HITPC approves best practices for VDT access for patient representatives, family

The Health IT Policy Committee formally endorsed best practices regarding the Meaningful Use Stage 2 requirement to allow patients to view, download and transmit (VDT)their personal health information to family, friends and personal representatives of adult patients.

Under HIPAA, covered entities can share PHI with family members or other persons who are involved in the individual’s healthcare or payment for care; however individual patients have the right to object to such disclosures.

At the April 8 HITPC meeting, Privacy & Security Tiger Team Chair Deven McGraw, director of the health privacy project at the Center for Democracy & Technology, received board approval to encourage the Office of the National Coordinator for Health IT (ONC) to develop and disseminate the following best practices when it comes to allowing VDT access for a family member, friend or personal representative:

• When a patient makes a request for VDT access for friend or family member, it can be done in person, over the phone, through VDT if that functionality is provided, and via e-mail. Providers should document the request and the capability to store electronically would be helpful. Out-of-band notification can be used to notify or confirm access, which is particularly important when a patient's request for proxy access is made remotely or through software acting on the patient’s behalf.

• When a friend or family member makes a request, such access must be confirmed with a patient, such as through out-of-band confirmation. When the patient is incapacitated, HIPAA permits sharing of treatment-related information with friends or family but limited to only information relevant to treatment. Providers will need to consider whether providing access to relevant treatment information through VDT is an appropriate vehicle.

• Providers should consider how they can adapt the processes they currently use for VDT to grant personal representatives access to records. They also need to develop processes and capabilities to cut off VDT access by friends, family and personal representatives due to patient change in preferences or changes in personal representative legal status.

• Providers also need to educate their patients on the risks and benefits of VDT.

• Personal representatives—which is defined differently state to state—need to determine whether VDT access is limited to what they can legally access.

• ONC should disseminate best practices to providers to enable them to establish, and turn off, proxy access to VDT accounts consistent with law and patient needs.

Some committee members expressed concern that the responsibility of education falls to providers. “We have to figure out who in the workforce really can be trained to provide this information and make it real and practical if we think it’s important. Relying on a provider to do this is a non-starter,” said Neil Calman, MD, president and CEO of The Institute for Family Health.

McGraw clarified that physicians would not perform the education themselves, but delegate that responsibility to nursing or front desk staff.

Other members said the recommendations should be more specific, providing a more granular view on levels of access in terms of who can administrator, edit and view PHI.

The committee agreed to incorporate these concerns into its formal letter to the ONC.