[{"innerBlocks":[],"name":"core\/freeform","postId":202,"blockType":{"name":"core\/freeform","keywords":[],"attributes":{"content":{"type":"string","source":"raw"},"lock":{"type":"object"}},"providesContext":[],"usesContext":[],"selectors":[],"supports":{"className":false,"customClassName":false,"reusable":false},"styles":[],"variations":[],"apiVersion":3,"title":"Classic","description":"Use the classic WordPress editor.","category":"text"},"originalContent":"While the American Medical Association supports enabling patient access and sharing of their own electronic healthcare information, the physician group is concerned that a proposed federal rule will put sensitive data at risk.AMA charges that the Office of the National Coordinator for Health IT is making a policy decision to \u201cnot prioritize patient privacy\u201d and that\u2014if the rule is finalized as proposed by the agency\u2014patients\u2019 health information will be vulnerable to inappropriate secondary uses and disclosures from third-party apps.

\u201cThe AMA supports and encourages the right of a patients to access their medical record\u2014what we do not support is a policy that enables third parties to monetize patients\u2019 data,\u201d says Jesse M. Ehrenfeld, MD, chair of the AMA Board of Trustees. \u201cONC\u2019s proposals will allow apps to use, package, and sell patient information\u2014which could contain financial and family information\u2014to the highest bidder. Patient privacy will be violated and could break the bonds of trust that exists between patients and their physician.\u201d In March, ONC issued a proposed rule requiring healthcare providers to offer patients\u2019 access to their electronic health information through secure, standards-based application programming interfaces. Specifically, the agency\u2019s proposed rule\u2014for the first time\u2014requires HL7\u2019s Fast Healthcare Interoperability Resources as the standard to which health IT developers must certify their APIs.However, AMA contends that ONC has not indicated that it will create policy to help ensure patient privacy protections through the API. \u201cIn other words, it is promoting API usage, but not requiring that the API technology include privacy and security controls,\u201d according to an AMA briefing document on the subject.Nonetheless, in response to AMA\u2019s assertions, an ONC spokesman countered that \u201cthrough the use of secure standards-based APIs, the transmission of data will be secure and\u2014through the use of authentication like OAuth 2\u2014individuals will be authorizing the sharing of their data through the apps,\u201d adding that \u201cwe expect that individuals who use these apps will keep their data safe and secure like they already do with many of the apps they currently use\u2014like those they use for their banking,\u201d In addition, the agency spokesman emphasized that HIPAA provides for the right of patient access to their electronic health information, which ONC\u2019s proposed rule supports.But, AMA executives point out that many third-party apps are not required to implement the protections of the HIPAA Privacy and Security Rules and that recent incidents reveal that third parties have used health data for marketing, selling data or using analytics to create new sources of revenue.\u201cMobile apps typically require a consumer to consent to all terms or not use the app at all,\u201d according to the AMA. \u201cHowever, we\u2019ve all read stories and studies about how smartphone apps share sensitive health information with third-parties, often without the knowledge of an individual.\u201dWhile the privacy and security of data applies to HIPAA covered entities and their business associates, AMA contends that once protected health information has been shared with a patient-designated app the HIPAA-covered entity or business associate is not liable for subsequent use or disclosure of that data\u2014provided that the app developer is not itself a business associate of a covered entity, directly or through another business associate.\u201cMost patients will not be aware of who has access to their medical information, how and why they received it, and how it is being used (for example, an app may collect or use information for its own purposes, such as an insurer using health information to limit\/exclude coverage for certain services, or may sell information to clients such as to an employer or a landlord),\u201d AMA warns. \u201cThe downstream consequences of data being used in this way may ultimately erode a patient\u2019s privacy and willingness to disclose information to his or her physician.\u201dIt\u2019s a regulatory reality that National Coordinator for Health IT Don Rucker, MD, openly acknowledges. During a Senate hearing in May, Rucker made the case that \u201cdeeply sensitive health facts about patients can be inferred from consumer data \u2018exhaust\u2019 such as accelerometers, location services, and a wide variety of app and social media usage patterns.\u201d

Still, Rucker told lawmakers that patients \u201cshould have the ability to decide whether the potential benefit of an app to manage their healthcare information and medical conditions outweighs potential risks\u2014this should be the patient\u2019s choice.\u201dA patient \u201chas to make a very conscious decision to download the data to the app\u2014that offers an opportunity, certainly, for providers to give those warnings,\u201d Rucker testified, adding that \u201cindividuals should balance their selection and use of a health app with the potential risk of having negative implications.\u201dHowever, AMA insists that \u201cif patients access their and their family\u2019s health data\u2014some of which is likely sensitive\u2014through a smartphone, a patient must have a clear understanding of the potential uses of that data by app developers.\u201d"ONC needs to ensure that its final rule includes a mechanism to promote transparency for consumers so they understand the information that apps are accessing, what the app is using it for, and with whom the app is sharing the information,\u201d adds Ehrenfeld. \u201cUltimately, third parties must be transparent about who is seeing a patient\u2019s data. Otherwise, you\u2019re not really empowering the patient\u2014you\u2019re empowering data brokers.\u201dWhile ONC does not have the authority to directly require attestations from consumer-facing apps, AMA contends that the agency should require an electronic health record vendor\u2019s API to check for the following three \u201cyes or no\u201d adoption and implementation attestations, as a part of its EHR certification requirements:

Industry-recognized development guidance (for example, Xcertia\u2019s Privacy Guidelines).<\/li><\/ul>
- Transparency statements and best practices (for example, Mobile Health App Developers: FTC Best Practices and CARIN Alliance Code of Conduct).<\/li><\/ul>
  - A model notice to patients (for example, ONC\u2019s Model Privacy Notice).<\/li><\/ul>
    \u201cThis shouldn\u2019t be a significant burden on EHR vendors, since it\u2019s only requiring that an API check for an app developer\u2019s attestation,\u201d according to AMA. \u201cWe also recognize this wouldn\u2019t ensure apps implement or conform to their attestations. However, we believe this will provide a needed level of assurance to patients and physicians, and would be greatly welcomed by users.\u201d
    In September, ONC\u2019s proposed rule was sent to the Office of Management and Budget for OMB\u2019s review. According to AMA, ONC is expected to release its final regulations in early 2020.\u201cWithout much needed changes, these rules will encourage the monetization of patients\u2019 health information and could lead to serious negative impacts on patient care,\u201d concludes an AMA spokesman. \u201cProposed regulations suggest that ONC is attempting to expand the volume and velocity of health data sent outside privacy protections.\u201d","saveContent":"While the American Medical Association supports enabling patient access and sharing of their own electronic healthcare information, the physician group is concerned that a proposed federal rule will put sensitive data at risk.AMA charges that the Office of the National Coordinator for Health IT is making a policy decision to \u201cnot prioritize patient privacy\u201d and that\u2014if the rule is finalized as proposed by the agency\u2014patients\u2019 health information will be vulnerable to inappropriate secondary uses and disclosures from third-party apps.\u201cThe AMA supports and encourages the right of a patients to access their medical record\u2014what we do not support is a policy that enables third parties to monetize patients\u2019 data,\u201d says Jesse M. Ehrenfeld, MD, chair of the AMA Board of Trustees. \u201cONC\u2019s proposals will allow apps to use, package, and sell patient information\u2014which could contain financial and family information\u2014to the highest bidder. Patient privacy will be violated and could break the bonds of trust that exists between patients and their physician.\u201d In March, ONC issued a proposed rule requiring healthcare providers to offer patients\u2019 access to their electronic health information through secure, standards-based application programming interfaces. Specifically, the agency\u2019s proposed rule\u2014for the first time\u2014requires HL7\u2019s Fast Healthcare Interoperability Resources as the standard to which health IT developers must certify their APIs.However, AMA contends that ONC has not indicated that it will create policy to help ensure patient privacy protections through the API. \u201cIn other words, it is promoting API usage, but not requiring that the API technology include privacy and security controls,\u201d according to an AMA briefing document on the subject.Nonetheless, in response to AMA\u2019s assertions, an ONC spokesman countered that \u201cthrough the use of secure standards-based APIs, the transmission of data will be secure and\u2014through the use of authentication like OAuth 2\u2014individuals will be authorizing the sharing of their data through the apps,\u201d adding that \u201cwe expect that individuals who use these apps will keep their data safe and secure like they already do with many of the apps they currently use\u2014like those they use for their banking,\u201d In addition, the agency spokesman emphasized that HIPAA provides for the right of patient access to their electronic health information, which ONC\u2019s proposed rule supports.But, AMA executives point out that many third-party apps are not required to implement the protections of the HIPAA Privacy and Security Rules and that recent incidents reveal that third parties have used health data for marketing, selling data or using analytics to create new sources of revenue.\u201cMobile apps typically require a consumer to consent to all terms or not use the app at all,\u201d according to the AMA. \u201cHowever, we\u2019ve all read stories and studies about how smartphone apps share sensitive health information with third-parties, often without the knowledge of an individual.\u201dWhile the privacy and security of data applies to HIPAA covered entities and their business associates, AMA contends that once protected health information has been shared with a patient-designated app the HIPAA-covered entity or business associate is not liable for subsequent use or disclosure of that data\u2014provided that the app developer is not itself a business associate of a covered entity, directly or through another business associate.\u201cMost patients will not be aware of who has access to their medical information, how and why they received it, and how it is being used (for example, an app may collect or use information for its own purposes, such as an insurer using health information to limit\/exclude coverage for certain services, or may sell information to clients such as to an employer or a landlord),\u201d AMA warns. \u201cThe downstream consequences of data being used in this way may ultimately erode a patient\u2019s privacy and willingness to disclose information to his or her physician.\u201dIt\u2019s a regulatory reality that National Coordinator for Health IT Don Rucker, MD, openly acknowledges. During a Senate hearing in May, Rucker made the case that \u201cdeeply sensitive health facts about patients can be inferred from consumer data \u2018exhaust\u2019 such as accelerometers, location services, and a wide variety of app and social media usage patterns.\u201dStill, Rucker told lawmakers that patients \u201cshould have the ability to decide whether the potential benefit of an app to manage their healthcare information and medical conditions outweighs potential risks\u2014this should be the patient\u2019s choice.\u201dA patient \u201chas to make a very conscious decision to download the data to the app\u2014that offers an opportunity, certainly, for providers to give those warnings,\u201d Rucker testified, adding that \u201cindividuals should balance their selection and use of a health app with the potential risk of having negative implications.\u201dHowever, AMA insists that \u201cif patients access their and their family\u2019s health data\u2014some of which is likely sensitive\u2014through a smartphone, a patient must have a clear understanding of the potential uses of that data by app developers.\u201d"ONC needs to ensure that its final rule includes a mechanism to promote transparency for consumers so they understand the information that apps are accessing, what the app is using it for, and with whom the app is sharing the information,\u201d adds Ehrenfeld. \u201cUltimately, third parties must be transparent about who is seeing a patient\u2019s data. Otherwise, you\u2019re not really empowering the patient\u2014you\u2019re empowering data brokers.\u201dWhile ONC does not have the authority to directly require attestations from consumer-facing apps, AMA contends that the agency should require an electronic health record vendor\u2019s API to check for the following three \u201cyes or no\u201d adoption and implementation attestations, as a part of its EHR certification requirements:
    Industry-recognized development guidance (for example, Xcertia\u2019s Privacy Guidelines).<\/li><\/ul>
    Transparency statements and best practices (for example, Mobile Health App Developers: FTC Best Practices and CARIN Alliance Code of Conduct).<\/li><\/ul>
    A model notice to patients (for example, ONC\u2019s Model Privacy Notice).<\/li><\/ul> \u201cThis shouldn\u2019t be a significant burden on EHR vendors, since it\u2019s only requiring that an API check for an app developer\u2019s attestation,\u201d according to AMA. \u201cWe also recognize this wouldn\u2019t ensure apps implement or conform to their attestations. However, we believe this will provide a needed level of assurance to patients and physicians, and would be greatly welcomed by users.\u201dIn September, ONC\u2019s proposed rule was sent to the Office of Management and Budget for OMB\u2019s review. According to AMA, ONC is expected to release its final regulations in early 2020.\u201cWithout much needed changes, these rules will encourage the monetization of patients\u2019 health information and could lead to serious negative impacts on patient care,\u201d concludes an AMA spokesman. \u201cProposed regulations suggest that ONC is attempting to expand the volume and velocity of health data sent outside privacy protections.\u201d","order":0,"get_parent":{},"attributes":[],"attributesType":{"content":{"type":"string","source":"raw"},"lock":{"type":"object"}},"dynamicContent":""}]

AMA: ONC proposed rule leaves patients’ data, privacy vulnerable

More for you