Tech fixes ease sharing of sensitive patient data

This spring, Michigan lawmakers removed a major roadblock to the exchange of patient medical records between behavioral-health and medical providers by approving a uniform patient notification and consent form. Leaders of Community Support and Treatment Services, a behavioral health provider in Ann Arbor, and the University of Michigan Health System promptly took the approved form and used it as the centerpiece of a new information exchange system to better coordinate care for patients with both behavioral and medical needs.

Under the new system, enrolled patients' electronic consent forms are stored in a database developed by PCE Systems, Community's electronic health-record vendor. Requests for patient records sent by the University of Michigan Health to Community are routed to the database, where they are checked against the list of consents on file. If a consent directive is there, the system approves the release of information, queries Community's EHR system for data on that patient, uses it to prepare a care summary, and displays it to UM care managers through a secure Web portal.

Gaining instant access to each other's data enables providers from both organizations to reconcile medications. “That's huge for our providers,” said Donna Fox, administrative manager of UM's complex care program. Seeing Community's patient-care plans enables providers from both organizations to “always speak to the patient in the same framework, so the patient is not hearing two different things.”

Michael Harding, Community's chief information officer, said the expanded patient-information sharing may reduce costs by eliminating duplication of costly metabolic tests. “We're anticipating we're saving 50 metabolic panels a week,” he said.

UM, Community and PCE Systems are among a handful of providers and IT vendors hard at work developing patient-directed privacy controls to be placed on EHRs to comply with strict federal privacy laws governing behavioral and addiction treatment. The federally backed effort to promote development and use of the new technology is called data segmentation for privacy, or DS4P.

Privacy rules protecting patient information on behavioral health and addiction treatment are deemed critical in encouraging Americans with mental-health, drug or alcohol problems to seek treatment without having to worry about their records being shared inappropriately and their suffering a stigma that could affect them socially or financially.

“If we compromise addicted people's records with open access through (EHR) interoperability, it will destroy people's confidence” that their privacy will be respected if they seek treatment, said John Liepold, executive vice president of Valley Hope Association, a behavioral-health provider in Norton, Kan.

The legal issues arise largely from 42 CFR Part 2, a federal rule issued in the 1970s that requires patients' consent for a disclosure of addiction treatment records to another provider; those other providers similarly must get the patients' consent to send the records to other providers. “Law enforcement would go to these specialty treatment centers and try to obtain records and information about these patients and arrest them,” said Kate Tipping, a public health adviser at the Substance Abuse and Mental Health Services Administration, or SAMHSA. “That's why 42 CFR came along.”

The Veterans Health Administration has a similar rule, 38 CFR Part 1, applicable to patients' care for drug or alcohol abuse, HIV and sickle cell anemia.

In contrast, under the Health Insurance Portability and Accountability Act, which covers the broader world of healthcare, a patient's consent is not required for disclosures to other providers of records for treatment, payment and other healthcare operations.

Those rules long have gotten in the way of coordinating behavioral health and medical services. Without such sharing, the risks increase for duplicated services and adverse patient outcomes, such as incompatible medication prescriptions. That's particularly a problem as policymakers, providers and health plans develop ways to better harmonize medical and behavioral care, which traditionally have operated with little or no coordination, resulting in higher costs and poorer quality of care.

State Medicaid programs increasingly are developing integrated-delivery models to encourage collaboration between physical and behavioral-healthcare providers. That quest has become especially urgent now that the Patient Protection and Affordable Care Act has brought millions of additional low-income adults into Medicaid, the nation's single largest payer for mental-health services. Accountable care organizations and managed-care plans in the private sector also are striving to better manage the care of expensive patients with behavioral and medical needs.

Many providers and plans, however, feel intimidated by the privacy rules. Meanwhile, surveys show that patients prefer to maintain tight control over which providers receive their records. That poses a problem for providers. “Healthcare is an information business,” said Dr. William Tierney, president of the Regenstrief Institute in Indianapolis. “If you exclude access to some of that information, you hurt healthcare delivery.”

In 2009, Congress ordered HHS to explore ways to segment data for privacy with the goal of minimizing “the reluctance of patients to seek care or disclose information about a condition because of privacy concerns.” HHS' Office of the National Coordinator for Health Information Technology sponsored development of the DS4P standards to do “meta-data tagging.” A meta-data tag could, for example, alert a provider that the transmitted record contains patient information subject to more stringent privacy laws. In Ann Arbor, a warning is built into the portal telling UM providers that the patient-care summaries they are about to see are covered under a strict federal privacy law governing behavioral health and that by accessing the document, they're obliged to follow its restrictions.

Six federally sponsored pilot tests of DS4P standards and implementation guides have validated the technology, experts say. One of them, a five-month pilot with SAMHSA and the health department of Prince Georges County, Md., tested a Web-based tool called Consent2Share. It enables patients at the county's multiple care sites to create consent directives. With the directives, patients pick which providers they're willing to share their data with. The system blocks or permits the flow of information about sensitive conditions such as HIV and reproductive health issues, as well as behavioral health information, said Kathryn Wetherby, public heath adviser for SAMHSA.

But exchanges between most behavioral-health and medical providers are still in their infancy.

Segregating behavioral-health data for privacy presents a sticky problem for medical providers wanting to keep HIPAA records and 42 CFR Part 2 data separate. Most don't have the technology to tag records for privacy, at least not yet.

In May, SAMHSA called for industry input on possible modifications to 42 CFR Part 2, noting that: “A number of organizations across the country are excluding substance-abuse treatment data because of the difficulty and expense of implementing the functionality and workflow changes necessary to comply with current regulations. In these instances, patients are prevented from fully participating in integrated-care efforts even if they are willing to provide consent.”

Organizations participating in the six ONC pilots include private providers in behavioral and medical care; health IT vendors and health IT institutes; the Veterans Health Administration; and SAMHSA. “Our goal is to lay the groundwork,” said Laura Rosas, senior adviser to the ONC. “I think we've done that.”

Of the other ONC pilots, the one closest to having a medical records exchange program in production using DS4P is a collaborative headed by Netsmart, an Overland Park, Kan.-based developer of EHRs for behavioral health organizations; Henderson Behavioral Health, Lauderdale Lakes, Fla; and the four-hospital Memorial Health System in Broward County, Fla. Memorial providers will see patient demographics, problems, allergies, medications and any recent encounters, said Liz Cole, Memorial's supervisor for health information exchange.

Of the six ONC pilots, the Veterans Health Administration has the most patients—80,000 veterans—signed up to use digital consent-management technology. The VA also had the only pilot to demonstrate all three DS4P use cases, said Mike Davis, security architect for the VHA.

Several behavioral-health providers said they're ready to send continuity of care documents of their patients' records but lack medical provider partners ready and willing to receive them. Valley Hope deployed a version of DS4P technology developed for the Software and Technology Vendors' Association's ONC pilot. It uses the pilot technology to manage discharge summaries, Liepold said. It hasn't used DS4P to exchange patient records because none of its business partners are geared up to do it yet.

“We're like the first guy on Earth with a fax machine,” he said

Follow Joseph Conn on Twitter: @MHJConn