Public Comment Portal

Why does the HIE need a separate Opt-In or Opt-Out consent form?  Most providers’ Notice of Privacy Practices already includes language to notify patients that their healthcare practitioner/provider may share their PHI with other internal and external providers and entities to support treatment, payment or operations.  An HIE simply provides a means of sharing data - in addition to other available methods like fax, email, phone, meetings, paper documents, etc.  Thus, the HIE doesn’t inherently do more than electronically connect various covered entities and business associates for TPO support – much like the phone company does when you use the phone or fax to share data, or an ISP vendor does when you send email with patient data or log onto an Internet portal, Skype or third party software system.

In addition, of course, an HIE may also host and/or manage a central store of patient data via a data base management system and/or software messaging system like Axolotl, Emdeon, GE or other HIE support product.  On top of that, HIE staff and administrators may support or even be directly involved in quality improvement, data collection, research, reporting, auditing, collective bargaining/contracting, etc. with, or for, one or more of its member organizations, which requires access to patient data.  This, again, is a support function similar to those being provided today by administrators of an Independent Physicians Association (IPA) for quality improvement/operations purposes.

Therefore, would it be legally viable (and simpler) to provide covered entity HIE members with one or two sentences to include in their existing Notice of Privacy Practices referring to sharing PHI with other external providers and covered entities for the purposes of treatment, payment and operations via an electronic Health Information Exchange and/or Regional Health Information Organization – and continue to allow patients to opt-out of sharing data with outside entities as they do now?  The HIE would then serve as a Business Associate to its member covered entities and support organizations and include BAA language in their HIE Agreement/contract with its members – and/or in a separate document.

Jim Albert

CIO Associates