Cancer Patient Data Rights: Accessing and Sharing Your Health Data

•Introduction 0:03

•The right to access protected health information. 4:59

•The safe harbor exceptions. 11:33

•What’s coming up to get excited about? 16:41

•How does the law play into this? 23:17

•What is actionable data? 24:51

•Patient access to data and data. 34:00

•What are the penalties for failure to comply? 40:59

•The value proposition of patients like me. 46:20

•Data on biomarkers in the community. 49:36

•Why doesn’t every modern pathology department make an image to send? 55:26 Brad Power 0:03 We're honored to have Deven McGraw today with us. She's going to be talking about stuff around data. I've known Deven for a while from her pioneering work when she was a Ciitizen. She's a lawyer by training, so she's an expert on health data. Advanced cancer patients are interested in using their data to help them make clinical decisions. The aspect that we're interested in is: what should we be thinking about in terms of accessing and sharing our data so we can get better insights? Deven McGraw 2:01 I am the lead for data stewardship and data sharing for the Ciitizen platform. I need to update that because when Ciitizen got acquired by Invitae, I got a bigger job. Invitae is a clinical genetic testing company. Ciitizen is a platform that helps patients to leverage their rights under federal law, at least here in the US, to get access to all of their health information, so that they have it at their fingertips and can use it as they wish and share it as they wish, whether it's for involving a caregiver, or seeking treatment options, or contributing data to research, or all of those things. I was formerly with the HHS Office for Civil Rights, which is all things HIPAA (The Health Insurance Portability and Accountability Act of 1996 is a federal law that required the creation of national standards to protect sensitive patient health information from being disclosed without the patient's consent or knowledge.), so policy and enforcement of the HIPAA Privacy and Security and breach notification laws, and also did a stint as the Acting Chief Privacy Officer at the Office of the National Coordinator for Health IT, which sets the standards for electronic medical records and more recently, policies around some new laws, called the information blocking, or Cures Act regulations. Most clinical information is digitized, accessible, and shareable thanks to several technology and policy advances making interoperable, electronic health record systems widely available. In 2016, the 21st Century Cures Act (Cures Act) made sharing electronic health information the expected norm in health care by authorizing the Secretary of Health and Human Services (HHS) to identify "reasonable and necessary activities that do not constitute information blocking." ONC's 2020 Cures Act Final Rule established information blocking exceptions to implement the law. I have the same caveat that Brad started with, which is that I'm going to give you a presentation about the laws and policies that facilitate patient access to their data, but I'm not your lawyer, and I cannot give you legal advice. That's really about the application of law to a particular set of factual circumstances so that you understand how you might be in compliance. This will help you understand the parameters of the law, but I can't be your lawyer or somebody will get me into trouble, as much as I would like to. I always start with a bit of a value proposition for patients. I feel like for this crowd, I don't really need to do that. You all are pretty well convinced. The ability of patients to seek treatment options for themselves, including clinical trials, depends on your data. You can't know if you match to a clinical trial without your data. Being able to support clinical research, keeping others informed of what's going on with your care so that they can be helpers to you. And then of course care coordination. This is an infographic that comes right from the Office of the National Coordinator for Health IT. We've been talking a lot lately about the rights of patients to get their data, and the tone of some of the discussion makes you think, “Oh, this is a new thing; the Cures Act established new rights,” and the reality is that it actually didn't. They're the HIPAA privacy laws which were finalized and put into effect for most entities covered by the law in 2001 – well over two decades ago. It established the right of individuals to get access to and a copy of their identifiable health information, which is otherwise known as protected health information or PHI, under the law. Now, despite this, right, we know from literature, and probably a lot of you from personal experience, that this is not easy to exercise. There are a lot of obstacles often to getting these records sometimes. I have heard stories of organizations outright telling people, “HIPAA won't let you get a copy of your data.” When, in fact, the opposite is true. But even if someone is granting you this right, sometimes the barriers to getting that right can be pretty significant. The scope of the right is actually really broad. I helped to write some guidance when I was at the Office for Civil Rights, to try to clarify that this right has a lot of parameters to it that are favorable to the patient. You can't make a patient come in person to get their data. They have to have some way of getting it remotely. You need to provide it to the patient in the form or format that they request, as long as you're technically capable of providing that to them. HIPAA provides that they can take up to 30 days, and can extend for an additional 30 days if they have to go offsite, for example, to get your information. In a minute, we'll talk about how the information blocking rules improve on those timeframes. HIPAA does allow for fees to be charged, but they're supposed to be reasonable and cost-based. And not necessarily per page, if what you're getting is digital copies of a digital document. This is another area where we see a lot of friction where patients are given bills for sometimes hundreds or thousands of dollars for access to their health information. More than likely those fees, unless they really are really old paper records for which a per page fee can be charged, are higher than they should be when they're imposed. Sometimes organizations give them for free to patients. But I do see charges from time to time. We're moving beyond HIPAA somewhat rapidly to greater facilitation with data, including the ability to get that data through a completely online experience, such as through an app. I don't think we're moving quickly enough. But we definitely have made a lot of progress in the last two to five years on accessibility of a core set of health information for patients. It's not nearly in the volume that's as impactful for cancer patients in particular, because the volume of data that's produced about them and in a clinical visit is pretty voluminous, and oftentimes not always available through an online kind of portal. But that situation should improve over the coming years because of some other other federal initiatives that I'm going to talk about next. HIPAA is no longer the only set of federal policies that lean very heavily towards favoring patient access. There are now payment incentives under Medicare and Medicaid for clinicians to make data accessible to patients. There are certification requirements in the electronic health record tools that many clinicians utilize that provide capabilities to make data more available to patients such as through application programming interfaces that are open and standard in accordance with “fire”, FHIR – the fast healthcare interoperability resource. Those capabilities have for the past couple of years been more widely adopted in the customer base for these EMR vendors. There are also new information blocking requirements that came out of the Cures Act. The information blocking rules, otherwise known as the Cures Act rules, play a really important role or will play an important role. They are nascent. What are these information blocking rules? What do they say? They went into effect on April 5, 2021. They're not being enforced yet. But we know that the Office of the National Coordinator has received a lot of complaints, particularly about healthcare providers not complying with the information blocking rules for patient access. They create this presumption that an entity covered by the rules must share electronic health information. Providing access to patients is not just a lawful purpose, it is a required purpose under HIPAA. So there's an emphasis in the information blocking rules on making sure that patients can access their data even though these rules don't just apply to patient access. It applies to healthcare providers and certified electronic health record vendors like Epic and Cerner, and these entities called health information exchanges (HIE), which exist across the country in states and sometimes with bordering state regional exchanges. They have typically exchanged information among medical providers for treatment purposes, but they are beginning to open up for other purposes. Because the information blocking rules put pressure on them to do so there are penalties associated with blocking. You can be fined up to a million dollars if you are an electronic record vendor or an HIE, and you've been found to be information blocking. Medical providers are going to be referred to CMS for appropriate disincentives. We don't know what those look like yet. We're anticipating a proposed rule to come out of the Office of the National Coordinator to propose those disincentives. It'll probably be at least another year before those get finalized. There are some Safe Harbor exceptions that an entity covered by