Jane Hyatt Thorpe, Lara Cartwright-Smith, and Elizabeth Gray - - PowerPoint PPT Presentation

www.healthinfolaw.org

Jane Hyatt Thorpe, Lara Cartwright-Smith, and Elizabeth Gray

www.healthinfolaw.org

Who We Are & Highlighted Projects

• Who We Are: Team of legal and policy analysts and researchers

based in the Department of Health Policy and Management in the Milken Institute School of Public Health at the George Washington

• University. We are passionate about health, health care, and health

information!

• Highlighted Projects
• Health Information & the Law
• State Health Practices Database for Research (SHPDR)
• Information Sharing in Medical-Legal Partnerships (MLP)
• Legal and Ethical Architecture for Patient-Centered Outcomes Research

(PCOR) Data

www.healthinfolaw.org

Health Information & the Law (www.healthinfolaw.org)

• Mission: Inform and empower a broad audience to understand and navigate federal

and state laws and regulations that may be perceived or real barriers to health system transformation, including the sharing of health information to support new delivery, clinical integration, consumer engagement, and payment models, as well as the exchange of information between health care and public health systems.

• Contents:

– Law library: 50 state (+DC) database of state laws and regulations and all relevant federal laws summarized, organized, and tagged with topics and subtopics

• Includes summaries, analyses, and links directly to relevant federal and state law organized by a

topical taxonomy

– Additional Products: Issue briefs, Fast Facts, Myth Busters, comparative state maps with accompanying explanatory tables, decision support tools, interviews with experts from the field, information about key developments in the field

• Website launched in May 2012, grew out of research funded by RWJF since 2007

www.healthinfolaw.org

HealthInfoLaw Audience

• Healthinfolaw.org has been visited

more than 1 million times to date.

• The highest monthly total occurred

in October 2016 with over 37,000 visits by approximately 29,000 unique visitors.

• Users include health care

providers, consumers, administrators, policymakers, researchers, advocates, academics, and members of the press.

• Several government agencies are

currently using the website to support their efforts, including CMS, ONC, FTC, SAMHSA, and NIH.

5,000 10,000 15,000 20,000 25,000 30,000 35,000 40,000 Jun-12 Aug-12 Oct-12 Dec-12 Feb-13 Apr-13 Jun-13 Aug-13 Oct-13 Dec-13 Feb-14 Apr-14 Jun-14 Aug-14 Oct-14 Dec-14 Feb-15 Apr-15 Jun-15 Aug-15 Oct-15 Dec-15 Feb-16 Apr-16 Jun-16 Aug-16 Oct-16

Monthly Visits to HealthInfoLaw.org Since Launch

Total Visits Unique Visitors

www.healthinfolaw.org

Example Comparative Map: “Who Owns Medical Records?”

• http://www.healthinfolaw.org/comparative-

analysis/who-owns-medical-records-50- state-comparison

www.healthinfolaw.org

State Health Practice Database for Research (SHPDR)

• Funded by NIH
• State law database

designed to facilitate health economics research

• www.shpdr.org

SHPDR Insurance Domain Variables

Topic Subtopic Variable (INDIVIDUAL AND SMALL GROUP MARKETS ONLY) Benefits Covered Services State requires insurers to provide care management services Benefits Covered Services State requires coverage for contraceptive drugs, devices, and related services Benefits Covered Services State requires coverage of breast cancer screening Benefits Covered Services State requires coverage of colorectal cancer screening Benefits Covered Services State requires coverage of HIV, AIDS, or HIV-related illnesses Benefits Covered Services State requires coverage of in vitro fertilization treatments Benefits Covered Services State requires coverage of minimum set of essential benefits Benefits Covered Services State requires coverage of prostate cancer screening Benefits Covered Services State requires coverage of treatment, screening, and/or services for autism spectrum disorder Benefits Covered Services State requires insurers to cover wellness programs (including incentives for wellness programs) Benefits Covered Services State requires insurers to cover mental health services Benefits Covered Services State requires insurers to cover substance abuse services Eligibility Pre-existing condition State prohibits or limits pre-existing condition exclusions Markets and Operations Any willing provider State has any willing provider law/regulation Markets and Operations Claims reviews State regulates grievance and appeals for insurance products Markets and Operations Consumer Protection State regulates consumer protection requirements for insurance products Markets and Operations High Risk State has high risk pool Markets and Operations Mandates State elects to operate state based health insurance exchange Markets and Operations Mandates State limits out of pocket costs Markets and Operations Mandates State opts out of Federal employer mandate requirements Markets and Operations Mandates State opts out of Federal individual mandate requirements Markets and Operations Mandates State passes legislation to address relationship with Federal exchange Markets and Operations Mandates State prohibits or limits waiting periods for coverage Markets and Operations Mandates State requires guaranteed issue Markets and Operations Mandates State requires insurers to report claims data to a central database Markets and Operations Medical loss ratios State regulates medical loss ratios Markets and Operations Provider Incentives State requires or encourages insurers to implement value-based purchasing programs Markets and Operations Rate setting State regulates actuarial value Markets and Operations Rate setting State regulates premium rate setting Markets and Operations Rate setting State restricts use of health status or other factors when setting premium rates

SHPDR Provider Domain Variables

Topic Subtopic Variable Care Delivery and Financing Billing State restricts provider balance billing managed care enrollees Care Delivery and Financing Delivery Model State regulates ACOs Care Delivery and Financing Delivery Model State regulates primary care or patient-centered medical homes Care Delivery and Financing Delivery Model State regulatory structure allows hospital shared savings programs Care Delivery and Financing Delivery Model State regulatory structure allows physician shared savings programs Care Delivery and Financing Malpractice State allows for patient compensation or injury fund Care Delivery and Financing Malpractice State has statute of limitations for medical liability/malpractice claims Care Delivery and Financing Malpractice State limits attorney fees in medical liability/malpractice claims Health Care Professionals & Facility Licensure Requirements Abortion Services State regulates abortion facilities Health Care Professionals & Facility Licensure Requirements Abortion Services State regulates abortion providers Care Delivery and Financing Malpractice State sets a cap on medical liability/malpractice damage awards Quality, Safety & Monitoring Pay-for-performance State regulates hospital value-based purchasing programs Quality, Safety & Monitoring Pay-for-performance State regulates nursing home value-based purchasing programs Quality, Safety & Monitoring Pay-for-performance State regulates physician value-based purchasing programs Quality, Safety & Monitoring Quality Reporting State requires hospital reporting on established performance metrics Quality, Safety & Monitoring Quality Reporting State requires nursing home reporting on established performance metrics Quality, Safety & Monitoring Quality Reporting State requires physician reporting on established performance metrics Technology and Infrastructure Certificate of Need State has CON law Technology and Infrastructure Certificate of Need State has CON moratorium or moratoria in place Technology and Infrastructure Health Information Technology State allows financial incentives for e-prescribing Technology and Infrastructure Health Information Technology State has established a body to address HIT (i.e., to develop infrastructure) Health Care Professionals & Facility Licensure Requirements Scope of Practice State has scope of practice for emergency medical service providers Workforce and Facilities Physician Ownership and Financial Interests State requires reporting of physician financial interests in medical facilities or practices (e.g., Sunshine Laws) Workforce and Facilities Physician Ownership and Financial Interests State regulates physician ownership or financial interests in medical facilities or practices (e.g., Physician Self-Referral Laws) Health Care Professionals & Facility Licensure Requirements Scope of Practice State regulates scope of practice for chiropractors Health Care Professionals & Facility Licensure Requirements Scope of Practice State regulates scope of practice for nurse professionals Health Care Professionals & Facility Licensure Requirements Scope of Practice State regulates scope of practice for physician assistants Workforce and Facilities Underserved areas/Populations State provides or allows financial incentives for dentists to work in underserved areas Workforce and Facilities Underserved areas/Populations State provides or allows financial incentives for primary care providers to work in underserved areas Workforce and Facilities Underserved areas/Populations State provides funding to programs that provide medical services to low-income individuals

www.healthinfolaw.org

GW team legal research and coding process

Data Extraction Method Process Flow – State Health Practices Database for Research (SHPDR)

Part 2: Variable analysis Part 1: Identify Statutes and Regulations GW Legal Team

1.1 Identify keywords 1.2 Identify relevant statutes and regulations

1.3 Catalog state statutes and regulations 2.1 Read the text of the statute/and or regulation 2.2 Analyze according to relevant Variable 2.3 Draft the justification 2.4 Add Statute/Regulation, Variable, Justification, and

• ther elements to the data

collection template.

www.healthinfolaw.org

• Issue Brief:

– Provides an overview of the federal legal privacy framework governing patient information sharing between healthcare practitioners and legal services providers in an MLP setting (with a primary focus on HIPAA); – Describes MLP structures that enable information sharing in compliance with the legal framework; – Offers a platform to further support MLP initiatives designed to encourage and enable patient information sharing in an MLP setting for the health of the patient; and – Includes a list of relevant resources and tools to support MLP efforts to design and/or enhance existing information-sharing arrangements between healthcare practitioners and legal services providers.

• http://medical-legalpartnership.org/privacy-brief/

Information Sharing in Medical-Legal Partnerships: Foundational Concepts and Resources

Example Pathways for Information Consent and Disclosure

Information in webinar and issue brief does not constitute legal advice

www.healthinfolaw.org

www.healthit.gov/topic/legal-and-ethical-architecture-patient- centered-outcomes-research-pcor-data-architecture

Legal and Ethical Architecture for PCOR Data

12

www.healthinfolaw.org

• Overview of legal and ethical considerations relevant to PCOR
• Background

– Architecture Development – Audience

• Primarily aimed at researchers engaged in PCOR and CER, as well as related entities and individuals like IRBs, Compliance

and Privacy Officers, etc.

• Also relevant to wider audience of stakeholders such as policymakers, funders, patient advocates, students, and policy

analysts

• How to Navigate and Use the Architecture

– Technology-neutral – Reference resource (not legal advice and does not present a single path)

Funded by the U.S. Department of Health and Human Services (HHS) Office of the National Coordinator for Health Information Technology (ONC)

Chapter 1: Overview

13

www.healthinfolaw.org

• Identifies relevant legal and ethical questions; answers provide foundation for

the Architecture

– Legal and ethical requirements vary depending on type of data sought, accessed, or used by a researcher

• Identifies key characteristics of health information used for PCOR

– Identifiability, Content, Subject, Source, Access, Use/Purpose, Consent/Authorization, Security, and Legal Status

• Describes the types of health information data relevant to PCOR

– Includes: clinical data, administrative data, patient-generated health data (PGHD), patient reported outcomes (PROs), genetic information, biospecimens, surveillance data, and quality improvement data

Chapter 2: Legal and Ethical Significance of Data for PCOR

Why would a stakeholder use Chapter 2? To identify and understand the legally relevant characteristics of data necessary for PCOR as well as the types of data commonly used for PCOR.

14

www.healthinfolaw.org

• Links specific legal requirements to key questions and data

characteristics identified in Chapter 2

• Describes various statutes and regulations that stipulate different

requirements and vary in their applicability to PCOR

• Organizes relevant legal provisions according to six key data

characteristics:

– Identifiability and Content; Subject; Source; Access and Use/Purpose; Consent/Authorization; and Security

Chapter 3: Linking Legal and Ethical Requirements to PCOR Data

Why would a stakeholder use Chapter 3? To identify and understand the relevant statutes and regulations applicable to the characteristics and data types described in Chapter 2 that may be triggered by the use of/access to data for PCOR.

15

www.healthinfolaw.org

• The Framework is a visual decision tool that highlights key characteristics and

considerations associated with the spectrum of data used for PCOR and the nature of the relationships between researchers and other stakeholders.

• Groupings and color coded key characteristics direct stakeholders to factors

determining:

– Whether a statute or regulation applies to the data; – How a researcher should navigate statutes/regulations that apply to the data; and – Whether there are case-specific determinations relating to data collection and use.

Chapter 4: Framework for Navigating Legal and Ethical Requirements for PCOR

Why would a stakeholder use Chapter 4? To identify relevance and importance of legal requirements and ethical principles detailed in Chapter 3 that may apply to the use of/access to data for PCOR depending on specific data characteristics described in Chapter 2.

16

www.healthinfolaw.org

Reflecting Primary (Green), Secondary (Blue), and Tertiary (Pink) Considerations

Organization of Framework

17

www.healthinfolaw.org

Example of the Framework

18

www.healthinfolaw.org

• Data Flows adapted from Phase 1 research data use scenarios

– General Data Flow (provides a foundational example of the mapping process) – Combining Data for PCOR – Consent Management – Release and Use of Specially Protected Health Data – Identification and Re-Identification of PCOR Data – Research Using Patient-Generated Health Data

• Data Flow Maps

– Outline key steps likely to be encountered in the course of PCOR research – Analyze legal trigger/decision points as applicable: HIPAA, Common Rule, 42 CFR Part 2, State Law, GINA – Include legal explanatory notes as a supplement as well as references to legal summaries in Appendix A

Chapter 5: Mapping Research Data Flows to Legal Requirements

Why would a stakeholder use Chapter 5? To understand how relevant statutes and regulations apply to specific research scenarios (step-by-step illustrations).

19

www.healthinfolaw.org

Individual is an 11-year old male with no other special status. A Federally-Qualified Health Center (FQHC) is among 10 sites collaborating with a research institution in conducting a federally-funded 20-year longitudinal cohort study on risk factors for obesity involving a representative sample of the US population, including children, adolescents, and adults. All entities participating in the research agree to use a common Institutional Review Board (IRB), which approves the research protocol. Individual seeks treatment at the FQHC for asthma. Individual’s mother consents to his treatment. Individual’s BMI is recorded in the obese range. Individual’s information is maintained within the FQHC’s Electronic Health Record (EHR) system along with other patient medical records. At the time of his asthma treatment, the FQHC recruits Individual to participate in a research study in which Individual’s health data collected in the course of treatment will be reported to the research institute at quarterly intervals. Individual’s mother consents to Individual’s participation in the research study and for Individual’s information to be given to the research institute. Per the approved research protocol, the FQHC also obtains Individual’s assent to participate in the research. Individual’s mother also consents to unspecified future research at the research institution using Individuals’ information. Data is collected by the FQHC and reported quarterly to the

• researcher. The researcher conducts her analysis, combining clinical information from research

participants with public economic and housing data. The researcher publishes an analysis of 5 years of data in de-identified, aggregated form (planning to publish updates every 5 years and then at end of study). Individual turns 18 and withdraws from research protocol, revoking authorization for his information to be used in further research, but continues receiving asthma treatment at the FQHC.

Example Data Flow: Consent Management

20

www.healthinfolaw.org

Data Flow Example

• p. 1

21

Acronyms for Data Flow 1 BA = Business Associate BAA = Business Associate Agreement CE = Covered Entity DUA = Data Use Agreement EHR = Electronic Health Record IRB = Institutional Review Board LDS = Limited Data Set PHI = Protected Health Information QSO = Qualified Service Organization QSOA = Qualified Service Organization Agreement

www.healthinfolaw.org

Data Flow Example

• p. 2

22

Acronyms for Data Flow 1 BA = Business Associate BAA = Business Associate Agreement CE = Covered Entity DUA = Data Use Agreement EHR = Electronic Health Record IRB = Institutional Review Board LDS = Limited Data Set PHI = Protected Health Information QSO = Qualified Service Organization QSOA = Qualified Service Organization Agreement

www.healthinfolaw.org

• Appendix A: Summary of Statutes and Regulations Relevant to

PCOR

• Appendix B: Assessing Potential Barriers and Ambiguity in the

Legal Landscape

• Appendix C: Selected Federal Initiatives
• Appendix D: Selected Federal Resources
• Appendix E: Glossary

Architecture Appendices

23

www.healthinfolaw.org

• “Legal and Structural Issues in Health Services Data Sharing.” Annual Review of Public Health (upcoming invited article)
• American Hospital Association Annual IT Survey Issue Brief Series:

– “Expanding Electronic Patient Engagement (Annual Survey IT Supplement Brief #1).” February 2018 – “Sharing Health Information for Treatment (Annual Survey IT Supplement Brief #2).” February 2018 – “Improving Patient Safety and Healthcare Quality through Health IT (Annual Survey IT Supplement Brief #3).” (upcoming) – “Advanced Use of Health Information Technology with New Models of Care (Annual Survey IT Supplement Brief #4).” (upcoming)

• Lara Cartwright-Smith, Elizabeth Gray, Jane Hyatt Thorpe “Who Owns Health Information – A Legal Framework,” Invited

article, Vanderbilt University School of Law Journal of Entertainment and Technology Law, Vol. XIX: 2:207, 2016

• Sara Rosenbaum and Jane Hyatt Thorpe, Guest Editors, “The Affordable Care Act at Six: Reaching for a New Normal,”

Journal of Law, Medicine & Ethics, 44(4): 533-537, 2016

• Jane Hyatt Thorpe, Elizabeth Gray, Lara Cartwright-Smith, “Show Us the Data: The Critical Role Health Information

Plays in Health System Transformation” Invited article, Journal of Law, Medicine & Ethics, 44(4): 592-597, 2016

• Jesse Pines, Elizabeth Gray, and Jane Hyatt Thorpe, “10 Times HIPAA May Not Apply,” Emergency Physicians Monthly

(September 2015) 22(9): 12-15

• Jane Hyatt Thorpe and Elizabeth Gray, “Big Data and Public Health: Navigating Privacy Laws to Maximize Potential,”

Public Health Reports(March/April, 2015) 130: 171-75

• Elizabeth Gray and Jane Hyatt Thorpe, “Comparative Effectiveness Research and Big Data: Balancing Potential with

Legal and Ethical Considerations” Journal of Comparative Effectiveness Research (Jan 2015); 4(1): 61-74

• Jane Hyatt Thorpe and Elizabeth Gray, “Big Data and Ambulatory Care: Breaking Down Barriers and Maximizing

Opportunities,” Journal of Ambulatory Care Management (Jan-Mar 2015); 38(1): 29-38

Other Recent Publications

www.healthinfolaw.org

• Jane Hyatt Thorpe, JD

– 202-994-4183 – jthorpe@gwu.edu

• Lara Cartwright-Smith, JD, MPH

– 202-994-8641 – laracs@gwu.edu

• Elizabeth Gray, JD, MHA

– 202-994-4163 – egray11@gwu.edu

Contact Information

25