Updating HIPAA for the electronic medical record era

Abstract

With advances in technology, patients increasingly expect to access their health information on their phones and computers seamlessly, whenever needed, to meet their clinical needs. The 1996 passage of the Health Insurance Portability and Accountability Act (HIPAA), modifications made by the Health Information Technology for Economic and Clinical Health Act (HITECH), and the recent 21st Century Cures Act (Cures) promise to make patients’ health information available to them without special effort and at no cost. However, inconsistencies among these policies' definitions of what is included in “health information”, widespread variation in electronic health record system capabilities, and differences in local health system policies around health data release have created a confusing landscape for patients, health care providers, and third parties who reuse health information. In this article, we present relevant regulatory history, describe challenges to health data portability and fluidity, and present the authors’ policy recommendations for lawmakers to consider so that the vision of HIPAA, HITECH, and Cures may be fulfilled.

Diabetes Technology Meeting 2021

“…HIPAA does not apply to de-identified data; however, it must be realized that if enough data is collected, digital data included, then the data can be easily identified and linked to other data elements. 68,69 Congress and US Health and Human Services are aware of a need for new comprehensive data privacy legislation, although federal progress is minimal and slow. In the meantime, Europe passed and implemented the General Data Protection Regulation (GDPR) in 2018 and several states also passed legislation to protect consumer privacy including California with the California Consumer Protection Act (CCPA) and Virginia with the Virginia Consumer Protection Act.…”

Consumer Healthcare Technology Usage Impacting Behavior

“…In more recent years, the use of electronic resources for healthcare advancement has grown. The HIPAA, HITECH, and Cures Act have governed individual access to digital healthcare records, but researchers argue for increased oversight because current regulations have not kept pace with technology development and consumer demands, creating ambiguity and confusion (Rosenbloom et al, 2019). One study measured the adoption of patient portals before and after the Stage 2 Meaningful Use government program and found significant increases after the program launched (Turner et al, 2019).…”

A Policy Framework to Support Shared Decision-Making through the Use of Person-Generated Health Data

“…Despite two decades of continuous legislative and regulatory activity intended to promote the information-sharing interests of patients and clinicians, technology advances and business practices have far outpaced adjustments in federal policy, 56 resulting in unnecessary risk and frustration for everyone while still not supporting real-time access to key information. The privacy, security, and breach notification regulations under the Health Insurance Portability and Accountability Act (HIPAA) govern the use and disclosure of identifiable health information (known as protected health information)-but only when that information is held by covered entities (most health care providers and health plans) and their contractors (otherwise known as "business associates").…”