Meaningful Use, Patient Portals and Health Information Exchange

1. Meaningful Use, Patient Portals and Health Information Exchange Presented by:Melissa Markey Hall, Render, Killian, Heath & Lyman, PLLC 201 West Big Beaver Rd, Suite 1200 Troy, Michigan (248) 740-7505 January 29, 2014 HEALTH LAW IS OUR BUSINESS.

2. Meaningful Use Basics

3. Meaningful Use Basics • Stage 1: Criteria focus on electronically capturing health information in coded formats to track clinical conditions and communication of information for care coordination. • CDS tools to facilitate disease management and medication management. • Stage 2: Criteria expand in the areas of disease management, clinical decision support, medication management, support for patient access to health information, care transitions, quality measurement, research, and bi-directional communication with public agencies.

4. Meaningful Use Matters • Payment Penalties begin for Medicare Incentive Program participants in 2015. • Medicare eligible professionals physician fee schedule amount for covered professional services will be adjusted down by 1% each year to a maximum of 5%.

5. Patient Engagement • Engagement with patients is a major focus of MU Stage 2. • Much of that engagement is intended to be electronic.

6. Patient Portal • Patient Portal: a secure website that gives patients on-demand access to their medical information. Most patient portals provide access to: • Patient visit/encounter information • Discharge Summary • List of problems • Medications • Immunizations • Allergies • Some patient portals also offer secure e-mail, prescription refills, appointment requests, and similar communications options

7. Specific ambulatory criteria 170.304(h) • Clinical summaries (CCD) including problem list, medication list, allergies, procedures, immunizations and diagnostic test results provided for more than 50% of office visits within 3 business days. • Eligible Provider must also document that CCD was delivered.

8. Specific ambulatory criteria 170.304(i) • Implement the ability to exchange clinical information electronically • Must complete one test of exchange with CCD format • Relates to Menu Set 170.304(i): Provide a summary of care for 50% of patients who transition to another provider or location of service

9. General Certification Criteria 170.302(l) • Capability to submit electronic data to immunization registries or immunization information systems and actual submission according to applicable law and practice. • Performed at least one test of certified EHR technology's capacity to submit electronic data to immunization registries and follow up submission if the test is successful (unless none of the immunization registries to which the EP submits such information has the capacity to receive the information electronically).

10. General Certification Criteria 170.302(m) • Use certified EHR technology to identify patient-specific education resources and provide those resources to the patient if appropriate. • More than 10% of all unique patients seen by the EP are provided patient-specific education resources.

11. Specific ambulatory criteria 170.304(d) • Send reminders to patients per patient preference for preventive/followup care. • More than 20% of all patients 65 years or older or 5 years old or younger are sent an appropriate reminder during the EHR reporting period.

12. Specific ambulatory criteria 170.304(g) • At least 10% of patients seen by Eligible Provider are provided timely electronic access to their health information within 4 business days of information being available to Eligible Provider, including: • Problem list • Medication list • Laboratory results • Allergies • Provider may withhold some information, if indicated in the provider’s professional discretion

13. Hospital Measures • More than 50% of all unique patients discharged from the inpatient or emergency department of the eligible hospital or critical access hospital have information available online within 36 hours • More than 5% of all unique patients discharged from the inpatient or emergency department of the eligible hospital or critical access hospital actually view, download or transmit to a third party their information during the EHR reporting period

14. Hospital Measures • Use clinically-relevant information from the certified EHR to identify patient-specific education resources and provide them to the patient • More than 10% of all unique patients admitted to the inpatient or emergency department of the eligible hospital or critical access hospital are provided patient-specific educational resources identified by certified EHR technology

15. Hospital Measures • Able to submit electronic immunization information to immunization registries/information systems except where prohibited, in accordance with applicable law and practice • Measured by successful ongoing submission of immunization data to an immunization registry or immunization information system for the entire EHR reporting period • Exceptions: • CAH or hospital does not provide immunizations • The immunization registry/immunization information system cannot accept electronic submissions • At the start of the EHR reporting period, the immunization registry/immunization information system cannot enroll, or otherwise cannot accept electronic submission from the EHR

16. Patient Engagement • Reasons for enhanced patient engagement: • Meaningful Use – strong emphasis on patient engagement • Growth of social media and access to the internet • Focus on improving health among targeted population • Reducing unnecessary readmissions • Improving compliance • On-going healthcare needs – chronic conditions that need continual contact with healthcare staff • Patient ownership – as deductibles increase, patients may demand greater access to their health information to help them with healthcare decisions

17. Patient Engagement • Meaningful Use Stage 3 is going to require even more patient involvement • Increased focus on self-management and shared management of health conditions requires increased patient knowledge and communication • Patient portals can provide tools for patient education and coaching • Patient portals also provide a means for patients to communicate data back to physicians • If patient engagement is the key, portal needs to be designed and implemented to meet patient needs • A portal designed mostly to meet physician desires may not meet patient needs, and may not be used

18. Patient Engagement • A study by Accenture found that 41% of patients would change physicians if necessary to gain electronic access to their medical record • While on 36% of patients have electronic access at this point, 57% currently maintain their own health-related records, including: • 37% maintain records of their health history • 34% track their physical activity • 33% track health indicators such as B/P

19. Patient Engagement • Patients and physicians have differing views about access to medical records • 84% of patients believe full access is appropriate • 65% of physicians believe full access is appropriate • Patient portals typically only provide access to a limited selection of the patient record

20. Physician Engagement • Medicine is Technology • Portal Adoption and Implementation: Are your healthcare professionals ready? • Review Workflow process • Patients are more likely to use a patient portal if their providers recommend and support portal use.

21. Patient Portal • Some Legal Issues • Opt in versus Opt out • Provisioning • When, how, and who • Default passwords • Documentation • Terms of Use • NOPP • Opt In/Out and Revocation • The 14 year old problem

22. Patient Portal • Some Legal/Operational Issues • Which parts of the record will be visible? • Labs • First-time labs? • Pathology? • All test results, or negatives only? • Images, reports, or neither? • Demographics • Risks if patient can directly change demographic information • Ensure no changes flow from portal to primary record

23. Patient Portal • Privacy and Security • Patient portals permit outside parties (patients) access into your IT system, hence create substantial risk • Record of truth = EHR • Risks • Authentication • Man-in-the-middle attacks • DDoS • Breach • Viruses and malware

24. Patient Portal • Privacy and Security • Initial provisioning • Provide unique user names • Provide reasonably secure initial password • Educate on changing initial password • Have an easy password reset system • Coordinate log-on credentials with master patient index • Incident response system, including means for patient to notify doctor’s office if their credentials are compromised

25. Patient Portal • Privacy and Security • Protections • Firewalls • Strong Authentication • Passwords • Two-Factor Authentication • Security Questions • Face-to-fact authentication for higher-level access • Intrusion detection and intrusion protection • Monitoring • Education • Patients need to be educated about their role

26. Health Information Exchange • HIE refers to the electronic exchange of health information between different provider entities • Meaningful use requirements: • E-Prescribing • Electronic transfer of laboratory results • Immunization information to State • Epidemiologic/Surveillance Data • CCDA

27. Health Information Exchange • The Office of National Coordinator developed training modules around Stage 2 Meaningful Use to train providers on how to implement new standards to support: • Transitions of Care • Lab Exchange • Patient Engagement • Public Health Measures

28. Health Information Exchange • HIE can be “push” or “pull” technology • “Pull” – Data recipient sends out a request for information and others on the HIE respond • “Push” – Entity with the data sends data to those entities identified as proper recipients of the data • HIE can be federated or repository • Federated – data remains at the “home” of the data owner and is sent out when needed • Repository – data is stored at the HIE in a record set • Each has strengths and weaknesses

29. Health Information Exchange • Goal is to permit the exchange of information between entities to support timely, efficient, cost-effective care • Challenges • Patient identification • Identifying relevant data for the need • Patient consent – opt-in versus opt-out • More complicated with interstate exchange • Interoperability • Improving daily • Security • Man-in-the-middle • Integrity – packet loss, etc. • Intrusion detection and prevention • Breach

30. Health Information Exchange • ONC is working with NIST to ensure interoperability between EHRs to ensure ability to exchange data across vendors • Continued development of common standards and identity reconciliation • “…we will pay close attention to whether the requirements in the rule are sufficient to make vendor-to-vendor exchange attainable for providers. If there is not sufficient progress or we continue to see barriers that create data silos or “walled gardens,” we will revisit our meaningful use approach and consider other options to achieve our policy intent…”

31. Questions?