State settles ACLU lawsuit over HIE privacy protections

The Rhode Island Department of Health has settled a lawsuit brought by the American Civil Liberties Union regarding the department's methods for keeping patient records confidential and secure in Connect Care, the state's health information exchange.

The ACLU, according to Rhode Island Public Radio post, had sued the Department of Health to require it provide details as to how it would protect the privacy of patient records and otherwise operate the HIE, such as how patients could opt out of the HIE and correct information. The department had originally balked at providing this information publicly, instead relying on internal policies to operate the HIE.

It now has agreed to halt that practice and has unveiled new regulations with much more robust information regarding the HIE's operations and patient protections, such as how to revoke one's participation and how to limit provider access to patient data. The department held a public hearing on the new proposed regulations April 14.

"The department's agreement that it will no longer adopt unofficial policies to implement the health information exchange will better ensure public oversight of the way that Rhode Islanders' sensitive health care information is treated," voluntary ACLU attorney Frederic Marzilli said in a statement.

The ability of HIEs to adequately safeguard patient information has been a primary concern and has impeded interoperability, especially for data sharing across state lines.

The U.S. Department of Health & Human Services has allowed HIEs to determine their own governance and operational structure, providing them with voluntary guidance but not issuing regulations. The Government Accountability Office recently chastised HHS for its lack of strategies to accelerate interoperability.

To learn more:
- read the ACLU's announcement
- here's the Rhode Island Public Radio post