As hospitals move toward value-based contracts with a growing number of medical centers, physician groups and ACOs, executives must increasingly consider under which circumstances patient data is appropriate to share with individual outside facilities.
This content is sponsored by Change Healthcare
"The future of healthcare needs to be informed by robust data on an individual and population basis," Arien Malec, a senior vice president of Change Healthcare, said during a Nov. 13 workshop at the Becker's Hospital Review 6th Annual CEO + CFO Roundtable in Chicago. "We can't get to meaningful efficiency in care if we don't know … how patients move across the healthcare continuum."
However, in spite of the opportunity data sharing presents to healthcare organizations, there are a host of obstacles. Legal and regulatory frameworks for data exchange are complex, and healthcare executives often balk at sharing data with outside organizations, for fear of losing a competitive edge.
"I have actually seen health delivery organizations raise their hands and say, 'I can't share data because that other organization down the block might get access to it and might steal my patients,'" Mr. Malec said. "The competitive issues involving delivery of care require a careful balance of information sharing … without raising fears that something untoward will happen."
For Mr. Malec, who sits on the federal Health IT Advisory Committee and boasts 20-plus years of experience in the healthcare industry, one solution lies in establishing comprehensive data use policies between healthcare facilities. These protocols detail the specific circumstances under which patient information may be exchanged. Establishing data use policies poses an alternative to evaluating each exchange on a case-by-case basis or instituting a blanket approach in which a hospital asks an outside facility to share all of its patient data.
To lay the groundwork for a data sharing policy between healthcare organizations, Mr. Malec recommended hospital leaders assess the purposes of use and target populations related to their data needs. One facility, for instance, might need access to patient data to inform treatment decisions, while another is interested in using information to report on outcomes under a separate bundled payment agreement.
As an example, Mr. Malec shared how a single hospital and physician practice might establish an agreement to share patient data. Under HIPAA, if a patient seeks care at both facilities, the organizations can freely share data related to treatment with one another, according to Mr. Malec. However, if the two organizations are collaborating with an ACO, it adds an additional layer of complexity.
"Now I've got a case where the two organizations can share data, not for all purposes, but … for quality improvement and physician improvement," he explained. "Those are two permitted uses under the operations clause of HIPAA that allow commingling with [protected health information], but only in the cases where there's a common patient population."
The range of potential purposes expands as an ACO brings additional health systems, community hospitals, medical centers and physician groups under its umbrella — each of which may only need to acquire data related to a specific segment of existing patient information. "Depending on the program, that subset of common patients will change," Mr. Malec added.
He emphasized a comprehensive data use policy will enable collaborating organizations to establish these constraints in advance, enhancing accountability while controlling which facilities have access to each organization's trusted data.
"If you can get a policy framework and an IT framework that guarantees that data can only be accessed for the purposes of use for which it's allowed, and for the patient population for which it's allowed, now you're setting up a data sharing arrangement that is exactly in line with why that … group joined the ACO in the first place," Mr. Malec explained.