The healthcare industry has seen the effects of the digital age in the advent of electronic health records (EHRs), which allow patient Protected Health Information (PHI) to be stored in a versatile, transferrable electronic format. Through the use of health information exchange (HIE), the transmission of clinical data amongst healthcare facilities, health information organizations (HIOs) and government agencies, doctors now have the ability to share EHRs to analyze health patterns of the general population. As such, efforts are underway at the state, regional and national level to expand the use of HIE as a means to quicker and more accurate diagnoses of patients with similar symptoms and histories, thereby facilitating more effective treatment and continuity of care.
The 2009 Health Information and Technology for Economic and Clinical Health Act (HITECH) included grants to help foster the development of exchanges and address privacy concerns surrounding EHRs and HIE by extending the privacy and security provisions in the Health Insurance Portability and Accountability Act (HIPAA) from only covered entities to include their business associates. HITECH also requires covered entities to report data to the media and to the Department of Health and Human Services on any breach affecting 500 or more individuals. Balancing the substantial patient benefits and broader societal benefits of HIE with the privacy concerns raised requires in-house counsel to work with HIE providers to develop standards for obtaining consent from patients to use their PHI, and requires providers to be aware of the current status of these standards.
Current state of the law
There have been some recent law developments on the national and state levels that influence the easier adoption of HIE. Nationally, the HITECH Act charged the Office of the National Coordinator for Health Information Technology (ONC) with the responsibility of promoting HIE. Currently, the ONC is developing a Nationwide Health Information Network (NHIN), which will help interconnect the individual HIEs and facilitate the flow of information. In the future this may involve standardizing consent, but for now that delicate issue has been left for the states to decide.