Cancer Patient Data Rights: Why Sharing Your Health Data Matters
Featuring: Deven McGraw
Watch on Cancer Patient Lab YouTube
Ask Navis about this
Deven McGraw
“Patients Own Their Health Data, Which Is More Valuable If Shared” (Deven McGraw) [#46] March 1, 2023 Brad Power “Overall, it's an exciting time for the patient empowerment movement. At the same time we see where the puck is going, and it's looking good, and it's taken way too long to get there.
” – Deven McGraw Meeting Summary Getting access to and controlling one’s medical records can increase a patient's (or caregiver's) knowledge about their disease. This knowledge is power. It can enable a patient (or caregiver) to actively participate as a co-pilot with their medical team in guiding their testing and treatment decisions.
Advanced cancer patients also want to share their health data with experts and peers, and they want to learn what has worked and hasn't worked for other patients with a similar profile. Patients' health data is more valuable if shared. Deven McGraw is uniquely qualified to talk about the legal and regulatory situation for patients who want to get copies of their medical records and share them.
She is Lead, Data Stewardship and Data Sharing, at Invitae, a genomic medicine company that provides clinical genetic testing and helps patients gather their full records (genetic and phenotypic) for use in seeking care and advancing research. Previously, she was a co-founder and the chief regulatory officer for Ciitizen, a consumer-health technology start-up. She directed U.S.
health privacy and security as Deputy Director, Health Information Privacy, at the HHS Office for Civil Rights and Chief Privacy Officer (Acting) of the Office of the National Coordinator for Health IT. She is widely recognized for her expertise in health privacy.
She directed the Health Privacy Project at the Center for Democracy & Technology for six years and led the privacy and security policy work for the HITECH Health IT Policy Committee. She also served as the chief operating officer of the National Partnership for Women and Families.
She advised health industry clients on HIPAA compliance and data governance while a partner at Manatt, Phelps & Phillips, LLP. Deven graduated magna cum laude from Georgetown University Law Center and has a Masters of Public Health from Johns Hopkins University.
Patient rights for access to health information depends mainly on HIPAA (The Health Insurance Portability and Accountability Act of 1996), which has been around for decades, and the Cures Act, which was signed into law in 2016, and includes information blocking rules . There has been progress in making health information more accessible to patients through technology, but more needs to be done.
What are the barriers to accessing and sharing healthcare data that patients and caregivers face? What are your legal rights? The health system facilitates gathering data for drug discovery by researchers, but accessing and sharing clinical data with physicians or peers for clinical decision-making isn't as easy.
to accessing and sharing healthcare data that patients and caregivers face? What are your legal rights? The health system facilitates gathering data for drug discovery by researchers, but accessing and sharing clinical data with physicians or peers for clinical decision-making isn't as easy. The information blocking rules and HIPAA give you a right to any data that has been created that is used for clinical guidance or to seek payment for care. Beyond information stored in medical
“Patients Own Their Health Data, Which Is More Valuable If Shared” (Deven McGraw) [#46] records, you also have a right to access the underlying raw data files and to images. You cannot use the law as a way to force diagnostic companies or providers to generate data that they haven't already generated. What should patients (and caregivers) do to access and manage their healthcare data?
We're moving beyond HIPAA to improve patient access to their health data, including the ability to get that data through a completely online experience, such as through an app. HIPAA access is being more robustly enforced. New information blocking rules prioritize access by patients or apps acting on their behalf. Patients can get access through portals, apps/APIs, and other mechanisms.
Do the rules give patients control of their tissue and other sources of their health data? The access rules apply only to data, and not to specimens. A biospecimen is not going to be accessible by you.
The information and opinions expressed on this website or platform, or during discussions and presentations (both verbal and written) are not intended as health care recommendations or medical advice by Cancer Patient Lab/Prostate Cancer Lab, its principals, presenters, participants, or representatives for any medical treatment, product, or course of action.
You should always consult a doctor about your specific situation before pursuing any health care program, treatment, product or other course of action that might affect your health.
“Patients Own Their Health Data, Which Is More Valuable If Shared” (Deven McGraw) [#46] Meeting Notes The information and opinions expressed on this website or platform, or during discussions and presentations (both verbal and written) are not intended as health care recommendations or medical advice by Cancer Patient Lab/Prostate Cancer Lab, its principals, presenters, participants, or representatives for any medical treatment, product, or course of action.
You should always consult a doctor about your specific situation before pursuing any health care program, treatment, product or other course of action that might affect your health.
RDS patients, data, access, hipaa, generated, files, test, image, rules, blocking, entity, question, research, information, clinical, clinician, request, lab, purpose, year SPEAKERS Deven McGraw (39:10), Brad Power (6:42), Rick Stanton (5:06), Richard Anders (3:58), Brian McCloskey (2:40) Outline ●Introduction 0:03 ●The right to access protected health information.
4:59 ●The safe harbor exceptions. 11:33 ●What’s coming up to get excited about? 16:41 ●How does the law play into this? 23:17 ●What is actionable data? 24:51 ●Patient access to data and data. 34:00 ●What are the penalties for failure to comply? 40:59 ●The value proposition of patients like me. 46:20 ●Data on biomarkers in the community.
49:36 ●Why doesn’t every modern pathology department make an image to send? 55:26 Brad Power 0:03 We're honored to have Deven McGraw today with us. She's going to be talking about stuff around data. I've known Deven for a while from her pioneering work when she was a Ciitizen. She's a lawyer by training, so she's an expert on health data.
Advanced cancer patients are interested in using their data to help them make clinical decisions. The aspect that we're interested in is: what should we be thinking about in terms of accessing and sharing our data so we can get better insights?
“Patients Own Their Health Data, Which Is More Valuable If Shared” (Deven McGraw) [#46] I am the lead for data stewardship and data sharing for the Ciitizen platform. I need to update that because when Ciitizen got acquired by Invitae, I got a bigger job. Invitae is a clinical genetic testing company.
Ciitizen is a platform that helps patients to leverage their rights under federal law, at least here in the US, to get access to all of their health information, so that they have it at their fingertips and can use it as they wish and share it as they wish, whether it's for involving a caregiver, or seeking treatment options, or contributing data to research, or all of those things.
I was formerly with the HHS Office for Civil Rights, which is all things HIPAA (The Health Insurance Portability and Accountability Act of 1996 is a federal law that required the creation of national standards to protect sensitive patient health information from being disclosed without the patient's consent or knowledge.
), so policy and enforcement of the HIPAA Privacy and Security and breach notification laws, and also did a stint as the Acting Chief Privacy Officer at the Office of the National Coordinator for Health IT, which sets the standards for electronic medical records and more recently, policies around some new laws, called the information blocking, or Cures Act regulations.
Most clinical information is digitized, accessible, and shareable thanks to several technology and policy advances making interoperable, electronic health record systems widely available.
ormation blocking, or Cures Act regulations. Most clinical information is digitized, accessible, and shareable thanks to several technology and policy advances making interoperable, electronic health record systems widely available.
In 2016, the 21st Century Cures Act (Cures Act) made sharing electronic health information the expected norm in health care by authorizing the Secretary of Health and Human Services (HHS) to identify "reasonable and necessary activities that do not constitute information blocking." ONC's 2020 Cures Act Final Rule established information blocking exceptions to implement the law.
“Patients Own Their Health Data, Which Is More Valuable If Shared” (Deven McGraw) [#46] I have the same caveat that Brad started with, which is that I'm going to give you a presentation about the laws and policies that facilitate patient access to their data, but I'm not your lawyer, and I cannot give you legal advice.
That's really about the application of law to a particular set of factual circumstances so that you understand how you might be in compliance. This will help you understand the parameters of the law, but I can't be your lawyer or somebody will get me into trouble, as much as I would like to. I always start with a bit of a value proposition for patients.
I feel like for this crowd, I don't really need to do that. You all are pretty well convinced. The ability of patients to seek treatment options for themselves, including clinical trials, depends on your data. You can't know if you match to a clinical trial without your data.
Being able to support clinical research, keeping others informed of what's going on with your care so that they can be helpers to you. And then of course care coordination. This is an infographic that comes right from the Office of the National Coordinator for Health IT.
“Patients Own Their Health Data, Which Is More Valuable If Shared” (Deven McGraw) [#46] We've been talking a lot lately about the rights of patients to get their data, and the tone of some of the discussion makes you think, “Oh, this is a new thing; the Cures Act established new rights,” and the reality is that it actually didn't.
They're the HIPAA privacy laws which were finalized and put into effect for most entities covered by the law in 2001 – well over two decades ago. It established the right of individuals to get access to and a copy of their identifiable health information, which is otherwise known as protected health information or PHI, under the law.
Now, despite this, right, we know from literature, and probably a lot of you from personal experience, that this is not easy to exercise. There are a lot of obstacles often to getting these records sometimes. I have heard stories of organizations outright telling people, “HIPAA won't let you get a copy of your data.” When, in fact, the opposite is true.
Want to learn more about your specific case?
Upload your medical records and ask Navis questions tailored to your diagnosis.