Draft Legislation: Comprehensive Digital Health Records for All Americans Act
Section 1. Sense of Congress Regarding Accessibility, Exchange, and Use of Electronic Health Information.
It is the Sense of Congress that practices designed to exercise control or assert proprietary rights over electronic health information in ways that limit access, exchange, and use of that information by clinicians and other health care entities for authorized and permitted purposes impede progress toward a more connected health system that can better serve patients.
Furthermore, it is the Sense of Congress that such practices are often used by individuals and health care entities to maximize revenue or strengthen competitive positioning to the detriment of public- and private-sector efforts to improve health care quality, accelerate research and innovation, and provide greater value to health care consumers. Congressional action is needed to establish clear obligations on health care entities to provide access to and exchange health information and prevent inappropriate gatekeeping of patient health information.
Finally, it is the Sense of Congress that most patients today cannot access a timely, comprehensive set of their own health information in a readily usable, electronic form which is detrimental to their pursuit of improved health.
Section 2. Minimum Requirements to Improve Access to and Exchange of Health Information.
Background: Despite a myriad of state and federal laws to accelerate the digitization of health information and significant investments in technology and infrastructure to enable its exchange, health information often remains trapped in disparate clinical and administrative systems and networks. A lack of clear policies and requirements to share data among payers, clinicians, hospitals and other health care entities results in inefficiencies and friction across the health care system; impedes the delivery of high-quality care; and inhibits patient access to their comprehensive personal health record. To accelerate the exchange of health information across our health care system, this proposal would require specified health care entities to provide access to or exchange all electronic health information in real time for all required and permitted uses and disclosures under HIPAA, as follows:
Amend the Social Security Act by inserting the following:
(x) IN GENERAL.—Not later than one year after the date of enactment, the Secretary of the Department of Health and Human Services shall, through notice and comment rulemaking, require health care entities specified in paragraph (1) to exchange or provide access to all health information (as defined in 45 C.F.R 171.102), including data elements in the United States Core Data for Interoperability, to all other entities in paragraph (1) in real time in accordance with paragraph (2). The Secretary shall issue notice and comment rulemaking in partnership with the Department of Labor and the Department of the Treasury to apply the data exchange requirements in this section to group health plans and health insurance issuers offering group or individual health coverage.
(1) For purposes of this section, health care entities means:
a. Health insurance issuers and health plans, including individual and group health plans, Medicare Advantage organizations, Medicaid fee-for-service plans, and Medicaid managed care plans;
b. Physician practices, organizations, and medical groups;
c. General acute care hospitals;
d. Acute psychiatric hospitals;
e. Skilled nursing facilities;
f. Clinical laboratories; and
g. Other entities as determined appropriate by the Secretary
The Secretary may delay the requirements in paragraph (2) for physician practices, organizations, and medical groups of fewer than 25 physicians.
(2) The health care entities specified in paragraph (1) shall provide access to or exchange all electronic health information in real time or as soon as the information becomes available without intentional or programmatic delay for all required and permitted uses and disclosures under HIPAA (42 CFR Part 164).
(3) Access to or exchange of electronic health information under paragraph (2) shall be conducted using appropriate security standards and best practices.
(4) The health care entities specified in paragraph (1) are subject to applicable State and federal laws and regulations concerning privacy and security of health information.
(5) The health care entities specified in paragraph (1) that do not comply with the requirements in paragraph (2) shall be subject to investigation for information blocking by the Office of the Inspector General under 45 CFR 171.103 and, if determined to have committed information blocking, to applicable disincentives detailed in 45 CFR 171.1001.
Section 3. Establishing Comprehensive Personal Health Records for All Americans
Background: Under the HIPAA Privacy Rule, patients have a legal right to access their health information but are not guaranteed that their information is integrated into a comprehensive longitudinal health record. Instead, patients are forced to piece together medical information from various record systems, portals, or apps, especially when they receive care from multiple providers. As a result of barriers that keep patients from easily accessing their electronic health information, patients and the providers caring for them are often presented with an incomplete picture of their health. To improve patients’ access to their health information, this section would require specified health plans to make comprehensive, personal health records available to their members.
The second proposal in this section would leverage current standards for disclosures to clarify that it is “Treatment” under HIPAA for health plans to create and maintain comprehensive, personal health records for their participants, beneficiaries, or enrollees. This reform leverages a well-understood, HIPAA-permitted disclosure that is excluded from the “minimum necessary” standard, which reinforces that health information is permitted to be shared with no restrictions for this purpose. This would ensure that health plans would have more robust and complete access to health information to comply with the requirement to make comprehensive personal health records available to their members.
Amend the Public Health Service Act, the Internal Revenue Code of 1986, the Employee Retirement Income Security Act of 1974, and the Social Security Act by adding at the end the following new subsection:
(a) IN GENERAL.—For plan years beginning on or after January 1, 2027, group health plans, health insurance issuers offering group or individual health coverage, Medicare Advantage organizations, state Medicaid fee-for-service programs, and Medicaid managed care plans shall make available a comprehensive, personal health record to participants, beneficiaries, or enrollees of such plan or coverage (or authorized representatives of such participants, beneficiaries, or enrollees) that meets the following requirements:
(1) Integrates all electronic health information – including claims, encounters, and clinical information (including laboratory results) – that is maintained by and accessible to a health insurance issuer or health plan for participants, beneficiaries, or enrollees of such plan or coverage into a single, comprehensive health record that is easy to understand;
(2) Is updated in real time when new electronic health information is accessible to the health insurance issuer or health plan pursuant to Section 2;
(3) Is electronically accessible through a secure, web-based application, portal, or other platform that enables a participant, beneficiary, or enrollee (or their authorized representative) to view, download, and transmit their personal health record in a computable format at no cost;
(4) Is maintained by the health insurance issuer or health plan in a secure environment that prevents the unauthorized disclosure, access, use, modification, or exchange of a participant’s, beneficiary’s, or enrollee’s electronic health information in accordance with applicable State and Federal laws.
(b) SHARING REQUIREMENTS. Health insurance issuers or health plans shall share enrollees’ comprehensive digital health record with their:
(1) Treating provider(s); and
(2) Health insurance issuer or health plan when enrollees elect to coverage with a new issuer or plan, in accordance with their consent preferences.
Amend the HIPAA Privacy Act (45 CFR Part 164) by:
(c) Improving Access to Health Information to Support Comprehensive, Personal Health Records.
(1) Amend the definition of “Treatment” in § 164.501 to include a health plan’s creation and maintenance of comprehensive, personal health records for each individual participant, beneficiary, or enrollee. The definition of “Treatment” would read as follows:
Treatment means:
(1) The provision, coordination, or management of health care and related services by one or more health care providers, including the coordination or management of health care by a health care provider with a third party; consultation between health care providers relating to a patient; or the referral of a patient for health care from one health care provider to another; and
(2) The creation and maintenance of up-to-date, comprehensive, personal health records by a health plan for participants, beneficiaries, or enrollees.
Section 4. Additional Protections for Health Information
(a) IN GENERAL.— Not later than one year after the date of enactment, the Secretary of the Department of Health and Human Services shall promulgate regulations to apply the privacy, security, and breach notification requirements from the Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. 1320d-2) and section 13402 of the HITECH Act (42 U.S.C. 17932) to all entities that access to individually identifiable health information.