Medical records software giant Epic has rolled out a new feature that makes it easier for patients to release their medical records to the health or wellness apps they use.
As the healthcare industry becomes more patient-centric along with a shift to digital technologies, the new individual access services (IAS) capability gives patients more direct control over their health data, according to Epic executives.
"This is what's really going to make it possible for individuals to just have the health data that they want at their fingertips and know that it's secure," Rob Klootwyk, Epic's director of interoperability, said in an interview.
The new capability, first reported by CNBC, is part of a wider effort by the healthcare industry, facilitated by new health tech policies from the federal government, to advance data-sharing at scale.
In December, a nationwide network to exchange patient data became operational, marking a critical step in establishing universal connectivity across providers.
Through that network, called the Trusted Exchange Framework and Common Agreement (TEFCA), the federal government, along with industry partners, is paving the road to enable digital health data to flow more seamlessly between providers and patients.
While it sounds like a highly technical policy, with a rather unwieldy name, TEFCA establishes universal governance, policy and a technical floor for nationwide interoperability.
Individual access services is one of the "exchange purposes" under TEFCA that facilitates sharing patients' data. The other exchange purposes include treatment, payment, healthcare operations, government benefits determination and public health.
Patient access to digital health data already exists through application programming interfaces (APIs), and Epic enables patients to access their medical records through its MyChart tool. A few years ago, the company expanded patient access to ease disclosure to a health app that the patient chose, said Matt Doyle, Epic’s R&D team lead and software development team leader for interoperability.
"TEFCA's individual access use case further improves that by automatically finding all the providers and hospitals that have a chart for the patient. Instead of the patient needing to remember each provider, TEFCA can find the charts automatically. The patient still needs to provide authorization for the disclosure, and it is now much easier to jump straight to that step," Doyle explained.
IAS can provide patients access to their electronic medical records with information about their health history including conditions, treatments and test results. This can help patients keep track of their health information across multiple hospitals, clinics and electronic health record systems, and share it with healthcare providers when needed, such as for second medical opinions.
If a patient is using an app to help manage diabetes, or a health coaching tool, or wants to download an app to donate their health data to research, the IAS use case, and Epic's new capability, makes this a more seamless process for patients, Klootwyk noted.
He compared the advances that TEFCA is driving for interoperability to using a bank ATM. "TEFCA is bringing that to people to be able to trust that only they have access to their health data. But just like an ATM, I can spend my money on whatever I want. You can do whatever you want with your own health data," he said.
To participate in TEFCA, digital health apps have to agree to the TEFCA Common Agreement, which establishes guardrails for securely sharing data, and also have the technology to support FHIR transactions. Apps also have to voluntarily comply with the Health Insurance Portability and Accountability Act (HIPAA) privacy rules, even if they are not legally mandated to.
Epic also took the extra step to develop a patient education screen after a patient logs in with their Epic credentials to release health data to an app. The screen alerts patients about which health data they will be disclosing.
"We want to ensure there is an opportunity for that patient to understand, what data is this app going to access? What are they going to do with the data? Do they sell the data?" Klootwyk said.
He added, "There is a lot of greenfield space here for these apps. There's this scalable opportunity for them to plug into this broad ecosystem of trusted exchange and agreeing to give those patients the rights to their data."
As part of the TEFCA public-private partnership, Epic helps facilitate medical data exchange as one of seven designated Qualified Health Information Networks (QHINs). The organizations provide the technology and network solutions necessary to support the six different "exchange purposes" and enable organizations to access patient data.
Epic customers, including 498 hospitals, have pledged to join TEFCA. As of July 29, 52 health systems representing 307 hospitals and 4,700 clinics were live on TEFCA, according to an Epic blog post. Another 102 health systems comprised of 800 hospitals and 14,400 clinics have pledged to join.
"Our plan is to deliver software this year that will help our customers to be among the initial participants in TEFCA, and we’re optimistic that nearly all of the 2,000 hospitals and 600,000 clinicians that use Epic across the U.S. will participate," Doyle said in the blog post.
Standing up the IAS feature wasn't a huge lift, Klootwyk noted, as Epic already has established the infrastructure and "rules of the road" as a QHIN, and its participants use Epic certified EHR software.
"We know how to very easily connect all of that and make it available. We're excited for other QHINs to follow that lead and work with their participants to enable their certified software that allow patients that access. TEFCA is that single on-ramp that they promised for all of those use cases," he said. "It's exciting to see the promise that the federal government gave us with this TEFA environment to actually come through."
Klootwyk said he expects Epic customers to begin deploying the new feature in the coming weeks. "We have some groups that have already planned their rollout this month. It's like 'Field of Dreams': We built it, so now they'll come."
Epic launched Care Everywhere, its health information exchange in 2008. "Epic’s goal had always been that regardless of vendor, every patient’s data should be able to be shared, with the patient’s permission, wherever the patient went," Epic founder and CEO Judy Faulkner wrote in her "Hey Judy" blog post published Monday. Epic helped establish Carequality, an interoperability framework enabling nationwide care coordination, Faulkner noted, and she claims the company was the first vendor to sign up for TEFCA.
Brendan Keeler, interoperability and data liquidity practice lead at healthcare strategy and software development firm HTD Health, said Epic's announcement and approach is a "step forward that solves some of the major problems of individual access, with more work ahead."
In a LinkedIn post on Friday, Keeler, a self-described advocate for interoperability and healthcare integration, said while patient access APIs have existed, it's the "wide view" that makes this latest step important.
"Many EHRs have painful, hospital by hospital registration processes. This fixes that. Where Epic goes, others follow. The shift to TEFCA will accelerate," Keeler wrote.
It's also notable that the first two public health use cases—electronic case reporting (eCR) and individual query—as established under TEFCA went live July 1. This will enable more seamless information exchange between public health agencies and providers.
In a LinkedIn post, the Centers for Disease Control and Prevention (CDC) referred to the news as a "milestone on the CDC's public health data strategy."
"Between this [Epic's new feature] and the public health announcement, the 'Is TEFCA real?' question is finally and definitively getting answered: 'Yes,'" Keeler wrote.
It's expected that other approved exchange pathways like healthcare operations and payment use cases will follow shortly.
Many health IT experts are hopeful that those additional pathways will create trusted exchange for non-treatment use cases and provide more transparency and clarity on the rules of the road. A dispute between Epic and venture-backed health tech company Particle Health over healthcare data exchange practices earlier this year exposed gray areas in interoperability practices.
Patients and providers should think about TEFCA in the same way as using bank ATMs or cell phones, said Micky Tripathi, Ph.D., assistant secretary for technology policy and national coordinator for health IT, in a recent "Podnosis" interview.
"The big thing I'd like [the industry] to know is that they should learn about it so they can forget it," he said. "They should learn about it to the extent that they should make sure that their organization is connecting to TEFCA and by more organizations doing that, they won't have to think about interoperability anymore in the same way that you that you don't think about which ATM network my ATM is on. Or, we don't worry about whether we're connected to AT&T or Verizon, we just know it's going to be connected."
Advancing interoperability, one step at a time
Epic is not the only organization working on individual access services use cases. Health Gorilla, an interoperability solution provider, is partnering with Clear, an identify verification tech company, to launch individual access services capabilities. The program will begin in Puerto Rico with the Puerto Rico Health Information Exchange and expand to other regions in the future, the company announced last year.
Health Gorilla also is a designated QHIN and is a designated Qualified Health Information Organization (QHIO) in California.
There continue to be barriers to interoperability, including technical and cultural hurdles. Some hospitals and providers aren't connected on the same network. And even those providers who are connected on the back end, workflow issues and lack of training results in front-end staff printing out information or using faxes. Thirty percent of hospitals are not routinely exchanging health data electronically, according to Office of the National Coordinator for Health IT (ONC) data.
"There's deeply embedded organizational culture that takes a while to get out of," Tripathi said on the "Podnosis" interview. Moving to value-based care also provides more incentive to invest in EHRs and data-sharing capabilities. "We just don't have the economics lined up in a way that motivates organizations to see this as an investment, rather than just added overhead and added cost onto their system," he said.
Keeler notes that Epic's new IAS feature solves major problems for both patients and digital health app developers to connect with EHRs.
Currently, many digital health apps have to register with each EHR, or with each hospital.
"We solve the endpoint discoverability problem (after all the organizations follow Epic). We solve the app registration problem (register once, be used by all)," Keeler wrote in his post.
This approach doesn't solve the identity proofing problem, he noted. "You will still need to have a patient portal account and use those credentials," he wrote.
As of 2023, 64% of U.S. hospitals plan to participate in TEFCA, up from 51% in 2022, according to the latest data brief from the ONC, an agency within the Department of Health and Human Services.
Approximately seven out of 10 hospitals that participated in national networks or health information exchanges planned to participate in TEFCA, compared to four out of 10 hospitals that did not participate in either type of network.
Hospitals with more resources, such as those that are larger, noncritical access and affiliated with health systems, indicated greater awareness and had higher levels of planned participation in TEFCA when compared to smaller, critical access and independent hospitals with fewer resources.
Interoperability is already occurring at scale. Carequality, an organization that facilitates health data exchange between networks, supports the exchange of more than 745 million documents monthly. But there is still friction, and, often, health information isn't usable.
"So you've got connectivity issues, usability and you've got the fact that workflows and culture still aren't embracing that kind of interoperability. TEFCA, we think, will address each of those problems in a way that makes the data more usable by enabling FHIR APIs that makes the ability to just query for medications available, for example, rather than getting that whole 80-page medical record snapshot," Tripathi said in the podcast interview. "We, as the department, are focused on that 20% to 30%, to say, how can we address their needs and provide assistance to them to get them implementing TEFCA."