Colo. urges changes to info-sharing rules

The Colorado Regional Health Information Organization has issued a report on its two-year project to integrate behavioral-health information into broader health information exchange

The 36-page report, "Supporting Integration of Behavioral Health Care Through Health Information Exchange" (PDF), is available on the CORHIO website.

To remove what was termed a "barrier" to health information exchange, CORHIO worked with other behavioral-health community members to pass an amendment to Colorado law last year. The revision eliminated a requirement that providers obtain consent from behavioral health patients for the transfer of their medical records for treatment, aligning Colorado law with the less-stringent federal privacy rule under the Health Insurance Portability and Accountability Act of 1996. Following a 2002 rule modification by HHS, the HIPAA rule no longer requires providers to obtain patient consent for the disclosure of patient records for treatment, payment and other healthcare operations.

The CORHIO report also calls for amending and broadening the federal law's consent requirements governing providers of federally supported drug or alcohol treatment programs that require patient consent for release of patient records for such treatment. The report notes that mental-health centers that have integrated substance-abuse and behavioral-health treatment programs "are likely to be required to follow these limiting federal regulations."

"Through this model, a patient can choose to have health information accessible through the HIE and not be required to grant consent for every exchange," the report's authors wrote.

But the report also notes that it is of "highest priority" to develop some method of enabling selective consent controls within the exchange.

"Although CORHIO does not currently have the technical capabilities to segment data, there is a possibility that the necessary infrastructure can be built," the report said. CORHIO buys its health information exchange connectivity services from Medicity, a subsidiary of health insurance carrier Aetna.

The report suggests as most feasible two technical approaches to provide a "tiered consent model." One would have patients opt-in to share their more-sensitive information via the exchange. Another would have more-sensitive information, such as behavioral-health data, segregated by provider, which would "require a technical build for both providers and CORHIO."

A third possibility would be for patients to create a personal health record and give the patient ultimate control over the information, the report said. "Although this could empower patients, it shifts responsibility to them," the authors wrote. "This model also creates the most significant gaps information, which may have negative treatment consequences," they said.