Managing Consent Preferences in Today’s Data Sharing World

1. Managing Consent Preferences in Today’sData Sharing World Michele O’Connor, MPA, RHIA, FAHIMA Senior Director Healthcare Practice Initiate, an IBM Company Nance Shatzkin President Shatzkin Systems Shatzkin Systems®

2. Overview Background State & Federal policy landscape The ‘Alphabet Soup’ of ONC, NCVHS, CDT, HIPAA Consent Options ONC Whitepaper Privacy & Security Tiger Team Collecting & Documenting Consent Patient Identity & Consent Conclusions 2

3. Consent Preferences & Privacy: ‘The Big Picture’ Public Health Primary Care Primary Care Public Health First: Last: City/State: Treatment: Visit: Katie Johnson Las Cruces, NM Immunization Records 05/1980 First: Last: City/State: Treatment: Visit: Kathy Johnson Las Cruces, NM History & Physical 09/1987 Urgent Care SurgiCenter Kathy Abramowicz Baltimore, MD Arthroscopy CCR 08/2008 First: Last: City/State: Treatment: Visit: Record Locator Service / EMPI / Patient Registry SurgiCenter Urgent Care Health Record Katherine Johnson Albuquerque, NM Penicillin Allergy 11/1997 First: Last: City/State: Treatment: Visit: Name:Kathryn Abramowicz City/State:Baltimore, MD Visit Date: Name: Treatment / Prescription: Consent: 08/2008 06/2008 04/2008 04/2008 04/2008 11/1997 09/1997 05/1980 Kathy Abramowicz Kathryn Abramowitz Kate Abramawits Katie Abramowitz Kate Abromowits Katherine Johnson Kathy Johnson Katie Johnson Arthroscopy CCR Disability Approval CT Scan Coumadin 2mg Myocardial Infarction Penicillin Allergy History & Physical DTaP, IPV, PCV, Rota Yes Yes No Yes Yes Yes No Yes Clinic (Federal) First: Last: City/State: Outcome: Visit: Kathryn Abramowitz Baltimore, MD Disability Approval 06/2008 Hospital Federal Hospital First: Last: City/State: Treatment: Visit: Kate Abromowits Manasis, VA Myocardial Infarction 04/2008 Imaging Center Pharmacy Imaging Center Pharmacy First: Last: City/State: Prescription: Visit: Katie Abramowitz Manassas, VA Coumadin 2mg 04/2008 First: Last: City/State: Treatment: Visit: Kate Abramawitz Manassas, VA CT Scan 04/2008 3

4. There Are Many Ways & Pathsfor Data Sharing Local Serves local providers, key business consideration NHIN Direct Typically push model, appears to be covered by HIPAA Regional Public private collaborative prominent Governance & consent are challenges Push and pull models States All of the Regional challenges, plus more SDEs have interstate challenges Federal VLER, DOD, MHS, VA , FISMA,and all the alphabet soupyou can fathom 4

5. The Backdrop of ‘Alphabet Soup’ NCVHS Report 2006 Privacy vs. Confidentiality ONC White papers Consent preferences Data segmentation Privacy & Security TIGER team When do you need consent? European Union (EU) vs. USA Privacy as a human-dignity right vs. privacyas a consumer-protection right 5

6. Privacy & Security TIGER Team ALL entities in HIE must followFair Information Practices Individual Access Corrections Openness & Transparency Individual Choice Collection, Use &Disclosure Limitations Data Quality & Integrity Safeguards Accountability 6

7. Privacy & Security TIGER Team Recommendations Third parties Need Trust framework Right of patient or provider to consent to HIE Additional consent for directed exchange(not needed if already covered by law) Form of consent Consent implementation guidance. Provider consent option(s) Granular consent Didn’t make new regulations,solidified importance ofHIPAA & execution 7

8. The SDE Monies HaveRaised the Stakes 550M to SDEs: Strong incentive tospend monies quickly Plans must beapproved by ONC Meaningful use timeline& requirements Quarterly reports to ONC Inter-state data sharingrequirements NHIN Direct ?? 8

9. Managing Patient Consents: ‘The Journey Starts Here…’ ‘Opt in’ No inclusion, mustexecute consent ‘Opt in’ (with restrictions) No inclusion, subset of data ‘Opt out’ Included automaticallybut patient can opt out ‘Opt out’ (with exceptions) Included , subset can be excluded ‘No consent’ In, no exceptions “Mr. Smith, would you like us to share data electronically with your other healthcare providers?” 9

10. Managing Patient Consents: ‘The Journey Starts Here…’ ALTERNATE OF FRAME #09 • ‘Opt in’ • No inclusion, mustexecute consent • ‘Opt in’ (with restrictions) • No inclusion, subset of data • ‘Opt out’ • Included automaticallybut patient can opt out • ‘Opt out’ (with exceptions) • Included , subset can be excluded • ‘No consent’ • In, no exceptions “Mr. Smith, would you like us to share data electronically with your other healthcare providers?” 10

11. Tough Decisions &Conflicting Regulations Minors Behavioral health HIV Status Reproductive health STD testing Genetic testing Meds seekers Services received outsideinsurance coverage 11

12. Don’t Promise…What Can’t Be Delivered! Consent is not a panaceafor privacy management& information protection Be mindful of ‘consent fatigue’ Segmentation is not reality Information is pervasivein a record Privacy & security are not the same, but both are required to build trust 12

13. Consent & Privacy:Lots of Questions to Ponder… What is important to public health &‘quality healthcare’? What does a reasonable patient expect? What does a physician or treating practitioner expect? Do benefits outweigh the privacy trade-offs? Are we putting too much burden on the HC provider? Healthcare Policy Questions Privacy & Security Policy should drive the standards What is the benefit of information sharing & therefore what are wewilling to risk? 13

14. Key References for Staying Informed HIT Policy Committee & workgroups ONC’s Chief Privacy Officer, Joy Pritts, JD Center for Democracy and Technology (CDT) Patient Privacy Rights Markle Foundation’s Connecting for Health 14

15. The Practical Aspects ofConsent & Data Exchange Public Health Primary Care Primary Care Public Health First: Last: City/State: Treatment: Visit: Katie Johnson Las Cruces, NM Immunization Records 05/1980 First: Last: City/State: Treatment: Visit: Kathy Johnson Las Cruces, NM History & Physical 09/1987 Urgent Care SurgiCenter Kathy Abramowicz Baltimore, MD Arthroscopy CCR 08/2008 First: Last: City/State: Treatment: Visit: Record Locator Service / EMPI / Patient Registry SurgiCenter Urgent Care Health Record Katherine Johnson Albuquerque, NM Penicillin Allergy 11/1997 First: Last: City/State: Treatment: Visit: Name:Kathryn Abramowicz City/State:Baltimore, MD Visit Date: Name: Treatment / Prescription: Consent: 08/2008 06/2008 04/2008 04/2008 04/2008 11/1997 09/1997 05/1980 Kathy Abramowicz Kathryn Abramowitz Kate Abramawits Katie Abramowitz Kate Abromowits Katherine Johnson Kathy Johnson Katie Johnson Arthroscopy CCR Disability Approval CT Scan Coumadin 2mg Myocardial Infarction Penicillin Allergy History & Physical DTaP, IPV, PCV, Rota Yes Yes No Yes Yes Yes No Yes Clinic (Federal) First: Last: City/State: Outcome: Visit: Kathryn Abramowitz Baltimore, MD Disability Approval 06/2008 Hospital Federal Hospital First: Last: City/State: Treatment: Visit: Kate Abromowits Manasis, VA Myocardial Infarction 04/2008 Imaging Center Pharmacy Imaging Center Pharmacy First: Last: City/State: Prescription: Visit: Katie Abramowitz Manassas, VA Coumadin 2mg 04/2008 First: Last: City/State: Treatment: Visit: Kate Abramawitz Manassas, VA CT Scan 04/2008 15

16. Managing Consent: Where & How? Different models RHIO/HIE collects consents Direct interaction with patients Forms collected and forwarded Providers collect consent For themselves only or for others, too At registration or by clinician Patients enter consent In the future Via PHR or other access Different enforcement Challenge question on access Driven by value in systemof record 16

17. The Form(s) Legal document If by providers, needvalue in local system Collect minimum number of times Universal ConsentOption (FL, TX) Substance abuse OCR &SAMHSA FAQ 17

18. The Form(s) NYS labored overlanguage & format Specific inclusions detailed Set standard; require DOH approval for deviation Each site adds their logo, manages through local forms managementprocess If list of facilities,need method for updates

19. Source of Consent ValueDuring Processing Centralized Consent Registry RHIO may keep as part of RLS or CPI Some regions/states may build Record Locator Service (RLS) Know where data is – link to document registry Confidentiality tagging on ‘documents’will enhance privacy control options Helps manage unified patient identity Know how your system operates 19

20. The Technical Side When collected by provider in local system Values to support workflow and patient interaction Pass to RHIO or SDE as part of ADT feed Standards not well developed Bronx experience CON, ARV, PID, Z segments True ‘consent service’ Web service connection with centralized repository More important when cross-facility collectionor as patients control directly ‘Call’ for current value; send update if value recorded Need EMRs to be ready Developing standards(SAML, XACML) 20

21. Stories from the Front Lines The real-world Very dependent on patient flow & staffing realities What it means to achieve ‘informed consent’ The 80-20 rule applies Keep it simple NYS limits on age 10-18 Audit processes Find errors early & address Training is critical 21

22. The NY Experience The Bronx Experience: Started with RHIO-wide consent to access Modified after State Guidelines issued Facility specific provides advantages Created HIM Committee reporting to Board of Directors of RHIO Other NY RHIOS: Started with disclose and access consents Modified based on implementation difficulty Facility checklists Centralized data entry 22

23. Patient Identification Issues Are Deeply Intertwined with Consent Management Perfect world One MRN/patient/facility Link MRNs across facilities Single patient view The real world A few duplicate MRNs created Data quality variation across sites Rules for the HIE to follow 23

24. Operational Implications Virtual record is incomplete All facility form but site registration doesn’t match Different consent selections by patient when MRNs are to merge RHIO/HIE HIM Operations starting to address issues 24

25. Consent Management Is Not Easy It’s a complex issuethat requires: Governance Standards Trust Governance Standards Trust 25

26. Where Will the DiscussionTake Us? ONC is committed to exploring the challenges & formulating policy Rulemaking will be required States’ rights must be upheld& third party data Not all issues will be addressed Participate in the dialogue & getinvolved at the level you’remost comfortable!Your expertise is needed. 26

27. Q & A / Thank You Michele O’Connor, MPA, RHIA, FAHIMA Senior Director Healthcare Practice Initiate, an IBM Company moconno@us.ibm.com Nance Shatzkin President Shatzkin Systems nance@shatzkinsystems.com