The U.S. Department of Health and Human Services Office of the National Coordinator for Health Information Technology (ONC) and Centers for Medicare & Medicaid Services (CMS), recently published rules implementing interoperability and patient access provisions of the 21st Century Cures Act. New functionality required under the rules includes, among other things:
While this enhanced access creates an express lane for patient-empowered digital health, it potentially increases the risk of medical records identity theft and highlights the importance of consumer trust.
The rules create opportunities for consumer health apps and represent a major advancement in the traditionally restrictive health information space. They will enable a new, personalized health information ecosystem architecture with a direct connection to the consumer via required patient access APIs or application programming interfaces (i.e., tools for software development and integration). Indeed, the consumer now becomes a primary custodian and source for health information for innovative healthcare companies, making databases of valid, structured health information a new reality. In other words, the consumer can download health information for the consumer’s own use and subsequent processing, sale and disclosure—including interaction with third-party apps—all outside of the Health Insurance Portability and Accountability Act (HIPAA).
From a regulatory perspective, a data flow with access and download by the consumer through an independent third-party application will take the health information outside regulation under HIPAA. However, third-party applications will be subject to privacy regulation by the Federal Trade Commission (FTC). Additionally, while not subject to HIPAA, this health information remains sensitive and subject to regulation under various state-level privacy, security and breach laws.
Delivering on data protection and building trust in this new data environment will become key market differentiators. With the table set, the following are five things to consider now: