In September, Healthcare IT News explained how one lawsuit against a nascent health information exchange could be a sign of things to come as states get their own HIEs up and running.

The tiny state of Rhode Island is in many ways the perfect place for proving efficacy and interoperability of various healthcare information technologies. Its modest size makes it especially well suited to test-run the exchange of medical information.

Not only was the Ocean State the first in the nation to link all its pharmacies electronically, but it's also home to the Rhode Island Quality Institute (RIQI), "the only organization in the country to hit the trifecta on all thee of the major HIT grants: HIE grant, the Regional Extension Center grant and the Beacon Communities grant," said RIQI president Laura L. Adams.

But Lil' Rhody also earned a different sort of bona fides this past summer, when the Rhode Island chapter of the American Civil Liberties Union filed suit against the Rhode Island Department of Health charging that it had failed to properly protect the privacy rights of patients as the state health information exchange – an RIQI-led initiative called currentcare – gets off the ground.

"Rhode Island is going to be the first of many states, if not all," that will find themselves embroiled in legal entanglements over privacy as they seek to implement HIEs, said Deborah Peel, MD, founder of Patient Privacy Rights. "Many states are really running roughshod over patients' rights."

Upon being first proposed in 2008, regulations were drawn up in the Rhode Island legislature to help define how the HIE would operate. "A statewide health information exchange is another essential electronic advancement for improving patient care and this law will give the people of Rhode Island specific rights and assurances that their information will be protected," Gov. Donald Carcieri said at the time.

But when the Department of Health proposed its own rules for the exchange's implementation, the ACLU complained that it didn't specify how privacy, confidentiality and informed-consent laws would be addressed in practice

The lawsuit, which was filed in Rhode Island Superior Court by volunteer attorney Frederic Marzilli, charges, according to a statement from the ACLU, that the department "violates the Administrative Procedures Act (APA), 'since all department policies that have general application and which implement, interpret or prescribe law' are subject to the APA’s public vetting process."

Adams makes a point to clarify that the suit is "not against the HIE at all: It's about procedure and administration, it isn't about our technology."

Still, the case could serve as a bellwether for similar complaints as other states set up their own information exchanges.

"The suit doesn't substantively attack the creation of an HIE, it's solely addressing the department's failure to address some of these safeguards in the rulemaking process," said Steven Brown, executive director of the Rhode Island ACLU. "We certainly understand and appreciate the important benefits that come from making medical records electronic and easily accessible, but at the same time it's crucial that appropriate safeguards are in place."

"We don't think they've addressed enough of the issues," says Marzilli. "We want to make sure that information doesn't get in the wrong hands. But also: what happens when a patient says, 'I don't want to participate in this?' Does the doctor have a right to say, 'I don't want to treat you?'”

Adams noted that RIQI is "quite widely known for the process we went through to do a deep and genuine engagement with our consumers here," and suspects that "what the ACLU is looking for is to perhaps bring more of those policies into regulation. I sense they think these policies are all great, and they're delighted that the patient controls so much of their information, but would like to have the consent form put into regulation."

At any rate, she said, "We'll continue to enroll patients. Our Beacon Community project is enabling the patient-centered medical home, and the entire project is based on leveraging our HIE, so we have big plans.
Of course, however: "patient privacy is primary," she added. "It's the only way we win the much-needed confidence to make an HIE run correctly."