[{"innerBlocks":[],"name":"core\/freeform","postId":67,"blockType":{"name":"core\/freeform","keywords":[],"attributes":{"content":{"type":"string","source":"raw"},"lock":{"type":"object"}},"providesContext":[],"usesContext":[],"selectors":[],"supports":{"className":false,"customClassName":false,"reusable":false},"styles":[],"variations":[],"apiVersion":3,"title":"Classic","description":"Use the classic WordPress editor.","category":"text"},"originalContent":"The Office of the National Coordinator for Health IT is pushing forward with a proposed rule meant to ensure patient access to their electronic healthcare information.\n\nThe agency\u2019s efforts come despite industry concerns that policies are not in place to prevent inappropriate disclosures of patients\u2019 medical records.\n\nStakeholders have made the case that\u2014absent appropriate privacy protections\u2014the finalization of ONC\u2019s proposed rule, as written, would put patient information at risk.\n\nSpecifically, the American Medical Association has charged that ONC is making a policy decision to \u201cnot prioritize patient privacy\u201d and that patients\u2019 health information will be vulnerable to inappropriate secondary uses and disclosures from third-party apps.\n\nHowever, National Coordinator for HIT Don Rucker told the ONC annual meeting on Tuesday that what the agency is proposing in its rule is the transmission of patient data through the use of OAuth 2 authentication to authorize data sharing via apps.\n\n\u201cPretty much everybody in this room\u2014I assume\u2014has banking applications,\u201d commented Rucker. \u201cWe\u2019re using those types of security principles to facilitate this. And, that allows us in that OAuth 2 process to tie in some requirements on disclosures on very specific variant formed consent. This is going to have a very different flavor I think than what has been stated publicly by folks.\u201d\n

\n\nRucker added that \u201cthe data is not just all going to get stolen, as has been bandied about\u201d by critics of the ONC proposed rule.\n\nOn Monday, Health and Human Services Secretary Alex Azar lashed out at healthcare stakeholders critical of ONC\u2019s proposed rule. Speaking at the ONC annual meeting, Azar charged that EHR systems today are \u201cbalkanized\u201d and \u201csegmented,\u201d creating data silos that prevent patients from accessing their health information.\n\nAlso See<\/b>: Azar defends patient access to EHR data under ONC rule, but pushback resumes<\/a>\n\n\u201cUnfortunately, some industry stakeholders are defending the balkanized, outdated status quo,\" Azar said, adding that some vendors holding patient data have \"prevented new market entrants from participating in the space.\"\n\nOn Tuesday, Rucker echoed Azar\u2019s remarks by pointing out that \u201cthere are all kinds of economic interests of folks who have spent their lives and careers in this space.\u201d\n\n\u201cWe are very thankful for the Secretary\u2019s fierce support of the right for patients to access their electronic health information,\u201d Lisa Lewis, ONC\u2019s deputy national coordinator for operations and chief operating officer, told the agency\u2019s meeting on Tuesday. \u201cWe, at ONC, are fighting to implement the will of Congress.\u201d\n\nThe 21st Century Cures Act, passed by Congress and signed into law by President Barack Obama in December 2016, was intended to ensure greater patient access to healthcare records\u2014and the sharing of such information\u2014through several health IT interoperability provisions. Among them was a mandate from Congress to empower patients with open application programming interfaces (APIs) \u201cwithout special effort\u201d to assist with the access and exchange of health information.\n\nWhen it comes APIs, Rucker said they are designed to \u201cexist without elaborate requirements for providers to do any vetting of apps\u2014because that would actually impede the consumer access.\u201d\n\nLewis told the ONC meeting on Tuesday that \u201cthe work we\u2019re doing can really be considered a type of civil rights movement\u201d and that \u201cthe rights provided under HIPAA can only be realized when those rights are operationalized\u2014it is time to operationalize the digital flow of health information in a private and secure way without special effort by the end user.\u201d\n\nHowever, some healthcare stakeholders have expressed concerns about the lack of consumer protection for health data beyond the HIPAA-regulated environment.\n\nIn a letter last month to members of Congress, the American Health Information Management Association warned that the existing regulatory landscape \u201clacks sufficient privacy and security guardrails to protect health information held by entities not covered by HIPAA.\u201d\n\nAHIMA contends that there are many health-related technologies that exist and operate outside of the scope of HIPAA. \u201cWhile these health-related technologies produce and manage individually identifiable health information, they are not bound by or required to abide by the rules established under HIPAA because they are not considered covered entities\u2019 or \u2018business associates.\u2019\u201d\n\nNonetheless, Rucker pointed out that it\u2019s the responsibility of providers to \u201cclearly let folks know that when the patient accesses their data\u2014under their right of access\u2014this data has now left HIPAA.\u201d He also emphasized that patients who use API-enabled health apps must keep their data safe and secure, like they do with information associated with their banking apps.\n\n\u201cI don\u2019t think we can let the risks that are real prevent all of us as citizens and members of the United States from having all of our data,\u201d Rucker concluded. \u201cFor each and every one of us, that should be our choice on what to do.\u201d","saveContent":"The Office of the National Coordinator for Health IT is pushing forward with a proposed rule meant to ensure patient access to their electronic healthcare information.\n\nThe agency\u2019s efforts come despite industry concerns that policies are not in place to prevent inappropriate disclosures of patients\u2019 medical records.\n\nStakeholders have made the case that\u2014absent appropriate privacy protections\u2014the finalization of ONC\u2019s proposed rule, as written, would put patient information at risk.\n\nSpecifically, the American Medical Association has charged that ONC is making a policy decision to \u201cnot prioritize patient privacy\u201d and that patients\u2019 health information will be vulnerable to inappropriate secondary uses and disclosures from third-party apps.\n\nHowever, National Coordinator for HIT Don Rucker told the ONC annual meeting on Tuesday that what the agency is proposing in its rule is the transmission of patient data through the use of OAuth 2 authentication to authorize data sharing via apps.\n\n\u201cPretty much everybody in this room\u2014I assume\u2014has banking applications,\u201d commented Rucker. \u201cWe\u2019re using those types of security principles to facilitate this. And, that allows us in that OAuth 2 process to tie in some requirements on disclosures on very specific variant formed consent. This is going to have a very different flavor I think than what has been stated publicly by folks.\u201d\n\n\nRucker added that \u201cthe data is not just all going to get stolen, as has been bandied about\u201d by critics of the ONC proposed rule.\n\nOn Monday, Health and Human Services Secretary Alex Azar lashed out at healthcare stakeholders critical of ONC\u2019s proposed rule. Speaking at the ONC annual meeting, Azar charged that EHR systems today are \u201cbalkanized\u201d and \u201csegmented,\u201d creating data silos that prevent patients from accessing their health information.\n\nAlso See<\/b>: Azar defends patient access to EHR data under ONC rule, but pushback resumes<\/a>\n\n\u201cUnfortunately, some industry stakeholders are defending the balkanized, outdated status quo,\" Azar said, adding that some vendors holding patient data have \"prevented new market entrants from participating in the space.\"\n\nOn Tuesday, Rucker echoed Azar\u2019s remarks by pointing out that \u201cthere are all kinds of economic interests of folks who have spent their lives and careers in this space.\u201d\n\n\u201cWe are very thankful for the Secretary\u2019s fierce support of the right for patients to access their electronic health information,\u201d Lisa Lewis, ONC\u2019s deputy national coordinator for operations and chief operating officer, told the agency\u2019s meeting on Tuesday. \u201cWe, at ONC, are fighting to implement the will of Congress.\u201d\n\nThe 21st Century Cures Act, passed by Congress and signed into law by President Barack Obama in December 2016, was intended to ensure greater patient access to healthcare records\u2014and the sharing of such information\u2014through several health IT interoperability provisions. Among them was a mandate from Congress to empower patients with open application programming interfaces (APIs) \u201cwithout special effort\u201d to assist with the access and exchange of health information.\n\nWhen it comes APIs, Rucker said they are designed to \u201cexist without elaborate requirements for providers to do any vetting of apps\u2014because that would actually impede the consumer access.\u201d\n\nLewis told the ONC meeting on Tuesday that \u201cthe work we\u2019re doing can really be considered a type of civil rights movement\u201d and that \u201cthe rights provided under HIPAA can only be realized when those rights are operationalized\u2014it is time to operationalize the digital flow of health information in a private and secure way without special effort by the end user.\u201d\n\nHowever, some healthcare stakeholders have expressed concerns about the lack of consumer protection for health data beyond the HIPAA-regulated environment.\n\nIn a letter last month to members of Congress, the American Health Information Management Association warned that the existing regulatory landscape \u201clacks sufficient privacy and security guardrails to protect health information held by entities not covered by HIPAA.\u201d\n\nAHIMA contends that there are many health-related technologies that exist and operate outside of the scope of HIPAA. \u201cWhile these health-related technologies produce and manage individually identifiable health information, they are not bound by or required to abide by the rules established under HIPAA because they are not considered covered entities\u2019 or \u2018business associates.\u2019\u201d\n\nNonetheless, Rucker pointed out that it\u2019s the responsibility of providers to \u201cclearly let folks know that when the patient accesses their data\u2014under their right of access\u2014this data has now left HIPAA.\u201d He also emphasized that patients who use API-enabled health apps must keep their data safe and secure, like they do with information associated with their banking apps.\n\n\u201cI don\u2019t think we can let the risks that are real prevent all of us as citizens and members of the United States from having all of our data,\u201d Rucker concluded. \u201cFor each and every one of us, that should be our choice on what to do.\u201d","order":0,"get_parent":{},"attributes":[],"attributesType":{"content":{"type":"string","source":"raw"},"lock":{"type":"object"}},"dynamicContent":""}]

Rucker: Patient data access, choice is at heart of ONC rule

More for you