Payer Access to EHRs: What Providers Need to Know
As electronic health information exchange (HIE) becomes more prevalent among providers, payers increasingly are seeking direct access to electronic health record (EHR) systems for automated medical record collection and aggregation. The electronic exchange of protected health information (PHI) allows physicians, nurses, and other healthcare providers and patients to appropriately access and share PHI—improving the quality, efficiency, safety, and cost of patient care. So, why do payers want access to EHRs?
Payers suggest that access to EHRs can expedite claims processing, reviews, and audits without negative impact to the provider. However, there are inherent risks to the provider’s financial health, privacy, security, and information governance when they give access to payers. Providers should recognize that they have choices about how to share this data with payers, and they should carefully evaluate the benefits and risks to their organizations and their patients when doing so.
Why Payers Want Access to Medical Records
Before making a decision regarding payer access, providers need to understand the rationale for payer requests for medical records. The reasons usually fall into three basic categories:Claims Processing. Payers require patient information to process claims. Granting payers direct access to the EHR offers potential benefits for both payers and providers, enabling faster claims processing and reducing the burden on provider staff.
Post-Payment Audits. Payers conduct retrospective (post-payment) audits to seek opportunities for recoupment of improper claims or claims for which overpayments were made. This type of access is can be a financial detriment to the provider.
HEDIS and Risk Adjustment Reviews. Healthcare effectiveness data and information set (HEDIS) reviews are used for quality and performance rankings, which can lead to significant changes in Centers for Medicare and Medicaid Systems (CMS) reimbursement to payers. Risk adjustment reviews are used to shift payments from CMS away from payers whose member pools are lower risk—and therefore lower cost—to payers with higher-risk, higher-cost members. Though HEDIS and risk adjustment reviews can result in millions of dollars to payers, providers seldom share in the financial benefit unless they have negotiated with the payer or have a partner or owner relationship.
Concerns for Providers and Patients
As healthcare providers carefully consider the benefits and risks of granting direct payer access to EHRs, it is important to understand the following concerns as part of the evaluation process.Financial
Direct, automated access to a wide band of patient records will facilitate the growing trend of post-payment reviews, denials, and recoupments.
Privacy and Consent
Patient consent to share health records automatically for the purpose of providing care should not be assumed to extend to payers for payment purposes. It is unlikely that the aggregation and storage of these records by payers is a practice that patients would approve of in advance and learning it after the fact could lead to strong patient dissatisfaction.
Security
Automated access to health data by payers increases a provider’s exposure to cyberattack, and the aggregation and storage of that data in the payer’s IT systems widens the potential exposure to large-scale healthcare breach.
Information Governance (IG)
Automated sharing of full patient records with payers, and aggregating those records for permanent use, raises multiple legal and IG concerns. These include managing a distributed health record, meeting HIPAA requirements for minimum use and correction of errors, and inadvertently sharing encounters for which the payer was not the guarantor.
Four Recommendations for Providers
EHR access may work well with some payers depending on appropriate parameters for secure, restricted access to PHI. Here are four recommendations for providers to consider.- For claims processing purposes, providers can grant payers manual access to claims-specific encounters, with appropriate access and security restrictions. When handled properly, improved efficiency can benefit the provider.
- Do not allow payers to have unrestricted or automated access to the entire patient chart. In each case, allow only controlled access to preloaded information that the payer needs. For example, if the payer inquiry pertains to medical necessity, load only that information. Patients who consent to automated data sharing for the purpose of providing care do not intend for providers to share their data with payers whose interests are not specifically aligned with the patient’s privacy and financial concerns.
- Maintain health information management (HIM) governance of release of information (ROI) for post-payment audits and reviews, including HEDIS and risk adjustment.
- Negotiate with payers to receive a share of any financial benefits that the payers achieve from the HEDIS and risk adjustment reviews. If this is not possible, be sure to recoup the costs of releasing this data to the payer.
Rita Bowen is vice president of privacy, compliance, and HIM policy at MRO. Greg Ford is director of requester relations and receivables administration at MRO.
Legal Disclaimer
The views and opinions expressed in this article are those of the author and do not necessarily reflect or represent the views, opinions, or policies of MRO Corporation.
**Editor’s Note: Views expressed in this article are those of the author alone and do not necessarily reflect the opinion of AHIMA.