The healthcare industry continues to grapple with the optimal approach for improved interoperability, friction, and adequate privacy and security safeguards in the data ecosystem. Despite efforts such as information blocking regulations, the Trusted Exchange Framework and Common Agreement (TEFCA), and initiatives by the current administration aimed at promoting data sharing, significant barriers remain.

Health information exchanges (HIEs) serve a vital role in enabling providers and care coordinators to share information. Unlike brick-and-mortar providers who typically operate under a more uniform regulatory environment within their state, telehealth and digital health providers must navigate a complex patchwork of HIE regulations that vary across different states, leading to significant consent and interoperability challenges.

During this webinar, Jennifer S. Geetter, Sam Siegfried, and Sarah Chasson discussed current administration initiatives for health information exchange, key compliance challenges in health information exchange, and practical measures for implementing HIEs in a digital health world.

Key discussion points included:

1. The push for healthcare data interoperability is gaining momentum. The current administration has several initiatives focused on improving interoperability. Both the Centers for Medicare & Medicaid Services (CMS) and the US Department of Health and Human Services (HHS) are driving a major shift toward building a connected digital health ecosystem.
2. Less friction will benefit patients but needs to account for privacy and security challenges. Greater interoperability involves better identifying and address impediments to data sharing. But certain of these impediments may have the incidental effect of acting as blockers to protect privacy and security. Easing interoperability necessarily raises privacy and security compliance concerns and has the potential to create tension within the fragmented US privacy landscape.
3. Addressing consent fragmentation is critical for the success of HIEs and connected stakeholders. Digital health providers often operate across multiple states, making it difficult for providers, health IT vendors, and business associates to understand and manage varying consent requirements. Stakeholders face a layered web of different HIE consent requirements, health and consumer privacy laws, and HIE contractual obligations. The complexity of these requirements can be overwhelming, and a fragmented consent system can negatively impact patient trust and data quality and increase compliance risks.
4. Prioritizing patient education, transparency, and data architecture is crucial when participating in an HIE. To build patient trust and minimize consent fatigue, it is important to disclose HIE participation and ensure privacy notices are updated to reflect the use of HIEs. Consent workflows should be reviewed and updated as necessary, but it is also important to educate patients on the benefits of HIEs and the choices they have. This approach helps mitigate patient concerns and ensures that consent processes are clear and accessible. Managing various consent and access requirements can be a moving target. Developing data architecture to support compliance with a fragmented consent system through functionalities like data tagging can help minimize compliance risks.