One of the less-obvious, but critical, issues in rolling out an HIE is how management handles patient consent for widespread use of the data. Providers who don’t ask for detailed permissions as to which HIE partners may use patient data when may someday find themselves at the barrel end of a high-caliber lawsuit.
To avoid such entanglements, Beth Israel Deaconess Medical Center (BIDMC) CIO John Halamka, MD has announced that it will require its 1,800 affiliated ambulatory care providers get patient opt-in for data sharing among clinicians on their case. The permission slip Halamka wants patients to sign will cover not only care within BIDMC but also care provided by outside clinicians.
The process BIDMC has developed is quite interesting, both in what it demands from clinicians and how the IT department is involved:
* Doctors who have a need to see patient info for treatment, payment or operations can electronically request a view from a community practice. To make the query, doctors hit what BIDMC is calling a “magic button” which works as follows (info below from Halamka’s blog):
1. The clinician clicks on a button inside their EHR. This click launches a query containing Name, Gender, Date of Birth, and Zip Code to a responding EHR. The physician does not need to respecify the patient or log in to a separate portal since the patient identity information and security credentials are sent from the querying EHR automatically.
2. The responding EHR checks the security, looks up the patient, and responds with a medical record number if the patient is found.
3. The querying EHR sends a new query incorporating the returned medical record number.
4. The responding EHR launches a web-page which displays clinical data for that medical record number.
5. All transactions are audited in the responding EHRs.
* Doctors can only get data for patients shared between the two organizations
* All requests will be audited
* There will be no “break the glass” feature allowing clinicians to override patient preferences
* Patients can opt-in later if they choose not to now
The audit aspect of this is especially interesting. How often? By whom? What protocols are in place to respond when something seems to be out of order?
But I must say the whole thing is intriguing. It seems to me that BIDMC is making the right choice, but anything involving consumers has a bunch of fail points that don’t pop up at first. I wonder how consumers will feel about this plan six to twelve month after it’s enacted. Much to learn here.
