Senator Presses EHR Vendors on Patient Privacy Controls

A privacy-minded senator is pressuring U.S. health tech companies to give patients more control over where their data goes, framing the issue as a matter of national security as well as privacy.

See Also: Using the Netskope HIPAA Mapping Guide

Sen. Ron Wyden, D-Oregon, ranking member of the Senate finance committee, is pressing electronic health record vendors to build products with features that empower patients to better control how their health information is shared and accessed.

The push by Wyden comes as federal regulators have ramped up enforcement of regulations that promote the interoperability, secure exchange and access of patient data. That includes the Department of Health and Human Services in September announcing plans to “actively” enforce the 21st Century Cure’s Act of 2016’s information blocking rule, which aims to improve the flow of patient records for better care coordination.

“While interoperability improves care by enabling better data-sharing, it must be balanced with strong privacy protections for sensitive health information,” Wyden wrote.

Wyden contacted 10 EHR vendors – Oracle Health, Meditech, Altera Digital Health, Medhost, WellSky, Netsmart, McKesson, Veradigm, Athenahealth and TruBridge – urging the technology firms to provide patients “direct control” over which entities can access their healthcare information.

Epic, the largest vendor of EHRs in the U.S., informed the senator on Dec. 3 that the company was already addressing his patient data privacy control concerns with new features being added to their products.

The 21st Century Cures Act’s information blocking rule prohibits certified health IT vendors, healthcare providers and health information networks from “blocking” health information exchange, except for a handful of reasons, including privacy and cybersecurity (see: HHS Says It’s Cracking Down on Health Information Blocking).

Also, the HHS Office for Civil Rights since 2019 has issued dozens of enforcement actions involving alleged violations of the HIPAA Privacy Rule’s right of patient access provision, which requires HIPAA regulated entities to fulfill, in a timely manner, patients’ – or their representatives’ – requests for their health information contained in a designated health record (see: Patients Still Struggle With Full Access to Health Info).

The office announced Tuesday its 54th enforcement action in a HIPAA right of access case. It involved a $112,500 settlement with Concentra, a Texas-based occupational health services provider that HHS said took about one year and multiple requests to provide an individual with access to his health information.

But with interoperability comes increased risk. “Currently, the sensitive health data of the vast majority of Americans can be accessed by health providers in states around the country, regardless of whether those providers are actually treating the patient, or whether the patient has ever stepped foot in their state,” Wyden wrote.

A U.S. Department of Defense inspector general investigation in 2021 found that the health records of military personnel could be improperly accessed for “purposes of extortion, public embarrassment, or sale to others,” Wyden wrote.

“These issues underscore the need for interoperability frameworks that protect patient rights, ensure data is not misused and allow essential care to continue without delay or fear of legal consequences.” Wyden said.

Epic in a Dec. 3 letter to Wyden said that the finance committee made public that the Wisconsin-based EHR vendor is developing a new feature in its MyChart patient portal that “will help patients understand their options for data sharing and empower them to decide whether their medical records are shared across healthcare organizations.”

Those include features that allow individuals to opt out of record sharing; allow individuals to “hide” their records’ existence from other healthcare organizations using the same EHR; provide individuals with a list of healthcare organizations using the EHR that have accessed their health records; and provide prompts for individuals to confirm their record sharing preferences when they receive sensitive categories of care.