AMA: HIT Proposals Must Do More for Patient Privacy

Physicians See Potential Progress in Rules for Vendors, EHRs

The American Medical Association (AMA) has submitted comprehensive comments to the Office of the National Coordinator for Health Information Technology (ONC) in response to the sweeping set of proposed changes to HIT certification and implementation of the 21st Century Cures Act and to the Centers for Medicare and Medicaid Services (CMS) in response to its proposal on patient access and interoperability. 

The AMA supports several of the proposed changes, especially around HIT vendor practices, technology development, and EHR performance. The AMA also identified proposals that could prove problematic and run counter to the goals Congress set out to achieve in the Cures Act, particularly around privacy. 

“The AMA strongly supports patients having access to their own health information, which is a laudable goal of the Administration,” says AMA President Barbara L. McAneny, MD. “At the same time, the proposed rules are complicated, intertwined, and may result in a patient’s information being shared with third parties—including those under no obligation to keep information private—in a way the patient didn’t foresee or want.” 

The AMA says the rules, as proposed, would require health information to be shared but do not set any expectations or protections around what a recipient can do with it. 

“For example, a patient’s app should have to reveal to the patient that his or her health information will be sold to other companies. And a health insurance company should be prohibited from using a patient’s medical record to increase prior authorization requirements,” McAneny says. 

Before the proposals are finalized, the AMA requests that patients and policymakers have a robust dialogue and understanding of the potential consequences of these proposed rules. After that, solutions should be implemented to help establish transparency in how health information is used, who is using it, and how to stem data commoditization without a patient’s knowledge. 

“Once the information is out there, it’s virtually impossible to get it back,” McAneny says. “The technological capability to implement these controls exists. If ONC doesn’t implement controls, it is making a policy decision to not prioritize privacy.” 

In its comments, the AMA also makes numerous recommendations to ONC and CMS that will help reduce complexity and simplify documentation requirements while also strengthening patient privacy and physician autonomy:

• ONC should align its information blocking requirements and EHI with the certified capabilities of HIT vendors—ie, the USCDI and APIs. Information blocking should be evaluated through the lens of access, use, and exchange of the USCDI.

• ONC should require that all certified APIs include mechanisms to strengthen patients’ control over their data.
• ONC should clarify that a physician exercising his or her best judgment when providing information will not be considered an information blocker.

To read the summary of the ONC letter, click here. To read the entire ONC letter, click here. 

• CMS should prohibit payers from using these proposals to place additional contractual demands on physicians and impose meaningful penalties for payer noncompliance with this new prohibition.
• CMS should require payers to attest that USCDI exchange between plans will not be used as a basis to deny or delay coverage, increase rates, or implement step therapy, and should prohibit payers from requiring an applicant or enrollee to disclose his or her USCDI as part of the enrollment process.
• CMS should clearly state that payers may not condition provider participation in a plan based on whether a physician will grant the payer electronic access to the practice’s EHR to fulfill requests for information.

To read the summary of the CMS letter, click here. To read the entire CMS letter, click here.

— Source: American Medical Association