Updated at 2:30 p.m. ET
The Office of the National Coordinator for Health Information Technology is working with Congress and the White House on ways to help patients understand when their health data is being used for secondary purposes.
"We've had a number of rewarding discussions," Dr. Donald Rucker, chief of the ONC, said during remarks at the agency's third interoperability forum in Washington, D.C.
Patient privacy has been a particular point of concern for hospital groups as healthcare agencies have ramped up interest in using apps to connect patients with their health data. Application programming interfaces that connect IT systems with third-party apps were key parts of the ONC's and the CMS' companion interoperability proposals released in February.
HHS in April launched a webpage to address common questions about the use of third-party apps under HIPAA. When a patient shares protected health information with a third-party app, the provider organization is not liable for subsequent use or disclosure of the data, as long as the app developer is not a business associate of the group, Rucker said at the time.
That puts responsibility in the hands of the patient to decide which programs to share their data with. Once a patient downloads their data, it is their responsibility to protect it.
"Do I want to use applications with extensive secondary reuse of data, like Facebook?" Rucker said in April, as an example. "Or do I want to do things like, for example, banking apps that have a lot of trust? Or use folks with business models like Apple, that have very specific promises about privacy?"
But that hasn't quashed concerns among healthcare groups.
In a letter to the ONC this spring, the American Hospital Association raised concerns about encouraging patients to use tools not governed by HIPAA. A third-party app that's not held to the same privacy standards as providers might be able to use health data in ways patients are not aware of, such as by monetizing it or using it to target advertisements, the association said.
The American Medical Association has also expressed concerns that the ONC's proposed rule could lead to patient information being shared with third parties in ways the patient didn't expect.
Rucker on Wednesday said the ONC is working with "a number of folks on better ways of doing consent," to ensure patients are aware of possible secondary uses of data. The current system of notifying users of secondary uses of data, which in many ways relies on long-winded terms and conditions agreements, arguably does not provide an adequate way to educate patients about their health data.
"I think we all realize that these end-user licensing agreements that we click through … don't really work in the modern world," he said.
Rucker described balancing the concerns around protecting patients' right of access with the concerns around protecting their privacy as a "very, very complicated, delicate balancing act." Still, he said he believes "most patients are actually going to be as protective of their medical information as they are of their banking information."
Rucker also referenced a price transparency executive order President Donald Trump signed in June, which charges hospitals and insurers with publishing "standard charge information, including charges and information based on negotiated rates and for common or shoppable items."
"I think that price and product transparency … is going to be part of what this app economy does," Rucker said. However, price transparency was a controversial component of the ONC's interoperability rule, with healthcare groups like the AHA coming out strong against a suggestion that the ONC require providers to disclose price information as part of patients' health data.
The ONC is working on finalizing its interoperability rule. The agency is currently in the process of reading through the more than 2,000 comments that providers, health plans and trade groups submitted in response to the proposal, Elise Anthony, the ONC's executive director of policy, said at the interoperability forum.
