The eponymous sign in front of Epic's headquarters in Verona, Wisconsin.
Source: Yiem via Wikipedia CC
It will soon be much easier for patients in the United States to access their own medical records.
Healthcare software provider Epic Systems announced Thursday that individuals will now be able to securely share their health data with the apps they choose, giving them more direct control over their medical information than ever before.
For example, if patients use a health coaching app or an app that reminds them to take their medications, they can import their records directly into those platforms using only the credentials they use to log into Epic.
This seemingly simple feat actually represents a significant technological leap for the healthcare sector and marks the beginning of a new standard in data sharing that will take shape across the country.
Epic is one of the organizations that helped the federal government build the Trusted Exchange Framework and Common Agreement (TEFCA). Launched in December, the agreement aims to create both the legal and technical conditions for large-scale sharing of patient data.
Health data in the U.S. has traditionally been siloed and difficult to transfer. Clinics, hospitals and health systems may store their information in different formats with dozens of different vendors, and there has been no trusted nationwide mechanism for transporting the data securely. This means that patients who move to another state or visit a new hospital may not always be able to take their medical records with them.
In the private sector, several companies and information sharing networks have emerged to address this problem, but none of them has managed to fully solve it on their own. TEFCA was designed to bring all these different actors together.
TEFCA falls under the purview of an office within the U.S. Department of Health and Human Services. Patients can think about TEFCA the same way they think about their cell phone use, said Micky Tripathi, assistant secretary for technology policy and national coordinator for health information technology at the Department of Health and Human Services.
If one person uses Verizon as their phone provider, a second person uses AT&T, and a third person uses T-Mobile, they can all still call and text each other. The same goes for TEFCA.
“The idea was, 'We should just have the user experience that no matter where I am, no matter what system I'm using, I know it's going to connect to any other network, no matter what network I'm on,'” Tripathi said in an interview with CNBC.
“It will be revolutionary”
The U.S. Department of Health and Human Services building in Washington, DC, July 21, 2007.
Saul Loeb | Afp |
The main groups participating in health data sharing through TEFCA are so-called qualified health information networks (QHINs). These networks participate voluntarily – they receive no money – and must go through a two-step approval process to ensure they are eligible and have the necessary technical infrastructure in place.
Seven QHINs, including Epic, are now active on TEFCA, and Tripathi said several more are nearing the finish line. To illustrate the scale that TEFCA requires, Tripathi estimated that Epic's own network facilitates more than 10 to 12 million data transactions daily.
“Remember, this is about connecting networks that already exist and work,” he said.
To participate in TEFCA, QHINs must support six different “exchange purposes” for which an organization may request health information. These purposes include treatment, payment, health care operations, public health, government benefit determination, and individual access services.
Most exchange networks have so far supported the exchange of “treatment,” meaning that the recipient, such as a doctor or hospital, provides medical care to the person whose records they are requesting. However, by introducing other approved exchange routes, TEFCA may be able to avoid some disagreements, such as those that have arisen this year over what exactly counts as treatment.
Individual access services, for example, are a new exchange purpose that allows people to easily request all their records and bring them together in one app. This means patients can see their complete history of doctor visits and hospital stays at once, as long as all the necessary providers are connected to TEFCA.
“I think it's going to be revolutionary in the next few years,” Steve Yaskin, CEO of Health Gorilla, a QHIN within TEFCA, told CNBC. “If you look at any other industry, they're using data to their advantage, right? From banking to telecoms to any industry that's deeply rooted in understanding data.”
A person using his smartphone.
Kohel Hara |
Because TEFCA is so new, many QHINs are still working on setting up all six exchange purposes. Epic's announcement on Thursday means they are officially ready to support the individual access service path.
Rob Klootwyk, Epic's director of interoperability, said implementing individual access has taken some time because it needs to be done carefully. He said TEFCA needs to set guardrails that specify how patients are authenticated, how they can be educated about whether they should share their data with an app, and how apps can be held accountable to consumers.
These questions have now been answered, he said.
“We and our community believe that the pieces are now in place and TEFCA is the right way to do this,” Klootwyk said in an interview with CNBC.
For example, when a patient enters their Epic credentials to share their data with an app, they'll be presented with a screen of patient information, said Matt Doyle, a software engineer on Epic's interoperability team. The screens explain what information the patient would be sharing and ensure they're comfortable with that decision.
Patient data is inherently sensitive and valuable and is protected by the Health Insurance Portability and Accountability Act (HIPAA), a federal law that requires patient consent or knowledge for third-party access. While some apps are required to be HIPAA compliant, many are not.
As a result, HHS ruled that apps can voluntarily participate in TEFCA as long as they agree to comply with HIPAA, even if they are not legally required to do so. This means QHINs like Epic can inform users whether an app is a HIPAA-covered entity, whether it's part of the federally recognized data-sharing network, or none of the above.
“We say, 'Hey, we're not saying they're a bad group, we just don't know their policies on this. You want to make sure you're well informed before you decide to share this,'” Doyle told CNBC.
Whether individuals want to use apps to support their care or simply want an easy place to view their information, TEFCA essentially aims to provide the foundation of trust needed to do so, Klootwyk said.
It will take about two weeks for the new features to become available to Epic customers, but it will likely take longer for individual access services to be widely used nationwide.
HHS's Tripathi said the TEFCA framework is now in place and all that's left is for QHINs and the broader market to get on board.
“This is the next really important step for a patient to be able to access their own information through an application of their choice and thus participate more directly in their own healthcare,” Tripathi said.
Comments are closed.