Federal health privacy officials have indicated that they plan more robust enforcement of HIPAA’s right to access provision. In order to prepare health information management (HIM) professionals for future enforcement actions, Deven McGraw, JD, MPH, delivered a webinar on “Understanding Patient Access to Health Records in Today’s Digitized World” for AHIMA members on Thursday.
McGraw previously directed US health privacy and security through her roles as deputy director, health information privacy at the Department of Health and Human Services’ Office for Civil Rights (OCR), and as acting chief privacy officer at the Office of the National Coordinator for Health IT. The webinar summarized the findings of a survey and study conducted by the group Ciitizen—where McGraw is currently the chief regulatory officer—which advocates for the rights of cancer patients to receive timely access to their health information.
As Journal of AHIMA has reported, Ciitizen found that more than half of US healthcare providers are out of compliance with HIPAA’s right of access provision, and patient access to their complete designated record set is still several years away.
“Two decades later, HIPAA is still harder than it should be. Getting data is harder than it should be,” McGraw said.
For example, in their work on behalf of cancer patients—a patient population considerably motivated to obtain their records for referral, treatment, and research purposes—it took Ciitizen researchers as many as 24 phone calls to follow through on a single records request. Additionally, Ciitizen found that many hospital radiology departments are not up to speed on release of information policies and HIPAA compliance. Ciitizen researchers frequently reported that radiology departments said they didn’t release images to patients—they only released them to other healthcare providers, contradictory to OCR guidance.
“There’s clearly need for improvement. We’ll stay on the phone but the average patient would be discouraged long before 24 phone calls,” McGraw said. “…For a healthy person like me—I would like to see labs, refill prescriptions online, it works for me. But cancer patients need images, radiology, genomic testing, they need notes in order to seek second opinions and contribute to research. People who are sick are dependent on records offices [for access to their records] and will be for some time. You [HIM professionals] play an incredibly important role and you play a critical role. I’m proud to have this relationship with AHIMA. You know it’s important or you wouldn’t be on this webinar.”
McGraw also touched on recent proposed regulations by ONC and the Centers for Medicare and Medicaid Services aimed at making it easier for patients to access their records through application programming interfaces (APIs) and mobile apps, as well as the privacy concerns they raise, as described recently in the New York Times.
“It’s a good dialogue to be having with discussion around APIs and third-party apps. I think there are genuine concerns. We work with users to have their data and share it with whom they want—to provide opportunities to get information that can help with their cancer diagnosis and treatment and donate their records for other purposes,” McGraw said.