As the use of real-world data in the health care system grows, a recent HHS rule giving patients electronic access to their data stands to have a huge impact on this area. And the trend doesn’t show any signs of slowing, with companies such as Amazon.com Inc., Apple Inc., Google and Microsoft Corp. exploring opportunities in the health care industry though the use of patients’ medical data. Various stakeholders within the health care industry stand to benefit from this access in a variety of ways.
The Office of the National Coordinator for Health Information Technology (ONC) last year issued a final rule — The 21st Century Cures Act: Interoperability, Information Blocking, and the ONC Health IT Certification Program — in order to implement some electronic health information (EHI) and interoperability provisions of the 21st Century Cures Act.
ONC was responsible for certain aspects of the Cures Act “that are designed to advance interoperability; support the access, exchange, and use of electronic health information (EHI); and address occurrences of information blocking.” It also seeks to empower patients by allowing them access to their EHI in a form that is “convenient for patients, such as making a patient’s EHI more electronically accessible through the adoption of standards and certification criteria and the implementation of information blocking policies that support patient electronic access to their health information at no cost.”
While the rule was issued May 1, 2020, with an effective date of June 30, 2020, certain aspects of it took effect earlier this year on April 5, including prohibiting the blocking of patients’ EHI from them. The rule also established an ONC Health IT Certification Program that requires participating entities to follow certain application programming interface (API) conditions that would promote an open and competitive app marketplace. This is aimed at allowing patients to securely and easily access their health data at no cost in a form that is convenient for them, including smartphones.
The information blocking rule “requires healthcare professionals to deliver a patient’s test and study results in 16 categories to the patient’s electronic portal as soon as they are electronically available, regardless of whether the physician has had a chance to read those results or talk with the patient about them to put them in context and discuss further options for care,” explains Dominic Galante, M.D., M.S., chief medical officer at PRECISIONvalue. “If they delay and a complaint is filed alleging they were engaging in information blocking, an investigation by the HHS Office of the Inspector General or the Office of Civil Rights could result in financial ‘disincentives’ imposed on that provider’s practice (up to $1 million fine per violation). This is important because a practice that is likely to interfere with, prevent or materially discourage access, exchange or use of electronic health information may materially impact the patient’s ability to access timely care, which may lead to adverse clinical outcomes.”
Some providers, however, have asked ONC to delay posting the results for 24 to 72 hours in order for them to contact the patient ahead of time, according to a MedPage Today article. “Fearing that some patients might freak out after seeing bad news in their electronic health portals before their doctors have reviewed results, some pathologists have adopted creative strategies,” including calling the treating physician when they receive test results.
According to Ariel Katz, CEO and co-founder of H1, a company that connects health care professionals around the world, the information blocking provision is a “core element of the Cures Act” that “makes sure a patient who is treated by a physician can see, access and take their data to other providers and platforms. This is the cornerstone of the legislation ensuring that data can start to move freely between different platforms, health care practices and systems. Down the road, this should lead to more complete records for patients, allowing their providers and health tech companies to give more accurate treatment and health care insights, respectively.”
The rule identifies eight categories of information-blocking exceptions:
(1) Preventing harm exception,
(2) Privacy exception,
(3) Security exception,
(4) Infeasibility exception,
(5) Health IT performance exception,
(6) Licensing exception,
(7) Fees exception, and
(8) Content and manner exception.
The Cures Act is not the first to be focused on protecting patients’ rights. The Health Insurance Portability and Accountability Act of 1996 (HIPAA) required the establishment of nationwide standards to protect against sensitive patient information being disclosed without a patient’s knowledge or content. HIPAA gave patients the control over who they would like to share that information with, explains Katz. Meanwhile, the Cures Act gives patients the right to get their medical records from a provider at any time.
The Cures Act, he tells AIS Health, a division of MMIT, “puts the patients first by helping get rid of the barriers between you as a patient and your health history, making it easier to access and share your records when you can best use them and when you need them the most. So, while your medical provider must still retain your records with the utmost security and be HIPAA-compliant, the Cures Act gives you the right as a patient to have the ability to access your medical records whenever you choose to do so.”
According to Galante, while the Cures Act does not modify HIPAA, “the goal of both is to protect the rights of patients. The laws simply achieve this goal using different methods.” The right of access provision is a “central component” of the HIPAA Privacy Rule that requires providers to allow patients to view and copy their medical records, he explains.
“The Cures Act also has the goal of promoting patient (and provider) access to electronic protected health information (ePHI),” continues Galante. “The Cures Act and the HIPAA Privacy Rule also both regulate disclosure of protected health information (PHI): The HIPAA Privacy Rule is designed to prevent unauthorized access to PHI; the Cures Act actively requires disclosure of PHI. These two disclosure goals may seem contradictory but are not. The Cures Act’s information blocking provision does prohibit conduct that is ‘likely to interfere with, prevent, or materially discourage access, exchange, or use of electronic health information.’ However, the Cures Act does not permit disclosure of information that the Privacy Rule prohibits disclosure of. The Cures Act and the HIPAA Privacy Rule do not contradict each other. By complying with both, entities fulfill their obligations to allow for access to health information while ensuring that access is limited to what is permitted under the law.”
The idea behind the provision in the Cures Act that allows patients to access their medical records through smartphones and apps “was to allow for the entrepreneurial economy to start using this free-flowing information to build platforms and services that can provide a deeper understanding of a patient’s individual health care, as well as show opportunities for treatments that may not be as easily accessible without substantial computing power,” says Katz. “Additionally, it is increasingly the case that consumers are ‘mobile-first,’ meaning smartphone usage is the way that we anticipate them accessing their health data. This provision works to ensure that this legislation isn’t obsolete from day one.”
Galante notes that “while the evidence is currently immature, access to patient medical records through smartphones, apps and patient portals has demonstrated benefit by enabling the discovery of medical errors, improving care during medical emergencies, providing medical histories at the point of care, creating better understanding of a patient’s personal health, improving recollection of the patient’s treatment plan, improving adherence to medications, bettering coordination of care, enhancing efficiency, reducing costs, improving patient-provider communication, etc. Also, recent studies show that only about 30% of patients who currently have access to their secure medical records are actually using them. Future high-quality studies are needed to fully understand, improve, and evaluate its impact.”
Various Stakeholders Could Benefit From New Rule
Another patient benefit of the new rule is that their medical data may provide them with a financial gain. Katz notes that at the MedTech Conference, Sen. Bill Cassidy (R -La.) “discussed legislation that would enable patients to make money off the sharing of their health care data. Right now, patients don’t make any money if their data is shared, for example, between smart devices and health insurers. He believes that patients should be able to opt in or out of the sharing of that information and not be left out of money shared during the exchange of their data. Once individuals take control of the data they generate, it will usher in a whole new wave of possibilities, not the least of which is the commoditization of that data.”
Katz points out that companies such as Apple can use patient data for its smart watches without consent. And a “substantial secondary market for anonymized health care data” already exists by which life sciences companies can gain knowledge through claims data. The Cures Act gives people more ownership of their health information, and that “could help pave the way for companies to offer financial incentives to people to use that data for innovation, real-world evidence (RWE) and a deeper insight into the health of certain groups, which would aid in the development of therapeutics. While it’s speculation at this point, we could see a similar market-based solution to get people to share their anonymized health data the way people already sell plasma, etc.”
According to Galante, “the new rules are emerging just as Amazon, Apple, Google and Microsoft are racing to capitalize on health data and capture a bigger slice of the health care market. Opening the floodgates on patient records now could help tech giants and small app makers alike develop novel consumer health products.” To assist with this data sharing, companies including Amazon, Google and Microsoft have “committed to using common standards to categorize and format health information. Microsoft, for instance, has developed cloud services to help health providers, insurers and health record vendors make data available to patients.”
Providers also stand to benefit from the new rule, Katz maintains. These stakeholders “are big winners,” as the Cures Act will allow them to “more seamlessly be able to converse with patients about their full history and be able to view patients in a more longitudinal way, rather than whatever the patient is experiencing in a snapshot of time.”
Payers “will also be winners” in two areas, he continues. The data will provide “transparency into costs and outcomes, but more importantly, the opportunity to use data to analyze and theoretically offer competitive options. This could ultimately improve outcomes and reduce costs.”
And manufacturers could benefit in a few ways, including having “the opportunity to source anonymized data and draw meaningful conclusions from large real-world evidence and feedback from product usage that could inform treatments for other indications or in alternative populations.”
“Digital health, telehealth and Internet of Things (IoT) companies stand to benefit the most, as do insurance companies,” Galante tells AIS Health. “Digital health companies will get better access to data, which has been a barrier, and payers will see improvements in care management.”
However, electronic health record (EHR) vendors and hospitals will face “near-term headwinds,” he says, because both stakeholder groups will need to respond quickly to comply. But despite these headwinds, “interoperability can unlock much more value for the entire health care system.”
That said, “many stakeholders believe the rules will significantly disrupt the EHR market,” he continues. “Large health care companies that have been ‘slow-walking’ interoperability are at risk to not survive. Once these APIs are created, there will be new market entrants who will create fundamentally new models that threaten large established companies in the space. It will be interesting to see, in the next three to five years, how many companies that didn’t embrace interoperability, or minimally embraced it, will be disrupted.”
The main challenges of the Cures Act are patient privacy and data security, maintains Galante. “Legal and regulatory frameworks for governing mobile health care applications remain conspicuously absent, and the current lack of regulation could impede health care delivery efforts in post-emergency settings. Three specific areas of concern include ownership and control of information in a personal health record, third-party use of consumer data for secondary purposes and the application of existing laws to PHR systems.”
Katz agrees that privacy and security are essential to this legislation to get uptake among various stakeholders. “Moreover, several of the limited exceptions to information sharing within the Cures Act are around protecting the data itself, meaning the foundation of the legislation, combined with the HIPAA protection that exists currently, will have security as a top priority.”
He adds that other potential challenges “are the same as the challenges with any type of decentralization of management of data — some consumers will use best practices around personal security, passwords and biometric access, while others could be less vigilant. Overall, though, my view is that there are no greater or fewer challenges than with the financial world moving onto smartphones and apps. If anything, medical records are later to join the ecosystem — meaning many of the challenges around security, organization and redundancy have been solved.”
Rule Could Spur Innovations Within Health Care System
The multiple benefits that various health care stakeholders may reap are not the only positive outcomes expected from the new rule. Katz says that “one of the most exciting elements — in addition to the new therapeutics and med devices that will be aided by the [freer] flow of information — is the predictive elements and modeling that can come from sharing all of this data. The COVID pandemic could have been significantly reduced if the data surrounding illness in hotspots had been more readily available and able to be modeled. In short, governments could have produced stronger preventative responses in areas that started to show signs of infection, thereby limiting the spread. But innovations like this will take time.”
The rule stands to advance the use of real-world data in the health care system. The impact on real-world data, says Katz, is “exciting and unknowable. In the near term, I think that real-world data starts to level up speed of treatment and outcomes in certain populations. Take, for example, the pandemic we’re in — real-world data has been key in everything from helping communities limit outbreaks to assessing risk in different populations. And some of the systems we have built for data in the pandemic will have a lasting positive impact on other areas of health for years to come (think dashboards and datasets that predicted hotspots for the virus). The ‘known unknown’ here is what predictive insights the volume of real-world data we’re about to receive can actually generate. Can we predict potential for disease, deliver education and preventative care, and ensure good health outcomes before people even get sick? I believe we can.”
RWE has a key role for research across a product’s lifecycle, from clinical trial design to post-market surveillance, points out Galante, benefiting both drug and device manufacturers. It also can fill in any gaps in clinical trials, helping manufacturers get FDA approval for an agent, as well as potentially expanding its indication. RWE can inform the creation of decision-support tools and treatment guidelines. In addition, “RWE can track outcome and quality measures across organizations. For administrators, RWE can provide information about how their entire health system is performing relative to others and how their individual physicians are benchmarking relative to peers. This information can help inform coverage discussions with payers and refine quality-based reimbursement strategies that reward solid outcomes.”
Theoretically, says Katz, “the large datasets that could come from this legislation will help manufacturers and payers leverage RWE to understand the most effective treatments/cures. It is possible that using this data, therapeutics reach the market (or new indications can reach the market) in less time or gain payer approval sooner based on the data.”
Galante agrees that the data could help with initial coverage decisions by payers, as well as health technology assessments (HTAs) from organizations such as the Institute for Clinical and Economic Review (ICER). That said, if RWE is not available for a new drug, HTA groups and payers will face the challenge of assessing that agent’s comparative effectiveness vs. that of a product already on the market.
“RWE gives HTA/payers the opportunity to reconsider coverage, formulary placement and price/payment terms in light of how the products are performing in their relevant population,” he states. “In addition to evidence on real-world safety and effectiveness, manufacturers can use RWE to provide payers with evidence on dimensions of value (from either a clinical [and/or] economic perspective) that are not evaluated during drug development.”
He tells AIS Health that research his company has conducted “suggested that evidence of real-world effect is what matters to payers. Uses can be as broad as trying to identify or rule out safety signals; measuring adherence in order to evaluate whether a drug that is slightly more tolerable could be more effective in the real world if patients actually take it; establishing effectiveness and value for money within the health plan’s specific population (i.e., RWE can be a good test of external validity, as the product is evaluated within a more representative sample); or establishing effectiveness within subpopulations.”
Having RWE also can aid manufacturers and payers in establishing outcomes-based deals for medications, observes Galante. “Outcomes-based agreements have not featured prominently in the U.S. health care system, largely because of the difficulty of collecting the RWE that could support such agreements.”