Strategizing Meaningful HIE Consent
Variations in approach to consent pose challenges to interoperable health information exchange. Each state around the US and, in many states, each individual health information exchange differs in their approach to consent processes and management. This can affect workflow and decision-making capabilities for users of the HIEs. Some state models have been shown to increase regulatory barriers to health information exchange and place a greater administrative burden on those less technologically advanced organizations. Below, we will examine some of the issues, approaches to address them, and implications on key stakeholders including providers, payers, and patients. If your organization is looking to solve HIE consent problems, Strategic Interests and our partners have the ability to assess the current state of consent in your region, compare to best practices around the nation, isolate and evaluate the impacts of making changes, and develop a practical plan to move forward.
There are several model variations around the nation with different selections across the potential options. Model variations include:
- Authorization models: range from opt-in, opt-out, and hybrids that require opt-in for sensitive information or other specific PHI or demographics.
- Initiating Party: consent initiation may be performed by the provider, the patient, or either, in addition to a parent/guardian or healthcare proxy.
- Initiation Domain: point of care, online, or a mixture of options. COVID-19 has led to waiver programs that temporarily change these policies. Such changes may become permanent, and in the meantime have already modified the everyday behavior of clinicians and care providers in their approach to patient care.
- Data Sharing: basic choice to share all data or can be more granular to select certain types of data by sensitivity level and clinical application or need.
- Provider Data Access: may be granted to a particular provider, organization, or multiple providers (community consent) based on the model deployed. Some models permit emergency access or blanket restrict all access regardless of an emergent event occurrence.
- Patient Data Access: models may provide ability to access and/or suggest changes
- Alteration and Revocation: patient changes to consent may be retrospective, prospective, or contain options of either. For example, revoking consent may or may not remove access to historic data. Changes to consent may be entered by the patient, provider, or either and may occur at the local or statewide level.
- Alignment with Federal Policies: HIPAA, TEFCA, etc. does not necessarily reconcile fundamental policy differences across regions or states.
Migration Issues:
- Process for providers who have a presence in geographies served by multiple QEs with varying policies
- Process for patients who travel across HIE regions for healthcare in addition to travel out of state which may entail seasonal or emergency care
Governance Structures:
- Centralized consent tracking system and standard consent form
- Patients are asked to repeatedly sign consents for each HIE, leading to “consent overload.” Such overload not only affects the HIE and the interconnected systems, but also creates temporal inconsistencies as to when a particular consent was in effect and when data was shared or denied.
- Patients ability to query for, or change their current state of consent without contacting each individual HIE
- Sensitive PHI may be treated differently in different organizations
Complications:
- Organizations may be steadfast in their own approach to consent and resistant to change on a statewide level
- Integration with EHRs and other HIEs
- Mobile technology support
- Platforms, architecture, security labeling, FHIR, OAuth/UMA, audit capabilities, security classes
- Relationship to identity management
The benefits of a well-managed consent program far outweigh the challenges. In order to successfully define and deploy such capabilities, HIEs must incorporate stakeholder requirements, design solutions and an approach to address these requirements, embrace a funding and program management approach that allows organizations, providers, and other stakeholders to migrate from current approaches, and solve workflow issues related to the collection and management of consent while conforming to regulatory requirements for the management of sensitive substance use, mental health, and persistent viral data (HIV, herpes, COVID-19, etc.). In addition, the potential of legislative changes could streamline the process but may also pose distinct privacy and workflow challenges.
A successfully deployed statewide consent management system will yield increased patient clarity in the process, lessened effort for participants in the consent process, improvements in care delivery and coordination and the maintenance of patient desires and health information privacy choices. These, and other complex healthcare workflow and strategy quandaries are situations that SI and our partners are well-positioned to address. Let us know if you need help.
Recent Comments