State Privacy Laws, HIPAA, Health Information Exchanges
I want three questions about the Chesapeake Regional Information System for our Patients’ (CRISPS) Health Information Exchanges (HIE) answered. First, is, how does the HIE govern data? I would like to know how the HIE makes decisions about use cases given that there is very many occasion to share data, some with risk-bearing entities. How will emerging technology affect HIE operations? I want this question too answered to know how useful the HIE is to adopt changes. Finally, I would like to know if the HIE is HIPAA complaint to avoid investing in illegal ventures.
I have concerns about the use of the system and application of data in terms of the agreement. According to its terms and conditions, CRISPS may, from time to time, establish new permitted purposes of use or delete a listed permitted purpose of use. These procedures can be potentially dangerous because they can create loopholes that can allow the HIE to be used for other purposes other than to treat the patient. Concerning the use of HIE and data, CRISP may request for information including confidential information from the participant. The HIPAA prohibits the sharing of such information without patients’ consent.
The provider should not proceed with negotiations with HIE because it cannot be liable to the damage and the loss of data arising in connection to the agreement. I see this claim as a potential deal-breaker unless the HIE is willing to change this requirement. Any data collected in health care is of paramount importance. So it ought to be protected against loss and damages, and should anything happen to the data, the HIE should be in a position to assist with the retrieval process. Therefore, the provider should not enter into a contract with this HIE as it would not help in such an event.