Nonprofit network Carequality concluded its investigation into the feisty dispute between Epic and Particle Health over access to patients' health data and how that data is used.
Carequality released a redacted version of its dispute resolution Tuesday evening that aims to settle an internal conflict over healthcare data exchange practices. Each company quickly claimed the findings support its side of the story.
The dispute centered on who is accessing patients' health data, for what purposes and the proper gatekeeping process to safeguard medical data.
The 25-page resolution (PDF), posted to Carequality's website, "reinforces the integrity of Carequality’s framework and the community’s commitment to its collectively established principles of trust," the organization said in a statement.
"We remain dedicated to maintaining the trust instilled in our interoperability framework and protecting sensitive patient information. We take any potential misuse of health data exchanged under our framework seriously, and we act to address any threats to the integrity of the system," Carequality wrote in its statement.
While the dispute within the Carequality interoperability network is now resolved, Particle Health's antitrust lawsuit against Epic continues. The startup filed a lawsuit in September alleging Epic engaged in anti-competitive practices. Carequality is not a party in Particle Health's antitrust lawsuit. But, the data dispute between the two health tech companies formed the basis for Particle Health's beef with Epic.
Particle Health is a data platform that aggregates health information for digital health companies through APIs, providing access to more than 300 million patients’ medical records. With a 36% market share of the hospital sector, electronic health record giant Epic is a dominant force in the health IT industry.
Both Epic and Particle Health are connected to Carequality, which operates a nationwide health data exchange service used by more than 600,000 care providers, 50,000 clinics and 4,200 hospitals to access patients’ medical records. Carequality says it supports the exchange of 1 billion clinical documents each month.
At issue in the dispute was whether patient data was shared properly for treatment purposes. But health IT experts say there is a lack of clarity on the definition of "treatment" as it pertains to data requests, which will likely fuel more conflicts in the future.
Carequality said the resolution, which both Epic and Particle Health have accepted, is the result of a "thorough and robust process." A panel of Carequality community members and external subject matter experts reviewed claims made by Epic and Particle Health relating to each other’s participation in Carequality.
Some companies' confidential information has been redacted in the public version of the resolution, the organization said.
With the resolution, Carequality aims to shore up gaps in data governance and oversight that enabled some companies to access patient data for questionable uses not related to patient care or treatment.
As a result of the resolution, Particle Health agreed to a corrective action plan and additional oversight for six months to confirm that it is thoroughly following Carequality's process, including onboarding diligence, to prevent future issues with customers utilizing the network, according to the resolution.
The resolution also addresses Particle Health's claims that Epic violated Carequality anti-discrimination rules by blocking some Particle Health customers from accessing data.
"Epic’s decision to not exchange with certain Particle Health customers is generally permissible under the Carequality Interoperability Framework provided that Epic bases its decision on objective criteria that are applied consistently across all those who participate in Carequality," the nonprofit network said.
As part of the resolution, Epic agreed to update its policies to include "clear, objective criteria" to be used to determine if an organization participating in Carequality is performing treatment. Carequality also is requiring Epic to provide information confirming that it is acting in accordance with these policies for the next six months.
In a statement about the resolution, Particle Health CEO Jason Prestinario said, "The increased transparency and clarity outlined in this statement–particularly as it calls on Epic to make changes for more open communication with the ecosystem–will benefit all participants and drive positive innovation for patient care."
The data dispute, which started last spring, shook up the health IT community as the industry is trying to advance better health data exchange practices. In fact, Carequality said it's the first independent dispute resolution process in the organization's 10-year history.
Health IT experts say the rift between the two companies exposes larger challenges with health data exchange including a lack of transparency and clarity on the rules of the road along with the need for better gatekeeping.
Carequality is made up of dozens of implementer organizations that in turn onboard their participant organizations to the framework. Epic connects its provider customers to Carequality as an extension of its Care Everywhere network.
Organizations that connect to Carequality agree to an “interoperability framework,” which is a collection of legal, governance and technical documents used to operationalize trusted exchange of health information nationwide, according to the organization.
Back in April, Epic's 15-member Care Everywhere Governing Council flagged three companies, who are Particle Health customers, for questionable use of patient data not related to patient care or treatment. One of these companies, Integritort, provides legal professionals with access to real-time medical records, according to the company’s website.
The ensuing dispute resolution through Carequality had been a closed-door process, but Particle Health publicly disclosed some details about that confidential discussion in its lawsuit against Epic.
Carequality's Steering Committee, as outlined in the resolution, concluded that two of those customers submitted data requests that were not intended for treatment purposes, at least in certain instances. In June, Particle Health informed the Carequality panel that it had terminated its contractual relationships with those two organizations.
Those two organizations are prohibited from participating in Carequality for another 12 months for any "permitted purpose" supported by the Carequality network, including treatment, according to the resolution. Those organizations then will need the explicit approval of the Steering Committee to rejoin.
For the third Particle Health customer in question, Carequality is demanding more information to confirm that the company is providing services to a healthcare provider as a business associate.
Carequality concluded that Particle Health conducted "sufficient diligence" in onboarding these customers but still "failed to reveal inaccurate information provided by each customer."
Epic is taking the resolution as a victory, saying that the Steering Committee's report "confirms Particle Health customers inappropriately accessed people’s medical records by falsely claiming to be treating them as patients," an Epic spokesperson said in a statement. Particle has been placed under a corrective action plan, the spokesperson noted.
"Three of its customers, including one that provided records to class action law firms, have either been suspended from the network or face other sanctions. The resolution confirms Epic and its customers took appropriate action to protect patient privacy," the company spokesperson said.
Following this article's publication, a Particle Health spokesperson said in a statement to Fierce Healthcare, "Particle Health is also claiming victory with the resolution, noting that Carequality invalidated Epic’s original dispute and that Epic has agreed to implement more transparency and open communication, with a six month oversight period to ensure adherence to this agreement."