T he American Revolution had July 4. The allies had D-Day. And now U.S. patients, held down for decades by information hoarders, can rally around a new turning point, October 6, 2022 — the day they got their health data back.
Under federal rules taking effect Thursday, health care organizations must give patients unfettered access to their full health records in digital format. No more long delays. No more fax machines. No more exorbitant charges for printed pages.
Just the data, please — now.
“My great hope is that this will turn the tide on the culture of information blocking,” said Lisa Bari, CEO of Civitas Networks for Health, a nonprofit that supports medical data sharing. “It’s a ground level thing to me: We need to make sure information flows the way patients want it to.”
We're hosting events nationwide (and virtually) to tackle the biggest questions in health and medicine. Browse our upcoming events to see what's on the horizon.
That’s the opposite of the situation now in place. Health systems, data networks, and the companies that sell electronic medical records determine how much data patients can access, when, and under what circumstances. Meanwhile, private data brokers make huge profits by amassing hundreds of millions of de-identified medical records and selling insights to drug companies, device makers, and insurers without patients’ knowledge or consent.
The new federal rules — passed under the 21st Century Cures Act — are designed to shift the balance of power to ensure that patients can not only get their data, but also choose who else to share it with. It is the jumping-off point for a patient-mediated data economy that lets consumers in health care benefit from the fluidity they’ve had for decades in banking: they can move their information easily and electronically, and link their accounts to new services and software applications.
“To think that we actually have greater transparency about our personal finances than about our own health is quite an indictment,” said Isaac Kohane, a professor of biomedical informatics at Harvard Medical School. “This will go some distance toward reversing that.”
Even with the rules now in place, health data experts said change will not be fast or easy. Providers and other data holders — who have dug in their heels at every step — can still withhold information under certain exceptions. And many questions remain about protocols for sharing digital records, how to verify access rights, and even what it means to give patients all their data. Does that extend to every measurement in the ICU? Every log entry? Every email? And how will it all get standardized?
For months, patients have been able to obtain a minimum data set specified under federal law, and applications such as Apple Health Records have already dramatically expanded access. But the new rules throw open the floodgates to a much wider swath of information, including medical images, doctors’ notes, genetic data and other details normally kept under lock and key.
“It’s really simple — I have access to all my data, and people need to make that available to me digitally at my request,” said Harlan Krumholz, a cardiologist at Yale University and founder of Hugo Health, a company that helps patients collect and organize their health data.
He said it will take time for providers and other data holders to fully comply, especially since enforcement remains spotty and unclear under the new rules. But patients’ ability to get their data means they can better understand their care, shop for services, and participate in research without waiting for a clinician, or drug company, to present them with an opportunity.
“I hope it will become clear that we need to switch from a paternalistic system where a lot of data is moving behind peoples’ backs and without their permission or knowledge, to one where people have more control and agency over their data,” Krumholz said. Now, Krumholz said, patients can have their own personal repository of data that they can build on and ferry from one health care setting to another.
A growing number of data companies are popping up to help them in that quest, seeking to act as fiduciaries for consumers who want access to their records, but don’t have the time or technical savvy to wade through the bureaucracy.
The new environment is a radical departure from the status quo. For decades, it’s been all but impossible for patients to quickly and easily access their records. Hospitals and other organizations are loath to relinquish that information for a couple of business reasons. It makes it easier to retain patients in their care, and it keeps them in control of information with high commercial and research value.
The federal law known as HIPAA requires that providers turn over records when patients ask for them. But such requests are often met with delays, fees, and sometimes requests that they fetch them via fax. “HIPAA’s been in place for a long time,” Bari said. “But it’s simply not respected and used in that way.”
The roadblocks made it harder for patients like Liz Salmi, who has brain cancer, to get the care they need. For the first eight years of her cancer treatment, she sought care at Kaiser Permanente in California. But a change in insurance coverage meant she eventually had to switch to new providers.
“I naively thought that because they were all on Epic, they could easily share my records,” Salmi said. But she found out that their computer systems didn’t talk to each other, so one hand didn’t know what the other was doing. She ended up going to the medical records office at Kaiser in person to request copies of her records.
“They said, ‘OK, what parts of your record do you want? Lab results? Visit summaries?’” Salmi recalled. “I said, ‘No, I want everything.’”
She was told her full record — comprising eight years of care at Kaiser — was 4,823 pages. If she wanted it printed, she would have to pay 15 cents per page, for a total of $723.45. Salmi said she opted to pay $45 for three DVDs instead. It was 2017: well into the era of streaming services, smartphones, and same-day delivery. But to read her medical records, Salmi had to buy an external hard drive to load the disks into her computer.
When she finally opened them, it was like experiencing health care for the first time.
“I had no idea there was a whole other narrative going on behind the scenes,” Salmi said. “I could see all the emails back and forth with my doctors. I could see my progress notes. There was so much I had forgotten as a patient and here it was in black and white, because somebody had taken the time to write it down. I was blown away.”
Salmi, who is now undergoing treatment for a recurrence of her cancer, joined OpenNotes, an organization that promotes data sharing, where she is director of communications and patient initiatives. She said the effective date for the new data rules marks an important milestone. But to have a real impact it must be accompanied by an education campaign to help patients understand their rights and the benefits of getting their data.
Too many patients, she said, are unaware of the volume of information recorded about them or its value in an environment with new opportunities to participate in clinical studies and digital health services, without leaving their communities, or even their homes. Many also may be unaware of the security risks and how to separate reputable data users from swindlers.
“You need to see and experience your health records to even know what you’d be sharing,” she said. “But for years that decision was made for us — ‘you can see this, but you can’t see that.’ When I peeled back the curtain and actually could see what was in there I said, ‘Oh my gosh, this is incredible. I want to keep reading. I wish I knew this sooner.’”
STAT is tracking the effects of a new federal law that requires health care organizations to give patients access to their full health records in digital format. Are you willing to discuss your experience requesting your health records? We will not share your name or story without your permission.
