The Trusted Exchange Framework and Common Agreements catalog have helped consumers overcome the hurdles of combining data from multiple electronic health record (EHR) sources. And now Epic is offering new features that take advantage of that reality.
“We opened up an API so customers can allow patients to connect to apps outside of the Epic system – like health coaches, fitness apps, etc.,” said Matt Doyle, Epic’s head of engagement software development.
One patient, multiple data sources
Some consumers have been able to connect EHR data to apps like Apple Health and others, but enabling data exchange with multiple providers at scale has long been a challenge for the healthcare industry.
“It’s a great idea and we’ve been supporting that through MyChart for quite a while,” Doyle said. “What’s new is connecting that individual access to a large scale through TEFCA.”
Previously, an app developer needed to know every provider and hospital “and have contacts and relationships with all of them,” he explains.
Now that the directory of institutions willing to exchange is available under TEFCA, Epic has been developing a way for consumers to leverage this directory and collect their patient data in the app of their choice for the past six months.
Epic announced on CNBC on Thursday that it has opened up a way for more health apps to access health records. Doyle said the planning process began about a year ago and involved working with the Office of the National Health IT Coordinator, federal partners, Project Sequoia, the ONC’s accredited coordinator, and others.
The effort also brings together the companies building these apps and providers into a community to “figure out the right approach — the right privacy, the right patient education, the right workflow” to meet all the requirements.
When patients use the health app that is part of TEFCA, which launched in December, they will authenticate in MyChart to gain access to their health records through the TEFCA directory.
Remembering each healthcare provider has become a burden for patients, but TEFCA has solved this problem.
“When you join TEFCA, you agree to talk to everyone in the TEFCA community,” Doyle notes.
Authorized by the CARES Act, TEFCA aims to establish a common governance, policy, and technical platform for nationwide interoperability and should be simple for patients, providers, payers, and public health agencies.
When requesting medical records through a TEFCA third-party application, location services will use that directory to find all information sources for the healthcare consumer.
“This is a huge win for me as a consumer because it takes a lot of the burden off of me, and it’s also a huge win for app developers because they don’t have to maintain a relationship with every website.”
App developers no longer have to negotiate agreements. But for providers, the responsibility to release data to apps that may share protected health information is a different story.
Consumer Privacy Warning
When using a third-party app, consumers will authenticate through Epic’s patient portal and will be presented with information — on a red, blue or green screen — outlining how they are about to share their health information.
“One of the challenges we hear from providers is the importance of patients understanding that they are taking their data out of the HIPAA ecosystem, that they have the proper authentication to ensure that the right person is giving permission before providers can release that data, and knowing that they are complying with their HIPAA obligations,” Doyle explained to Healthcare IT News as he pulled up colorful screenshots.
If the consumer’s chosen app is HIPAA-approved, Epic’s green data privacy note will state so. If it’s not a HIPAA-covered app but Epic has information about the third-party’s data policy, the blue result will provide details.
“We can tell you and direct you about how they might use your data,” Doyle said.
But if users see a red screen, they’ll be asked to make sure they want to export their protected data and share it with a third-party app whose data security practices Epic can’t verify.
Because it is not known whether a consumer’s app partners will have access to the PHI being transmitted, “this is an opportunity for you as a consumer to pause and make sure you understand the choices you are making to transfer your data to this third-party app.”
After that step, “the data flows,” Doyle says.
This is a significant step towards empowering healthcare consumers to compile a unified health record.
Back in 2016, Duke Medicine announced it was the first Epic-based health system to use the Fast Health Information Resources API with the Apple Health developer kit in a secure, HIPAA-compliant live environment as part of its connected care initiative. The health system wanted to leverage the app’s data to better monitor and support chronic care patients.
While Epic can interact with HIPAA-approved apps before TEFCA, opening up the API opens the door for health apps to leverage the provider directory, “bringing better scalability and a better experience for you as a consumer,” Doyle said.
While healthcare interoperability is a national mandate, keeping PHI secure is always a concern.
“One point that I think is really strong here is that the TEFCA agreement requires app developers to voluntarily comply with HIPAA privacy and security rules, even if they are not HIPAA-covered entities,” he said. “That’s a lot easier to explain to consumers than getting into a [Federal Trade Commission] and the nuances of HIPAA.”
Doyle said the feature will begin rolling out to more Epic customers within two weeks, and will happen in the fall.
Andrea Fox is senior editor of Healthcare IT News.
Email: [email protected]
Healthcare IT News is a publication of HIMSS Media.
