[{"innerBlocks":[],"name":"core\/freeform","postId":949,"blockType":{"name":"core\/freeform","keywords":[],"attributes":{"content":{"type":"string","source":"raw"},"lock":{"type":"object"}},"providesContext":[],"usesContext":[],"selectors":[],"supports":{"className":false,"customClassName":false,"reusable":false},"styles":[],"variations":[],"apiVersion":3,"title":"Classic","description":"Use the classic WordPress editor.","category":"text"},"originalContent":"While the Office of the National Coordinator for Health IT is pushing to empower patients to access and share their electronic health information, ONC is warning about the inherent risks from third-party apps.

In March, ONC issued a proposed rule requiring healthcare providers to offer patients\u2019 access to their electronic health information through secure, standards-based application programming interfaces. Specifically, the agency\u2019s proposed rule\u2014for the first time\u2014requires HL7\u2019s Fast Healthcare Interoperability Resources as the standard to which health IT developers must certify their APIs.

Yet by sharing that data with a third party API-based app, patients are potentially putting that health information at risk from inappropriate secondary uses and disclosures, according to National Coordinator for HIT Don Rucker, MD.

\u201cSecondary use of data creates privacy challenges that extend beyond the healthcare industry,\u201d Rucker testified on Tuesday before a Senate committee. \u201cAcross all business sectors, individuals often have little say with respect to the secondary use and disclosure of their personal data. However, the misuse of health information can have lifelong consequences for the patient.\u201d

Also See<\/b>: Consumer health information is increasingly at risk, groups tell Congress<\/a>

Nonetheless, Rucker made the case that patients \u201cshould have the ability to decide whether the potential benefit of an app to manage their health care information and medical conditions outweighs potential risks\u2014this should be the patient\u2019s choice.\u201d

A patient \u201chas to make a very conscious decision to download the data to the app\u2014that offers an opportunity, certainly, for providers to give those warnings,\u201d he added.

Although the HHS Office for Civil Rights has regulatory authority to ensure the privacy and security of data applies to HIPAA covered entities and their business associates, once protected health information has been shared with a patient-designated app the HIPAA-covered entity or business associate is not liable for subsequent use or disclosure of that data\u2014provided that the app developer is not itself a business associate of a covered entity, directly or through another business associate.

\u201cWe are actively engaged with the Office for Civil Rights to inform patients about both their HIPAA rights and potential risks,\u201d Rucker told lawmakers. \u201cIndividuals should balance their selection and use of a health app with the potential risk of having negative implications.\u201d

In his testimony, Rucker pointed out that many third-party apps are not required to implement the privacy protections and patient rights of the HIPAA Privacy and Security Rules, but they may fall under the jurisdiction of the Federal Trade Commission, including the Health Breach Notification Rule.

The FTC issued the Health Breach Notification Rule to require certain businesses not covered by HIPAA to notify their customers and others if there\u2019s a breach of unsecured, individually identifiable electronic health information.

\u201cDeeply sensitive health facts about patients can be inferred from consumer data \u2018exhaust,\u2019 such as accelerometers, location services and a wide variety of app and social media usage patterns,\u201d according to Rucker\u2019s testimony.

Rucker suggested that \u201cas Congress thinks about secondary use of data\u201d and how to safeguard that health information, the overall assessment by legislators \u201creally should be a fairly broad consideration.\u201d","saveContent":"While the Office of the National Coordinator for Health IT is pushing to empower patients to access and share their electronic health information, ONC is warning about the inherent risks from third-party apps.

In March, ONC issued a proposed rule requiring healthcare providers to offer patients\u2019 access to their electronic health information through secure, standards-based application programming interfaces. Specifically, the agency\u2019s proposed rule\u2014for the first time\u2014requires HL7\u2019s Fast Healthcare Interoperability Resources as the standard to which health IT developers must certify their APIs.

Yet by sharing that data with a third party API-based app, patients are potentially putting that health information at risk from inappropriate secondary uses and disclosures, according to National Coordinator for HIT Don Rucker, MD.

\u201cSecondary use of data creates privacy challenges that extend beyond the healthcare industry,\u201d Rucker testified on Tuesday before a Senate committee. \u201cAcross all business sectors, individuals often have little say with respect to the secondary use and disclosure of their personal data. However, the misuse of health information can have lifelong consequences for the patient.\u201d

Also See<\/b>: Consumer health information is increasingly at risk, groups tell Congress<\/a>

Nonetheless, Rucker made the case that patients \u201cshould have the ability to decide whether the potential benefit of an app to manage their health care information and medical conditions outweighs potential risks\u2014this should be the patient\u2019s choice.\u201d

A patient \u201chas to make a very conscious decision to download the data to the app\u2014that offers an opportunity, certainly, for providers to give those warnings,\u201d he added.

Although the HHS Office for Civil Rights has regulatory authority to ensure the privacy and security of data applies to HIPAA covered entities and their business associates, once protected health information has been shared with a patient-designated app the HIPAA-covered entity or business associate is not liable for subsequent use or disclosure of that data\u2014provided that the app developer is not itself a business associate of a covered entity, directly or through another business associate.

\u201cWe are actively engaged with the Office for Civil Rights to inform patients about both their HIPAA rights and potential risks,\u201d Rucker told lawmakers. \u201cIndividuals should balance their selection and use of a health app with the potential risk of having negative implications.\u201d

In his testimony, Rucker pointed out that many third-party apps are not required to implement the privacy protections and patient rights of the HIPAA Privacy and Security Rules, but they may fall under the jurisdiction of the Federal Trade Commission, including the Health Breach Notification Rule.

The FTC issued the Health Breach Notification Rule to require certain businesses not covered by HIPAA to notify their customers and others if there\u2019s a breach of unsecured, individually identifiable electronic health information.

\u201cDeeply sensitive health facts about patients can be inferred from consumer data \u2018exhaust,\u2019 such as accelerometers, location services and a wide variety of app and social media usage patterns,\u201d according to Rucker\u2019s testimony.

Rucker suggested that \u201cas Congress thinks about secondary use of data\u201d and how to safeguard that health information, the overall assessment by legislators \u201creally should be a fairly broad consideration.\u201d","order":0,"get_parent":{},"attributes":[],"attributesType":{"content":{"type":"string","source":"raw"},"lock":{"type":"object"}},"dynamicContent":""}]

ONC: Patients must balance benefits of third-party apps with risks

More for you