Concern Raised Over Patient Records Shared in Idaho Health Data Exchange

Nov. 04--Karen Helms didn't realize until this year that her medical records were being shared with a statewide network of health care providers. The discovery prompted her to question the state's health data exchange and to file a complaint with the federal government over privacy concerns.

A spokesman for the Idaho Health Data Exchange -- several years old and unrelated to the state's new health insurance exchange -- said the system has no risks or downside. There are almost 1,700 health care providers in Idaho sharing 1.97 million medical records through the electronic system. Those providers accessed patient records on the system 343,369 times in September, according to the exchange.

The exchange office receives calls from concerned patients on a weekly basis, a spokesman said. But exchange officials say privacy concerns are unfounded. They say when Idahoans learn how the exchange can prevent medical errors and other problems as well as expedite the burdensome process of getting medical records from one doctor to another, they usually choose not to opt out of the system.

"Privacy and security is our foundation with what we do and how we do it," said Scott Carrell, executive director for the data exchange.

Helms was referred in April to a specialist doctor in Meridian, where she lives. She filled out the usual paperwork and asked the person at the front desk whether her records would be shared.

"I always ask this, because I want to make sure my records don't go anywhere without my consent," Helms said. "She said, 'Well, actually, we will be sending them to the Idaho Health Data Exchange, but that's it.' "

Helms went ahead with the doctor's appointment, later visiting the exchange's website -- idahohde.org -- where she saw a list of hospitals and medical providers who share records through the exchange. The list included one of her regular doctors, which made her "really upset," she said.

Helms is a pharmacist who started working in psychiatry in 1994, most recently working with veterans in Florida. That shaped her perspective, making her a defender of patient privacy.

"The patients I worked with (had conditions that carried) a lot of stigma, and we did everything we could to keep their records private," she said.

Helms hadn't explicitly given her doctors permission to share her records on the exchange, she said. She wasn't informed before "having to really ask, pressure to get an answer," she said. "I was just really angry that that right had been taken away from me, to decide that I wanted information (shared). Everything was being uploaded to this database."

Helms filed a complaint last month with the U.S. Department of Health and Human Services Office for Civil Rights, asking the office to investigate whether the exchange violates federal privacy laws. Her case is pending, she said.

Exchange officials said the system, which has the support of Gov. Butch Otter, is fully compliant with federal privacy laws and is a secure system.

"We've not had a single security breach," said Matt McGraw, senior marketing coordinator for the exchange.

WHAT THE EXCHANGE IS -- AND WHAT IT'S NOT

The data exchange is a nonprofit corporation with a board of directors and a small staff. It was built over the past seven years with state money, in-kind contributions from early participants and a $5.9 million federal stimulus grant in 2010. The exchange is expected to eventually pay for itself with contributions from hospitals and other participants.

The exchange was established in 2008, but was born out of a 2006 Idaho Health Quality Planning Commission established by the Idaho Legislature.

"The governor believes it is part of the future of high quality health care that will improve patient outcomes," said Jon Hanian, spokesman for Gov. Butch Otter. "It is an effort to move health care away from what can sometimes be a piecemeal approach toward a method that gives the oncologists, (general practitioners), radiologists, pharmacists, etc., the ability to query one another and provide them collectively with a patient-centric, virtual health record that will lead to better care and better outcomes."

Other states have health information exchanges -- California has several -- that operate like the one in Idaho. But McGraw said the federal government left it up to states to decide whether to make patient record-sharing automatic, with patients having the choice to opt out, or to require permission from patients before records are shared. Idaho and many other states chose the opt-out model -- a decision Carrell said is partly because "you may never get a health information exchange lifted off the ground" if required to ask patients to opt in. Other states, including Utah, chose to require permission from patients, McGraw said. A report last year prepared for the Office of the National Coordinator for Health Information Technology said the states that chose the "opt-in consent approach" usually did so because state laws require patient consent and because it gave them a chance to tell patients about the exchange.

The Idaho exchange collects lab results, medication records, X-rays and other images, office-visit notes and other records. Its users include all kinds of medical professionals, from hospital admissions personnel to specialist physicians and nurse practitioners. They sign in with usernames and passwords. The exchange controls the data, which health insurance companies cannot see, according to McGraw.

Exchange officials said the system benefits Idahoans by:

- Giving emergency room doctors instant access to a patient's medical history, even if the patient is unconscious.

- Preventing duplication of lab tests, X-rays and other procedures.

- Using a filter to prevent users from seeing information about a patient's behavioral health, substance abuse or infectious disease problems. However, it does collect records about medications used to treat those problems, through an e-prescription company called Surescripts.

About 80 percent of drugs will show up in the system, McGraw said, but controlled substances will not. If a patient pays cash for a drug at the pharmacy, that medication won't show up in the record, he said.

McGraw said the system would benefit from gathering psychiatric and infectious-disease information by alerting a hospital if a patient is psychotic and could become violent or if a patient is a carrier of an antibiotic-resistant staph infection and needs to be quarantined.

"I understand it's scary" from a patient standpoint, McGraw said. "But it's a really good thing."

Helms disagrees.

She wanted a chance to say yes or no, instead of learning after the fact that her records are shared and that even if she opts out, those records -- though inaccessible -- stay stored on the system.

"What we're really talking about here is patient autonomy, and they're taking that away," she said. "I can't believe this is happening, and I don't agree with it."

Audrey Dutton: 377-6448, Twitter: @IDS_Audrey

Copyright 2013 - The Idaho Statesman