How to Build a Mountain of Patient Data: Don’t Ask for Permission

Photograph by Joey Foley/Getty Images

The Methodist Hospital in 2010 in Indianapolis, Indiana. The state has one of the most advanced exchanges in the country.

Indiana isn’t usually considered a hub of technological innovation. However, about 2,000 miles from Silicon Valley, it has solved a problem that has flummoxed even high-tech states like California.

Indiana has built one of the most advanced “health information exchanges,” a computer network that lets doctors from different practices swap patients’ electronic medical records with the ease of a mouse click.

As I reported on, hundreds of such exchanges have popped up around the country, most in the last two years and fueled by $548 million in grants from the Obama administration as part of its health care overhaul. There have been problems: In Maine, patients discovered their medical files were being poured into a statewide database without their knowledge. California has struggled to recruit enough doctors to share their records. Some exchanges have even gone belly-up.

The Indiana Health Information Exchange, meanwhile, is a nonprofit that was launched in 2004 and now has 5 billion pieces of health data up to 40 years old. It is one of the oldest and most technologically sophisticated exchanges in the country, owing to a partnership with the Regenstrief Institute, an Indianapolis research organization that developed one of the nation’s first electronic medical records systems more than 30 years ago.

Indiana has four other, smaller exchanges. Together, they cover more than 4.5 million of Indiana’s 6.5 million residents — a level of coverage that will take many other states years to achieve.

The amount of medical data sloshing around Indiana makes it a national model. The lifesaving benefits of doctors being able to instantly pull up patients’ medical histories, such as medications and lab results, is unquestioned. But Indiana’s success comes with a caveat: The state has no law mandating patient consent before doctors share patient data with exchanges. That has been crucial in allowing the system to flourish, said Andrew VanZee, Indiana’s director of health information technology.

“One of the reasons Indiana has been successful is we haven’t over-regulated the private sector,” VanZee said. “It’s allowed the market to blossom. We were able to do a lot of that work when there was less scrutiny.”

The result is many patients may not know they’ve been included. And if they are aware, opting out is hard: Patients must be granted permission by their health care providers to opt out of the exchange, said Molly Butters, spokeswoman for the Indiana Health Information Exchange. The number of people who opt out is “very low,” she said.

Those two factors have rankled some consumer watchdogs and raised a sensitive idea: that stricter privacy controls, when it comes to health information exchanges, can both help and hurt consumers at the same time by restricting the flow of some of the most sensitive data on earth.

Maine also didn’t have a state law mandating patient notification before their data were shared with an exchange. That is, until patients found out their records were being shared without their permission and cried foul. They pushed through new legislation last year mandating that patients get an opt-out form at the time of treatment.

Eric Thieme, general counsel for the Indiana Health Information Exchange, said all health care providers that are part of the exchange are contractually obligated to notify patients how their data will be used.

But Deven McGraw, director of the Center for Democracy and Technology’s health privacy project in Washington, said policies like Indiana’s give patients little real choice and can serve the needs of health care providers more than patients. In the U.S., 48 exchanges give patients no choice at all about such matters, according to eHealth Initiative, a nonprofit organization that researches health-care technology.

“Some of these health information exchange efforts don’t pay enough attention to the importance of building public trust in what they’re doing,” she said. “The public trust issue is really, really critical. Just getting the providers on board and constructing a system that works for them is not enough.”

Indiana is closing in on a milestone: VanZee said that Indiana should have its five exchanges fully connected to each other by this summer. That could pave the way for other states to link their exchanges to Indiana’s, allowing residents’ electronic medical files to follow them across state lines.

What do you think about this article? Comment below!