The following is a guest article by Deven McGraw, Co-Founder of Ciitizen® and Lead for Data Stewardship and Data Sharing at Invitae Corporation
HIEs and HINs Should take Key Actions Now to Prepare for the Enforcement of the Information Blocking Rules
On Sept. 1, 2023, enforcement of the 21st Century Cures Act Information Blocking Rule goes into effect, putting teeth into the much-celebrated law that enables patients to have full access to their personal health data.
Some health information exchanges and health information networks (HIEs) have been preparing for this moment, knowing full well the steep statutory penalties for noncompliance created by the rule. Unless a clear exemption applies, HIEs will be responsible for turning over patient health records upon request, and quickly: If the OIG determines that an individual or entity has committed information blocking, they may be subject to up to a $1 million penalty per violation.
If history is any indication, many HIEs are underprepared for supplying patients with their health records. HIEs frequently don’t have direct relationships with patients and often lack staff for supporting direct patient-facing tasks such as identity proofing and help desk.
Over the next few months, HIEs will need to strengthen their technology, policies, and procedures to fully align with the new rule and ensure everything runs smoothly.
What’s at Stake
One can’t overstate how critical it is for patients to have prompt access to their data. I’ve spent a big portion of my career fighting for patient access to their health records. Thousands of individuals and families have shared their personal stories on the importance of speedy access to patient data — including President Biden, who has spoken at length about the struggle his son Beau faced in getting his medical records from a facility in Maryland so he could receive treatment in Texas for brain cancer.
Prompt access to health records speeds up lifesaving interventions, including potential access to clinical trials. If you’re a patient and you have a very serious diagnosis or for which standard-of-care therapies don’t exist, determining eligibility for clinical trials depends on fast access to computable medical records. Otherwise, you could miss a critical opportunity for potential treatment.
Of course, there are also financial concerns to consider, too. The monetary penalties for noncompliance could add up quickly.
Moving Forward
While HIEs weren’t initially built to respond to individual patient queries for data — and most of them still don’t mandatorily respond to every request — change is imminent with stronger enforcement around patient access.
With the Information Blocking Rule enforcement penalties set to take effect soon, HIEs are now faced with a few choices. They can attempt to push off requests to a national network such as CareQuality, CommonWell Health Alliance, or eHealth Exchange if they’re connected to them; they can build their own infrastructure to manage patient queries; or they can work with a technology partner that can take care of identity proofing, validation, and verification, in line with NIST Level 2 requirements, and serve as the gateway to patient access.
HIEs that want to handle queries without outside partners will, at a minimum, need to invest more heavily in the right staffing support. That’s why the third approach — partnering with a third party — may make more sense because it offloads the burden of vetting and ID proofing and facilitates the delivery of computable electronic medical records. With this option, HIEs can focus on their primary role: being a neutral body for facilitating the collection and sharing of healthcare data with authorized users.
Whichever path forward an HIE chooses, support of patient access must remain a priority.
HIEs are the true stewards of information sharing in their communities. By taking proactive steps to ensure compliance — and protect patients who are rightly seeking access to their own health information — HIEs will be doing their part to ensure they have the right support systems in place to serve the needs of patients.
