What is and what is not EHI for purposes of information blocking regulations?  In Verisma’s Nov 2022 ROI Roundtable Webinar we heard from two experts with the ONC – Rachel Nelson JD, Branch Chief, Compliance and Administration Branch, and Dan Healy, Policy Coordinator, Compliance and Administration Branch on what EHI is and how its definition relates to but differs from the definition of ePHI under the HIPAA Rules. The speakers provided important facts related to current information blocking policy and what healthcare organizations and providers should bear in mind specific to information blocking regulations as they review and update their technical capabilities and workflows in context of their DRS (Designated Record Set) to ensure they are sharing EHI consistent with all applicable laws. Some highlights from their presentation follow.

What is EHI as defined by the information blocking regulation?  According to ONC, EHI is as follows:

• “Electronic Health Information (EHI) means electronic protected health information (ePHI) to the extent that the ePHI would be included in a designated record set as these terms are defined for HIPAA.”

The scope of EHI is relayed was shared in the following ONC graphic that can be found at HealthIT.gov:

The expansion is “only” PHI that is in an electronic format. Noted in the webinar is that EHI is “electronic health information (ePHI) to the extent that it would be included in a designated record set.” Further explained during the webinar was that EHI “is individually identifiable health information, that is maintained in electronic media or transmitted by electronic media.” If the ePHI is included in any of the following records and not in the exclusions such as psychotherapy notes, then it would be considered EHI:

• Medical records and billing records of a provider about an individual
• Enrollment, payment, claim adjudication, and case or medical management record systems maintained by or for a health plan.
• Records used in whole or in part to make decisions about individuals

What is not EHI was explained as well. For example, such things like psychotherapy notes, information complied in anticipation of, or for use in, a civil, criminal, or administrative action or proceeding, employment records health information, and de-identified protected health information. EHI is not limited by when the information was generated.

Organizations should be looking at what they now include in their designated record set policy and revise if necessary, to ensure the that their policy includes the full scope of EHI that is now in effect as of the October 6, 2022 expansion of the EHI definition beyond the current USCDI v.1 definition.  Working with your Release of Information vendor is important as well, so they are aware of exactly what ePHI is defined in your designated record set and how to access all the ePHI for disclosure purposes. Many resources such as an EHI Fact Sheet, recorded Webinars, and an Infographic are available on https://www.healthit.gov/.

Dan and Rachel also spent time going over the Information Blocking definition and explaining how that relates directly to the exchange of ePHI. More details and explanation of the Information Blocking Regulation was shared with the attendees. Points that have caused some questions from health care providers and others in the health IT field were clarified. Information Blocking applies to “actors.” Actors are:

• Health Care Providers
• Health It Developers of Certified Health IT
• Health Information Networks (HINs)
• Health Information Exchanges (HIEs)

Exceptions to the Information Blocking Rule, which have caused a lot of questions from “actors,” in particular the “Content and Manner Exception” where it is not considered information blocking if the actor does not have all the requested EHI in their possession, cannot be shared using the technology requested, or where it must be “withheld due to laws or is permissible to be withheld, such as under the Preventing Har or Privacy exceptions.” One example would be if it would be impossible for an actor to segment out psychotherapy notes from the EHI. Another would be the cost to comply would be prohibitive. Other examples were given as well as resource information available on ONC’s Cures Act Final Rule website.  For more in-depth information on Information Blocking, resources can be found at https://www.healthit.gov/ where there are fact sheets, Webinars, and FAQs. 

Health Information Management leaders should be reviewing all the policies and procedures related to release of ePHI, especially their designated record set policy to ensure they are following the updated requirements that went into effect on October 6, 2022 and working closely to ensure their ROI vendor is up to date on all the requirements to ensure there are no risks of information blocking.

Now let’s be honest – this is a fantastical scenario. Most, if not all, healthcare organizations have a backlog of requests they’re aware of but haven’t processed. Thankfully, if you track the date those requests entered your system, reaching the HIPAA-required turnaround time should be doable, right?

Not always. Here’s three reasons why:

1. Your backlog is bigger than you think

If you manage turnaround times based on your intake queue, you need 100% certainty that record requests make it to the queue on day one. Are there requests sitting on the fax machine? Are there several sitting in someone’s email inbox? Are they on vacation?

There’s risk in what you can’t see. If your organization has multiple locations with a decentralized ROI process, this problem compounds.

To confidently say your organization meets required turnaround times, you need 100% visibility across the intake process.

2. Your backlog is smaller than you think

We all know it’s unavoidable – duplicate requests. Whether by accident or due to impatience, this redundancy is an inefficient use of time and resources.

3. You’re not prioritizing effectively

First in first out isn’t always the best process. If all record requests in your system look the same, how do you know which are from patients vs attorneys? How many are for continuity of care?

COVID, hybrid workforces, Information Backlog requirements, and the upcoming anticipated HIPAA changes with a reduced turnaround time to 15 days have put more pressure on healthcare organizations to move to a streamlined unified process.

Verisma’s disclosure management experts are here to guide you through the process. Well-orchestrated policies and procedures paired with leading technology designed for ROI workflows are the key to achieving improved productivity, enhanced patient/requestor experience, and actionable metrics on your ROI operations success.

Specifically, the Verisma® advanced Release Management (VRM®) platform with its powerful Verisma Inbox™ technology:

• Utilizes smart barcode technology that automates the entire request intake by healthcare facility, giving you 100% visibility
• Flags duplicate requests to reduce multiple releases of the same record to the same requestor
• Centralizes and automatically categorizes all requests based on rules you specify so you can prioritize effectively

Verisma Inbox™ technology is the first of its kind and continues to offer more automation capabilities at no extra cost to our clients. Come see our latest innovations at AHIMA 22 booth #411.

Not going to AHIMA? Request a demo any time here.