Dive Brief:

• On Monday, the HHS unveiled the first six networks that have been approved to be onboarded as qualified health information networks, or QHINs, under TEFCA, the government’s framework for a nationwide health information exchange.
• It’s been about a year since the Office of the National Coordinator for Health IT released TEFCA, or the Trusted Exchange Framework and Common Agreement. Now, Epic, CommonWell Health Alliance, eHealth Exchange, Health Gorilla, Kno2 and Konza — organizations that collectively cover a significant swath of American health records — have committed to become eligible and go live within TEFCA in 12 months.
• A number of additional organizations are readying themselves to apply into the voluntary framework, said Mariann Yeager, CEO of the Sequoia Project, ONC’s private-sector coordinating partner for TEFCA, at a Monday HHS event. “This is just the beginning,” Yeager said.

Dive Insight:

Interoperability is critical for national healthcare infrastructure, HHS officials said Monday, and improving it will bring down costs while also improving care delivery.

Bringing the new prospective QHINs on board is a great start to improving the U.S. healthcare systems’ interoperability, but there’s a lot more work to do to address the digital divide between well-resourced and struggling providers, a lack of connectivity with public health agencies, sparse information sharing between payers and providers and little patient access to their own information, ONC head Micky Tripathi said.

“Our vision is that TEFCA can get us out of the collective shared helplessness that we’re in,” Tripathi said.

The 21st Century Cures Act passed in 2016 required the government to create a set of foundational principles for health information exchange, under a contract establishing a technical infrastructure model and governing approach.

TEFCA’s goal is to create a simplified and standardized connectivity infrastructure for providers, plans, patients and public health agencies. The effort builds on the progress of national networks, state and regional health information exchanges that facilitate secure exchanges of millions of medical documents each day.

The Biden administration early last year finalized TEFCA and opened a window for organizations to apply to be designated as QHINs, or groups of organizations that agree to the same data sharing infrastructure. That connects them to one another and enables their participants, including providers, payers and public health agencies, to exchange health information across the country.

The six potential QHINs unveiled Monday have 12 months to be onboarded, but that work could be done by the end of 2023, Tripathi said. Some of the QHINs, including electronic health record giant Epic, had already announced their intention to join.

The number of QHINs isn’t set in stone. An HHS spokesperson told Healthcare Dive they “continue to receive interest from a diverse range of organizations,” including health information networks and EHR vendors.

But the six organizations alone cover a significant number of Americans. Though it’s difficult to pin down an exact number given the overlap in covered lives, collectively the QHIN applicants have networks that cover most U.S. hospitals and tens of thousands of providers, and process billions of transactions annually across all fifty states, the ONC said.

Moving forward, the ONC plans to announce additional QHINs when they're designated.

Interoperability continues to improve among U.S. hospitals, but there’s still a ways to go, according to new government data.

More than six in 10 hospitals electronically shared health information and integrated it into their electronic health records in 2021, up 51% since 2017, the Office of the National Coordinator released in a Thursday data brief.

The availability and usage of electronic data received from outside sources at the point of care has also increased over the last four years, reaching 62% and 71% respectively in 2021.

The brief illustrates the progress that’s been made in hospitals using electronic data to provide care, and sharing it with other providers outside of their networks, as facilties adopt government-certified EHRs and pivot to comply with interoperability regulations stemming from the 21st Century Cures Act. However, discrepancies among providers indicate ongoing challenges.

For example, rural and small hospitals saw rates of available electronic information at the point of care increase by more than 26%, to reach 48% in 2021. In addition, rural and small hospitals’ use of information received electronically from outside facilities grew twice as fast as all hospitals nationally over the four years studied.

But these smaller hospitals, which generally have fewer resources than their larger counterparts, aren’t on par with larger peers in terms of having full access to electronic information from external sources, the report said.

Other barriers to information exchange also remain sticky. For example, 48% of hospitals said they shared patient data with other providers who don’t share patient information with them.

The ONC also found that roughly four in 10 hospitals participate in multiple health information exchanges, or data-sharing networks. The agency said the findings reinforce the need to have multiple networks at play, and the importance of policies that facilitate cross-network exchange, such as the Trusted Exchange Framework and Common Agreement launched last year.

TEFCA’s goal is to create a framework for nationwide data exchange, though its voluntary nature has raised concerns about industry buy-in. However, a number of entities have applied or said they plan to apply to be certified as qualified health information networks in TEFCA, including EHR giant Epic and existing HIEs like Carequality and eHealth Exchange.

Regulators are still working to implement provisions of 21st Century Cures, including potential punishments for providers and vendors found information blocking. 

The government is authorized by statute to issue up to $1 million in civil monetary penalties against health IT vendors found guilty of information blocking. However, regulators have yet to finalize a rule proposed in 2020 outlining how their investigations will be performed and the size of penalties. In addition, the HHS has yet to define penalties for providers found blocking the free flow of information due to enforcement complexity, ONC head Micky Tripathi has told Healthcare Dive in December.

Sponsored content

By Rhapsody

Creators of healthcare technology solutions that aim to solve complex market issues — whether for providers, health information exchanges, public health, accountable care organizations, or other health tech vendors — face a tall order. While your product may address a specific pain point, such as revenue cycle management, patient engagement, or analytics through artificial intelligence (AI) and machine learning (ML) — your solutions must also help solve two major challenges that many healthcare organizations are facing: clinical and IT staffing shortages and financial strain.

To address these challenges, consider how your solutions interoperate with other applications and systems within your own ecosystems and those of your customers to support streamlined, secure, scalable, and quality data exchange, ensuring your customers have access to data that is reliable, accurate, and actionable.

When you get this right, your solutions help customers save time and resources because they have access to the data they need when they need it to make more informed decisions. In addition, your team saves time while providing that value.

Key to any interoperability strategy is establishing and maintaining a strong foundation of quality data. Prioritizing data integration and data enrichment within your overall interoperability strategy can help differentiate your solutions from the competition and enhance the experience for your customers, as well as your customers’ customers.

Yet the devil is in the details. What is interoperability? What roadblocks impede interoperability? What’s required to create a strategy for interoperability that is built on a strong data foundation? This article addresses these questions and offers considerations to evaluate as you develop innovative solutions that deliver short- and long-term value to customers.

What is interoperability?

Interoperability in healthcare means that patients can move across healthcare settings and their data follows them. Care teams using an interoperable system will have the right data in their hands at the right time to efficiently provide optimal outcomes.

This is complex for many reasons. Oftentimes conversations about interoperability are limited to integration — accessing and exchanging data. Access is only part of the equation. Data must also be actionable by the systems and people accessing it. This requires a data foundation that includes identity data and terminology management.

Identity data involves understanding who you're talking about — which patients and providers are related to the data you’re exchanging. Inaccurate patient identification and duplicate medical records are a major challenge for healthcare organizations because they introduce inefficiencies, billing errors, data capacity issues, and clinical or legal risk.

Terminology management involves knowing what you're talking about. To achieve a high level of interoperability, high-quality clinical information, and accurate analytics, all data sent by or received into a healthcare ecosystem should be mapped to a recognized standard.

What are the roadblocks to interoperability?

Product leaders who try to architect for interoperability themselves quickly realize that homegrown solutions won’t cut it for long-term success.

Among the primary challenges that product leaders face are data volume, data standards, and data sources. It’s likely your product will need to exchange data with provider EHRs, which is a good starting point but if it’s the only system you’re considering integrating with, you will need to broaden your scope. More data sources and workflows exist outside of EHRs.

What’s more, healthcare ecosystems are notoriously idiosyncratic. Many healthcare organizations rely on more than one EHR, not to mention a myriad of other systems — including older, legacy applications and newer ones — that your solution will have to exchange data with. As your data sources multiply, so will the risk of introducing duplicate or inaccurate data.

Data privacy and security also create challenges for product leaders. As you and your customers roll out new capabilities, processes, and workflows, the risk for cybersecurity breaches is high. Your interoperability strategy must take into consideration how you’ll minimize vulnerability to cybersecurity attacks and ensure customer security.

These are only a few of the challenges product leaders face when it comes to interoperability. Other considerations include developing and testing integrations, maintaining your environment, adapting to new use cases, and scaling deployments as you grow. Creating interoperable solutions on your own requires your team to spend development cycles solving for data integration and data quality challenges and can potentially derail product development timelines.

Overcoming roadblocks to interoperability

Do-it-yourself is rarely the right choice for product leaders. While interoperability is complex, you don’t have to navigate it alone. By partnering with interoperability experts, you can shift your focus from integrating and deciphering the meaning of your data, to developing your product roadmap and onboarding customers faster.

As you think through what you need in a partner to help you achieve your interoperability goals, there are a few questions you should ask yourself. Access the white paper, 9 questions to ask to create a winning interoperability strategy, to learn what you should consider as you develop a strong interoperability strategy that supports growth and innovation.

Back when America adopted the main law for medical privacy and technology, the most popular mobile device was a pager, home movies played on VHS at Blockbuster, and the leading search engines were AskJeeves, AltaVista and Dogpile. 

Our times and tech have changed, but the famed HIPAA law of 1996 — the Health Insurance Portability and Accountability Act — remains stuck in the bygone era when the Macarena was still king. 

Fortunately, there’s a bipartisan push in Washington to update the law, sponsored by Sens. Tammy Baldwin of Wisconsin and John Cassidy of Louisiana. That bill calls for a commission to review existing state and federal protections of personal health information, as well as current practices for health data use by the healthcare, insurance, financial services and consumer electronics industries. It also is to recommend to Congress whether federal legislation is needed to modernize health data privacy. 

As an RN and CEO of a healthcare company, I’m hoping we can update HIPAA in a way that not only acknowledges the value of new health apps and Fitbit-style monitoring devices, but also scales back the silos around health data so providers can respond to a wider, fuller picture of a person’s health.  

In the 1990s, legislators, consumers and medical professionals were justifiably concerned about the use and disclosure of personal health information. The result was the one part of the vast law that consumers are most familiar with — the HIPAA Privacy Rule. 

Intentions were good, as were many results, but the law hasn’t kept pace with the technological reality of today.  

One unintended consequence was the compartmentalization of medicine. HIPAA makes it tougher to share health data, a change obvious to any patient who has had the frustrating experience of having to fill out forms and repeat their medical history every time they see a new doctor, physician assistant, nurse or health insurance rep. 

Have you ever tried to assemble and review your own medical history? This is no easy task — it’s extremely walled off. If it’s so hard for you to get your own records in one place, then you can imagine how difficult it is for the professionals trying to gain a complete health picture so they can understand, treat and cure you. 

HIPAA has encouraged the rise of giant electronic health record companies like Epic and Cerner, which have set up cloud-based repositories of patient records — and then built moats around them. They figured out that if you control the data, you control the game. That might be good for their business, but it impedes the ability of providers to understand and improve a person’s health based on their life story.  

Fragmented medicine makes healthcare more difficult. At a time when we need to be considering the health of a whole person, our system is set up instead for different medical specialists to view people through their particular specialist eyes. A patient isn’t a living, breathing human with complex needs and varied dreams. She’s viewed on the medical conveyor belt as a broken hip, or a high blood pressure that needs to come down, or a cancer that needs to be radiated away.  

In my own business of complete senior health, our members have lived full lives, often after being treated by many different medical providers. Yet the burden is on the individual to tell their story, their life journey, with every provider at every point of service time and again. It’s incredibly frustrating that the healthcare business can’t aggregate the story and the information around the person, in our case, seniors.  

Though tech platforms like Facebook, iCloud and Google Photos have greatly advanced the ways that people can record, remember and share major life events, there is no similar and straightforward way to capture and understand their full medical story. (By the way, Facebook, Google and the cloud did not exist when HIPAA was approved.) Clearly the tech is possible to help medical record keeping if we put the proper safeguards around it. 

Is there any other business that makes the customers repeat, again and again, why they are here, how they arrived, when they last visited, what they hope to gain from this visit — and if they recall doing anything years ago that might have any relevance to what we want to do now? 

Omissions, faulty memories, unclear dates — there are just so many opportunities for errors in this process, both from patients and providers. Yet we keep repeating it. 

Having a single data source to tell the whole healthcare story would make it so much easier to improve care and tailor services to the individual.  

At the same time, personal medical privacy must be protected. The key here is that the health data must be made to work best for the consumer, whose wishes should get top priority over the companies trying to capture the data and commercialize it. 

Technology and data can do so much to help improve our health. With an update of HIPAA, we need to make sure that medical information is available to help and illuminate instead of being walled off in a frustrating turf battle

The Office of the National Coordinator for Health IT has had a busy year supporting public health agencies during the COVID-19 response, working to improve health equity, improving electronic health record standards adoption and continuing to hammer away at information blocking regulations, as complaints against providers and health IT vendors roll in.

The ball on information blocking enforcement is already rolling, as the ONC receives hundreds of complaints, mostly from patients, accusing actors of blocking the free flow of health data. But the HHS has yet to finalize long-awaited penalties against providers and vendors found guilty of information blocking, which are some of the final hurdles in implementing the information blocking tenets of the 21st Century Cures Act, passed in 2016 to try to improve the free flow of health data in the U.S.

In an interview, ONC head Micky Tripathi shared his thoughts on information blocking complaints, provider worries about compliance and what’s holding up the HHS in delineating punishments for actors found obstructing data — a major gap in the enforcement of the rules.

1. Info blocking complaints accelerate, but future volume uncertain

   In the 11 months from April 2021 through February, the ONC received about 300 complaints of information blocking. In the eight months from March through October, the ONC received another 240, representing a slight acceleration. But the ONC isn’t sure what volume or pace to expect moving forward, given that its still the early days of the interoperability complaints, Tripathi said.

   It’s “uncharted territory” without a clear frame of reference, according to the ONC head. For example, the 540 complaints received are “a drop in the bucket” compared to HIPAA complaints, which can number in the tens of thousands per year.

   “What’s more surprising to me is actually the composition of the complaints that we’ve gotten so far,” Tripathi said.

   Claims against providers continue to make up a clear majority, continuing the trend first seen in March. The large majority of complaints are still filed by patients and patient advocates.

   That’s surprising given information blocking is “still kind of an esoteric concept,” Tripathi said. It’s harder for people to be aware of the reporting process, while vendors pay strict attention given they can be held liable for high fines if they’re in violation. Tripathi said that as awareness grows and enforcement kicks in, that could raise the visibility of the information blocking regulations and cause the number of complaints to increase.

   “It’s surprising to me that it’s percolated down to the patients,” Tripathi said. “But we’ll see. Again, it’s very early. We could see other types of complaints against other types of actors build over time.”

2. Enforcement complexity delaying HHS

   After the ONC receives complaints, the agency does an initial, high-level screen to determine whether the complaint could plausibly be an information blocking violation by a covered actor. If the answer is yes, the ONC passes the complaint along to the HHS Office of the Inspector General for investigation.

   The OIG has the statutory authority to issue up to $1 million in civil monetary penalties against health IT vendors found guilty of information blocking. However, regulators have yet to finalize a rule proposed in 2020 outlining how their investigations will be performed and the size of any penalties.

   That could result in a backlog of information blocking complaints, since OIG has yet to start investigating — and can’t until the regulation is finalized.

   “In general, until you have your final rule out, you don’t really do the things that you’re spelling out in the rule,” Tripathi said. “We’re hoping for this calendar year, but I can’t speak for them.”

   In addition, the HHS has yet to define penalties for providers found blocking the free flow of information. Tripathi declined to lay out a timeline on when industry can expect a rule, but said “we’re working really, really hard.”

   Regulators have run up against a slew of difficulties in crafting a rule. The 21st Century Cures Act separated penalties for providers from penalties for other actors, and left it up to the secretary of the HHS to determine “appropriate disincentives” without defining the disincentives —or giving the HHS any additional authority to enact them.

   There’s not a lot of clarity there for regulators, Tripathi said.

   As a result, the HHS has had to identify agencies and programs where existing authority could be used as an appropriate disincentive. That could be the CMS, or any other agency with funding programs. And, regulators have had to do this while navigating a federal bureaucracy that tends to be fairly conservative in interpreting what the statute allows it to do.

   “It’s certainly a little bit frustrating — the complexity of it,” Tripathi said. “That’s the reason for the extended timeline here. Despite our efforts to work really hard, we were handed something that was inherently complex, that we’re having to sort our way through.”

3. Leniency of disincentives?

   Some provider groups have lobbied the HHS for an initial warning and corrective action letter before regulators move toward a penalty phase. Tripathi stressed that the ONC is not involved with deciding how punitive the disincentives will be, and that the OIG — and whatever other agencies oversee “appropriate disincentives” — will have sole responsibility for enforcement.

   The ONC head declined to comment on whether the HHS is considering a warning phase before enacting penalties. However, Tripathi said it’s likely punishments will differ based on the offense of the actor.

   “The OIG does the enforcement, and then you’ve got agencies that will ultimately be the ones who are administering the appropriate disincentives through their existing programs. And so they themselves may sort of define a spectrum, let’s say, based on severity of violation, according to a set of criteria or whatever. You can imagine that would be a part of the process,” Tripathi said.

4. ‘As well defined as it could possibly be’

   The amount of electronic health information that providers and health IT vendors had to share significantly expanded in October. Initially, the information blocking rule’s definition of “electronic health information” was limited to the data elements represented in the USCDI dataset. However, as of Oct. 6, that definition expanded to include all electronic health information in a record that qualifies as protected health information under HIPAA.

   The American Hospital Association and other provider groups in September asked the ONC to delay the change by a year. Providers argued they’re not ready to meet the deadline due to confusion over the regulations’ implementation and enforcement requirements, including what they say is an unclear definition of EHI and a lack of technical infrastructure to support its exchange.

   Tripathi said providers’ concerns are valid, but noted it’s been six years since 21st Century Cures was passed. The ONC also gave providers an 18-month path from USCDI sharing to the requirement for full EHI data sharing, Tripathi said.

   “No one’s ever going to feel ready, right?,” Tripathi said. “You say, ‘Well, if we delayed it another 12 months, everyone’s all of a sudden going to be ready. That doesn’t make any sense to me. I don’t think that’s actually the way the world works. We didn’t see any reason to delay it any further.”

   The ONC leader also pointed to the eight information blocking exceptions giving actors more wiggle room to operate within the rules. For example, if an organization can’t make an emergency department note available to a patient electronically, there’s an infeasibility exception that would cover that.

   And regulators were careful to define EHI in a construct that providers should already understand, Tripathi said. The EHI that providers are now required to make available is essentially the electronic portion of the HIPAA-designated record set that providers have been handling for decades.

   ”I would say that it’s actually as well defined as it could possibly be,” Tripathi said. “I appreciate there might be some things that are like, is that? or isn’t it? But it goes back to HIPAA. And you were supposed to do this 20 years ago. Just build on the thing that you’re already supposed to do.”

Google is continuing to explore a consumer-facing health record, more than a year after first launching a user feedback program, according to Chief Health Officer Karen DeSalvo.

“We’re still testing and learning,” DeSalvo told Healthcare Dive at the HLTH conference in Las Vegas on Tuesday. “It’s an ongoing curiosity.”

The tech giant is testing and evaluating features of a personal health record, not currently building a standalone tool, as it weighs big questions like how it should be hosted and whether consumers even want a personal health record, DeSalvo said.

Tech giants including Google have tried and failed to create a consumer-friendly electronic health record, though efforts have been revitalized amid recent government regulations freeing up medical data from siloed systems.

Google first launched a user feedback program last April to see how patients might want to keep and view their medical data after pulling it from provider patient portals, STAT News reported.

The user testing comes more than a decade after Google attempted to create a new digital health record in 2008, called Google Health. Google shut down the high-profile project after four years, citing difficulties getting adoption into the daily health routines of patients.

Yet consumers have become increasingly open to accessing their health information electronically. The number of hospitals allowing patients to use third-party apps to view data jumped from 2018 to 2019, and more U.S. patients are using online portals to access medical information, according to government data.

Google’s efforts around patient medical records comes as rival company Apple launched a health records section in its Health app in 2018. The app allows users to pull their records from hospitals and medical offices and hold that data on their iPhone.

Despite disbanding its health-specific unit last year, Google has remained active in the healthcare industry, creating new provider appointment scheduling capabilities online and launching tools to help healthcare companies make their medical images more interoperable and actionable through AI and machine learning.

Google Health is focused both on coordinating health ventures internally and linking different offerings. That ethos has given rise to products like Device Connect for Fitbit, an integration between Google Cloud and Google’s wearables business that launched in September, and a new app, called Health Connect.

Device Connect for Fitbit is meant to make it easier for healthcare and life sciences organizations to use Fitbit data for patient monitoring, research and population health projects, according to the company.

Health Connect, which rolled out on Monday, assimilates data from eligible health, wellness and fitness apps and brings it onto a single platform. The app allows Android users to sync and track their lifestyle goals in one place using data from variety of participating apps, like Peloton, Oura and Flo.

Also on Monday, Google Cloud announced it was linking with EHR giant Epic to build an offering that will allow clients to run their Epic workloads on Google Cloud, and launched three new healthcare data engine accelerators to address common pain points for health system clients.

Dive Brief:

• The CMS has issued a new rule meant to streamline prior authorization by requiring certain payers to implement an electronic prior authorization process and respond to requests more quickly.
• The rule would also require payers to put in place standardized data exchange processes, to help them exchange data when a patient changes health insurers. If finalized, the policies would take effect in 2026.
• The rule, which the CMS estimates will save hospitals and doctor’s offices more than $15 billion over 10 years, replaces one proposed in the final days of the Trump administration that was controversial with health insurers.

Dive Insight:

The CMS is once again tackling prior authorization in its new rule proposed Tuesday. Prior authorization, a process in which a physician must get the green light from an insurer for medication or treatment before administering it, has become increasingly common among payers as a way to curb unnecessary medical spending.

However, physicians argue that the additional administrative steps required before being able to provide care delays needed services and adds paperwork, contributing to burnout.

Regulators are proposing new requirements that would apply to state Medicaid and Children’s Health Insurance Program agencies, Medicaid and CHIP managed care plans and plans on the Affordable Care Act exchanges.

They will also apply to Medicare Advantage plans — one key way that the new rule differs from 2020’s iteration. The exclusion of MA plans, which are growing in popularity among Medicare seniors and expected to cover more than half of the Medicare population as early as next year, was a complaint from provider groups in the original rule.

Like its predecessor, the new rule includes requirements that payers provide doctors their rationale for denied requests. Payers would also be required to send decisions within 72 hours for urgent requests, and within seven calendar days for non-urgent requests — twice as fast as the existing MA response time limit, the CMS said.

The turnaround time in the final rule could be even shorter. Regulators are seeking comment on alternative time frames, like 48 hours for urgent requests and five calendar days for standard ones.

The rule would also require payers to build and maintain standardized application programming interfaces, or APIs, to automate the process for providers to determine whether a prior authorization is needed, identify any documentation requirements and facilitate the exchange of requests and decisions electronically.

The CMS also wants payers to build and maintain two additional APIs — one to share patient data with in-network providers treating the patient, and another to share patient data with other insurers when a patient moves to new coverage or has concurrent plans.

Payers would be required to share claims and encounter data, prior authorization requests and decisions and other data elements in the USCDI dataset in those Provider Access and Payer-to-Payer APIs, with patient permission.

Payers would not have to share cost information.

The CMS originally required payers to share patient data with one another at a patient’s request under information blocking rules finalized two years ago, with the goal of creating a longitudinal health record that could follow patients in a healthcare system, regardless of coverage changes.

However, regulators said last December they wouldn’t enforce the policy after payers raised concerns about operational challenges and risks to data quality, given a lack of specificity in the rule.

The CMS also wants to expand the existing Patient Access API to include information about prior authorization decisions. That API, which was also required by the interoperability regulations, allows payers to share claims and encounter information with members.

Regulators are also requesting information around standards for social risk factor data, exchanging behavioral health information electronically, improving medical documentation exchange between providers in traditional Medicare, advancing the Trusted Exchange Framework and Common Agreement, and how interoperability can improve maternal health outcomes.

Comments on the rule are due March 13.