[Senate Hearing 116-409]
[From the U.S. Government Publishing Office]
S. Hrg. 116-409
IMPLEMENTING THE 21ST CENTURY
CURES ACT: MAKING ELECTRONIC
HEALTH INFORMATION AVAILABLE
TO PATIENTS AND PROVIDERS
=======================================================================
HEARING
OF THE
COMMITTEE ON HEALTH, EDUCATION,
LABOR, AND PENSIONS
UNITED STATES SENATE
ONE HUNDRED SIXTEENTH CONGRESS
FIRST SESSION
ON
EXAMINING IMPLEMENTING THE 21ST CENTURY CURES ACT, FOCUSING ON MAKING
ELECTRONIC HEALTH INFORMATION AVAILABLE TO PATIENTS AND PROVIDERS
__________
MARCH 26, 2019
__________
Printed for the use of the Committee on Health, Education, Labor, and Pensions
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
Available via the World Wide Web: http://www.govinfo.gov
______
U.S. GOVERNMENT PUBLISHING OFFICE
41-393 PDF WASHINGTON : 2021
COMMITTEE ON HEALTH, EDUCATION, LABOR, AND PENSIONS
LAMAR ALEXANDER, Tennessee, Chairman
MICHAEL B. ENZI, Wyoming PATTY MURRAY, Washington
RICHARD BURR, North Carolina BERNARD SANDERS (I), Vermont
JOHNNY ISAKSON, Georgia ROBERT P. CASEY, JR., Pennsylvania
RAND PAUL, Kentucky TAMMY BALDWIN, Wisconsin
SUSAN M. COLLINS, Maine CHRISTOPHER S. MURPHY, Connecticut
BILL CASSIDY, M.D., Louisiana ELIZABETH WARREN, Massachusetts
PAT ROBERTS, Kansas TIM KAINE, Virginia
LISA MURKOWSKI, Alaska MARGARET WOOD HASSAN, NewHampshire
TIM SCOTT, South Carolina TINA SMITH, Minnesota
MITT ROMNEY, Utah DOUG JONES, Alabama
MIKE BRAUN, Indiana JACKY ROSEN, Nevada
David P. Cleary, Republican Staff Director
Lindsey Ward Seidman, Republican Deputy Staff Director
Evan Schatz, Minority Staff Director
John Righter, Minority Deputy Staff Director
C O N T E N T S
----------
STATEMENTS
TUESDAY, MARCH 26, 2019
Page
Committee Members
Alexander, Hon. Lamar, Chairman, Committee on Health, Education,
Labor, and Pensions, Opening statement......................... 1
Murray, Hon. Patty, Ranking Member, a U.S. Senator from the State
of Washington, Opening statement............................... 3
Witnesses
Moscovitch, Ben, M.A., Project Director, Health Information
Technology, The Pew Charitable Trusts, Washington, DC.......... 6
Prepared statement........................................... 7
Summary statement............................................ 15
Savage, Lucia, C., J.D., Chief Privacy and Regulatory Officer,
Omada Health, Inc., San Francisco, CA.......................... 16
Prepared statement........................................... 17
Summary statement............................................ 29
Rehm, Christopher, R., M.D., Chief Medical Informatics Officer,
LifePoint Health, Brentwood, TN................................ 29
Prepared statement........................................... 31
Summary statement............................................ 34
Grealy, Mary, J.D., President, Health Leadership Council,
Washington, DC................................................. 36
Prepared statement........................................... 37
ADDITIONAL MATERIAL
Supplemental remarks of Lucia C. Savage, J.D.....................
Digital Health Data and Information Sharing: a New Frontier
for Healthcare Competition................................. 54
ONC's Proposed Rule On Information Blocking: The Potential To
Accelerate Innovation In Health Care....................... 83
Comments of Omada Health, Inc. to U.S. Department of Health
and Human Services Office for Civil Rights in Response to
Request for Information, Docket # 0945AA00................. 86
Supplemental remarks of Mary Grealy, J.D.........................
HLC BPC Report on Advancing Interoperability, Information
Sharing, and Data Access................................... 98
IMPLEMENTING THE 21ST CENTURY
CURES ACT: MAKING ELECTRONIC
HEALTH INFORMATION AVAILABLE
TO PATIENTS AND PROVIDERS
----------
Tuesday, March 26, 2019
U.S. Senate
Committee on Health, Education, Labor, and Pensions,
Washington, DC.
The Committee met, pursuant to notice, at 10 a.m., in room
SD-430, Dirksen Senate Office Building, Hon. Lamar Alexander,
Chairman of the Committee, presiding.
Present: Senators Alexander [presiding], Cassidy, Romney,
Braun, Murray, Baldwin, Kaine, Jones, Hassan, Rosen, and Casey.
OPENING STATEMENT OF SENATOR ALEXANDER
The Chairman. The Senate Committee on Health, Education,
Labor, and Pensions will please come to order. Senator Murray
and I will each have an opening statement, then we will
introduce the witnesses. After the witnesses' testimony,
Senators will each have about five minutes of questions.
Reid Blackwelder is a family physician with three clinics
in the tri-cities area of East Tennessee. A few years ago, he
talked with the New York Times about his electronic health
records that were supposed to make his life easier saying, ``we
have electronic health records at our clinic but the hospital,
which I can see from my window, has a separate system from a
different vendor. The two do not communicate. When I admit
patients to the hospital, I have to print out my notes and send
a copy to the hospital so they can be incorporated into the
hospital's electronic records.'' Dr. Blackwelder could pay for
his patients' hospital records to be electronically sent from
his system to the hospital system, but it would cost him
$26,400 every month or $316,800 a year. So, for Dr. Blackwelder
and many other doctors, record keeping is now more expensive
and burdensome as a result of electronic health care records.
In 1991, the National Academy of Medicine released a report
urging the prompt development and implementation of what were
then called computer-based patient records. We forget that was
well before the internet was in common usage in the United
States. The report said, these systems have a unique potential
to improve the care of both individual patients and reduce
waste through continuous quality improvement. Electronic health
records, as they came to be called, got a boost in 2009 when
the Federal Government, in a bipartisan effort, began the
Meaningful Use Program, spending over $36 billion in grants to
incentivize doctors and hospitals to use these systems. As was
the prediction in the 1991 report, the hope was that electronic
records would improve patient care and reduce unnecessary
healthcare spending. This is important to this Committee
because at our hearing last summer Dr. Brent James from the
National Academies testified that up to 50 percent of what we
spend on health care is unnecessary. So, there is bipartisan
focus, both in the Congress and the administration, on reducing
health care costs.
One way to reduce what we spend on administrative tasks and
on necessary care, is by having electronic health records that
talk to one another, which we call interoperability. But in
2015, six years after the Meaningful Use Program started, as
this Committee worked on the 21st Century Cures Act, we
realized that in many cases electronic health records added to
administrative burden and increased unnecessary health care
spending. A major reason for that is the records are not
interoperable. One barrier to interoperability is called
information blocking, which is when some obstacle is in the way
of a patient's information being sent from one doctor to
another. So, in 2015, this Committee held six bipartisan
hearings, formed a working group to find ways to fix the
interoperability of electronic health records. These hearings
led to a bipartisan group of HELP Committee Members working
together to include a provision in the 21st Century Cures Act,
to stop information blocking and encourage interoperability.
Today's hearing is about two rules that the Department of
Health and Human Services proposed to implement this provision
in the 21st Century Cures Act. The two rules are complicated,
but I would like to highlight a few ways they lay out a path
toward interoperability. One, the rules define information
blocking so we know what we mean when we are talking about it.
So, it is more precisely clear what we mean when one system,
hospital, doctor, vendor, or insurer is purposely not sharing
information with another.
Second, the rules require that by January 1, 2020, for the
first time insures must share a patient's health care data with
the patient so their health information follows them as they
see different doctors. Third, all electronic health records
must adopt the same standards for data elements, known as
application programming interface or API, two years after these
rules are completed. And fourth, hospitals are required to send
electronic notifications to a patient's doctors immediately
when that patient is admitted to, discharged from, or
transferred from the hospital. According to the Department of
Health and Human Services, these new rules should give more
than 125 million patients easier access to their own records in
electronic format. This should be a huge relief to any of us
who have spent hours tracking down paper copies of our records
and carting them back and forth to different doctors' offices.
The rules will reduce administrative burden on doctors so they
can spend more time with patients.
A recent study from Kaiser found that emergency room
doctors in order use electronic health record systems make up
to 4,000 mouse clicks per shift. If electronic health records
data was truly interoperable, it would greatly reduce how many
clicks doctors have to make. According to the Department of
Health and Human Services, spending less time on these
administrative tasks will improve efficiency and save about
$3.3 billion a year. And because doctors can see patients full
medical history, they can avoid ordering unnecessary tests and
procedures. I also want to be aware, and I know this Committee
does, of unintended consequences from these two rules. Are we
moving too fast?
In 2015, I urged the Obama administration to slow down the
Meaningful Use Program, which they did not do, and looking
back, the results would have been better if they had. Are the
standards for data elements too rigid? Is the door still open
for bad actors to game the system and continue to information
block? And how can we ensure patient privacy as patients gain
more access and control over their personal health information,
and how do we help them keep it secure? I want to ensure these
rules will make the problem of information blocking better not
worse.
I look forward to any specific suggestions to improve the
rules from those who use electronic health record systems.
Electronic health records that work can give patients better
outcomes and better experiences at a lower cost.
Senator Murray.
OPENING STATEMENT OF SENATOR MURRAY
Senator Murray. Thank you very much, Mr. Chairman.
Back in 2008, just one in 20 hospitals used electronic
health records. A decade later, we have made enough progress to
flip that number entirely. Today, just one in 20 hospitals have
not adopted electronic health records. And over the past
decade, we have seen how better information about a patient's
health care does make a big difference. In national news,
electronic health records played an important role in
understanding how the water in Flint, Michigan was putting
families in danger. And while they do not always make
headlines, electronic health records also make a difference by
helping care providers identify health problems sooner so
patients can get preventive care to stay healthy, avoid
duplicated tests or medication errors, and identify treatments
that might be counterproductive based on a patient's medical
history or current prescriptions.
The HITECH Act we passed in 2009 was a big part of
accomplishing the progress we have seen so far, but we have to
continue building on that progress to ensure health information
technology lives up to its full potential. And we have to
continue oversight, following up the work we did in 2015 after
the Office of the National Coordinator for Health Information
Technology put out a report detailing some of the challenges
ahead. The report made clear information blocking was a serious
problem throughout the health care system. While high tech
required certified electronic health record products to meet
technical standards intended to make good information more
accessible for care providers, the ONC report found substantial
evidence some organizations were intentionally setting up
barriers between their systems and other systems, like
exorbitant fees whenever someone sent, received, or even
searched for a patient's information, contracts that restricted
people's ability to access and share their own health
information, and systems built in ways that made sharing
information needlessly complicated. Maybe they missed the day
in kindergarten about sharing, because putting something where
only you can reach or charging excessive fees for it is
absolutely not how it should be done. And it is absolutely not
acceptable when it comes to people's health.
We cannot afford to have bad actors who prioritize their
bottom line over patients' best interest, and block information
hospitals, providers, and patients need to be able to share
that with one another. We also cannot expect health IT systems
to get better when some vendors include gag clauses that
prevent care providers from speaking out about the problems, or
issues, or errors they encounter. It should be easy for
providers shopping for electronic record systems to learn about
potential issues. It should be easy for medical professionals
to hear about a problem with a system they use, and it should
be easy for anyone to speak out when they see something that
would jeopardize people's health. When systems cannot speak
with each other and people cannot speak up about the problems
they see, it is patients who do get hurt. Like the man in
California who suffered brain damage after his diagnosis was
delayed because a hospital software could not properly
interface with a lab software, or the woman in Vermont who died
of a brain aneurysm that might have been caught if a software
problem had not stopped the order for a test that she needed.
When we talk about making sure we have a strong health IT
system, we are not just talking about technology and
innovation. Families' lives depend on making sure we get this
right, which is why I was glad we were able to take steps to
address these issues in the 21st Century Cures Act.
I look forward to hearing from our witnesses about their
perspective on ONC's proposed rule to implement the Cures'
provisions. In that bill, we moved to end information blocking,
and make clear when patients and their care providers need
information, they should not be stopped by unnecessary,
unreasonable barriers. And we tasked ONC with clarifying what
sort of concerns, like privacy, and safety, and security, would
be grounds for reasonable exceptions. We also took steps to
help ONC strengthen its certification program beyond technical
criteria for electronic health records, so they can make sure
that if vendors want to get the Government seal of approval,
then they cannot engage in information blocking or use gag
clauses.
The new conditions also call for open application
programming interfaces, or APIs, another step that will help
make sure systems developed by different vendors and used by
different doctors are able to speak to each other, and that
patients have an easier time getting access to their medical
records. I am glad ONC is moving to put these common sense
steps into action. I am interested in making sure this gets
done right. I look forward to hearing from our witnesses about
their perspective on ONC's approach, and about the steps the
Centers for Medicare and Medicaid Services is taking to make
claims data more accessible and prompt care providers to be
better about sharing information. Of course, as we continue to
proof our health IT system, we need to make sure that health
information is being provided in a way that works for patients
as well.
During our 2015 hearings, I shared the story of woman who
had been seeking the results of her pregnancy test, but instead
of a clear answer, her electronic health record simply reported
her hormone levels--not helpful. We need to do better for her
and for other patients who have gone looking for information
they can use only to find massive binders, unreadable PDFs, and
stacks of CDs. Engagement and usability have to be part of this
discussion. And last but most certainly not least, we need to
talk about security, privacy, and data stewardship. That means
prioritizing the development of technology and best practices
that can help prepare for the constantly evolving cyber
security threats of the 21st century.
It also means having a national conversation about what is
required for all parties to be good stewards of the data people
entrust them with, and that conversation is only going to
become more important as tech companies and others introduce
new products like mobile applications that empower people with
their health care data but are not covered by existing HIPAA
protections. Patients should be able to expect tech companies
are going to use their most sensitive information responsibly
and give them the tools they need to be able to control how and
when their information is disclosed. Our objective should be to
make sure tech companies are putting patients in the driver's
seat, not the other way around. It is clear we have come a long
way when it comes to strengthening our Nation's health
information infrastructure, but it is also clear there are a
lot of challenges ahead.
I look forward today to hearing from all of our witnesses.
Thank you for being here. We want to hear about how data and
technology can actually empower patients and care providers,
and I hope we can continue our bipartisan work on this
important issue, Mr. Chairman.
Thank you.
The Chairman. Thank you Senator Murray and thank you for
your leadership on this. I think all Members of the Committee
would agree that the 21st Century Cures Act is one of the most
important pieces of legislation we have had a chance to work
on. Senator McConnell, Majority Leader, said it was the most
important bill in the Congress in which it passed, and it was a
bipartisan piece of legislation.
I have noticed that we can do three things in the
Committee, it seems to me. One, we can call attention to
something, which we are doing today and which we did with our
five hearings on electronic health care records. Two, we can
pass a law, which we did with 21st Century Cures. And three, we
can make sure the law works, which is what this hearing is
about--it is about oversight. And we welcome our witnesses.
The first one, Mr. Ben Moscovitch is the Project Director
of Health Information Technology at the Pew Charitable Trust.
He leads research on the challenges of achieving
interoperability and highlights possible solutions.
Next, we will hear from Ms. Lucia Savage. She is the Chief
Privacy and Regulatory Officer at Omada Health. Omada is a
digital behavioral health company that aims to address health
issues including type 2 diabetes, heart disease, and obesity.
She focuses on advancing health care using technology and
maintaining the security of patients' health information.
The third witness, Dr. Christopher Rehm, is Chief Medical
Information Officer of LifePoint Health in Brentwood,
Tennessee. It is a hospital system with 89 locations in 30
States. He works both with physicians and patients to apply
technology solutions to health care needs.
Finally, we will hear from Ms. Mary Grealy, President of
the Healthcare Leadership Council, which is comprised of health
care executives from leading organizations and companies in the
health care industry, health plans, hospitals, health product
distributors, pharmacies, and academic medical centers.
Welcome to each of our witnesses. Thank you for making time
for us today. If you will summarize your remarks in about five
minutes, we will then have questions. Why don't we begin, Mr.
Moscovitch with you.
STATEMENT OF BEN MOSCOVITCH, M.A., PROJECT DIRECTOR, HEALTH
INFORMATION TECHNOLOGY, THE PEW CHARITABLE TRUSTS, WASHINGTON,
DC
Mr. Moscovitch. Chairman Alexander, Ranking Member Murray,
Members of the Committee, thank you for holding this hearing
and for the opportunity to present testimony. If one were to
read recent news articles, it would be reasonable to think that
our healthcare system is less efficient and less safe because
of the transition from paper to electronic records.
The truth is EHRs have revolutionized modern medicine by
giving clinicians better tools to document patients' needs,
safely prescribe medications, and administer care. But, as
Congress recognized in the 21st Century Cures Act, gaps remain.
They keep EHRs from reaching their full potential. Oversight
from this Committee can help fill those gaps. My testimony will
focus on three aspects of the recently proposed regulations to
implement Cures that could one, enable easier use of health
data, two, promote better matching of patient records, and
three, improve safety and reduce clinician burden.
First, interoperability requires patients and clinicians to
be able to effectively access and extract information from
EHRs. To address that, Congress directed ONC to develop new
criteria for EHRs, which help different systems communicate.
These are called APIs or Application Programming Interfaces.
APIs are the foundation of the modern internet. They allow
travel websites to aggregate airline fares, personal financial
applications to pull data from an individual's accounts, and
countless other everyday uses. For APIs to be effectively used,
different systems need to exchange data in the same way. To
accomplish this, ONC identified the use of a standard called
FHIR for data exchange and provided guidance on how to
consistently implement it for better interoperability. As ONC
finalizes the rule, Congress should ensure that the agency
maintains its commitment to these standard APIs.
Interoperability also requires health organizations to know
that they are communicating about the same person. This is
often referred to as patient matching. When data are exchanged,
records may not be matched up to half the time. Pew has
identified concrete steps that Congress should encourage ONC to
take, including ones recently highlighted in a GAO report
required by Cures. We found that better standardization of data
can improve match rates. For example, Pew funded research at
Indiana University revealed that use of the U.S. Postal Service
standard for address would increase match rates by
approximately 3 percent, a significant improvement. One
technology developer told us this would help their system match
an additional tens of thousands of records per day. To improve
matching, ONC should specify use of the postal service standard
for address and include other routinely collected elements like
email address, which is already in half of records but not used
for matching. In Cures, Congress also recognized that EHR
usability must be improved. Usability refers to system design,
as well as how they are customized and used. Poor usability can
contribute to clinician burden and contribute to medical
errors.
Pew collaborated with MedStar Health to examine the
contribution of EHR usability to medication safety events, such
as dosing errors in three pediatric health care facilities. The
research found that EHR usability contributed to more than a
third of the 9,000 events examined. This Committee can
encourage ONC to make patient safety a priority in implementing
Cures. Congress charged ONC with developing new criteria for
EHRs used in pediatric care. While ONC rightly identified 10
priorities for pediatric care, such as the dosing of drugs
based on weight, the agency should better focus on safety and
usability. For example, ONC should clarify that developers
seeking certification for pediatric functions involve
pediatricians and pediatric nurses to test the system.
Congress also required ONC to establish an EHR reporting
program. The agency should embed safety in the usability
aspects of this program, as recommended by clinicians,
technology professionals, and others. In conclusion, the
bipartisan passage of Cures launched a new era for digital
health by providing patients and clinicians with better access
to data and reducing medical errors. As the administration
continues its implementation, this Committee can ensure that
Congress's goals are met by supporting secure, standard API
access to a wide range of health data, encouraging ONC to
address patient matching through better standards, and pressing
ONC to focus on patient safety throughout the implementation of
Cures.
Thank you for holding this hearing, and I look forward to
answering your questions.
[The prepared statement of Mr. Moscovitch follows:]
prepared statement of ben moscovitch
Chairman Alexander, Ranking Member Murray, Members of the
Committee, thank you for holding this hearing and for the opportunity
to present testimony.
My name is Ben Moscovitch; I serve as the Project Director of
Health Information Technology at The Pew Charitable Trusts (Pew), a
nonprofit, nonpartisan research and policy organization. Our health
information technology project focuses on improving the safety of
electronic health record (EHR) systems, and enhancing the exchange of
information so that health care providers and patients have the data
they need to make informed decisions.
EHRs have revolutionized how clinicians deliver care by equipping
them with better tools to document patients' health status, safely
prescribe medications, and otherwise order health care interventions.
And, these tools have the potential to make it easier for patients and
clinicians to have more complete and robust data to coordinate care
across health care settings.
Seeking to build on the improvements spurred on by the digitization
of paper records, Congress recognized that gaps remain in realizing the
full potential of EHRs to give patients their data, make clinical care
more efficient, and enhance patient safety. The 21st Century Cures Act
(Cures), passed in 2016, marked an important step toward remedying
these deficiencies by addressing barriers to both the effective
exchange of health data, known as interoperability, and the usability
of these systems.
Congress, through Cures, set a positive vision for the future of
EHRs--a vision where patient data are securely accessible to patients
and clinicians wherever and whenever they need them. Access to health
data would help advance the coordination of care for patients who see
multiple physicians. This coordination would help patients live longer
and better lives, and reduce costs associated with duplicate laboratory
and other services. And, this vision would have EHRs serve as a
critical, helpful tool that clinicians can seamlessly use to administer
higher quality care. In this vision, EHRs are indispensable, yet almost
invisible to patients because the systems are easily and efficiently
used, and only interject in care to offer essential support services to
help clinicians provide safer, higher quality care.
Earlier this month, the Office of the National Coordinator for
Health Information Technology (ONC) and the Centers for Medicare &
Medicaid Services (CMS) issued proposed rules to begin implementing
that vision captured in Cures. The regulations aim to ease the exchange
of health data when patients want to access their information or have
it transmitted to their health care providers, and otherwise focus on
barriers to the use of these systems to improve patient care.
My testimony will focus on three key aspects of the proposed rules
from ONC and CMS published earlier this month that address Congress'
desire to improve the interoperability of health data and effective use
of EHRs. Specifically, I will discuss:
provisions enabling easier extraction and use of
health data from EHRs via application programming interfaces
(APIs), which enable different technologies to communicate;
needed enhancements to better match patient records
across the different health care providers where individuals
seek care; and
necessary improvements to the usability of EHR
systems to address design and implementation factors that can
both introduce burdens on clinicians and contribute to medical
errors.
Enhanced Interoperability via Application Programming Interfaces
For patients to obtain their records or health care providers to
exchange information, they first need the ability to effectively
extract data from EHRs. To address that challenge, Congress required
ONC to develop new criteria for EHRs to make ``all data elements''
available via APIs, which are software tools that allow systems to
request and deliver information to other systems. APIs are the
foundation to the modern internet; they allow travel websites to
aggregate fares from different airlines, personal financial
applications to pull data from an individual's accounts, and countless
other everyday uses. \1\
---------------------------------------------------------------------------
\1\ The Pew Charitable Trusts, ``Electronic Tools Can Strengthen
Health Care Data Access, Sharing'' (2018), https://www.pewtrusts.org/
en/research-and-analysis/issue-briefs/2018/09/electronic-tools-can-
strengthen-health-care-data-access-sharing.
Currently, EHRs often do not support the robust use of APIs for
data exchange, or if they do, those APIs can be implemented in
proprietary ways that inhibit the use of the data by clinicians and
patients. The Cures provision on APIs--colloquially referred to as
``open APIs''--would let other technologies more readily access data
within the system in a secure manner. The term ``open'' does not
suggest that health data can be freely accessed by any user. Instead,
``open'' refers to the fact that these APIs would be easier to use,
such as that the business and technical documentation would be publicly
---------------------------------------------------------------------------
available.
By including this provision in Cures, Congress recognized that APIs
reflect the future of data exchange in health care. They can enable
patients to access their health records, hospitals to better exchange
data with other organizations, and health care facilities to build and
implement new decision support tools on top of their EHRs.
In the recently proposed regulations, ONC implements this API
provision, making several critical decisions on the standards to use
for data and what information EHRs must be able to release.
ONC Advances Standard, Secure APIs
For third-party technologies--like smartphone applications that
patients use to download their records or clinical decision support
tools that sync with EHRs--to utilize APIs to access data, the
developers of these tools must know how to request and access the
information. When EHRs use different standards for APIs, each third-
party technology must change its systems to reflect every variation.
Recognizing this challenge, ONC sought to minimize the variability
across systems by requiring the use of standards for APIs. Achieving
standardization across APIs necessitates consistency both for how
information can be accessed and how the data elements are represented.
ONC accomplishes that goal by requiring use of the Fast Healthcare
Interoperability Resources (FHIR) standard, which technology developers
are increasingly adopting, for how to exchange information.
However, FHIR permits the depiction of data elements in different
ways and considers the inclusion of some data as optional, which could
inhibit interoperability. To reduce this variability, ONC proposes to
require the use of an implementation guide developed by the Argonaut
Project--a collaboration among technology developers and health care
providers--that provides constraints on how to implement FHIR.
This combination of the FHIR standard and the Argonaut Project
implementation guidelines will reduce the barriers to API use, so that
patients and clinicians are better able to access data contained in
EHRs. As ONC finalizes the rule, Congress should ensure that the agency
maintains its commitment to standardized APIs--both through the use of
FHIR and refined implementation guidelines.
ONC Expands Data Elements Made Available
To fully take advantage of APIs as a tool to improve
interoperability and patient access to electronic health data, Congress
required that they provide access to ``all data elements'' within an
EHR system. In ONC's proposed rule, the agency provides guidance on
what information constitutes ``all data elements'' that systems would
be required to make available.
In prior regulations, ONC has required EHRs to have APIs that make
certain information--referred to as the Common Clinical Data Set
(CCDS)--available for patient access, such as through a smartphone
application. The CCDS contains some critical information, including
medications, laboratory tests ordered, and problem lists, but lacks
other data, such as physicians' notes. ONC has proposed expanding and
adjusting the CCDS to meet the statutory requirement of making ``all
data elements'' available. This expanded data set would be renamed the
U.S. Core Data for Interoperability (USCDI), and would include
additional key information. ONC's proposed additions include:
Different types of clinical notes. These clinical
notes include free text entered by clinicians and other data
about laboratory and imaging observations, treatment plans, and
other aspects of care. In clinical notes, clinicians describe
the nuances of care and patients' medical conditions. The
addition of notes to the USCDI can give patients and other
clinicians critical information that may not be captured
effectively in structured fields or medical codes.
Provenance. Provenance indicates the author, the
author's organization, and a time stamp for data elements in
the EHR. The inclusion of provenance would allow patients and
clinicians to understand the origin of the data, such as
whether a medication was entered by a primary care physician or
at a hospital. The time stamp will allow applications to chart
or sort information, such as by listing patients' medications
starting with the most recent. The addition of provenance to
the USCDI would provide much needed context for the data.
Patients' addresses and phone numbers. The
availability of addresses and phone numbers will better enable
systems to link patient records across systems, and is
described in more depth below.
Pediatric vital signs. The inclusion of pediatric
vital signs would enable more precise care for children by
allowing different applications to model the growth of a
patient according to biologic reference ranges, and prescribe
the proper dosing of drugs based on weight and age.
ONC has also requested comments on whether to expand the
``medication allergies'' list to also encompass reactions for other
substances, such as food. By expanding this capability, clinical
decision support tools could, for example, alert clinicians when
patients are allergic to substances from which medications are made,
such as eggs or pigs, and could improve patient safety.
Electronic Health Information Export Could be Enhanced
ONC's implementation of the API provision from Cures supports API-
based access to some--but not all--data contained in EHRs. In parallel,
the ONC proposed rule also includes provisions that would facilitate
the extraction of a broader group of data--referred to as electronic
health information (EHI)--from health information technology systems.
The EHI provision in the proposed rule would require EHR systems to
support the export of all their patient data, and potentially
information from other data bases connected to it. The EHI export
function must support the export of an individual patient's data as
well as information on all patients in the system to allow health care
providers to switch EHR systems if they so choose.
Unlike the API provisions in the proposed rule, ONC does not
propose to require that technologies make this information available
via any specific standards or format. Indeed, no such standard exists
to describe all possible data elements across all EHRs. Instead, ONC
indicates that the information should be extracted and remain
computable wherever possible. Eventually, ONC states, it expects that
health technologies would increasingly enable the extraction of EHI via
APIs.
As noted above, Cures required ONC to issue new criteria for EHRs
to make ``all data elements'' available via APIs. However, ONC has
proposed API requirements that would only expose a subset of data--the
USCDI--via APIs. To address the gap between what Congress required in
Cures and ONC's current proposal for APIs, Congress should encourage
ONC to expeditiously make all EHI available via APIs wherever possible.
\2\ However, unlike the USCDI data, much of EHI data may not have
widely adopted standards or be easily exchanged via FHIR. Therefore,
ONC should require EHR vendors to support an API-based export
capability for all data elements (i.e., information beyond the USCDI),
even without requiring any particular standard for EHI that is not part
of the USCDI. Eventually, as standards are more widely adopted for
different data elements that are made available via the EHI provision,
ONC should expand the USCDI to encompass more of this information.
---------------------------------------------------------------------------
\2\ Josh Mandel, ``Cures Envisions APIs for `All data'; ONC
Proposes `a Limited Set' '' (2019), https://github.com/jmandel/interop-
2019-nprms/blob/master/ehi-export.md.
---------------------------------------------------------------------------
Timeline for Health Care Provider Adoption
Historically, ONC releases regulations for a new edition of
certification criteria for EHRs and separately CMS issues rules for
health care providers to adopt technologies that meet those
requirements.
However, as currently written, ONC's regulations would require
technologies certified to the 2015 version of the criteria to upgrade
to meet provisions in the new regulations within approximately 2 years
of when they are finalized by the agency. By the end of that 2-year
period, health care providers that have not upgraded their systems to
include functions--such as for APIs and EHI--required by the new
regulations would no longer be using certified products and could fall
out of compliance with CMS requirements.
In effect, ONC has created a system that would require several
steps to occur in approximately 2 years: the development of new
functions by EHR vendors; the testing and certification of those
functions; implementation of changes at health care facilities;
customization and configuration of the technology by health care
providers; the testing of systems to ensure that they function properly
within a facility and do not introduce inadvertent patient safety
risks; and the training of staff.
Given all the steps that need to occur during that time period,
Congress should ensure that these systems, once implemented, are
sufficiently tested--including for safety--by health care providers.
Additionally, ONC should work with CMS to ensure that the timeline the
agency finalizes in the regulations is not subsequently delayed. This
assurance would provide certainty to both EHR developers and health
care providers on government's expectations on when these provisions
take effect.
CMS Regulations Advance API Use for Patient Access to Claims
In parallel to ONC's regulations, the CMS proposed rule also
advances the use of standard, FHIR-based APIs for patients to gain
access to their information held by health plans. This would allow
patients to--for example--download claims data on their phones, giving
them a holistic understanding of the services and treatments that they
have received from different health care providers. Equipping patients
with their claims data builds on previous efforts from CMS to leverage
this information, including by providing increased access to the data
by researchers working to identify ways to improve care quality and
reduce costs. \3\
---------------------------------------------------------------------------
\3\ Centers for Medicare & Medicaid Services, ``CMS Administrator
Verma Unveils New Strategy to Fuel Data-driven Patient Care,
Transparency,'' Apr. 26, 2018, https://www.cms.gov/newsroom/press-
releases/cms-administrator-verma-unveils-new-strategy-fuel-data-driven-
patient-care-transparency.
Claims are especially useful because, unlike other information
sources, they contain data for nearly every encounter an individual has
with the health care system. Claims are standardized for providers and
payers, resulting in easier aggregation of information across the
health care system. As CMS states in this proposed rule, ``[w]hereas
EHR data is frequently locked in closed, disparate health systems, care
and treatment information in the form of claims and encounter data is
---------------------------------------------------------------------------
comprehensively combined in a patient's claims and billing history.''
CMS' efforts to give patients access to their claims data and
provide researchers with this information, while laudable, omits one
critical element particularly important for the Medicare population.
Currently, claims only indicate that a procedure was performed--for
example, a total knee replacement--but not the brand and model of
implant used. In parallel, the unique device identifier system
developed by the Food and Drug Administration (FDA) provides each
medical device with a code corresponding to its brand and model. Adding
the device identifier to claims can fill the gap, and provide patients,
clinicians, and researchers with additional information on products
used to sustain life and support care. \4\
---------------------------------------------------------------------------
\4\ The Pew Charitable Trusts, ``Unique Device Identifiers Improve
Safety and Quality'' (2016), https://www.pewtrusts.org/en/research-and-
analysis/fact-sheets/2016/07/unique-device-identifiers-improve-safety-
and-quality.
Incorporating device identifiers in claims can also generate
significant savings. The Department of Health and Human Services Office
of the Inspector General (OIG) found that the failures of just seven
types of cardiac implants cost Medicare $1. 5 billion to treat affected
patients, and an additional $140 million directly to beneficiaries in
out-of-pocket costs. \5\ These findings led the OIG to support the
addition of device identifiers to claims. The White House's fiscal 2020
budget request for FDA also listed strong support for the addition of
device identifiers to claims. \6\ For CMS to effectively equip patients
with their data--including from claims--and provide researchers with
information to evaluate care, the agency should ensure that claims
contain critical information on the products used.
---------------------------------------------------------------------------
\5\ Department of Health and Human Services Office of Inspector
General, ``Shortcomings of Device Claims Data Complicate and
Potentially Increase Medicare Cost for Recalled and Prematurely Failed
Devices'' (2018), https://oig.hhs.gov/oas/reports/region1/11500504.pdf.
\6\ Food and Drug Administration, ``FDA Fiscal Year 2020
Justification of Estimates for Appropriations Committees'' (2019),
https://www.fda.gov/downloads/AboutFDA/ReportsManualsForms/Reports/
BudgetReports/UCM633738.pdf.
Given broad support across the health care industry and CMS'
recognition of the importance of access to claims data, Congress should
ensure that device identifiers are incorporated into claims.
Ineffective Patient Matching Also Inhibits Widespread Interoperability
To achieve interoperable exchange of medical data, health
organizations must also know that they are communicating about the same
person. Presently, up to half of the information exchanges made by
health care organizations may fail to accurately match records for the
same patient. Both ONC and CMS included requests for information (RFIs)
on patient matching in their proposed rules.
To accurately match records held at different health care
facilities, organizations typically compare patients' names, dates of
birth, and other demographic data to determine if records refer to the
same individual. Health care facilities use algorithms to conduct these
matches, and also employ staff to manually review records--which is
both costly and time consuming. This process, referred to as patient
matching, often fails to accurately link records because of typos
entered into the system; similarities in names, birth dates or
addresses among different patients; changing information, such as when
individuals move or get married; and many other reasons. \7\
---------------------------------------------------------------------------
\7\ The Pew Charitable Trusts, ``Enhanced Patient Matching Is
Critical to Achieving Full Promise of Digital Health Records'' (2018),
https://www.pewtrusts.org/en/research-and-analysis/reports/2018/10/02/
enhanced-patient-matching-critical-to-achieving-full-promise-of-
digital-health-records.
While some private sector technologies--such as referential
matching, wherein third-party data are used to support matches--show
promise, market forces have been unable to solve the patient matching
problem for decades. In fact, patient matching requires collaboration
between unaffiliated organizations, even competitors, that lack
incentive to agree to a set of standards or develop systems that
---------------------------------------------------------------------------
seamlessly exchange information.
Recognizing that effective patient matching is necessary to achieve
interoperability, a provision in Cures championed by several Members of
this Committee required the Government Accountability Office (GAO) to
evaluate steps that ONC and the private sector have taken to address
this challenge. \8\ The GAO report highlights a solution that many
organizations--including a contractor to ONC--have proposed: consistent
use of standards for demographic data. \9\
---------------------------------------------------------------------------
\8\ Government Accountability Office, ``Approaches and Challenges
to Electronically Matching Patients' Records across Providers'' (2019),
https://www.gao.gov/products/GAO-19-197.
\9\ Genevieve Morris et al., ``Patient Identification and Matching
Final Report'' (2014), https://www.healthit.gov/sites/default/files/
patient_identification_matching_final_report.pdf.
In parallel, Pew conducted 2 years of research--including
interviews with health care providers, focus groups with patients, and
contracted studies--to examine different ways to address matching
challenges. The Pew research--summarized in a report released in
October 2018--examined four main opportunities: the standardization of
data; the use of unique identifiers or biometrics (such as facial
recognition or fingerprint scans); a smartphone-based, patient-led
solution; and referential matching.
ONC Should Advance Standardization to Improve Match Rates
While no single solution will completely solve the patient matching
problem, our research identified concrete steps ONC can take to make
meaningful progress to address this challenge.
First, ONC should require the use of standards for certain
demographic data elements. In Pew-funded research published earlier
this month, researchers at Indiana University studied whether the
standardization of different data elements improves patient matching
rates. \10\ Indiana University researchers attempted to match records
in four data bases, standardized the data in those data bases, and then
retried matching the records to determine whether that standardization
yielded better results.
---------------------------------------------------------------------------
\10\ Shaun J Grannis et al., ``Evaluating the Effect of Data
Standardization and Validation on Patient Matching Accuracy,'' Journal
of the American Medical Informatics Association (2019), https://
doi.org/10.1093/jamia/ocy191.
The research revealed that the standardization of address to the
standard employed by the U.S. Postal Service (USPS), which details the
preferred abbreviations for street suffixes and states, for example,
would improve match rates by approximately 3 percent. One technology
developer indicated that this would help their system match an
additional tens of thousands of records per day. Separately,
standardizing last name--while showing limited utility on its own--
would further improve match rates if done in addition to address
---------------------------------------------------------------------------
standardization.
ONC already proposes in the new recent regulations to embed address
in the USCDI, but further improvements in match rates could be realized
if the agency simply updates this provision to require use of the USPS
standard when matching records. Software that automatically converts
addresses to the USPS standard after they are input into the system is
available in the commercial market; it is the reason many websites, for
example, automatically make format changes to your address at the time
you place an online order. Use of this standard would not necessarily
require workflow changes at the point of patient registration, and
would meaningfully help better link records using the general processes
that providers already employ.
Second, the use of additional data elements could also improve
match rates. For example, research published in 2017 showed that email
addresses are already being captured in more than half of patient
records. \11\ However, email address is not typically used for matching
despite its widespread availability. ONC could improve match rates by
identifying and including in the USCDI readily available data
elements--potentially email address, mother's maiden name, or insurance
policy identification number--that health information technologies
should use for matching.
---------------------------------------------------------------------------
\11\ Adam Culbertson et al., ``The Building Blocks of
Interoperability: A Multisite Analysis of Patient Demographic
Attributes Available for Matching,'' Applied Clinical Informatics 8,
no. 2 (2017): 322-336, https://doi.org/10.4338/ACI-2016-11-RA-0196.
Given the effect of low match rates on patient safety and health
care spending, as well as the failure of the market to address this
challenge, Congress should work with ONC to ensure that the agency is
requiring use of better standards for address and enabling the
utilization of additional data elements for matching.
ONC Should Leverage Key Cures Provisions to Improve Usability and
Safety
Along with barriers to the interoperable exchange of data among
health care providers and to patients, Congress also recognized in
Cures that subpar EHR usability hampers the ability of these systems to
meet their full potential in delivering more efficient and safer care.
Usability refers to the layout and design of systems, and how their
customization, configuration, and implementation affects their use by
clinicians. Usability-related safety problems can emerge due to
confusing interfaces, the need to develop workarounds to complete
tasks, an overabundance of unnecessary alerts, and many other issues
given the central role that EHRs increasingly have in helping
clinicians order procedures, review health information, and obtain
decision support.
Poor usability has two major consequences. First, ineffective
usability can contribute to clinician burden and burnout, which can
make them more susceptible to making errors. \12\ Second, poor
usability can contribute directly to patient harm through errors that
occur when clinicians interact with the EHR. Pew collaborated with
MedStar Health's National Center for Human Factors in Healthcare to
examine the contribution of EHR usability to medication safety events
in three health care organizations that treat pediatric patients. The
research, published in Health Affairs last year, revealed that EHR
usability contributed to 3,243 of 9,000 safety events examined. \13\ Of
those usability-related events, more than 80 percent involved an
inappropriate drug dose, and 609 of the usability-related events
reached patients. In one case, a transplant patient missed days-worth
of medication that would help prevent organ rejection. In another case,
the blood transfusion for a newborn in critical condition was delayed
due to the inability to create a record. These findings, including
other research conducted by MedStar Health, found a clear link between
the usability of EHRs and patient safety. \14\
---------------------------------------------------------------------------
\12\ Louise H. Hall et al., ``Healthcare Staff Well-being,
Burnout, and Patient Safety: A Systematic Review,'' PLOS One, July 8,
2016: https://doi.org/10.1371/journal.pone.0159015; and Maria Panagioti
et al., ``Association Between Physician Burnout and Patient Safety,
Professionalism, and Patient Satisfaction: A Systematic Review and
Meta-analysis,'' JAMA Internal Medicine 2018;178(10):1317-1331.
doi:10.1001/jamainternmed.2018.3713.
\13\ Raj M. Ratwani et al., ``Identifying Electronic Health Record
Usability and Safety Challenges in Pediatric Settings,'' Health Affairs
vol. 37, no. 11: Patient Safety (2018): https://doi.org/10.1377/
hlthaff.2018.0699.
\14\ Jessica L. Howe et al., ``Electronic Health Record Usability
Issues and Potential Contribution to Patient Harm,'' Journal of the
American Medical Association 319, no. 12 (2018): 1276-78, http://
dx.doi.org/10.1001/jama.2018.1171.
ONC has an opportunity to improve system usability and patient
safety under the existing authority provided to the agency by Congress
as part of Cures. Congress has required that ONC create voluntary
certification criteria for EHRs used in the care of children and
develop a new EHR reporting program that could be used to identify and
address usability issues. Patient safety could be greatly improved if
ONC makes it a priority during their implementation of these
provisions.
Pediatric EHR Certification Program Should Include Patient Safety
The health care needs of children and adults differ substantially;
for example, pediatric patients often receive medication dosage amounts
based on their weight. Given differences such as this, Congress
included provisions in Cures for ONC to develop and adopt new voluntary
criteria for EHRs used in the care of children.
In the proposed rule, ONC identified 10 clinical priorities for
pediatrics, including weight-based dosing, use of biometric norms for
growth charts, as well as age-and weight-specific dose range checking.
The 10 clinical priorities selected by ONC rightly recognize many of
the key clinical priorities for pediatric patients, including factors
that research has shown contribute to patient safety problems. However,
ONC should build on the provisions in its regulations to further
improve the usability and safety of EHRs. Specifically, ONC could take
concrete steps to tailor the certification program to pediatric care
and improve patient safety:
Involve pediatric end users. ONC currently requires
EHR developers to involve at least 10 end users of the system
in testing the system for certification. However, research
suggests that some health information technology developers do
not use appropriate end users to test their systems. \15\ ONC
should clarify that any EHR developer seeking certification for
pediatric functionalities should test the system using
pediatric-focused clinicians, such as pediatricians and
pediatric nurses. ONC could indicate, for example, that at
least five of the 10 end-users participating in testing have
pediatric expertise to obtain this certification.
---------------------------------------------------------------------------
\15\ Raj M. Ratwani et al., ``Electronic Health Record Vendor
Adherence to Usability Certification Requirements and Testing
Standards,'' Journal of the American Medical Association 314, no. 10
(2015): 1070-71, http://dx.doi.org/10.1001/jama.2015.8372.
Use pediatric-focused scenarios. EHR developers
currently use different testing scenarios--which mimic real
clinic events and workflows--to demonstrate the functionality
of their systems. To obtain certification for pediatric
functionality, ONC should clarify that some of the testing
scenarios must focus on situations involving children as
---------------------------------------------------------------------------
patients.
Utilize mock pediatric data. EHR developers use data
on mock patients to demonstrate that their technologies meet
ONC's certification program. ONC supplies some test data for
those assessments. For a pediatric-focused certification, ONC
should supply test data for mock pediatric patients and clarify
that the test data used must involve mock data of children.
As ONC revises its approach to the voluntary certification program
for EHRs used in the care of children, Congress should work with the
agency to prioritize patient safety and system usability by ensuring
that these common-sense approaches are incorporated.
Usability Criteria in EHR Reporting Program Should Include Safety
Through Cures, Congress also requires ONC to develop a reporting
program to examine several different functions of EHRs, including
system interoperability, security, usability and user-centered design.
Findings obtained via this EHR Reporting Program, as envisioned by
Congress, would be publicly available on ONC's website.
Late last year, ONC began implementing this provision. The agency
selected a contractor to administer the program, and issued an RFI to
obtain input on what data to collect on the use and functions of EHRs.
\16\ While the recent regulations do not implement this provision from
Cures, ONC is expected to issue associated rulemaking in the future.
---------------------------------------------------------------------------
\16\ Office of the National Coordinator for Health Information
Technology, ``Request for Information Regarding the 21st Century Cures
Act Electronic Health Record Reporting Program,'' Federal Register,
Aug. 17, 2018, https://www.regulations.gov/document?D=HHS-ONC-2018-
0022-0001.
In response to the RFI, organizations representing clinicians,
health technology professionals, and hospitals--among others--urged ONC
to incorporate safety in the usability aspects of the program, though
importantly not as a separate category. \17\ Pew provided
recommendations to ONC on how to collect some of this information, and
is collaborating with MedStar Health to identify additional
opportunities for embedding safety into the usability aspects of the
EHR Reporting Program.
---------------------------------------------------------------------------
\17\ Ben Moscovitch, ``Medical Groups Urge Federal Government to
Strengthen Health IT Usability, Safety,'' Dec. 11, 2018, https://
www.pewtrusts.org/en/research-and-analysis/articles/2018/12/11/medical-
groups-urge-Federal-government-to-strengthen-health-it-usability-
safety.
Congress has provided ONC a prime opportunity to improve the
usability--and consequently, safety--of EHRs. As ONC implements this
program, this Committee should work with ONC to ensure that the
usability aspects of the EHR Reporting Program focus on the facets of
usability that contribute to unintended patient harm.
Conclusion
The bipartisan passage of Cures launched a new era for improving
EHR interoperability and patient safety. As CMS and ONC continue their
implementation of Cures and other policies related to health
information technology, this Committee can play an important role in
the coming months by ensuring that these agencies carry out the goals
expressed by Congress. Specifically, this Committee can conduct
oversight in several key areas:
Support ONC's efforts to require secure, standard API
access to a wide range of health data, including clinical
notes;
Address the gap between Congress' requirements in the
21st Century Cures Act and ONC's current proposal to advance
the release of more data--including all EHI--via APIs;
Advance the addition of device identifiers to claims;
Encourage ONC to address patient matching through the
use of the USPS standard for address and the incorporation of
additional demographic data elements in the USCDI;
Press ONC to focus on addressing the risks to patient
safety as part of the voluntary criteria for EHRs used in the
care of children; and
Urge ONC to embed safety in the usability aspects of
the EHR Reporting Program.
By taking these steps in the coming months, Congress can provide
patients and clinicians with better access to health data, reduce
medical errors associated with the use of EHRs, and continue to ensure
that the potential of the 21st Century Cures Act is fully realized on
behalf of patients and clinicians across the country.
Thank you for holding this hearing today, and for your bipartisan
commitment to improving the interoperability, usability and safety of
electronic health records. I look forward to answering any questions
you may have.
______
[summary statement of ben moscovitch]
Electronic health records (EHRs) have revolutionized how clinicians
deliver care by equipping them with better tools to document patients'
health status, safely prescribe medications, and otherwise order health
care interventions. And, these tools have the potential to make it
easier for patients and clinicians to have more complete and robust
data to coordinate care across health settings.
Seeking to build on the improvements spurred on by the digitization
of paper records, Congress recognized that gaps remain in realizing the
full potential of EHRs to give patients their data, make care more
efficient, and enhance patient safety. The 21st Century Cures Act
(Cures) marked an important step toward addressing these gaps by
optimizing the use of these technologies and addressing barriers to
both the effective exchange of health data, known as interoperability,
and the usability of these systems.
My testimony will focus on three key aspects of the recently
proposed rules from the Office of the National Coordinator for Health
Information Technology (ONC) and the Centers for Medicare & Medicaid
Services (CMS) published earlier this month that address Congress'
vision to improve the interoperability of health data and effective use
of EHRs. Specifically, I will focus on:
provisions enabling easier extraction and use of
health data from EHRs via application programming interfaces
(APIs), which enable different technologies to communicate;
needed enhancements to better match patient records
across different health care providers; and
necessary improvements to the usability of EHR
systems to address design and implementation factors that can
both introduce burdens on clinicians and contribute to medical
errors.
As CMS and ONC continue their implementation of Cures, this
Committee has an opportunity to ensure that these agencies carry out
the goals expressed by Congress. Specifically, this Committee can
conduct oversight in several key areas:
support ONC's efforts to require secure, standard API
access to a wide range of health data;
advance the addition of device identifiers to claims;
encourage ONC to address patient matching through the
use of the better standards for address and exchange of
additional demographic data elements;
press ONC to focus on addressing the risks to patient
safety as part of the voluntary criteria for EHRs used in the
care of children; and
urge ONC to embed safety in the usability aspects of
the EHR Reporting Program establish by Cures.
By taking these steps in the coming months, Congress can provide
patients and clinicians with better access to health data, reduce
medical errors associated with the use of EHRs, and continue to ensure
that the potential of the 21st Century Cures Act is fully realized for
patients and clinicians across the country.
______
The Chairman. Thank you, Mr. Moscovitch.
Ms. Savage, welcome.
STATEMENT OF LUCIA C. SAVAGE, J.D., CHIEF PRIVACY AND
REGULATORY OFFICER, OMADA HEALTH, INC., SAN FRANCISCO, CA
Ms. Savage. Chairman Alexander, Ranking Member Murray, and
the entire Committee, thank you for the opportunity to speak
with you today.
From October 2014 through January 2017, I served as Chief
Privacy Officer at ONC. I was the senior advisor for efforts to
enable patients to get their health information through apps,
and I provided technical assistance as you were drafting 21st
Century Cures. After leaving ONC, I joined Omada Health, a
late-stage, privately held healthcare company that focuses on
chronic disease prevention and management, as well as
supporting people with anxiety and depression. We utilize a
secure digital communications platform to connect individuals
to professional health coaches--no robots here. In the process,
our participants share their health information just like they
would with any other provider. We analyze that information in
real time using proprietary data science and we feed actionable
insights back to the individual and his or her health coach in
real time on a secure app. The result is health care services
that scale quickly and leverage those individual insights at
the population health level.
One of my duties at Omada is to oversee its operations as a
health care service provider and covered entity under HIPAA. In
other words, we are just like a doctor's office under Federal
law. That means that for our business, all of the HIPAA
privacy, security, and breach notification rules apply. ONC
proposes some bold reforms that could significantly impact the
way facts are shared and that should foster innovation. Among
the most impactful things they propose is that information
blocking rules apply to business-to-business transactions. This
is a logical and necessary next step to achieving the vision of
an innovative healthcare system where health facts can flow
appropriately and securely to benefit patients.
Included in my supplemental remarks is an article published
yesterday by the American Bar Association Antitrust Law Journal
where professors Martin Gaynor, Julia Adler-Milstein, and I
examine the anti-competitive effects of B2B health information
exchange absent ONC's rule. There are, however, three areas
where ONC could push its vision more aggressively or the agency
may want to consider unintended consequences of its rulemaking.
First, the ONC rule does strike a good balance on privacy
and security. It has appropriate exceptions for privacy
promises made to individuals, for state or Federal laws, for
securing one's own system, for system maintenance, and for
safety. However, the rule proposes ongoing deference to
organizational policies that might be at odds with
democratically developed privacy laws that support
interoperability. I encourage ONC to consider a transition or
sunset period, during which institutions have time to adapt to
app-enabled health information exchange, and to eliminate
organizational policies that block appropriate flow of health
facts.
Second, 21st Century Cures applies the prohibition against
information blocking to developers of health information
technology. However, the ONC proposal applies that only to a
subset or certified health information technology, primarily
certified EHRs. This limitation leaves out many types of health
information technology where individuals' health facts are
collected. For example, the proposed rule does not reach to
health information technology in the emerging world of
connected devices or software as a medical device, and it seems
to omit any non-certified EHR, such as a lab or pharmacy
electronic record system that is not certified.
Third, ONC proposes to allow technology developers to
license interoperability elements. Licenses must not be so
expensive or so restricted as to interfere with or stifle
innovation, or create barriers to new entrance. As ONC
finalizes the concept of interoperability elements it is
critical that it clarify that the health facts within that
software are never to be licensed. Omada made this point in our
recent proposal response to the RFI from the Office for Civil
Rights, and I have included those comments in my supplemental
materials.
Finally, I applaud CMS's efforts to ensure that people have
the same app-enabled access to their health facts from health
plans as they do from providers. CMS expects that common
consumer tools like laptops, smartphones, and apps will be used
throughout the healthcare system. In the health care startup
world, we use these common consumer tools every day to connect
with and deliver valuable health care services to individuals.
We are excited to have the barriers to interoperability
fall, and we look forward to a time when the barriers fall for
us to be paid for efficacious health care services with these
common consumer tools.
Thanks again for the opportunity to testify and I look
forward to answering your questions.
[The prepared statement of Ms. Savage follows:]
PREPARED STATEMENT OF LUCIA C. SAVAGE
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
[summary statement of lucia savage]
Lucia C. Savage, JD, is Chief Privacy and Regulatory Officer at
Omada Health. From October 2014 to January 2017 she served as Chief
Privacy Officer at the Office of the National Coordinator for Health IT
(ONC). At ONC, Ms. Savage was the senior privacy advisor on an
individual's rights to get their own health data electronically and by
app. She also provided technical assistance in drafting the health
information technology provisions of Cures.
Her current employer, Omada Health, is a late-stage, privately-held
health care company focused on chronic disease prevention and
management, as well as supporting those dealing with anxiety and
depression. Omada utilizes a secure digital communications platform to
connect individuals to professional coaches. In the process, its
participants share their health information, just as they would with
any healthcare provider. Omada is a health care provider and a covered
entity under HIPAA, legally just like a doctor's office. The HIPAA
Privacy, Security and Breach Notification rules apply to Omada.
Ms Savage will testify that:
While the ONC rule strikes a good balance on privacy
and security, the rule proposes ongoing deference to
organizational policies that might be at odds with privacy laws
that support interoperability. Rather than deference, a
transition or sunset period might be appropriate for
organizational policies.
The prohibition against information blocking should
apply more widely to ``health information technology'' (a term
defined in 21st Century Cures), and not just to certified EHR
developers. A more expansive reach will more effectively and
quickly assure that individuals can get and use their health
facts wherever they are collected in the healthcare system.
ONC should clarify its proposal on licensing
``interoperability elements'' to ensure that an individual's
health facts are never subjected to such licenses, and that the
licenses themselves are not so strict or expensive as to
inhibit innovation.
Omada is fully committed to interoperable exchange of
health facts, and sees the full implementation of these rules
as an opportunity for growth, even if it means that Omada,
which is not currently a provider type proposed to be covered
by the rule, is in scope for the rule's reach.
CMS timely proposes to require health plans to make
individuals' health facts available from plans on the same
conditions as those facts are available from providers. This
proposal, if finalized will ensure consumers can continue to
use everyday consumer tools, like laptops, smartphones and apps
to get care and manage their health.
______
The Chairman. Thank you, Ms. Savage.
Dr. Rehm, welcome.
STATEMENT OF CHRISTOPHER REHM, M.D., CHIEF MEDICAL INFORMATICS
OFFICER, LIFEPOINT HEALTH, BRENTWOOD, TN
Dr. Rehm. Thank you very much. Chairman Alexander, Ranking
Member Murray, and Members of the Senate HELP Committee, thank
you for the opportunity to testify before you today.
As Chairman Alexander stated, I am the Chief Medical
Informatics Officer at LifePoint Health. And LifePoint Health
is a provider organization that provides care in over 89
communities in 30 states across the United States. Our clinical
technology environment consists of over 20 distinct inpatient
and ambulatory EHRs, and countless vendor partners providing
departmental and point solutions. It takes a tremendous amount
of effort for our team to build, configure, and tie together
these systems so that our medical teams are set up for success
to provide safe, efficient, high quality care to every patient
we see in the communities that we serve. Despite our best
efforts, our providers and patients are impacted by the lack of
interoperability daily.
The desire to make electronic health information freely
available spans the political spectrum and has been a long-
standing goal of both patients and medical teams. I am here
today as a healthcare provider, someone who has taken care of
patients, and supports others who take care of patients. I love
my work and my colleagues love their work, but this is hard.
The lack of interoperability associated with our medical
technology, some of it related to the technology itself, some
of it related to the regulations that apply to this technology,
make it harder to do our job. Electronic medical records,
medical devices, and patient monitors are supposed to help us
be better caregivers. Instead these technologies frequently add
to the complexity and burden that we feel.
Today, I will touch on some of the causes and offer
suggested solutions to lessen the provider burden and move
toward the interoperable future that we all desire. First,
providers do not build these technologies. We purchase them
from vendors. It is commonplace that vendors develop products
that do not interoperate. Many vendors release products that
meet minimum standards for ONC certified technology. Their
contracts do not cover the maintenance for updating them when
new regulations come about. It is up to the provider
organizations to cover the cost and the burden of implementing
these add-ons to cover new regulations.
In addition to being costly, upgrades take time. Where we
are often given 6 months to comply with CMS regulations, it can
take up to 12 months for a provider organization to review,
configure, test, train all of our end users, and deploy
numerous vendor technologies, ensuring that we do not break
hundreds of existing custom interfaces that are already in
place. We applaud the ONC proposal to require health IT vendors
demonstrating that their products are usable for patients and
providers in a real-world environment. We need our health care
technology and software systems to work in real life settings
in concert with other vendor technologies if we expect to meet
the needs of patients and providers now and in the future.
Second, where the HITECH Act catalyze the new from paper to
digital records via provider-based incentives and penalties,
unfortunately it did not address or create the underlined
infrastructure of interoperability to enable data liquidity
across technologies. Provider organizations have been left to
bridge the gap with interface engines, workarounds, and manual
processes with varying degrees of success and reliability. This
lack of infrastructure is troublesome for a number of reasons,
from privacy and security challenges to the ability of
providers to seamlessly send and receive data. For example, the
CMS proposed rule would require hospitals to send electronic
notifications when a patient is admitted, discharged, or
transferred as part of the conditions of participation.
In order to comply with the condition of participation,
providers must clearly understand the requirement and the
objective compliance measure. This proposal lacks both of those
elements, which is concerning given the tremendous penalties
hospitals face for failing to comply with conditions of
participation. Instead, I encourage the administration to focus
on its current activities to improve interoperability, such as
continuing to advance the goals of the Trusted Exchange
Framework and Common Agreement, known as TEFCA, and vendor
accountability for the products that they develop. Another
victim of this lack of infrastructure is patient-provider trust
that data will be secure and used appropriately. The proposals
both envision that unvetted third-party applications will be
accessing patient electronic health data via open APIs.
Personally, I like the idea of controlling my own data, but
the truth is the vast majority of us, me included, do not read
the entire terms of use agreement on every app or website that
we enroll in. We believe our data is more private and secure
than it actually is. The entrance of non-health care actors
into the healthcare market, particularly those that fall
outside of HIPAA requirements, necessitates strong principles
of trust and security. One approach that supports innovation
and provides the needed safeguards to govern personal
electronic health data is an industry backed process to
independently vet these applications to ensure they meet all
relevant security standards, use data appropriately and in line
with consumer expectations, and for those applications that
offer medical advice, is the advice clinically sound?
In closing, Government policies must allow digital health
information to be exchanged in a way that protects and
prioritizes the health interests of individuals and the health
systems and clinicians who care for them. In this technological
age, it is important we all remember that deployment of health
information technology, interoperability, data exchange, and
security are all in service of delivering the highest quality
care. It is not about the technology. It is about the patients,
their care, and their outcomes.
Thank you for the opportunity to speak today. I have
additional information on these topics in my written testimony
I hope you will also consider.
[The prepared statement of Dr. Rehm follows:]
prepared statement of christopher rehm
Chairman Alexander, Ranking Member Murray, and Members of the
Senate HELP Committee, thank you for the opportunity to testify before
you today. It is an honor to be invited to participate in today's
discussion.
My name is Christopher Rehm. I am a physician and the Chief Medical
Informatics Officer at LifePoint Health. LifePoint Health is a provider
organization that delivers Acute, Emergency, Post-Acute and Outpatient
care for over 85 communities in 30 states. Our clinical technology
environment consists of 10 different Inpatient electronic health
records (EHRs), greater than 10 Ambulatory EHRs, and countless vendor
partners providing departmental, ancillary and point solutions. My team
and I work with our hospitals and providers to build, configure and tie
together these systems so that our providers are set up for success to
provide safe, efficient, high quality care to each and every patient we
see in the communities we serve.
The desire to make electronic health information freely available
spans the political spectrum and has been a long-standing goal of
patients and those who care for them. These proposed rules represent an
important step in our journey to achieve the ultimate aims of a truly
person-centric health care delivery system. I applaud this Committee
and Federal health agencies for recognizing the need to improve
existing regulations to keep pace with evolving technologies and
innovations. I support the ability of patients to have access to their
health information and understand that the future health of our
population and the sustainability of our industry depends upon the
timely, efficient movement of data.
There are several ways that we can choose to navigate toward this
future state. The new Centers for Medicare & Medicaid Services (CMS)
and Office of the National Coordinator for Health Information
Technology (ONC) rules represent the interpretation of the great work
that this Committee did on the 21st Century Cures Act. And we support
the general direction of the rules. Having said that, if we do not take
time to consider how these new rules may affect certain stakeholders in
the health care ecosystem, especially providers and patients, the
decisions that we make today may have unintended consequences for years
to come.
Cost and Regulatory Burden of Health IT on Providers
I am here today as a health care provider--someone who has taken
care of patients and oversees others who take care of patients. I love
my work because there is no other place or profession where people are
so consistently caring and devoted to alleviating human suffering
caused by disease. But many of the forces facing hospitals, doctors,
nurses and patients make it really hard to do the job well.
Some of the most stifling forces are those imposed by our
technology and the regulatory policies that govern them. Electronic
medical records, devices, diagnostics, monitors--these are all things
that are supposed to augment our practice, to help us be better
caregivers. Instead, our technology only adds to the complexity and
burden that we feel. Part of the problem is that there is no
underpinning that supports a system-of-systems for technology in the
health care industry. No one has established the rules of the road for
data exchange, like industries such as banking, aviation, cable,
telecom and others did decades ago. Vendors develop products and
services that do not interoperate. In order to support some level of
communication across systems, the market has created even more products
and services--like integration and interface engines--that help to glue
together these proprietary technologies. But it is up to the providers
to bear the burden and cost of implementing and integrating all of
these separate pieces, and it doesn't stop once we have bought them.
Many vendors release products that meet minimum viability standards
for ONC certified technology, but their service contracts do not
include the cost of maintaining and updating them to remain compliant
with new regulations. Coming into compliance with new or updated
regulations generally involves upgrading the EHR or device to modify
how information is documented, collected and reported. \1\ The average-
sized community hospital (161 beds) spends nearly $760,000 annually on
information technology investments needed to support compliance with
Federal regulations. \2\ These IT changes and associated costs are
crushing our industry where margins are already thin.
---------------------------------------------------------------------------
\1\ Assessing the Regulatory Burden on Health Systems, Hospitals
and Post-acute Care Providers. American Hospital Association. February
2018.
\2\ Assessing the Regulatory Burden on Health Systems, Hospitals
and Post-acute Care Providers. American Hospital Association. February
2018.
Additionally, these upgrades take time. Six months is simply not
enough time for a provider organization to review, build, configure,
test, train and deploy numerous vendor technologies following new
releases to be ready to meet the regulatory deadlines for reporting
under the CMS programs. IT product design, testing and implementation
requires lead time, particularly when it involves a vendor. Time frames
for implementation and updates need to be adjusted to reflect what is
reasonable and acceptable, for instance, 12 months after a Generally
---------------------------------------------------------------------------
Available release date from a vendor.
We applaud the ONC proposal to require health IT vendors to
demonstrate that their products are usable to patients and providers in
a real-world environment. Any solution can work in a vacuum. We need
our health care technology and software systems to work in real life
settings and in concert with many other vendor technologies if we
expect them to meet the needs of patients and providers now and in the
future.
While the HITECH Act catalyzed the move from paper to digital
records via incentives and penalties on health care providers, it did
not, unfortunately, address or create an underlying infrastructure of
interoperability to enable data liquidity among technologies. Think
about this for moment: it is the equivalent of telling people they must
buy cars and move those cars from place to place, but there are no
roads and no agreed upon design for the roads, let alone the funding to
actually pay for the construction. In the case of EHRs, it is the
provider organizations who have been left to bridge the gap with
everything from integration and interface engines, to workarounds that
lead to significant ``clicks'' for clinicians, to even a combination of
electronic and manual processes.
Health care providers are trying hard to persist in their
dedication, but the increasing pressure of having to do more with less
weighs heavily on these well-meaning people. Atul Gawande's November
2018 article was aptly titled ``Why Doctors Hate Their Computers,'' \3\
and a joint Fortune and Kaiser Health News article just last week
highlighted and astounding average of 4,000 clicks per shift for an
emergency room doctor. \4\ Clinicians need our support, encouragement,
and appreciation for the value they bring to patients and to society.
---------------------------------------------------------------------------
\3\ Atul Gawande, Why Doctors Hate Their Computers, The New Yorker
(Nov. 12, 2018), https://www.newyorker.com/magazine/2018/11/12/why-
doctors-hate-their-computers.
\4\ Erika Fry and Fred Schulte, Death by a Thousand Clicks: Where
Electronic Health Records Went Wrong, Fortune and Kaiser Health News
(Mar. 18, 2019), http://fortune.com/longform/medical-records/.
As a health care provider, I support the ability of patients to
have access to their health information and the sharing of information
across disparate technologies, systems, and providers. The CMS proposed
rule would require, as part of the Medicare Conditions of Participation
(CoPs), hospitals to send electronic notifications when a patient is
admitted, discharged, or transferred. Hospitals would be required to
send these notifications to other facilities, providers, or community
care providers with an established patient relationship who the
hospital has reasonable certainty will receive the notifications. While
I support this idea directionally--and look forward to achieving this
level of information sharing--this is unfortunately putting the cart
before the horse. It sounds like it would be simple to implement, but
there are numerous unanswered questions and operational considerations.
For example, not all EHRs can generate these messages--and this
functionality is not required of vendors under the ONC certification
rules. And if a provider is not connected to a health information
exchange or similar network, of which the most advanced ones are quite
costly, it is an enormous undertaking--in both time and money--to
---------------------------------------------------------------------------
connect to these other providers and facilities individually.
In order to comply with a CoP, providers must clearly understand
what it is they must do and how they will be surveyed and judged to
determine compliance. This proposal lacks both of those elements, which
is concerning given the tremendous penalties hospitals face for failing
to comply with CoPs, including termination from the Medicare program.
Instead, I encourage the administration to focus on its current
activities to improve interoperability, such as continuing to advance
the goals of the Trusted Exchange Framework and Common Agreement
(TEFCA), as well as its proposals in this rule to further ensure
vendors are accountable for the products they develop. The
responsibility for interoperability cannot and should not be borne
solely by providers, and there are plenty of things that vendors,
business associates, plans and other organizations can and should be
expected to do and contribute.
Patient Privacy and Security
It is clear that Congress and this administration are committed to
solving the issue of interoperability and achieving complete patient
access in the U.S. health care system. So far, the administration is
relying on third party apps and the private market to solve these
problems. The rules state that they wish to ``enable patients to access
their health information electronically . . . to make the data
available through an application programming interface [API] to which
third party software applications connect to make the data available to
patients.'' \5\
---------------------------------------------------------------------------
\5\ 84 Fed. Reg. 7610, 7612 (Mar. 4, 2019).
Providing unvetted third party applications fairly open access to
patient digital health data concerns me as both a clinician and a
consumer. I am well-aware of the argument that it is the patient's
prerogative to specify where and to whom their data goes. Personally, I
like the idea of controlling my own data. But reality does not always
align with our ideas, particularly when it comes to our personal
information--whether health-related, financial, or even demographic.
The truth is that the vast majority of us, myself included, do not read
the entire ``terms of use'' agreement on every app or website that has
some of our personal information, and we often mistakenly believe our
---------------------------------------------------------------------------
data is more private or more secure than it actually is.
While it may be tempting to allow access to personal digital health
information for any and all entities who claim to operate under the
banner of ``promoting care coordination,'' we would be wise to take a
lesson from the consumer data privacy events of the past few years.
Millions of individuals were surprised and angry to learn how Facebook
was using and selling their data, while other consumers weren't even
aware that all their financial information is funneled through three to
four major credit bureaus, two of which experienced major breaches in
the last few years.
Digital data is the currency of the modern technology ecosystem and
marketplace. There are fortunes to be made in mining and monetizing
your personal digital health data. New rules and processes that govern
and protect digital health data must be sensitive to the reality that
not all covered entities, business associates, and third parties are
created equal. Particularly with regard to entities that fall outside
of the HIPAA requirements, it is imperative that patients, their
families, providers, and consumers can trust that these applications--
and the data both sent to and received from them--are secure, private,
and clinically sound.
The vision for the future is one in which a patient's data flows
between her/his care providers, the patient and her/his providers, and
between the patient's personal electronic device and the provider.
That vision presupposes that data is vetted, clinically sound and
comes from a trusted source. The reality is that neither clinicians nor
patients have the ability to validate that it is trusted data.
A Trust-Based Approach
I believe there are ways to support the innovation coming from the
external marketplace while providing the needed safeguards to govern
personal digital health data. The entrance of non-health care actors
into the health care market--particularly those that fall outside of
the HIPAA requirements--necessitates strong principles for trust and
security. One such idea is an industry-backed trust platform technology
architecture, supported by an appropriate governance model.
This is a wide-ranging solution that would encompass all health-
related digital information on a single platform architecture. In the
meantime, I also encourage a smaller scale solution to address privacy,
security, and clinical efficacy of third-party applications,
specifically an industry-backed process to independently vet these
applications to ensure they are meeting all relevant security
standards; are using data appropriately and in line with consumer
expectations; and, for those applications that offer medical advice,
are clinically sound. Such a process will go a long way toward ensuring
trust while removing the burden of this process from consumers and
providers.
What Federal Policy Can Do
Policymakers must strike a balance between their desire to make
personal digital health information available and the burdens that
these requirements place on health systems under proposed timelines.
Government policies must allow digital health information to be
exchanged in a way that protects and prioritizes the interests of
individuals--and the health systems and clinicians who care for them--
while allowing the marketplace to innovate and interact in a
responsible and controlled way.
In this technological age, it is important we all remember that the
deployment of health information technology, interoperability, data
exchange, privacy and security are all in service of patients receiving
and providers delivering the safest, highest quality care. It is not
about the technology; it is about patients, their care, and their
outcomes.
______
[summary statement of christopher rehm]
Chairman Alexander, Ranking Member Murray, and Members of the
Senate HELP Committee, thank you for the opportunity to testify before
you today.
My name is Christopher Rehm. I am a physician and the Chief Medical
Informatics Officer at LifePoint Health. LifePoint Health is a provider
organization that delivers Acute, Emergency, Post-Acute and Outpatient
care for over 85 communities in 30 states. Our clinical technology
environment consists of 10 different Inpatient EHR's, greater than 10
Ambulatory EHR's, and countless vendor partners providing departmental,
ancillary and point solutions. My team and I work with our hospitals
and providers to build, configure and tie together these systems so
that our providers are set up for success to provide safe, efficient,
high quality care to each and every patient we see in the communities
we serve.
The desire to make electronic health information freely available
spans the political spectrum and has been a long-standing goal of both
patients and medical teams. I am here today as a health care provider--
someone who has taken care of patients and supports others who take
care of patients. I love my work--and my colleagues love their work.
But sometimes health IT and the regulatory policies that govern them
are stifling and make it harder to do our job. Electronic medical
records, medical devices, and patient monitors are supposed to help us
be better caregivers. Instead, these technologies frequently add to the
complexity and burden that we feel. I will touch on some of these
causes today as well as offer suggested solutions to help alleviate a
portion of this burden to support providers as we move toward the
interoperable future we all desire.
First, providers do not build these technologies; we purchase them
from vendors. I have frequently found, however, that vendors develop
products and services that do not interoperate. Many vendors release
products that meet minimum standards for ONC certified technology, and
their contracts do not include the cost of maintaining and updating
them to remain compliant with new regulations. It is up to the
providers to bear the burden and cost of implementing and integrating
these separate pieces.
In addition to being costly, upgrades take time. While we are often
given 6 months to comply with CMS regulations, it can take up to 12
months for a provider organization to review, configure, test, train
and deploy numerous vendor technologies, ensuring we did not break
hundreds of custom interfaces, following new releases.
We applaud the ONC proposal to require health IT vendors to
demonstrate that their products are usable for patients and providers
in a real-world environment. We need our healthcare technology and
software systems to work in real life settings and in concert with many
other vendor technologies if we expect to meet the needs of patients
and providers now and in the future.
Second, while the HITECH Act catalyzed the move from paper to
digital records via provider-based incentives and penalties, it did
not, unfortunately, address or create an underlying infrastructure of
interoperability to enable data liquidity across technologies. Provider
organizations have been left to bridge the gap with interface engines,
work arounds and manual processes--with varying degrees of success.
This lack of infrastructure is troublesome for a number of
reasons--from privacy and security challenges to the ability of
providers across the country to send and receive data. For example, the
CMS proposed rule would require hospitals to send electronic
notifications when a patient is admitted, discharged, or transferred as
part of the Conditions of Participation (CoPs).
In order to comply with a CoP, providers must clearly understand
the requirement and the objective compliance measure. This proposal
lacks both of those elements, which is concerning given the tremendous
penalties hospitals face for failing to comply with CoPs, including
termination from the Medicare program. Instead, I encourage the
administration to focus on its current activities to improve
interoperability, such as continuing to advance the goals of the
Trusted Exchange Framework and Common Agreement (TEFCA) and vendor
accountability for the products they develop.
Another victim of this lack of infrastructure is patient and
provider trust that data will be secure and used appropriately. The
proposals envision unvetted third party application access to patient
digital health data via open API's. Personally, I like the idea of
controlling my own data. But the truth is that the vast majority of us,
me included, do not read the entire ``terms of use'' agreement on every
app or website, and we believe our data is more private or more secure
than it actually is.
I believe there are ways to both support the innovation coming from
the external marketplace while providing the needed safeguards to
govern personal digital health data. The entrance of non-healthcare
actors into the healthcare market--particularly those that fall outside
of the HIPAA requirements--necessitates strong principles for trust and
security. One idea is an industry-backed process to independently vet
these applications to ensure they meet all relevant security standards;
use data appropriately and in line with consumer expectations; and, for
those applications that offer medical advice, are clinically sound.
Government policies must allow digital health information to be
exchanged in a way that protects and prioritizes the health interests
of individuals--and the health systems and clinicians who care for
them--while allowing the marketplace to innovate and interact in a
responsible and controlled way.
In this technological age, it is important we all remember that
deployment of health information technology, interoperability, data
exchange, privacy and security are all in service of delivering the
highest quality care. It is not about the technology; it is about the
patients, their care and their outcomes.
Thank you for the opportunity to speak to the Committee today. I
have additional information on these topics in my written testimony
that I hope you will also consider.
______
The Chairman. Thank you, Dr. Rehm.
Ms. Grealy, welcome.
STATEMENT OF MARY GREALY, J.D., PRESIDENT, HEALTHCARE
LEADERSHIP COUNCIL, WASHINGTON, DC
Ms. Grealy. Excuse my laryngitis, please. Chairman
Alexander, Ranking Member Murray, and Members of the Senate
HELP Committee, thank you for inviting the Healthcare
Leadership Council to testify before you today.
HLC is a coalition of Chief Executives from all disciplines
within American healthcare. It provides a forum for the
Nation's health care leaders to work together toward their
vision of a 21st century healthcare system that makes
affordable, high-quality care accessible to all Americans.
Members of HLC, hospitals, academic health centers, health
plans, pharmaceutical companies, medical device manufacturers,
laboratories, biotech firms, health product distributors, post-
acute care providers, and information technology companies,
advocate for measures to increase the quality and efficiency of
health care through a patient-centered approach.
The members of HLC are saying that the time is here, the
time is now, to achieve full nationwide interoperability of
health information and to have secure, seamless access to data
for clinicians, patients, and health care consumers. Today, I
am pleased to present to you a significant project undertaken
by HLC with the Bipartisan Policy Center, two organizations
that between us represent many of the major companies that
purchase healthcare, pay for healthcare, provide healthcare,
and deliver access to the data that drives quality health care.
Despite all the progress we have seen in health care moving
into the digital age with more providers utilizing electronic
health records and more consumers able to get health
information on our smartphones, everyone in this room knows
that we still have a long way to go. Today, we do not interact
with just one family physician. We as patients interact with
primary care doctors, specialists, hospitals, clinical labs,
pharmacies, insurers, and more, yet these entities often do not
talk to each other electronically. And if we are to reach our
goal of a healthcare system that provides high-quality,
patient-centered care, interoperability is not simply
desirable, it is absolutely necessary.
HLC and the Bipartisan Policy Center set out to determine
what needs to be done to achieve nationwide health data
interoperability. We engaged the University of California at
San Francisco to interview dozens of experts from multiple
health care sectors and the Government. What we learned in
these interviews led to the recommendations and our call to
action that we provided as an attachment in our written
testimony. There are a couple of exciting aspects to this
project and the proposals that emerged from it that I would
like to highlight for the Committee. It is significant that
leaders from the private sector across the entire health care
continuum have come together and agreed upon mechanisms to
accelerate nationwide interoperability. And this is not just a
matter of telling Government what it should be doing, but
rather these private-sector entities are placing the
responsibility among themselves and upon themselves, pledging
action and embracing accountability.
Thus, you see us calling for collaboration between
healthcare payers and providers to use payment incentives to
drive adoption of baseline interoperability expectations. And a
call for providers to work with electronic health record
companies and software developers in incorporating these same
expectations into their business contracts. We are calling for
common standards to be utilized to improve patient matching,
and we are calling for the rapid adoption and implementation of
open standards-based APIs. These just touch the surface of the
recommendations you will see in the report.
We are pleased that the leaders in the public sector
stepped forward with the proposed Federal rules we are
discussing today on data access and interoperability, and we
see a great deal of alignment in these rules with what we are
offering in our report. We applaud the efforts of ONC and CMS
to eliminate information blocking and ensure the consumers have
easy access and ability to share their health information as
they wish. These rules represent an important and perhaps
ground breaking first step for true nationwide
interoperability.
I would note that both proposed rules include changes to
how patient health information is used and shared. These rules
incorporate new innovative products such as third-party
applications that are not currently covered by the HIPAA
Privacy Law. We need to ensure a thoughtful approach in how
entities currently subject to HIPAA share information with
these new entities to ensure the safeguarding of sensitive and
valuable personal health information.
Any future legislation or rulemaking that addresses the
electronic flow of identifiable health information should
engender the same trust as the HIPAA privacy standards have
done for the past 20 years. Given the significant impact of
these rules, including the strong enforcement, penalties, we
are requesting that ONC and CMS grant a 30-day extension of the
comment period for the proposed rules.
Thank you for the opportunity to speak to the Committee
today, and I look forward to discussing the comments of HLC
members and our commitment toward advancing nationwide
interoperability.
[The prepared statement of Ms. Grealy follows:]
prepared statement of mary grealy
Chairman Alexander, Ranking Member Murray, and Members of the
Senate Health, Education, Labor, and Pensions (HELP) Committee, thank
you for the opportunity to testify today.
My name is Mary Grealy, and I am President of the Healthcare
Leadership Council (HLC). HLC is a coalition of chief executives
representing all disciplines within American healthcare. It is the
exclusive forum for the Nation's healthcare leaders to jointly develop
policies, plans, and programs to achieve their vision of a 21st century
healthcare system that makes affordable high-quality care accessible to
all Americans. Members of HLC--hospitals, academic health centers,
health plans, pharmaceutical companies, medical device manufacturers,
laboratories, biotech firms, health product distributors, post-acute
care providers, home care providers, and information technology
companies--advocate for measures to increase the quality and efficiency
of healthcare through a patient-centered approach. All of these health
sectors, and the patients they serve, are affected by and committed to
comprehensive access to health data.
The members of HLC are saying that the time is here, the time is
now to achieve full nationwide interoperability of health information
and to have secure, seamless access to data for clinicians, patients
and healthcare consumers.
Today, I'm pleased to present to you the results of a significant
project undertaken by HLC with the Bipartisan Policy Center (BPC), two
organizations that, between us, represent many of the major companies
that purchase healthcare, pay for healthcare, provide healthcare, and
deliver access to the data that drives quality healthcare.
For all the progress we've seen in healthcare moving into the
digital age--with more providers utilizing electronic health records
and more consumers able to get health information on our smartphones--
everyone in this room knows we still have a long way to go. Today, we
don't just interact with one family doctor. We as patients interact
with primary care doctors, specialists, hospitals, clinical labs,
pharmacies, insurers, and more. Yet, these entities often don't talk to
each other electronically. And if we're to reach our goal of a
healthcare system that provides high-value, high-quality, safe, cost-
effective, patient-centered care, interoperability is not simply
desirable--it's necessary.
HLC and BPC set out to determine what needs to be done to achieve
nationwide health data interoperability. We engaged the University of
California at San Francisco to interview dozens of experts from
multiple healthcare sectors and the government. These interviews gave
us an idea of the barriers that stand between the present and our
essential future, and how to overcome them, leading to the
recommendations we've provided as an attachment to this testimony.
Our goals today and moving forward are clear and unwavering--we
intend to bring information seamlessly to the point of care to support
care delivery, and we will meet the information needs of patients and
consumers to support their health and healthcare. There are a couple of
exciting aspects to this project and the proposals that emerged from it
that I want to highlight for the Committee.
It's quite significant that leaders from the private sector--across
the entire healthcare continuum--have come together not only to say
that we must accelerate the movement toward nationwide
interoperability, but they have agreed upon mechanisms by which to do
it. And this isn't just a matter of telling government what it should
be doing, but rather, these private sector entities are placing the
responsibility upon themselves--pledging action and embracing
accountability.
Thus, you see us calling for collaboration between healthcare
payers and providers to use payment incentives to drive adoption of
baseline interoperability expectations, and a call for providers to
work with electronic health record (EHR) companies and software
developers in incorporating those same expectations into their business
contracts.
We're calling for common standards to be utilized to improve
patient matching, to make certain the right patient is getting the
right treatment at the right time, all the time. And we're calling for
providers, EHR companies, software developers, payers and other sectors
to pursue rapid adoption and implementation of open standards-based
APIs. These just touch the surface of the recommendations you will see
in the attached report.
But the other aspect of this project that is so encouraging is that
we are in alignment with the Federal Government and its goals in this
area.
We are pleased that leaders in the public sector stepped forward
with proposed Federal rules on data access and interoperability and we
see a great deal of agreement in these rules with what we are offering
in our report.
We applaud the efforts of the Office of the National Coordinator
for Health Information (ONC) and the Centers for Medicare and Medicaid
Services (CMS) to eliminate information blocking and ensure that
consumers have easy access and the ability to share their health
information as they wish. These rules represent an important, and
perhaps groundbreaking, step toward true nationwide interoperability.
It should be noted that both proposed rules include changes to how
patient health information is used and shared. These rules incorporate
new, innovative products, such as third-party applications, that are
entering the healthcare market at a rapid pace but are not covered by
the Health Insurance Portability and Accountability Act (HIPAA) privacy
and security rules. We need to ensure a thoughtful approach in how
those entities currently covered by HIPAA share information with new
entities to ensure the safeguarding of sensitive--and valuable--
personal health information. Any future legislation or rulemaking that
addresses the electronic flow of identifiable health information should
engender the same trust as the HIPAA privacy standards have done for
the past 20 years.
Given the significant impact of these proposed rules, including
strong enforcement and penalties, we are requesting that ONC and CMS
grant, at a minimum, a 30-day extension of the deadline for submitting
comments on the proposed rules. An extension would provide more
adequate time to conduct a thoughtful analysis of the proposed rules
and their impact, and to fully address the multiple requests for
comments and information embedded within them.
Thank you for the opportunity to speak to the Committee today. I
look forward to discussing the commitment of HLC members toward
advancing nationwide interoperability. These commitments are explicitly
included in the HLC BPC Report on Advancing Interoperability,
Information Sharing, and Data Access, which is included as part of my
written testimony.
______
The Chairman. Thank you, Ms. Grealy, and thanks to each of
you. We will now have a round of 5 minute questions.
We will begin with Dr. Cassidy.
Senator Cassidy. Thank you, Mr. Chairman. I thank you all
for being here. Raised several interesting things. Ms. Grealy,
I just learned that in my state, the patient does not own her
data. Does HLC have a position on whether or not the patient
should own her data?
Ms. Grealy. We think it is important that patients do own
their data and that they have access to that data. And that
really, the providers and those working with that patient
health information, really are the stewards of that
information.
Senator Cassidy. Simple answer, yes. Thank you for that.
Ms. Savage, you raised a point, I think you did, of the ability
for the health plan--again, do I own the data that the health
plan has? Or should I own that data?
Ms. Savage. As you mentioned, it is really a matter of
state law. So technically within a health plan, you may not own
the data, but you certainly have a right to get a copy. That is
the state of the law.
Senator Cassidy. Let me ask, define the data. If the health
plan is purchasing data from data brokers, not just about the
doctor who saw me for a busted arm, but rather the data from
the grocery store as to whether or not I am buying high
cholesterol food, should I have the right to that data?
Ms. Savage. You have a right to get any data that the
health plan is using to make a medical decision about you.
Senator Cassidy. Now, define medical decision.
Ms. Savage. Well, it is a little bit ambiguous and so I----
Senator Cassidy. Oh, that is what I thought.
Ms. Savage. That is right. But I want to definitely
distinguish is you do not have a right to get data that is
used, for example, to calculate a measure because that is not--
--
Senator Cassidy. To calculate a measure----
Ms. Savage. Like a measure. Like a plan, HEDIS measure for
how many people referred to a mammogram or something like that.
Senator Cassidy. Got it.
Ms. Savage. That is not about you. But if they are using
that data to decide that you should or should not have a
particular treatment or should or should not have a premium
increase that is definitely within the data you should be able
to get access to.
Senator Cassidy. Now, you say should, implying that you
personally think that we should, but legally do I--legally do I
have access to that data?
Ms. Savage. Absolutely, you legally have access to that.
The problem is that in caring that out, obviously there is a
lot of gaps in how people do that. That issue of individuals
getting their own data, I think is a top five complaint at OCR.
Senator Cassidy. Do we have a need therefore for
standardization of how the patient would access her data and
what exactly comprises that data so that there is not this
variability in response?
Ms. Savage. I think there are some great paths of
standardization beginning to take hold. The idea of using an
app and a standard API is one, although not all data will be
available behind that API in the immediate future. A second is
the Association of Health Information Management, AHIMA, is
working on a standardized form and they are urging people to
adopt it voluntarily so that it can be turned into an online
form so people can use it, but it is not enough.
Senator Cassidy. I think that my colleagues and I would be,
and I certainly am interested, if you all have ideas as to how
I could know if the health app that I am using does--feeding up
to the insurance plan, that I actually have that data as well
as that which they purchase from data brokers, which I am told
is quite extensive.
Ms. Savage. Right. So that is a couple of different issues,
but in my longer testimony I refer to an article that I did
with ten or so tips people could just adopt right now that
would make it easier for patients and nothing prevents a health
insurer from adopting those. I want to separate that for a
moment from the broker purchased data because we do not know
exactly which health plans are doing that, and second or third
from the app you choose to use. All different things.
Senator Cassidy. I get that. So that is my question for
you, Dr. Rehm. So, I recently read of somebody partnering with
somebody so that smart watches were on the wrist of the
insured. And I thought to myself, now they know how many steps
I am taking today and whether or not my gate becomes shuffling
and so maybe I have the first onset of Parkinson's disease,
right. And should that be protected, the fact that I am
basically telling them that I may be at risk for a neurologic
disease--by the way I do not have a neurologic disease for the
record, that I know of.
[Laughter.]
Dr. Rehm. I would characterize that, as soon as that
personal health data gets transmitted into the healthcare
system that information should be protected so----
Senator Cassidy. But I do not believe it necessarily
currently is, correct?
Dr. Rehm. Well, if that, let us say you have an EMR that
allows you to add personal health devices to that EMR so that
the patient that is wearing that watch or scale, for that
instance, feeds my EMR, then that information is entered into
the EMR and it is protected, at least in my practice.
Senator Cassidy. Now you are speaking of the theoretical,
but I am pressing on you, do we know that is the case?
Dr. Rehm. Only if it answers the EMR. So, I would say we do
not know that is the case.
Senator Cassidy. If it goes to the health plan, and not to
the doc, but if it goes to the health plan, is that part of the
data that Ms. Savage referred to as being a covered entity--a
HIPAA protected set of data or not?
Dr. Rehm. I do not know.
Senator Cassidy. I do not know either. Ms. Savage?
Ms. Savage. Yes, the health plan is a covered entity under
HIPAA just like a physician's office.
Senator Cassidy. But is the app, the information that they
are receiving from the app considered part of that covered
data?
Ms. Savage. When it flows into the covered entity's
custody, it becomes covered by HIPAA. The second thing to
remember is, OCR has been very clear, when the app is sponsored
by or paid for by the covered entity, the collection by the app
is in fact covered by HIPAA. The one place we do not, that OCR
does not reach, is to an app that is not paid for or sponsored
by a covered entity itself.
Senator Cassidy. Got it. So, if I just voluntarily give. I
am going over. Thank you, Mr. Chairman.
The Chairman. Thank you, Senator Cassidy.
Senator Murray.
Senator Murray. Thank you very much. And Ms. Savage, you
talked about the importance balance between protecting patient
privacy and making sure patients have access to their data. I
think that is what the Senator was going after. Let me ask a
little differently. Do patients who share their health care
information with third-party apps have their information
protected under the patient privacy laws of HIPAA?
Ms. Savage. It is going to go back to who is sponsoring
that app. So, in the Omada context, our app is sponsored by us.
We are a healthcare provider under HIPAA. All the HIPAA rules
apply within the app, however, we do not stop people from
taking whatever they want about the health information, just
like Senator Cassidy did, and blurting it out in whatever
context they want. And so, unless the context in which that
blurt is received is also covered by HIPAA, it would not be
covered.
That might be a third party app that is not covered, that
is covered only by the Federal Trade Commission or State
Attorneys General, as opposed to being within kind of the
confines of a HIPAA-covered entity and its sponsorship.
Senator Murray. Well, what should patients know? What
should we all know about how our data can be shared if we use
an app that is not covered by HIPAA privacy protections? Can
their data be sold or just goes to drug companies or
advertisers?
Ms. Savage. Yes. It is a very confusing place for consumers
when in 2016 we sent a report up to Congress on this very
thing. It is footnoted in ONC's rule, and consumers just--it is
too much information for them to understand and it is very
confusing for them. I think that they have the ability to rely
pretty well on what their doctors do and how the healthcare
system works, and those rules are very familiar, but people
definitely feel that--think those rules apply when they do not.
Senator Murray. Can your data be sold?
Ms. Savage. Outside of HIPAA, yes. Within HIPAA, it cannot
be sold in an identifiable way. There is a very specific rule
on that.
Senator Murray. Like to drug companies? It could be sold to
drug companies?
Ms. Savage. Well, if you were, if it was a third party app,
without naming names, and any kind of social media app, of
course.
Senator Murray. Okay. Well, so there is a lot of potential
for digital records, but it also comes with risks. I think that
is pretty clear.
Ms. Savage. Correct.
Senator Murray. Tell us what policy recommendations would
you make to better protect patient privacy.
Ms. Savage. It is a very complicated area that I know many
Senators and many of your colleagues and also House Members are
working on, and what I think is to look at the totality of the
fact that the digital life is no longer sliced up into economic
sectors and we really need policies to converge.
Whether that is things that look like HIPAA migrating
outwards or some uniform policy that everyone can, as a
consumer, easily understand, that would be my policy
recommendation. And that is not an easy thing to do given our
Federalized system but that is where I think the direction
needs to go, is how to converge it so that it is the same and
the expectations are the same for consumers wherever they go.
Senator Murray. Consumers understand it better because it
is uniform?
Ms. Savage. Yes.
Senator Murray. Okay. Mr. Moscovitch, open APIs are really
an essential programming feature that allow programs to share
information with each other, and the requirement that
electronic health records make them available was a very high
priority for this Committee. As you said in your testimony,
APIs are the foundation of the modern internet. So, to ensure
that the APIs are truly open, the Office of the National
Coordinator for Health Information Technology proposes
electronic health records developers publish business and
technical documentation associated with their APIs. Talk to us
about why that requirement is so important.
Mr. Moscovitch. The documentation is much like an
instruction manual for how third-party developers can request
information and how it is formatted so they can use it. In
other industries, that documentation is publicly available to
spur innovation. If a technology has an API, for developers to
use it they need that instruction manual or that documentation
or else they do not know how to request the documentations,
whether it is behind a paywall or some other proprietary manner
or made public on a website and it still needs to be developed.
Senator Murray. Is that going to impose a burden on
electronic health-record developers in your opinion?
Mr. Moscovitch. One thing ONC did in the regulations is
leverage existing work that is already done through different
standards bodies, and which many EHR developers are already
implementing. That is through the work, the standards and FHIR
work that ONC is doing. So, the industry is already moving in
this direction and are already developing documentation based
off of FHIR standards.
Senator Murray. Okay. And quickly, Ms. Savage and I can go
back to you. We want to make sure the Department of Health and
Human Services takes the time to implement Cures right away,
but if health organizations are hoarding data in order to gain
a competitive advantage for themselves, there are real
consequences if the Department takes too long to implement
these policies. So, what do you think the risks are of delaying
the prohibition on information blocking?
Ms. Savage. Well, I cannot do an economic estimation. You
have to go to my co-author, Martin Gaynor, on that, but I think
that we know that there is lots of savings that have been
documented for the little teeny bits of interoperability we
have right now and avoided redundant costs. And that will only
grow. And then there is the whole consumer frustration piece.
In every part of their lives they are quickly and efficiently
using the supercomputers in their pocket except in this.
I cannot even estimate the increase in productivity if we
all don't have to spend hours and hours and hours chasing down
our records and moving them around in the system for ourselves.
Senator Murray. Okay. Thank you. Thank you very much, Mr.
Chairman.
The Chairman. Thank you, Senator Murray. And Ms. Savage,
your last comment was important to me. This all--listing this
testimony sounds very complex, difficult, obtuse, all those
things, but we are really talking about a very common everyday
experience for most Americans. I mean, as we think about our
health care records, we think on the one hand, well, I can make
an airline reservation just like that. Two, I can order
something over Amazon just like that, and if I want to take my
health care records from Vanderbilt to the Mayo Clinic, the
best thing for me to do is to go down to the bottom floor of
the hospital with a wheelbarrow and put them all in there, and
then pack them in a suitcase, and then fly to Minneapolis, and
then drive to Rochester, and hand them to the doctor. So that
is--even though each of those two institutions do not use those
because they are leading the country really in terms of
interoperability within their systems.
We are well-meaning here. But I can still remember going to
Vanderbilt to find out about electronic health care records and
they said, Meaningful Use 1 was helpful, Meaningful Use 2 was
Okay, Meaningful Use 3 was terrifying because as we project our
good intentions out to the real world of hundreds of thousands
of doctors, and thousands of hospitals, and millions of
patients, sometimes it does not work like we hope it would. So
that is how we got to standards that we are talking about today
and how we got to these rules about information blockage.
My question is about the standards. I had this great fear,
as we were doing the 21st Century Cures bill, that if we
required standards that somebody would write them in Washington
and that they would be the wrong standards and they would not
imply properly to everybody. We would just create more of an
administrative burden and big mess than existed.
If I am remembering it right, what we just said was you
have to have standards. We are not going to write them for you.
And now the rules are saying but you are going to have to use
these standards written in the private sector so everybody can
work together and talk with each other.
My question is, Dr. Rehm, let me ask you, are these the
right standards? Are we correct to insist that there be the
same standard for everybody, and are we going too fast in
asking doctors and hospitals to implement these rules?
Dr. Rehm. I will start with the first one. I think we are
headed in the right direction with being very prescriptive in
the standard, because when the standard is broad and you leave
it up to the industry to implement, they will take advantage of
the breath of what is allowed in the standard, which then
leaves the provider organization trying to do all the manual
work in between because it is not interoperable.
I do think being as prescriptive and precise in the
standard and requiring people to develop to that standard will
accelerate interoperability. And the second part of your
question as it relates to going too fast, I think you just have
to keep in mind that the provider side is always months behind
when the technology is developed to cover us----
The Chairman. What I am meaning by that is on Meaningful
Use 3, it was my strong feeling that if we could kind of slow
the train down a year or two, that we would get where everybody
wanted to go more effectively than if we insisted on pushing
it. Well there were two different views on that and maybe it
was the train was going too fast to slow down, but I want to
make sure that these new rules are implemented at a pace that
gets us where we want to go but does not do it so rapidly that
it makes it more difficult to get where we want to go.
Dr. Rehm. Right now there is 24 months for the technology
organizations to come alongside the final rule and implement
whatever is in the final rule. I think that you got to add time
to the end of that for the provider organizations to be able to
react to whatever it is they release, because we will have to
understand and work with whatever technology is released at the
end of those 24 months, and the provider side will need time.
The Chairman. Ms. Grealy, I have a little less than a
minute. What about the standard, should we require standards?
Are these the right standards, and is the time that the
administration is allocating for implementing the standards
appropriate?
Ms. Grealy. I think there is a need for standards. I think
your concern, and it is a concern that we share, is making sure
that we are still allowing for innovation within those
standards. We do not want to stifle the innovation and
improvement, electronic records and the exchange of
information. I think we will hear from everyone that they
probably will want a bit more time. We are at the outset asking
for a longer time to analyze and comment on these rules----
The Chairman. Well, before you stop, does the proposal
allow for innovation? I mean I have always imagined that these
problems would be solved not by anyone here writing them, but
by somebody showing up with a, Delta Airlines reservation
system and then everybody is, oh, that is the way to do it, and
they use it. Or maybe it was American, I do not remember who it
was but that is the way it happened.
Ms. Grealy. But I think standards like open APIs--I think
there is just broad, deep agreement that is the way we should
go, and the FHIR standard. So, there is a need for standards. I
do not think we view these as stifling innovation at this
point. We never want to be micromanaged, again, because that
would stifle the innovation, but I think you are hearing--
everyone is committed to interoperability and we do need some
rules of the road that we can all understand and implement.
The Chairman. Thank you.
Senator Baldwin.
Senator Baldwin. Thank you, Mr. Chairman. Thank you to our
witnesses. I hail from Wisconsin and we have a long history of
playing a major role in technological transformation. My
colleagues, many have heard about successful health IT
innovations from Gundersen Health System and La Crosse from
Marshfield Clinic, and of course Epic Systems in Verona,
Wisconsin, which exchanges nearly 4 million records a day.
However, our system has not yet achieved the ultimate goal
of being fully interoperable, which is why I was proud to play
a role on this Committee in crafting the 21st Century Cures
Act. The proposed rules released by the administration to
advance implementation of the 21st Century Cures Act are
critical steps to achieving interoperability and improving
patient access to health data. Several provisions would allow
patients to become more engaged with their own care by
requiring electronic health-record systems to make patient data
available to be exported and available through third-party
apps, as we have been discussing.
We need to do more to empower patients, however I am
concerned that the proposal may expose new vulnerabilities for
patient confidentiality. Dr. Rehm, these proposals to expand
patient data sharing through third-party applications
potentially lead to breaches in patient privacy and security,
and how can we best balance patient access while preserving the
confidentiality of the physician-patient relationship in our
fast, developing digital era?
Dr. Rehm. Right. So, as I put in the written testimony and
in the oral testimony, I do think that there is risk with
third-party applications that do not necessarily--HIPAA does
not apply to them all, potentially, in this scenario of what
the open API--a third party app can be developed, can be
directed toward consumers and there is nobody vetting or
currently there is no organization that would be vetting just
the technology infrastructure security of that application.
At LifePoint, we have a technology review board that looks
at applications that some of our member hospitals want to bring
into the fold, and it is frequent that when we do a deep dive
into that technology, we find a cybersecurity risk and so we do
not bring that technology into our technology stack.
We need to do something to protect the patients because if
they are drawn to a consumer-driven app, they use it, they use
the open API to pull their health information into that
application, who is it that is making sure that company is
putting the proper safeguards to keep that data secure? So, I
think it is a risk.
Senator Baldwin. Thank you. Mr. Moscovitch, you noted that
the proposal requires electronic health record systems to
ensure that all of their patient data and electronic health
information can be exported to patients, which could include
other information from vendors' data bases.
I have certainly heard concerns from my constituents about
the lack of clarity and standards in the rule concerning what
constitutes this electronic health information. In fact, there
is currently no standard for this broader group of data. Can
you elaborate on this gap in existing standards and how
requiring extraction of large, potentially undefined data sets
may create obstacles for a vendor compliance or other risks to
patient privacy.
Mr. Moscovitch. Sure. The goal of that electronic health
information provision is so that if patients want their data
that, including it is outside of the core data elements that
ONC wants exchange for APIs, that patients can get it. And that
is correct for many of these data elements, that standards do
not exist. And so, as ONC finalizes its regulations, it should
absolutely clarify which data element, or which information
more broadly, needs to be available to patients, and where
possible, to do that in an easy way for patients.
Senator Baldwin. Great. Thanks. I yield back.
The Chairman. Thank you, Senator Baldwin.
Senator Braun.
Senator Braun. Thank you, Mr. Chairman. For me it is
surprising that we have to be talking about interoperability
and information blocking, and I think it is part and parcel of
what is wrong with the healthcare industry in general. I know
in my own business, which is a logistics and distribution
business, we due to competitive pressures and transparency,
embraced the latest, the leading edge. And here, that we are
having to nudge the healthcare industry itself to get with it
on these topics, it is to me, it is what is wrong with the
healthcare industry in general, which is a lack of
transparency.
The industry knowing all this stuff, has been out there for
a long time, and when it comes to, drug pricing, when it comes
to embracing transparency to engender competition that drives
most other industries, I think that is why we are talking about
it. And every time I get the opportunity, I want to challenge
the industry to get with it. To do what almost all other
industries have done, and when you have got a leading edge of
anything, you grab it, because if you do not, you are left in
the dust by your competition. The cloaking and shrouding of the
healthcare industry, mostly due to the industry itself
embracing that rather than transparency and technology, leads
us to this discussion.
I, again, challenge the industry to get with it or else you
are going to have one business partner, the Federal Government.
Let us go back to interoperability and information blocking.
Which of the two, and any of the panelists can weigh in on it,
is more important leading us to this point to where we are
dysfunctional when it comes to information sharing, and where
should we spend the resources, if we can in some way through
Government, help speed the process? I would like to know the
relative importance of these two issues. So, you can start.
Mr. Moscovitch. The Congress had a lot of foresight in the
21st Century Cures Act in leveraging APIs, which as you
mentioned, many other industries are already taking advantage
of these kinds of technological tools. And ONC has implemented
that provision also with a lot of foresight in leveraging these
standards that are already adopted throughout the industry and
being refined through various collaborative groups like the
Argonaut Project, which brings technology organizations
together to identify a refined way to implement the standard.
Senator Braun. You sense that if we were not here today
talking about it, the industry would be pushing forward on its
own? And you can either answer that or not. I would love your
opinion.
Mr. Moscovitch. Congress certainly have accelerated the
adoption of APIs in a meaningful way.
Senator Braun. Thank you.
Ms. Savage. I would like to say that is true. I think the
nudges both from high-tech and from Cures have been crucial.
And all you have to do is go on the right Twitter feed and you
will see the hashtag #axethefax because everyone is still using
faxes in healthcare. So, we need to move beyond that just like
the rest of industry has.
Dr. Rehm. I would just double down on that. I think the
focus on forcing the industry, when I say industry the
technology side for the interoperability piece because data
blocking--some of it is just you cannot accomplish it or
sometimes it is so costly or outside your normal workflow that
you do not accomplish it, but if the technology was more plug-
and-play from an interoperability perspective, you would see
data flow more freely because the providers, they want access
to information to care for the patient. Right place, right
time, right now. And so, the providers are pushing from their
side, but the struggle is in the middle where time, money, and
effort to overcome the interoperability challenges.
Ms. Grealy. I would just underscore how welcomed these
proposed rules are. It is not often that you see, I think, such
great alignment between what the Government is offering here
and what the private sector has been asking for and wants to
work with them. But I think an area that you touched on is one
that we really need to do more work on, and that is how do we
create better consumer, or more consumer demand for this?
We need to engage patients and consumers as to what should
be available to them, how it is going to improve their health,
and the efficiency of the healthcare system. So, I think we
would welcome a public-private partnership type of campaign to
really educate people on how best to use this information, and
that they should have access to it. Just like when you change
cell phone carriers, you do not have to get a new cell phone
number anymore, you get to transfer that number. We should have
that same ease of operation with electronic health information.
Senator Braun. For consumers to be part of the process,
which is what we did in my own company, to make it consumer-
driven, you have got to have transparency. And all I am saying,
in the entire industry, across the board, start working on this
stuff, doing it on your own where you do not need to be nudged
by hearings like this because I think you will regret the
outcome down the road if you do not start embracing what all
the rest of us do, transparency and competition. Thank you, Mr.
Chairman.
The Chairman. Thank you, Senator Braun.
Senator Rosen.
Senator Rosen. Thank you. I would like to thank you, Mr.
Chairman. Thank you for your testimony today. You know, I am a
former applications programmer so a lot of this interface stuff
is near and dear to my heart, but recent study by the Kaiser
Family Foundation show that 88 percent of patients say their
medical provider does use electronic medical records. That is
up almost 50 percent from 10 years ago, but the biggest concern
everybody has is privacy, of course. And so being a former
applications programmer, systems analyst, this is something
that I focus on a lot.
What I want to ask you, Ms. Savage, is this, who in your
view is ultimately responsible for the integrity of an
individual's medical record? Is it the doctor, provider,
electronic health vendor, the hospital? I mean, who? All of
them? I mean, where does accountability ultimately lie?
Ms. Savage. In our system, we have pieces of our record in
the hands of various entities. When they are covered entities
under HIPAA, each entity is responsible for what is in its
custody. At Omada, we have we are responsible for what we have
custody for. If we are sharing that data at a patient's request
with their physician's office, the transom is a great visual.
It crosses the transom, the physician takes responsibility for
it. And that is how the current rules work.
Similarly, outside of that sort of the system the
individual is responsible, just like an individual is
responsible for what they do about their own banking, or how
they describe their children on social media, or any of those
things.
Senator Rosen. Now, if we consider medical devices, perhaps
plug and play, I do not want to make the pun about your
pacemaker perhaps, but we know that medical device does upload
to your medical health record. And so, depending on what you
have, now we have this open platform with many kinds of medical
devices, many kinds of things feeding in, that can give us a
gateway, a doorway, into the system for cyberattacks, for
hacking, things that may ultimately change or modify your
record. So, how are we preventing that doorway in? What are we
doing about that? Anyone can take that question.
Ms. Savage. I will take a first stab at it. So, FDA is very
hard at work, certainly in helping device manufactures
understand how they can upgrade the security of their equipment
without having to do additional filings or changing the safety
and functionality of that equipment. But the FDA actually does
not enforce security standards, except on those devices, and
the legal authority sits with OCR, who is enforcing it at the
doctor's office or hospital office level.
Back to what Senator Murray was asking about, as we think
about convergence and digital life, I think the policy question
for all the Senators is, how do we bring these things together
and kind of thread stuff together that previously was happily
living in distinct silos. That is not the case anymore. We do
not want silos for individual data, and we do not want silos
for security authority----
Senator Rosen. What if something is wrong and you realize
that. How does a patient--how does ``us'' as a consumer get a
correction through all of this?
Ms. Savage. For their data?
Senator Rosen. Yes.
Ms. Savage. We all have the right to ask a physician's
office or a hospital, any record holder, to correct data, and
then hopefully the right physician will say, oh, yes that
correction needs to be made. I just corrected my own data
recently with my physician. But it is a little bit of a kludgy
process, and it could be automated. For example, if you could
ask for a correction through logging into your secure portal,
then your identity would be proven and it would all be
electronic, and the physician could just make the change. I do
not know if Dr. Rehm wants to add anything to that.
Dr. Rehm. I was just going to add and kind of restate
something I said earlier, which is with the open API, we are
potentially opening up the electronic health data to a segment
of technology that currently is not covered by HIPAA, which has
been very prescriptive as to how we have to handle health
information as a provider organization, or any organization
covered by HIPAA. So, I think that is the thing to just--what
are we going to do legislatively to make sure that when we put
in the door for people to pull in their information out of the
electronic health record into some other application, how is
that application governed?
Senator Rosen. Then, I have a quick question for you at the
end. The huge responsibility put on the end care provider on a
small family practice and on the individual at the end of the
system. What is the burden for you to hire more people to take
care of all this data and information?
Dr. Rehm. The provider burden today, because it is not
interoperable, is huge. Because we at LifePoint, we are
fortunate enough with our size and scale so that we can throw
an army of people at the bridging the gaps between----
Senator Rosen. But if you are a small practice?
Dr. Rehm. But if you are a small practice, you do not have
those folks. And so that puts you at risk for one. Are you data
blocking because you do not have the resources to do the custom
interfaces to allow this ADT message to flow from here to here.
I mean, you might be caught in the middle of, yes, that is data
blocking, and that is because you do not have the expertise or
the resources. So, I think we have run out--there is a great
risk in the current technology environment for practices that
do not have the resources because the systems are not
interoperable today. It takes effort and expertise, and not
everybody has that.
Senator Rosen. Thank you.
The Chairman. Thank you, Senator Rosen. Well, thanks to
all. I have--Senator Rosen brought up devices. These rules are
not about devices, I guess. They are about data, but there is
an outfit in Nashville called a Center for Interoperability
that is a combination of hospitals, nonprofit and profit, all
around, who realized they have a lot of buying power and they
are trying to create a common platform so that anyone from whom
they buy things has to plug into a common platform. They use an
analogy of why we do not worry much about cable television,
that way back in the early days they got a common platform, so
all the different cable companies use a common platform. What
does what you are talking about today about devices, I mean
about data and interoperability, have to do with devices and
the data that comes from devices?
Ms. Savage. I will take a stab at that. So, in my longer
comments we gave an example of a person who has a surgery, and
they get a brace, and the brace has a radio chip and a
gyroscope, and it attaches to their app, and that feeds to the
brace manufacturer's servers. And it may or may not feed to a
physician's practice. It depends on what the patient chooses.
When it is not going to the EHR, all of that activity is
both not within HIPAA, and we have talked about that quite
extensively, but it is also health information technology with
important information gate and success of the surgery, that is
not subject to this rule. And so that is really something to
think about back to this idea of convergence.
Mr. Moscovitch. The CMS rules also focus on getting
patients their claims' data. And claims today for the millions
of patients with implants lack key information. That is the
device identifier of the implant they have in their body. So,
when they are getting their claim's data, they will not know
which brand of device or which model of the device they have in
case something goes wrong. And CMS can close that gap by adding
device identifiers to claims.
Dr. Rehm. We have talked a lot about interoperability and
usability, and I think those two are inextricably linked. And
the usability is made better if medical devices--when you think
about what is in the EHR, it is a store of data. And a lot of
it is manually entered today by whether nurses, medical
assistants, or physicians.
Devices are just one example where they are not covered but
the interoperability between the device and the EHR is just as
key as the interoperability from one EHR to another because
that burden of getting the data from whether it's from a blood
pressure cuff, a ventilator machine, whatever it might be,
getting that into the system is today either manually entered
or a custom interface to pull that in.
The Chairman. Ms. Grealy, anything to add?
I think Senator Romney is on his way back, but as he comes,
let me ask each of you. If you were in my shoes or Senator
Braun's shoes, what would be the one thing that you would like
for us to do or you think we can most constructively do to
encourage interoperability of data as we consider these two
rules over the next year or so? What is the one thing you would
like for us to keep our eye on or push?
Mr. Moscovitch?
Mr. Moscovitch. Sure. One thing we have not talked a lot
about today is patient matching. So, the ability to know that
the patient at one health system is the same person at another
health system. And match rates can fail today around half the
time. Our research has found that better standards for
demographic data can meaningfully improve match rates. So that
is a next step that ONC can be taking as it finalizes its
rules.
The Chairman. Ms. Savage?
Ms. Savage. Well, I think the Committee is rightfully
concerned about privacy and security, and you as Committee
Members have a lot of expertise about how this works in the
healthcare system. And I think the best thing you can do is
work with your colleagues on what is working in healthcare that
would need to be migrated elsewhere because none of this will
matter if the consumers do not have confidence, and their
doctors do not have confidence that the consumers have
confidence.
The Chairman. Dr. Rehm?
Dr. Rehm. I mean she did not say and I think the standards
FHIR, Argonaut, the USCDI, and the real-world testing. So as
folks adopt those standards, the validation through the real-
world testing that is working across vendors.
The Chairman. Ms. Grealy?
Ms. Grealy. I would endorse all of the comments you have
just heard. And then the other thing I would really ask that
you sort of maintain oversight on the implementation of this
and the time really necessary to do it the right way. And I
think you have pointed out that perhaps there may be more time
required. We do not want to halt this. We do not want to
prevent moving ahead or progress, but I think we also have to
be very cognizant of the challenges that providers and others
are facing in trying to this complex work.
The Chairman. You have asked for 30 more days?
Ms. Grealy. At least for the comment period.
The Chairman. For the comment period for the rules.
Ms. Grealy. Yes.
The Chairman. We will let Senator Romney provide the
benediction.
[Laughter.]
Senator Romney. I think I will ask questions instead, Mr.
Chairman.
[Laughter.]
Senator Romney. Thank you. I appreciate the work that is
being done to provide standardization and I happen to believe
that this is a scenario we have lagged in and there is a real
cost financially but more importantly in terms of the quality
of care delivered to patients by virtue of not having been able
to have this information. I am pleased, as I consider the
providers of health care in my state, to recognize that they
have interoperability within their own systems. At LifePoint,
of course, within your system. Intermountain Healthcare within
their system. And from what I can tell from the outside, the
interoperability within the specific systems is having a very
significant impact, particularly on the cost and quality
overall in the enterprise.
I guess I have two questions that I am happy to direct this
to anyone who wants to pick up on it. One is, does this
information inform also the choice that the doctors choose to
guide the type of treatment they might provide or the
prescription they might provide? So, are they using the
information to actually change their practice in providing care
to the patient? That is No. 1. And then No. 2, is the data
being used yet, the electronic medical record data, being used
to allow the patient to inform their life choices?
If a record indicates that someone looks like they are at
risk for developing diabetes, for instance. Is this flagged by
someone? Is someone seeing that? Is it then flagged to the
individual? Are they given then instructions on what type of
foods they should be eating and what types of things they
should be avoiding? So, to what extent are we using medical,
the advent of electronic records, not just to improve the cost
of the healthcare system, whether it is at LifePoint or the
Intermountain, or Mayo, or any of the others, but also to
actually make decisions by physicians, and No. 2, allow
patients to make--individuals to make decisions for their own
health and well-being?
Ms. Savage. With the diabetes prevention product, I will
take the first step. Intermountain is actually one of our
oldest customers. We started offering DPP to Intermountain
employees and now it has been expanded out to their patients in
certain populations. In fact, we used their EHR data to decide
who to refer to Omada, and then we in turn engaged the person
that is in an asynchronous platform. You can open your
smartphone and see your weight record and your food intake at
any point in time. There is a picture in our supplemental
materials, and so I would say, in fact when you can figure out
the business relationships and the data relationships, that
magic alchemy occurs. And what we want to have happen is have
it occur more widely throughout the whole healthcare system.
Mr. Moscovitch. What Cures did and what these rules do is
make sure that first and foremost patients can get their data
and providers can get the data from other places. And better
APIs to make sure the data are exchanged, and better patient
matching can meet that end.
Senator Romney. Thank you.
Dr. Rehm. From the provider perspective, when the
information is visible and present in many of our systems, even
if it is interoperable, that information that is brought in
from the outside, is outside of their workflow. So, when the
patient is in front of you and you are trying to make clinical
decisions, you have everything that is native to your EMR, and
the outside information is frequently in a separate workflow
that you have to go find and get.
Sometimes, in some of our EMRs, that information is closer
to your workflow, so it is leveraged. The more difficult it is
to leverage that outside information, the less likely our
providers are to see it at the right time to make a care
decision at that moment. So, the usability and interoperability
again are, I think, go hand-in-hand.
Senator Romney. Can we make progress on that front? Are
we----
Dr. Rehm. Yes. Sorry, I did not mean to cut you off there.
Yes, so I believe some of the--what we are talking about today
and what the rules are proposing bring us closer to narrowing
the playing field so that interoperability is more useful
because it becomes more usable by the clinicians who are in
front of the computer and the patient at the same time.
Senator Romney. Yes. Thank you.
Ms. Grealy. Well, I just want to highlight with a personal
story. When you see this work and work well, it is amazing. Two
years ago, my husband had a very unusual stroke which affected
his vision. So, there was an ER visit, an overnight hospital
stay, and then the next 2 days he had to see an
ophthalmologist, cardiologist, neurologist, and then back to
the primary care physician. All of the recommendations for most
different physicians came back to the primary care physician.
The most notable one being the cardiologist saying, I know
this will sound unusual to you and your husband because his
cholesterol level is extremely low, but the latest research
shows that for this type of stroke, him going on a statin would
be a good thing. I am not going to prescribe it now. I am
making the recommendation but discuss it with your primary care
physician. So, we go back to the primary care physician. He has
been treating my husband for many years. He looks at it, goes,
well this does not make sense, but that cardiologist had
included the latest research. He took the time to look through
that and said, she is correct.
Next day I did have an opportunity to attend an AMA
function and talk to other cardiologists, and ophthalmologists,
and primary care physicians. And again, it was cutting edge
research. To me that is the real value of having an
interoperable electronic health record where the physicians
have the information and you as the patient are able to engage
in that discussion in how to manage your health. So, this is
what we need to have nationwide, not just within these closed
healthcare systems.
Senator Romney. Thank you. Mr. Chairman, in keeping with
your introduction, amen.
[Laughter.]
The Chairman. I agree with Senator Romney. That helped take
what can sometimes sound complex and confusing and gave it the
kind of meaning that we hope to give it. Thanks to each of you.
You have been very helpful today. As I said earlier, this is
a--we all believe the 21st Century Cures Act was, as the
Majority Leader said, the most important bill we passed in that
Congress, and we are determined that it be implemented
correctly. It sounds like these two rules are important steps
toward interoperability.
If you have other comments that you would like to make to
the Committee after you leave and think, oh, I wish I had said
this or I wish I had said that, the record will remain open for
10 days so you may do that. Members may submit additional
information too.
The Chairman. The HELP Committee will meet again on
Tuesday, April 2d for a hearing on higher education.
Thank you for being here. The Committee will stand
adjourned.
ADDITIONAL MATERIAL
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
[Whereupon, at 11:29 a.m., the hearing was adjourned.]