their medical records.
Patients have rights to their health information. The Health Insurance Portability and Accountability Act of 1996 (HIPAA) protects the privacy and security of individuals’ health information, but also provides patients the legal and enforceable right to access and gain a copy of their health information—including but not limited to their medical records, x-rays, and lab tests. The only exceptions to this right of access are psychotherapy notes and “information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding” (bit.ly/HIPAAFAQS).
In most states, the physician may own the physical medical record, but the patient owns all of the underlying information. HIPAA clearly established a right to access that information. In 2014, the Department of Health and Human Services finalized a rule that allows patients to request test results from CLIA-certified labs and amended the HIPAA Privacy Rule to compel those same labs to furnish that information directly to patients (bit.ly/privacyruleamendment). (Urologists who own their own CLIA-certified lab should take special note.) Patient access to health information—whether it resides in a medical record, a lab company’s system, or an insurance company records—is a right firmly protected by federal laws and regulations.
Also by Dr. Dowling - Open Payments data: What you should know about 2019 update
Notwithstanding these rights, neither the custodians of this information nor the health information technology vendors whose products store this information have rapidly facilitated electronic access. The federal EHR incentive program once known as “meaningful use” initially included a core objective to provide patients an ability to view, download, and transmit their health information, as well as two measures to reward eligible clinicians for performance under this objective. As with other aspects of meaningful use, many physicians found the objective to be burdensome and their EHRs unable to easily meet the measures.
Eventually, this program and its incentives and regulations, along with market forces and consumer demand have pressured EHR vendors and their users to adopt a usable patient portal and facilitate patients’ access to their own information. In 2019, the incentives for providing such access are contained in the Promoting Interoperability category of the Merit-based Incentive Payment System (MIPS). Forty percent of the category score is based upon the measure, “Provide Patients Electronic Access to their Health Information”—essentially the fraction of unique patients seen in the measurement period who have successfully registered for the portal.
Practices who have not yet mastered the art of registering all patients for portal access are simply not meeting the expectation of most patients and payers—including Medicare—and will see this reflected in their MIPS scores this performance year.
The government has also created the “Blue Button” initiative to allow Medicare beneficiaries, veterans, and those insured through the Federal Employees Health Benefit Program to download certain information about their health (bit.ly/Bluebutton). Blue Button is powered by new standards that allow systems to “talk with each other,” known as interoperability. Many commercial insurers have Blue Buttons for their beneficiaries, and you should look for this functionality to expand to all payers, pharmacies, provider organizations, and others in the health care information ecosystem.