What is happening to patient privacy?
Recently, I realized that my medical records are available through not one, but three health information exchanges (HIEs), CTHealthlink, CONNIE and CareEverywhere.
I learned this by looking at the privacy disclosures on the website where I have received care. I then looked up the member organizations participating in each HIE. Most of the member organizations are acute care hospitals but some are mental health clinics.
I investigated a bit further to find that if I were referred for cancer treatment (as an example) and have a record available at a mental health clinic participating in that HIE, my records are available to my treating health care provider. Indeed, my mental health records might be relevant to the health care team if I have been treated for prescription drug abuse. Armed with this knowledge, my physician could be aware of the need to avoid prescribing drugs with the potential for dependence. The problem is that someone, usually a nurse, must access and review my mental health treatment records, to determine if they are relevant to my care.
In a prior column, I focused on HIEs and implications for psychologists. Some states have begun to mandate that independent health care practitioners with electronic medical records begin the process of connecting to the state HIE. Federal mandates required states to develop HIEs. State mandates determine the type of consent process “opt-in” or “opt-out.”
Some New England states such as Rhode Island are “opt-in,” meaning that specific consent is required for health information to be exchanged or stored. A greater number of states (Massachusetts, Vermont, and Connecticut) are “opt-out” such that residents are automatically enrolled but have the option to opt out by taking specific steps outlined by each health information exchange.
An individual’s decision to opt out of the state health information exchange is usually binary and thus affects all medical data. Maine is an opt-out state that allows residents to opt in or out of sharing sensitive mental health information without opting out of the HIE altogether.
Psychologists who delivered treatment prior to the 1996 Health Insurance Portability and Accountability Act (HIPAA) may remember the sea change that resulted from the federal law that protected disclosure of patient records without consent.
Decades later, it is ironic that the federal Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009 has given states the mandate to develop health information exchanges where the consent decision is managed at the level of the HIE, rather than at the level of the organization, provider or patient.
Patients need to be sufficiently educated such that they understand HIEs and the implications of what it means to opt-in or out.
I developed the vague understanding that my health records were increasingly interconnected over the past two years, when I realized that prescriptions filled at my local pharmacy were available in the health records of my primary care physician.
At no point do I ever recall a prescriber informing me that a record of my prescription would be available via the HIE, nor do I remember signing consent to release prescription data to any healthcare provider involved in my care.
I see the value and need for health care providers to have a full and adequate understanding of a patient’s medication usage. However, if the data pertained to mental health rather than prescriptions, I would not want it shared. If I had been seen in a community mental health setting, I would have wanted to opt out of sharing my records on the HIE.
There has been no widespread campaign to educate the public about HIEs. Health care professionals have not been sufficiently educated either. I checked with several colleagues (nurses and physicians) who work in acute care hospital settings to ask if they were aware of CONNIE, one of Connecticut’s HIEs.
They were familiar with the exchange capability of Care Everywhere but had not heard of CONNIE. Interestingly, they took steps to opt out via the website immediately. If many health care providers are insufficiently educated about HIEs, then there is little reason to assume that the public has enough information to make an informed decision about opting in or out.
In medicine, technology often develops without a full understanding of the ethical implications. Case in point: Implantable cardioverter defibrillators are medical devices that deliver electrical current to restore heart rhythm. ICDs existed for many years before medical professionals understood the degree to which dying patients experienced painful shocks.
Most families never knew that they had an option to deactivate the ICD of a dying patient. Eventually, guidelines about deactivation of ICDs were developed. Similarly, in the effort to develop robust HIEs, interoperability has developed without a thorough understanding of the untoward effects.
HIEs have been around for quite some time. So, isn’t a public health campaign at this point a bit like locking the gate after the horse has bolted? Mental health professionals in independent practice are only slowly becoming aware of this as a privacy issue as some states have mandated that they register with the state HIE. It is not too late to advocate for patients to have the right to opt out of sharing mental health data without opting out of an HIE altogether.
Given the dearth of mental health literacy in healthcare settings, we should be thoughtful about the patient perspective on sharing mental health records via HIEs. The evolution of digital health care records ensures that a permanent historical record exists for all who seek health care treatment. There is much potential public health and patient benefit from HIEs, but we should leave the decision to consent to share mental health treatment records in the hands of the patient.