If only they could provide the recipe, rather than simply ranting about what it should smell and look like. I am in no way saying that this recipe is an easy thing to produce. In Stepping stones for Privacy Consent, I am actually saying that we need to get going trying a bunch of recipes to see if any of them will work. There are Health Information Exchanges out there that are trying. I just don't think that there is much in the way of lessons to learn yet. This might take a while to determine what really works vs what sounds good in theory.
I like that the Tiger team is starting with the HHS white paper on Consumer Consent Options. This paper is really well written, and does face some reality around priorities. The first instrument should be a blunt one: Opt-In, and Opt-Out. For special cases simply don't publish THAT! . Not a very elegant tool, but for those willing to take the risk, they get the reward of the benefits that a HIE offers. For those not willing, they get to stay out. Then encourage creativity.
Accountability using Audit Controls is critical to success. We must know what happens with the information regardless of the consent rules.
I encourage anyone to let me know if they know of a HIE that has any form of consent, including simple OPT-IN or simple OPT-OUT. I would be very glad to share best practices.
I run SAFEHealth.org which is a federated edge proxy server HIE that uses Opt-In consent in central Massachusetts. Patients can pick and choose which connected organizations they authorize sharing. The authorization is for all data types for TPO, both sending and receiving. The patient-authorized organizations continue to synchronize the data that they expose until the patient revokes an organization's consent, or has had no contact with an organization for a year. A consent form prints out next to the registrar automatically when the patient checks in only if no consent has been signed in the past and they have been to other connected organizations. It works quite well because it has minimal burden on patients, registration clerks, and physicians. What needs to be layered on top of this is one-off data pushes for those patients that do not opt-in.
ReplyDeleteLarry Garber, MD
Medical Director for Informatics
Fallon Clinic/SAFEHealth