Protecting Patient Privacy in the Era of TEFCA

Jay Nakashima, President, eHealth Exchange
LinkedIn: Jay Nakashima
LinkedIn: eHealth Exchange

A. John Blair, III, MD, CEO, MedAllies
LinkedIn: A. John Blair, III, MD
LinkedIn: MedAllies

Trust is essential when it comes to accessing health care data. That is why we have been so consistently laser-focused on trust and “getting it right” for the patient as we’ve launched a new government-sponsored health data exchange framework. Once fully scaled, the Trusted Exchange Framework and Common Agreement™ (TEFCA™) will make data sharing more ubiquitous without extra effort. But that doesn’t mean opening the gates without significant guardrails to protect patients’ privacy.

Healthcare interoperability helps provide clinicians with a full picture of an individual’s medical history so they can make a better diagnosis and care plan. The patient shouldn’t have to worry about which vendor their hospital uses for their electronic health records — the information should seamlessly flow as the patient moves among various providers to receive care. In today’s modern technology ecosystem, clinicians shouldn’t have to wait for faxes, and patients shouldn’t have to physically carry copies of their health information to medical appointments.

To help make seamless interoperability a reality, eHealth Exchange™ and MedAllies™ are among the first designated Qualified Health Information Networks™ (QHINs™) under TEFCA. As QHINs, we brought our trusted networks of providers to exchange information with each other. When a doctor plugs into one of our QHINs they are immediately connected to TEFCA’s numerous national networks of providers and healthcare organizations, allowing a patient’s data to seamlessly and securely move as they receive care – no matter where they are in the country.

When someone requests an individual’s health information for treatment, TEFCA has developed clear rules to help confirm if that person is actually treating them. Using these rules, we believe further efforts should be taken to ensure patient privacy is protected:

  • Meticulous Onboarding is Priority #1: TEFCA needs a Standard Operating Procedure (SOP) for onboarding new participants. More rigors should be applied to vetting a new participant, looking carefully at their use cases for data exchange. While everyone agrees to the same “rules of the road” via TEFCA’s terms and conditions, it is critical that all players completely understand the substance of these principles prior to being onboarded to TEFCA. Once approved, participants and sub-participants need ongoing education that clarifies purposes of use, explains reciprocity, and outlines penalties for misuse. Guidelines in the form of a participant onboarding SOP can help level those expectations for all.
  • Representative Governance: Trust is the bedrock for an interoperability framework to succeed, and that trust is evident in how the framework is governed. TEFCA governance must be updated to accurately reflect the healthcare providers that are participants in the framework, not just at the QHIN and Recognized Coordinating Entity® (RCE™) level. Providers who are accountable to their patients’ data need a significant voice in the governance process.
  • Immediate Remediation: Each QHIN has a governance body overseeing their own network, security incidents, and dispute resolution. The current documented process for TEFCA dispute resolution is too drawn out and may inadvertently prioritize vendor confidentiality over patient privacy. When it comes to protecting patient data, bureaucracy cannot delay investigation. Realizing that suspending access to the network can also impact patient care, clearer directions with a more expedited timeframe should be written into the SOP for dispute resolution.

Conclusion

We are proud to be leading the industry as inaugural designated QHINs. Under TEFCA, QHINs will play a critical role in ensuring the patient privacy and trust that is needed to advance interoperability. We call on all QHINs, the Assistant Secretary for Technology Policy/Office for the National Coordinator for Health Information Technology and the RCE to prioritize these recommendations to ensure TEFCA scales for the benefit of all individuals.