AUGUSTA, ME – Earlier this spring, Maine State Sen. Roger Katz (R-Augusta), introduced a bill to the Legislature's Committee on Health and Human Services titled “An Act To Ensure Patient Privacy and Control with Regard to Health Information Exchanges.”

 

Drafted with the support of the Maine Civil Liberties Union, one of the bill's chief provisions would require that the state’s health information exchange, Maine HealthInfoNet, switch from an opt-out model of patient consent to an opt-in.

 

“Maine patients and healthcare providers can realize the benefits of a statewide health information exchange without sacrificing privacy or security,” said Katz at the time. “In order to maximize trust, participation and value in a statewide exchange, we must protect a patient’s right to control what happens to their highly personal medical information.”

 

Added MCLU Executive Director Shenna Bellows, in a statement in April, "Patients should have a choice as to whether they want their private medical records to be shared in a statewide database or not. Patient privacy and consent need not be barriers to improving coordinated care.”

 

But Devore Culver, executive director at HealthInfoNet, disagrees. "The general consensus," he said, is that "an opt-in model would not be successful."

 

With "the vast majority of people" making no choice either way, he pointed out, what's left is an HIE where "there's not a significant enough mass of people to make it worth the provider's time" to participate.

"You're going to be hard pressed, anywhere in the country," he said, to find an operational statewide exchange "that stood up as an opt-in strategy."

 

With at least some information on as many as 850,000 patients in its database, which currently connects 15 – soon to be nearly 30 – of Maine's 39 hospitals, along with roughly 830 physician practices, HealthInfoNet is a large undertaking.

 

Over the three years or so of its development, Culver said many stakeholders have had a place at the table – including the MCLU. "They have been involved with this all along,” he said. “They sit on one of our board subcommittees. They're not dealing in darkness here."

 

As the HIE was developed, he said, MCLU did not like going to an opt-out strategy, but HealthInfoNet offered to compromise: "Our opt-out doesn't mean we just shield the data" if a patient asks to not participate in the exchange, Culver said. "We get rid of it, we delete it. So that was a direct compromise to make it a little more palatable."

 

Nonetheless, in its initial form, the bill supported by Katz and the MCLU called for a shift to an entirely opt-in status for the HIE just as the exchange would be starting to gain steam.

 

Moreover, said Amy Landry, HealthInfoNet's communications director, instead of putting the burden on the HIE, as it does now, the bill would have put the burden for managing the opt-in process on the doctors’ office or hospital, on a patient by patient basis. "Each time a patient goes to a new provider, they'd have to opt in again," she said.

 

Landry said the message from the provider community, "loud and clear," was that if that aspect went forward, "we can't participate anymore." Even if opt-in were to be enabled by working with vendors to customize EHRs, "it would be so cost prohibitive that they still wouldn't be able to participate at all," she said doctors told her. "This bill, as written would lead to eventual closure of the health information exchange.”

 

A hearing in early May led to some further revisions of the bill's language. With the case put forth that the opt-in strategy would be "unworkable," said Landry, MCLU, HealthInfoNet and other stakeholders (including the Maine Medical Association and Maine Hospital Association) met to draft a compromise that would accomplish some of MCLU’s goals without threatening the viability and value of the HIE.

 

The amended language requires providers taking part in HealthInfoNet to give patients a separate form that includes information about the HIE and explicitly offer the opportunity to opt out. Prior to that, providers included information in the Notice of Privacy Practices, and HealthInfoNet gave education and opt-out forms to providers, but providers were not required to hand them out by law.

 

Other provisions include deletion of a patient’s health information in the exchange after they opt out (which was always HealthInfoNet’s policy), that patients be given a way to opt out both online and offline (likewise), and that they be able to request a report of who has accessed their records and when they were accessed. The amended language passed with a unanimous vote of the HHS Committee and moved on to general legislature, where its passage looked probable at press time.

 

Bellows never disputed the value of the HIE. The issue, she said, was that the majority of Mainers in the system didn't realize their information was shared there. "HealthInfoNet had achieved approximately 65 percent of Mainers in their database, but most Mainers have never heard of HealthInfoNet," she said.

Under the compromise, she said, "patients will be notified that their records are being shared with HealthInfoNet, they'll be informed about what HealthInfoNet is, and they'll be given the opportunity to opt out."

 

It's crucial that patients be "informed and educated about both the benefits and the risks of a centralized medical record system," she added. "We can both advance medical care and protect patient privacy" through common-sense measures like this.

 

"It really boils down to patient awareness," agreed Landry. "Opt-in and opt-out are irrelevant at that point. It's really about making the patient aware that this is there, and what it can do for them, what the benefits are, what the risks are, and how they engage."

 

No longer facing an existential crisis, HealthInfoNet officials are relieved. But, said Culver, the sort of discussion and deal-making that led to this point "is going to repeat itself over and over and over again" nationwide. "You're going to see this played out in other states."

 

A big lesson for other HIEs, said Landry, is to ensure that all stakeholders – including critics – are involved in the planning and implementation process, especially when it comes to the consent model and patient education.

 

"Taking a multi-stakeholder approach builds trust and respect, so that when and if you do have differences of opinion, it's easier to come to a compromise."