HM311

1. © 2019 AHIMA
ahima.orgahima.org
Introduction to Information Systems
for Health Information Technology
Chapter 11: Health Information Exchange
© 2020 American Health Information Management
Association

2. © 2019 AHIMA
ahima.org 2
Learning Objectives, 1
Illustrate why the health information exchange (H I E) is a positive
step for healthcare
Describe the role and functions of the health information
organization (H I O) in the H I E efforts
Explain the concept of interoperability and its importance in
healthcare

3. © 2019 AHIMA
ahima.org 3
Learning Objectives, 2
Juxtapose the benefits and barriers of H I E
Compare and contrast the models and methods of H I E
Explain the requirements of Meaningful Use

4. © 2019 AHIMA
ahima.org 4
Health Information Exchange (H I E), 1
The formal agreed-upon process for the seamless exchange of
health information electronically between providers and others with
the same level of interoperability, according to nationally recognized
standards

5. © 2019 AHIMA
ahima.org 5
Health Information Exchange (H I E), 2
Requires a shift in mindset for healthcare professionals
From treating individuals within a specific practice or facility
To understanding how healthcare organizations (HCOs) impact the
health of the entire community in which they practice

6. © 2019 AHIMA
ahima.org 6
Value-based Healthcare
Evolving concept focused on:
• Better care for the individual
• Better health for the community
• Lower cost of healthcare through improvement of services and delivery
methods

7. © 2019 AHIMA
ahima.org 7
Health Information Exchange (H I E), 3
Interoperability: Capability of different information systems and
software applications to communicate and exchange data
Must be both an internal and external application and can be difficult
to achieve

8. © 2019 AHIMA
ahima.org 8
Four Types of Interoperability, 1
Technical
• Based on the hardware and equipment connectivity used in the exchange
• Allows any computer or device to exchange data with another computer or
device without corrupting the data or creating errors

9. © 2019 AHIMA
ahima.org 9
Four Types of Interoperability, 2
Syntactic
• Message format standards identify how data is formatted or structured to allow
exchange
• Interface software must be employed for compatibility to enable exchange
• These interoperability standards are not specific to healthcare, as they are
applied to any electronic transmission between two entities

10. © 2019 AHIMA
ahima.org 10
Four Types of Interoperability, 3
Semantic
• This process involves the use of standardized terminologies (such as S N O M
E D-C T)
• Provide clarity, consistency, and appropriate meaning in H I E
• This area of H I E is still undergoing development

11. © 2019 AHIMA
ahima.org 11
Four Types of Interoperability, 4
Process
• Most difficult of all the types of interoperability
• Process refers to degree to which integrity of workflow can be maintained
between systems
• Includes maintaining and conveying information such as user roles, data
protections, and system service quality between systems

12. © 2019 AHIMA
ahima.org 12
Health Information Exchange (H I E), 4
American Recovery and Reinvestment Act (A R R A) was enacted to
stimulate the United States economy during a recession
• Dedicated to expanding use of H I T to improve business efficiency and
effectiveness of healthcare organizations while increasing patient safety health
outcomes

13. © 2019 AHIMA
ahima.org 13
Health Information Exchange (H I E), 5
Health Information Technology for Economic and Clinical Health
(HITECH) Act
• $19 billion dedicated to
• Develop H I T
• Workforce education and training
• Certification of E H R products
• Establishing standards and vocabularies
• Driving electronic security and privacy regulations into the 21st century

14. © 2019 AHIMA
ahima.org 14
HITECH Act, 1
Foundational H I T legislation for:
• Development
• Adoption
• Promotion
• Use of electronic and computerized applications to create an interoperable
health information exchange system

15. © 2019 AHIMA
ahima.org 15
HITECH Act, 2
Added new regulations and requirements
Toughening enforcement
Increasing penalties for security breaches and privacy violations

16. © 2019 AHIMA
ahima.org 16
History of Health Information Exchange
Health Information Organization (H I O): Typically a public-private
partnership organization that oversees, governs, and facilitates the
transmission of health data between different types of HCOs that
have various E H R systems, according to nationally recognized
standards

17. © 2019 AHIMA
ahima.org 17
Local/Regional Health Information Organization (L H I O
and R H I O)
A group of organizations with a business stake in improving quality,
safety and efficiency of healthcare delivery that comes together to
exchange information for these purposes
The terms R H I O and H I E are often used interchangeably
An L H I O is a small-scale version of an R H I O

18. © 2019 AHIMA
ahima.org 18
Sequoia Project eHealth Exchange, 1
Federal agencies and non-federal organizations that came together
under common mission and purpose to
• Improve patient care
• Streamline disability benefit claims
• Improve public health reporting through secure, trusted, and interoperable
health information exchange

19. © 2019 AHIMA
ahima.org 19
Sequoia Project eHealth Exchange, 2
Provides exchange services in all 50 states
• More than 1,000,000 patients
• 65% of hospitals in the United States
• 50,000 medical groups
• 8,300 pharmacies
• Department of Defense, Centers for Medicare and Medicaid, Veterans
Administration, and the Social Security Administration

20. © 2019 AHIMA
ahima.org 20
Benefits to Implementing/Using Health I T and H I E, 1
Improve quality of care
Reduction of healthcare costs
Clinical decision support software
Increased public health monitoring and reporting

21. © 2019 AHIMA
ahima.org 21
Benefits to Implementing/Using Health I T and H I E, 2
Reporting and monitoring population health trends
• Decrease in diabetic complications due to patient education and notification
Increased use of mobile technology (cell phones, tablets, laptops)
• Communicate anywhere and anytime
• Bring Your Own Device (B Y O D): Healthcare practitioners using personal
devices rather than devices provided by the HCO
• Personal device must meet specific encryption and other security protocols to
protect P H I

22. © 2019 AHIMA
ahima.org 22
Benefits to Implementing/Using Health I T and H I E, 3
Increased and improved effectiveness and efficiency of healthcare
treatments and business operations
Improved connection between evidence-based health research and
actual medical practice
Provides basic level of interoperability among E H Rs

23. © 2019 AHIMA
ahima.org 23
H I E Benefits for Patients, 1
Patient safety
Automatic appointment and health reminders
Saving patient’s time throughout continuum of care

24. © 2019 AHIMA
ahima.org 24
H I E Benefits for Patients, 2
Equity of treatment and services with improved health outcomes
leading to reduction of health disparities
Emergency and urgent care personnel can quickly determine the
patient’s medications, allergies, and significant medical history to aid
in diagnosing current episode of care
More engaged patient education and patient involvement in
decisions that affect their health

25. © 2019 AHIMA
ahima.org 25
H I E Benefits to Society, 1
Decreased response time for disaster response
• Population/public health issues have links to homeland security
• Newly emerging diseases such as Ebola and bioterrorism attacks
Public health surveillance of outbreaks or epidemics of large-scale
food-borne illnesses, epidemics and pandemics of mutated
influenza, and Zika virus spread

26. © 2019 AHIMA
ahima.org 26
H I E Benefits to Society, 2
Alerts sent to appropriate government and health officials to speed
response and mitigation efforts
• Particularly helpful when outbreaks or epidemics cross state lines

27. © 2019 AHIMA
ahima.org 27
Barriers to Implementing Health I T, 1
Financial issues
• Supporting H I Os and H I E
• Increased cost of hardware and software, trained professionals, and infrastructure
Lack of complete operational and interoperability standards and
vocabularies and inadequate computer interfaces across all vendors
and organizations
Healthcare information ownership between patients and providers

28. © 2019 AHIMA
ahima.org 28
Barriers to Implementing Health I T, 2
Patient identification and matching capabilities and protocols along
entire continuum of care
Competition and proprietary issues between HCOs
Many rural hospitals lack financial stability and strength to provide
new hardware, software, up-to-date I T personnel, and regional
geographic infrastructure for reliable transmission of data

29. © 2019 AHIMA
ahima.org 29
Meaningful Use, 1
An incentive program for
• Eligible professionals (E Ps)
• Eligible hospitals
• Critical access hospitals (C A Hs)
Participating in Medicare and Medicaid programs that adopt and
successfully demonstrate meaningful use of certified E H R
technology (C E H R T)

30. © 2019 AHIMA
ahima.org 30
Meaningful Use, 2
A R R A and HITECH specified components for M U, requiring use of
C E H R T:
• Must be used in a meaningful way
• E-prescribing (e R x)
• Computerized provider order entry (C P O E)
• Exchange of health information must be used to improve quality of health care
• E H R must be used to submit clinical quality measures (CQMs) and other
specified measures identified by the O N C and HHS

31. © 2019 AHIMA
ahima.org 31
Meaningful Use, 3
CQMs: Criteria and tools to measure/quantify
• Healthcare processes
• Outcomes
• Patient perceptions
• Organizational structure and systems

32. © 2019 AHIMA
ahima.org 32
Meaningful Use, 4
Relate to one or more of quality goals for healthcare:
• Effective
• Safe
• Efficient
• Patient-centered
• Equitable
• Timely

33. © 2019 AHIMA
ahima.org 33
Meaningful Use, 5
Population health (public health) reporting
• Aggregate data
• Immunizations
• Communicable diseases
• Other health events
CQMs that healthcare entities, providers, and public health agencies
are required to report and is a standard function in E H Rs

34. © 2019 AHIMA
ahima.org 34
Meaningful Use, 6
State of health outcome disparities between
• Genders
• Race
• Socioeconomic status
Health disparity: When there are unequal differences in health
access, status, or outcome based upon factors such as gender,
race, socioeconomic status, sexual identity/orientation, disability,
and geography

35. © 2019 AHIMA
ahima.org 35
Meaningful Use, 7
CMS has priority to research and develop action plans that address
health disparities several populations:
• Racial and ethnic minorities
• Immigrants (and those with limited English proficiencies)
• Individuals with low health literacy
• Socioeconomically disadvantaged
• Disabled and those with special needs

36. © 2019 AHIMA
ahima.org 36
Meaningful Use, 8
• Older adults
• Rural residents
• Children and adolescents
• Lesbian, gay, bisexual, and transgender (LGBT) people

37. © 2019 AHIMA
ahima.org 37
Models of H I E Architecture—Consolidated, 1
Also called centralized model
• Many independent HCOs connect with H I E and aggregate data within central
repository or data warehouse managed by the H I E
Centralized data has a master patient index or a record locator
service (RLS)
• RLS detects patient’s information within H I E data repository based on patient
identity information and record data type
Each HCO can access the appropriate information from within the
centralized data repository of the H I E

38. © 2019 AHIMA
ahima.org 38
Models of H I E Architecture—Consolidated, 2
Advantages:
• Consistency of the data availability
• Rapid response to requests
Disadvantages:
• Duplication of data
• Data that is not completely up to date
• And costs for supporting software

39. © 2019 AHIMA
ahima.org 39
Models of H I E Architecture—Federated, 1
Also called decentralized model
• Not a centralized database of patient information
• More common than the consolidated model
• When HCOs join federated H I E, they agree to
• Security
• Confidentiality
• Transmission
• Access standards
• Protocols established by O N C for this type of H I E

40. © 2019 AHIMA
ahima.org 40
Models of H I E Architecture—Federated, 2
Each separate HCO is responsible for maintaining own patients’
health records
Also uses an RLS: the RLS tells the requesting provider/organization
which other participating HCO has the patient information
Requesting provider initiates a query, through the H I E, to the
identified HCO that controls the patient information within H I E
Responding HCO then replies to requesting provider, through the H I
E, with the specified patient information

41. © 2019 AHIMA
ahima.org 41
Models of H I E Architecture—Federated, 3
Advantages:
• Lack of data ownership
• Each HCO maintains its own data,
• Data are always current
• Capability to integrate with many E H R systems, providing redundancy, or the
use of additional or back-up systems

42. © 2019 AHIMA
ahima.org 42
Models of H I E Architecture—Federated, 4
Disadvantages:
• Data availability problems due to technical issues of a specific HCO
• Data may not always be available or complete because the patient may have
data distributed across many of the HCOs involved

43. © 2019 AHIMA
ahima.org 43
Models of H I E Architecture—Hybrid
Combines advantages of centralized and decentralized models
Has an RLS, and some data are stored in a central repository
While the remainder stays with the other HCOs within the H I E
Also has a patient portal to itself, and not to a specific HCO

44. © 2019 AHIMA
ahima.org 44
Methods of H I E, 1
Directed exchange: A “push exchange” because it pushes
authorized and secure information from one HCO to another
• If patient is being transferred from one hospital to another, patient’s health
information would be “pushed” to receiving hospital
Direct Project: A standards-based exchange platform to provide
secure, straightforward, scalable method to transmit encrypted
information to collaborating providers

45. © 2019 AHIMA
ahima.org 45
Methods of H I E, 2
The Direct Project is important for secure messaging and
transmission of laboratory results, summary care records, referrals,
public health reporting, and conveying quality measures
Direct messaging exchange acts like regular e-mail but with added
HIPAA security mechanisms for protection of both senders and
recipients with Direct addresses
Messages sent from a Direct e-mail address are encrypted and can
only be opened when received by another Direct e-mail address

46. © 2019 AHIMA
ahima.org 46
Methods of H I E, 3
DirectTrust: Oversees the Direct Project
Federally recognized, non-profit policy and governance body that
makes it possible for Direct exchange to operate smoothly and
reliably, giving Direct users much needed confidence in their
exchange partners’ privacy and security practices

47. © 2019 AHIMA
ahima.org 47
Methods of H I E, 4
Query-based exchange: A find-and-seek request for information
Sent through the H I O to find any available health information on a
specified individual
Opposite of the “push exchange,” so it is thought of as a “pull
exchange”

48. © 2019 AHIMA
ahima.org 48
Methods of H I E, 5
Consumer-Mediated Exchange
• Controlled by patients who want to control use and access of their health
information
• Patients can manage their healthcare and information like they would use
online banking
• Providing other providers with their health information
• Identifying and correcting wrong or missing health information
• Identifying and correcting incorrect billing information
• Tracking and monitoring their own health

49. © 2019 AHIMA
ahima.org 49
Patient Identification, 1
Identity matching: The process in which the H I O identifies the
right person within the database to exchange information between
HCOs
• Also called patient matching
Congress has banned the Department of Health and Human
Services from trying to develop and implement a national unique
patient identifier (U P I)
Common method for identity matching is the use of algorithms
• Algorithm: A way of solving a mathematical problem within a limited number
of steps that often requires repetition of the step or a rule or procedure
containing conditional logic for solving a problem or accomplishing a task

50. © 2019 AHIMA
ahima.org 50
Patient Identification, 2
Basic algorithms: Compare selected data elements, (name, date of
birth, and gender) are the simplest technique for matching records
Intermediate algorithms: Compare/match records by assigning
subjective weights to demographic elements for use in a scoring
system to determine the probability of matching patient records
Advanced algorithms: Contain the most sophisticated set of tools
for matching records and rely on mathematical theory and statistical
models to determine the likelihood of a match

51. © 2019 AHIMA
ahima.org 51
Patient Identification, 3
Identity management: Ensures the individual who has been
identified is who they say they are, that they have the authority to do
what they want to do, and that their actions are tracked and involves
the standard security functions of authorization, authentication,
access control, and audit control
A component of identity management within H I E is consent
management
• Consent management:
• Nothing to do with the consent for treatment
• Rather the patient consents or approves the H I O to transmit health information between
two or more authorized entities

52. © 2019 AHIMA
ahima.org 52
Patient Identification, 4
Electronic consent management: A system, process, or set of
policies that enables patients to choose what health information they
are willing to permit their healthcare providers to access and share.
• Allows patients to affirm their participation in electronic health initiatives such
as patient portals, personal health records (PHR), and health information
exchange

53. © 2019 AHIMA
ahima.org 53
Patient Identification, 5
3 key components for implementation on electronic consent
management process:
• Patient education and engagement
• Technology
• Law and policy
Patient education and engagement
• Educating patients about consent options, who may release their information
and how, and significance of the consent choice

54. © 2019 AHIMA
ahima.org 54
Patient Identification, 6
Technology
• Using technology to capture and maintain patient consent decisions, identify
which sensitive portions of patient information are restricted from access, and
communicate these restrictions electronically with others
Law and policy
• Ensuring alignment with federal and state law and other legal and policy
requirements pertaining to consent, individual choice, and confidentiality

55. © 2019 AHIMA
ahima.org 55
Electronic Consent Management, 1
Components for obtaining approval or consent to transmit health
information:
• Obtain consent from an authorized HCO or provider to electronically request
or transmit any patient’s health information to or from other authorized
healthcare entities
• Obtain patient consent to have the health information accessed and released
• Typically done when a patient registers to receive healthcare services

56. © 2019 AHIMA
ahima.org 56
Electronic Consent Management, 2
Opt-in or opt-out consent sets the default for health information of
patients to be included in the H I O automatically (opt-in)
The patient can choose not to be included (opt-out) completely
Opt-in consent means that the patient must specifically agree to
have personal health information accessible in the H I E

57. © 2019 AHIMA
ahima.org 57
Electronic Consent Management, 3
Variation of consent is opt-in with restrictions:
• The default is “no patient health information” is automatically made available,
and the patient must define what information is to be sent, who it is sent to,
and for what purposes the information may be used
Opt-out consent: The patient data can automatically be exchanged
within the H I O by default
Variation on this consent is the opt-out with exceptions model that
sets the default for health information for patients to be included, but
the patient can opt-out completely or allow only select data to be
included

58. © 2019 AHIMA
ahima.org 58
Electronic Consent Management, 4
Recommended specific data elements to help with patient
identification issues:
Primary data elements
• Legal name (first, middle, last,
maiden)
• D O B
• Gender
• Race
• Mother’s maiden name
• Primary phone number
Secondary data elements
• Birth place
• Marital status
• Social security number
• Driver’s license number
• E-mail address
• Some type of biometric

59. © 2019 AHIMA
ahima.org 59
Electronic Consent Management, 5
Biometric: A physical characteristic of the patient or users (such as
fingerprints, voiceprints, retinal scans, iris traits) that systems store
and use to authenticate identity of the patient or before allowing the
user access to a system

60. © 2019 AHIMA
ahima.org 60
H I E Privacy Concerns, 1
All health information is private, but mental health diagnoses, drug
and alcohol treatment, and sexually transmitted disease
identification are considered particularly sensitive
HCO must determine what additional privacy and security
protections are in place because some H I Es may not be able to
adequately protect that sensitive information

61. © 2019 AHIMA
ahima.org 61
H I E Privacy Concerns, 2
Best practices addressing privacy issues with the H I E include:
• Workforce education programs:
• Robust and timely, including the right of the patient to request restrictions
• All employees involved in any patient data or information transaction, access to eP H I, P
H I, or H I E operations must receive regular and documented training regarding HIPAA
and HCO rules, regulations, policies, and procedures
• Up-to-date breach notifications policies and procedures for all HIPAA-covered
entities
• As recent news of data breaches and identity-theft events have shown, the public’s trust
has decreased regarding the ability of an organization to safeguard their information

62. © 2019 AHIMA
ahima.org 62
H I E Privacy Concerns, 3
All mobile devices have effective and strong encryption protection
Application of breach sanctions are as written in policy and
procedures:
• Depending on level of breach, sanctions must have commensurate severity of
consequences and be established prior to event following HIPAA guidelines

63. © 2019 AHIMA
ahima.org 63
H I E Privacy Concerns, 4
Business associate agreements are analyzed, evaluated, and
updated on a regular basis
• Rules are continually expanded and updated and the HCO must make certain
it follows suit

64. © 2019 AHIMA
ahima.org 64
H I E Privacy Concerns, 5
Current risk analysis implemented and revised on a regular basis:
• Follow-up with business associates, covered entities and any others must be
verified by the HCO to be in compliance
Request for restrictions on release of information by patients is
implemented and on the Notice of Privacy Practices:
• Enhanced privacy rule requires the HCO to have method to note that the
information has been restricted