The Health Insurance Portability and Accountability Act (HIPAA) enacted in 1996 includes the necessity to safeguard the privacy and security of health information of an individual, defined as “protected health information” (PHI). The HIPAA regulation pertains to “covered entities”, which include healthcare providers, health plans and healthcare clearinghouses.
The 2009 American Recovery and Reinvestment Act (ARRA) passed by the Obama administration, carries a section called the Health Information Technology for Economic and Clinical Health (HITECH) Act. The HITECH Act promotes adoption of “electronic health records” (EHRs) to enhance efficiency and lower healthcare costs. Anticipating that the widespread adoption of electronic health records would increase privacy and security risks, the HITECH Act introduced new security and privacy related requirements for covered entities and their business associates under HIPAA.
Further, the fines for non-compliance with the HIPAA privacy rule have increased significantly with the introduction of the HITECH Act. Smaller practices are now being fined tens of thousands of dollars and large provider organizations are now being fined countless dollars predicated on some recent landmark cases. To this point, the federal government has unearthed that performing HIPAA compliance audits is just a significant revenue generation opportunity. Consequently, it has hired additional audit staff and plans to significantly increase how many HIPAA Compliance Audits. For providers, this implies a heightened threat of significant financial penalties, should you be found to be non-compliant.
Complying with one of these ACTs (HIPPA + HITECH are collectively called the ACTs) requires an investment in the adoption of HIPAA Compliance Plans, training of staff and attention to the specific information on the ACTs. Observe that the ACTs do NOT require the usage of technology, although HITECH in combination with ARRA does heavily promote and incentivize the adoption of EHRs. The objective of this document is to help healthcare providers understand how patient portals help achieve HIPAA compliance. You’ll find so many approaches to the broader compliance topic that range from hiring HIPAA compliance consultants to adopting HIPAA Compliance Plans that have been written for similarly situated organizations. These topics are beyond the scope of this paper.
So how can practices meet the insatiable desire for electronic communications to supply patient satisfaction, yet adhere to HIPAA and HITECH? Patient portals are definitely part of the answer. Simply put, patient portals are healthcare related online applications that allow patients to interact and communicate using their healthcare providers. The functionality of patient portals varies significantly but may include secure access to patient demographic information, appointment scheduling, payments, bidirectional messaging and access to clinical data if the portal will be given by the EHR provider.
Today used, we find patient portals being given by EMR/EHR providers, firms providing “Practice Management” (PM) solutions and even third parties that are promising patients eventual access to all of their health information in one single portal. These are typically called “Personal Health Portals” and many consider “Microsoft Health Vault” to be the first choice in this space. Since the personal health portal does not directly communicate with the practice, these portals typically only contain clinical information that is available through the myriad and increasing amount of healthcare data exchanges.
Change Management. This dilemma impacts small and large organizations undertaking major system implementations. Comprehensive systems implementations require redefinition and remapping of business processes by all members of an organization. The difficulties and significant challenges associated with dealing with these kinds of projects are well documented and beyond the scope of this paper, but they’re real problems that are slowing the adoption of new technologies
Cost/Time to Implement. The government recognized the cost section of this problem and with the ARRA provides around $44,000 per practice for implementing an EHR solution and meeting most of the yet to be defined “meaningful use” criteria. But in many practices, time to implement remains a large hurdle as practitioners are busy seeing patients all day long every single day and these systems invariably take weeks and months of training and lost productivity due to the learning curve of the newest technology
Existing EHR Solution meets core requirements but patient portal isn’t available. This can be a very common issue, specifically for larger and/or very specialized providers where systems have already been developed and customized to meet the complex clinical requirements, IAS Study Portal but were not designed to handle patient communications and other patient facing requirements of today. Due to this complexity and customization, adoption of a new solution is very impractical and wholesale replacement isn’t deemed an alternative by a number of these providers
Beyond the adoption issues stated above and many other unstated ones, there is a broader trouble with the usage of practitioner-level patient portals for clinical information. To comprehend the author’s perspective on this problem, consider that one of many real great things about electronic health information is that the theory is that it’s easily shared, aggregated, disaggregated and exchanged. The stark reality is achieving these benefits remains many years away, maybe more. The establishment of statewide healthcare exchanges marks a significant milestone but much work remains to be performed to attain interoperability of clinical data. Microsoft Health Vault is pushing hard to be the platform that securely delivers the entire group of clinical data to patients that incorporates data from every one of its providers, pharmacies and lab results in one single user friendly portal.
At best, then a practitioner-level patient portal providing clinical data only presents just one provider view, yet many of the patients that need this information the most have multiple providers engaged in their care. Like, just one patient might have a family physician, an internist, a cardiologist and an endocrinologist all engaged in their care. Taking a look at the info from any single practitioner would not provide a complete picture. Because of this, the writer believes that clinical data is most beneficial delivered as just one portal to the in-patient by an alternative party that can make arrangements to aggregate data from all sources and deliver it to the in-patient in one single portal.
“Standalone” Portals
Given the adoption challenges of the EHR/PM-centric (patient) portals, and the broader difficulties with delivering clinical data in practitioner-level portals, there is a position for “standalone” portals. By standalone portals, we mean portals that offer direct patient access to the creation and editing of patient demographic information, bidirectional secure messaging, appointment scheduling, payments and other non-clinical features. These portals don’t provide access to the clinical data. But standalone portals offer healthcare providers the capacity to quickly join the digital revolution, meet the insatiable desire of patients to communicate electronically in a way that is secure and HIPAA compliant, allow online self-registration and drive multiple efficiencies at the same time.