The Health Insurance Portability and Accountability Act (HIPAA) enacted in 1996 includes the requirement to guard the privacy and security of health information of people, defined as “protected health information” (PHI). The HIPAA regulation pertains to “covered entities”, which include healthcare providers, health plans and healthcare clearinghouses.
The 2009 American Recovery and Reinvestment Act (ARRA) passed by the Obama administration, features a section called the Health Information Technology for Economic and Clinical Health (HITECH) Act. The HITECH Act promotes adoption of “electronic health records” (EHRs) to improve efficiency and lower healthcare costs. Anticipating that the widespread adoption of electronic health records would increase privacy and security risks, the HITECH Act introduced new security and privacy related requirements for covered entities and their business associates under HIPAA.
Further, the fines for non-compliance with the HIPAA privacy rule have increased significantly with the introduction of the HITECH Act. Smaller practices are being fined thousands of dollars and large provider organizations are being fined millions of dollars based on some recent landmark cases. Up to now, the us government has discovered that performing HIPAA compliance audits is just a significant revenue generation opportunity. Consequently, it has hired additional audit staff and plans to significantly increase the number of HIPAA Compliance Audits. For providers, this implies a heightened threat of significant financial penalties, should you be found to be non-compliant.
Complying with one of these ACTs (HIPPA + HITECH are collectively referred to as the ACTs) requires an investment in the adoption of HIPAA Compliance Plans, training of staff and focus on the particular details of the ACTs. Remember that the ACTs do NOT require the utilization of technology, although HITECH in combination with ARRA does heavily promote and incentivize the adoption of EHRs. The goal of this document is to greatly help healthcare providers understand how patient portals help achieve HIPAA compliance. There are numerous approaches to the broader compliance topic that range from hiring HIPAA compliance consultants to adopting HIPAA Compliance Plans which have been written for similarly situated organizations. These topics are beyond the scope of this paper.
So how do practices meet up with the insatiable desire for electronic communications to provide patient satisfaction, yet adhere to HIPAA and HITECH? Patient portals are certainly part of the answer. Simply put, patient portals are healthcare related online applications that allow patients to interact and communicate making use of their healthcare providers. The functionality of patient portals varies significantly but may include secure use of patient demographic information, appointment scheduling, payments, bidirectional messaging and use of clinical data if the portal will be supplied by the EHR provider.
Today used, we find patient portals being supplied by EMR/EHR providers, firms providing “Practice Management” (PM) solutions and even third parties which are promising patients eventual use of their health information in one single portal. They are typically referred to as “Personal Health Portals” and many consider “Microsoft Health Vault” to be the leader in this space. Since the personal health portal doesn’t directly connect to the practice, these portals typically only contain clinical information that can be obtained through the myriad and increasing quantity of healthcare data exchanges.
Change Management. This problem impacts small and large organizations undertaking major system implementations. Comprehensive systems implementations require redefinition and remapping of business processes by all members of an organization. The problems and significant challenges involved with dealing with these kind of projects are well documented and beyond the scope of this paper, but they’re real conditions that are slowing the adoption of new technologies
Cost/Time to Implement. The us government recognized the cost element of this dilemma and with the ARRA provides up to $44,000 per practice for implementing an EHR solution and meeting all the yet to be defined “meaningful use” criteria. However in many practices, time to implement is still a huge hurdle as practitioners are busy seeing patients all day each day and these systems invariably take weeks and months of training and lost productivity due to the learning curve of the brand new technology
Existing EHR Solution meets core requirements but patient portal is not available. This is a very common issue, particularly for larger and/or very specialized providers where systems have been developed and customized to meet the complex clinical requirements, but weren’t designed to deal with patient communications and other patient facing requirements of today. As a result of this complexity and customization, adoption of a fresh solution is very impractical and wholesale replacement is not deemed an option by several providers
Beyond the adoption issues stated above and many other unstated ones, there is a broader problem with the utilization of practitioner-level patient portals for clinical information. To know the author’s perspective on this dilemma, consider that one of many real benefits of electronic health information is that the theory is that it’s easily shared, aggregated, disaggregated and exchanged. The truth is achieving these benefits is still a couple of years away, maybe more. The establishment of statewide healthcare exchanges marks a significant milestone but much work remains to be done to attain interoperability of clinical data. Microsoft Health Vault is pushing hard to function as the platform that securely delivers the whole group of clinical data to patients that incorporates data from most of its providers, pharmacies and lab results in one simple to use portal. upsc ias online study
At best, then a practitioner-level patient portal providing clinical data only presents a single provider view, yet many of the patients that want these records the most have multiple providers engaged in their care. Like, a single patient could have a household physician, an internist, a cardiologist and an endocrinologist all engaged in their care. Looking at the information from any single practitioner wouldn’t provide a complete picture. Because of this, the author believes that clinical data is most beneficial delivered as a single portal to the patient by a 3rd party that can make arrangements to aggregate data from all sources and deliver it to the patient in one portal.
Given the adoption challenges of the EHR/PM-centric (patient) portals, and the broader issues with delivering clinical data in practitioner-level portals, there is a part for “standalone” portals. By standalone portals, we mean portals offering direct patient use of the creation and editing of patient demographic information, bidirectional secure messaging, appointment scheduling, payments and other non-clinical features. These portals don’t provide use of the clinical data. But standalone portals offer healthcare providers the capability to quickly join the digital revolution, meet up with the insatiable desire of patients to communicate electronically in ways that’s secure and HIPAA compliant, allow online self-registration and drive multiple efficiencies at the same time.