THE IMPACT OF HEALTH DISCLOSURE LAWS ON HEALTH INFORMATION EXCHANGES
WEIS 2011
Idris Adjerid
Alessandro Acquisti
Rema Padman
Rahul Telang
Julia Adler-Milstein
2
Introduction & Motivation
HIE - A project or initiative focused around electronic health data exchange between two or more disparate organizations or stakeholders
Increased digitization and sharing of patient health records raise privacy concerns
Evidence suggests that privacy concerns have been and continue to be a significant concern for HIEs: Consistently ranks first or second in terms of HIE
concerns on the annual eHealth Initiative Survey In 2010, ACLU brought suit against the Rhode Island
HIE on privacy grounds
3
Research Objective
Evaluate the impact of health disclosure laws on the emergence and success of Health Information Exchanges
Two alternative hypotheses: Laws limiting disclosure of health information
negatively affect HIE growth and success. Stronger privacy protections may increase the cost of
technology adoption and risks involved in health information sharing
Limiting disclosure of health information positively affects HIE growth and success
Stronger assurances to patient groups, privacy advocacy groups, and regulatory bodies resulting in increased cooperation and participation
4
HIE Dynamics
Common HIE models Regional health leaders form independent
initiatives to facilitate health information sharing Subscription/Transaction based models Treated as Public Good
Relatively Homogeneous in Organization Types 85/88 Operational HIEs are independent non-profits or
function under a non-profits Incentives for HIE Adoption
Efficiency gains for payers and insurers Quality and Competitive gains for providers Federal Incentives (HITECH) State Incentives
5
HIE Formation - Overview
Health Information Exchange
Urgent Care
Hospitals
Clinic
Home HealthInsurer
GroupPractice
Lab
Long termCare
Pharmacy•Administrative Framework•Payment, Funding, TOU Agreements•Technological Infrastructure•Community Outreach & Support
6
HIE Data – Definition & Sources Publicly available data from the E-Health
Initiative Survey on Health Information Exchanges Includes a list of Health Information Exchanges by
state from year to year, and other metrics We use data from 2004 to 2009
We validated and augmented this list through online research and communications with HIE representatives
HIE Survey Data from 2007, 2008, and 2009 (Adler-Milstein et al 2009)
Total HIEs Operational Planning Failed
312 88 132 92
7
Health Privacy Disclosure Laws
1996 - HIPAA Enacted
State Health Disclosure
Laws
State Health Disclosure
Laws
2009
2004 HIE Data
State HIE Laws: Privacy
and Others
HITECH ActFebruary 2009
Consent and Disclosure of Health Information governed by: Federal Laws
Health Insurance Portability and Accountability Act (HIPAA) Health Information Technology for Economic and Clinical Health Act (HITECH)
State Statutes: General Health Disclosure Legislation (Not HIE specific, Prior to Data) HIE-Specific Legislation
Combination of state HIE and General Health Disclosure Laws define between-state variation in disclosure requirements
8
Legal Data – State HIE Laws
HIE Laws - Legislation pertaining to HIEs and generally involve spurring or encouraging HIE activities in a state
Passed in More Recent Years Interesting Variation for Disclosure Requirements We categorized states into one of five groups:
ProHIE and No Consent (11 states) “Evaluate Any changes in State laws that are necessary to protect the
privacy and security…” (Md. Code Ann., § 19-143 ) ProHIE and Consent (7 states)
“Patients and health care providers shall have the choice to participate in the HIE…” (R.I. Gen. Laws § 5-37.7-4 )
ProHIEOnly (3 states and D.C.) Privacy Only (3 states) No HIE Law (26 states)
9
Analysis - Overview
Cross-Sectional Analysis Summary Statistics Econometric Model Results
Panel Analysis Econometric Model Results
10
Cross-Sectional Analysis
Motivation for Cross-Sectional Analysis Evaluate HIE Outcomes of Interest Explore the relationship between HIE
outcomes and Health Disclosure Laws Cross-Sectional Data as of the end of
2009 Covariate of Interest: General Health
Disclosure Legislation Passed prior to the prevalence of HIE efforts Control for subsequent HIE legislation Endogeneity concerns
11
Cross-Sectional Analysis – Key Measures
Measure Description
Total HIE The total number of attempted HIEs
Operational HIE The total number of HIEs actively exchanging data
Failed HIEs The total number of failed HIEs
Operational Rate Total operational HIEs relative to the total attempted
Failure Rate Total failed HIEs relative to the total attempted
We identified five key indicators of HIE activity in any given state
12
Cross-Sectional Analysis – Econometric Model
Because other factors may affect the development of HIEs in a state, we performed additional analysis to better model this correlation with our various dependent variables
TotalHIEstate = 0 + 1*DisclosureLaw + 2*Population + 3*PopulationSquared+
4*BroadbandAccess + 5* DemocraticState+ 6*PerCapitaGDP+i*HIELaw+
Estimate Via Poisson Regression Our data is best categorized as count data which are
highly non-normal and poorly estimated by OLS
Results – HIE Counts13
Total HIE Operational HIE Failed HIE
Standard Normalized Standard Normalized Standard NormalizedDisclosure Law
0.031(0.19)
0.245(1.23)
0.654(2.03)**
1.114(3.04)***
-0.513(1.95)*
-0.977(2.85)***
Population 0.161(8.44)***
-0.099(3.15)***
0.158(4.49)***
-0.115(1.72)*
0.157(6.08)***
-0.063(1.27)
Population Squared
-0.003(6.68)***
0.002(2.35)**
-0.003(3.37)***
0.002(1.29)
-0.002(3.42)***
0.002(1.53)
Democratic State
0.269(1.64)*
-0.135(0.67)
0.340(1.15)
0.519(1.38)
0.135(0.55)
-0.245(0.68)
Broadband Access
-0.002(0.23)
0.008(0.68)
-0.011(0.46)
-0.024(0.87)
0.018(0.95)
0.063(2.94)***
Per Capita GDP
0.009(2.08)**
0.016(7.33)***
0.007(0.82)
0.025(3.06)***
0.005(1.06)
0.004(0.87)
Observations 51 51 51 51 51 51
* significant at 10%; ** significant at 5%; *** significant at 1%
14
Results – Operational and Failure Rates
Operational Rate
Failure Rate
Disclosure Law
0.722(2.03)**
-0.533(1.74)*
Population -0.015(0.27)
0.005(0.11)
Population Squared
0.000(0.19)
0.000(0.35)
Democratic State
0.384(0.98)
-0.220(0.66)
Broadband Access
-0.021(0.80)
0.030(1.45)
Per Capita GDP
0.009(0.86)
-0.006(0.95)
Observations 51 51
* significant at 10%; ** significant at 5%; *** significant at 1%
We find a consistent Positive Association between Health disclosure Laws
Correlation does not fade with the inclusion of various state controls
Other considered covariates were measures of GDP (Health & Computer), measures of legislative professionalism, and state education levels
15
Panel Analysis - Motivation
Our Cross-sectional model can only provide some evidence of correlation between health disclosure laws and HIE activity, but we cannot make any claim about causation
IV approach may mediate some of these concerns, but IV’s from previous literature raise concerns (IV Analysis in Appendix of presentation)
Panel-Analysis allows us to at least address fixed-effects and controls for other factors Covariate of Analysis: HIE Laws vary in the time period
with differing privacy protections Captures health disclosure laws as fixed effects
(passed prior to our dataset)
16
Panel Analysis – Econometric Model
Two Dependent Variables (Semi-Annual 2004-2009) Operational HIEs Total HIEs – Does not include failed HIEs (successful entrants)
Fixed Effects Regression used to estimate basic model for evaluating the effect of various HIE Laws
TotalHIEst& Operational HIEst = o + i*HIELawst+i* HIELawst*HealthDisclosureLawss
+
1*Fundingst+2*StateDesignatedHIEst+3*Populationst+4*PopulationSquaredst +5*PerCapitaGDPst +θs +λt+st
Control for other aspects of law that may be encouraging HIE growth Funding State Designated Entity State Scale Effects θsState Fixed Effects and λtTime Fixed Effects
17
Panel Analysis - Results
Total HIE Operational HIE
Pro HIE and Consent 2.151 0.692
(2.28)** (1.69)*
Pro HIE and No Consent -0.047 0.021
(0.14) (0.07)
Pro HIE Only -0.224 -0.122
(0.54) (0.35)
Privacy Only -2.791 -1.131
(1.94)* (1.95)*
State-Designated Entity -1.974 -0.197
(2.59)* (0.51)
Controls YES YES
Time Fixed Effects YES YES
State Fixed Effects YES Yes
* significant at 10%; ** significant at 5%; *** significant at 1%;
18
Panel Analysis – Results
Total HIE Active
Pro HIE and Consent -0.063 -0.370
(0.16) (1.32)
Pro HIE and No Consent -0.189 -0.281
(0.51) (0.62)
Pro HIE Only -0.182 -0.086
(0.45) (0.26)
Privacy Only -1.091 -0.743
(2.82)*** (4.33)***
Pro HIE and Consent * Health Disclosure Law
2.309 1.276
(3.46)*** (3.03)***
Pro HIE and No Consent * Health Disclosure Law
0.293 0.592
(0.56) (1.17)
Privacy Only * Health Disclosure Law
-3.504 -0.685
(1.52) (0.65)
Controls YES YES
Time Fixed Effects YES YES
State Fixed Effects YES YES
* significant at 10%; ** significant at 5%; *** significant at 1%;
19
Panel Analysis – Results
Robust to Inclusion of Various Other Measures: HIT Adoption Measures
EMR Adoption CPOE adoption
Healthcare Characteristics State Measures Managed Care Penetration Over65
No Significant Difference in HIEs between conditions Breadth of Sharing (Results, Inpatient, Outpatient) Amount of Patients Covered Percent of Hospital Beds covered in region Independent vs. Subsidiary Organization
20
Summary of Results
So How do Privacy Protections Impact HIE Progress?
It Depends: Find that of all HIE promoting initiatives, only
those that include strong privacy considerations (consent) encourage growth and success This effect is driven strongly by the states that also
have pre-existing health disclosure legislation Find that privacy protections without incentives
has a strong detrimental effect on HIE growth and success However, effect based on a small number of states
(3)
21
Limitations
Data limitations Although a comprehensive dataset, still a
small dataset Measurement of some outcomes difficult,
such as failed HIEs Effects based on sometimes small
number of “policy interventions” across states Analytical limitation common to other
studies examining cross-state differences
23
Appendix: HIE and Consent
Patient consent has been a central concern with respect to privacy and HIEs Opt In, Opt Out, No Consent
Federal and State Laws don’t provide requirements for consent for many HIE contexts Covered Entities under HIPAA are not required to solicit
consent prior to disclosure of health information for treatment purposes
State Health Disclosure Laws generally echo these requirements with few states going beyond HIPAA requirements However, state laws do provide additional enforcement power
HIE Laws may apply more broadly than general health disclosure laws (beyond providers and payers) and also may provide requirements beyond current state statutes
24
Appendix: IV Results
Total HIE Operational HIE
Failed HIE Operational Rate
Failure Rate
Disclosure Law
0.691(1.49)
1.491(1.91)*
-0.047(0.07)
0.513(2.25)**
-0.421(1.83)*
Population 0.199(6.37) ***
0.179(2.56)**
0.226(3.31) ***
0.006(0.20)
0.001(0.02)
Population Sq
-0.004(5.33) ***
-0.004(2.05)**
-0.004(2.62) ***
-0.000(0.28)
0.000(0.89)
Blue -0.103(0.47)
0.178(0.42)
-0.479(1.19)
0.159(0.84)
-0.154(0.80)
Broad Access
0.003(0.28)
-0.028(0.74)
0.037(1.48)
-0.006(0.35)
0.017(0.76)
Per Capita GDP
0.008(3.07) ***
0.009(1.49)
0.003(0.69)
-0.002(0.25)
-0.002(0.22)
N 51 51 51 312 312
* significant at 10%; ** significant at 5%; *** significant at 1%
25
Appendix: Endogenous Passing of HIE Laws
Prior to the passage of these laws (2004-2006), there are small differences between the states
A growing difference between states with and without HIE laws (Not Significant)
Trend of Operational HIEs relative to HIE Laws
2003 2004 2005 2006 2007 2008 2009 20100
0.2
0.4
0.6
0.8
1
1.2
1.4
1.6
1.8
No HIEAny HIEDifference
Year
Opera
tional H
IEs
26
Appendix: Endogenous Passing of HIE Laws
HIE promoting legislation with weak privacy protections seem to have initially more activity but maintain trajectory
HIE promoting and strong privacy projections seem to display a sharp increase in HIE activity around the passage of these laws
Little growth for states with HIE only and Privacy Only legislation
Trend of Operational HIEs relative to Specific HIE Law Type
2003 2004 2005 2006 2007 2008 2009 20100
0.5
1
1.5
2
2.5
3
ProHIE and ConsentProHIE and No ConsentProHIE OnlyPrivacy Only
Year
Opera
tional H
IEs
27
Appendix: Potential Causes
Given that health data privacy sensitivities exist even in states with weaker legislative protections, state with more prescriptive legislation dealing with privacy may result in a less ambiguous operating environment for HIEs
Restrictive legislative environments force the “privacy issue” resulting in HIEs that are foresighted in terms of handling privacy concerns, engaging the local community, and developing mitigating technologies and policies
Privacy protections without accompanying incentives may inhibit HIE entry and success due to fears of overly restrictive regimes (all stick and no carrot)
Legal Data - Health Disclosure Laws
State Health Disclosure Law: Laws that (at a minimum) limit the disclosure of patient health
information (through consent requirements) by physicians, hospitals, health management organizations, and insurers
Didn’t include laws that restrict only specific types of data (HIV, Mental Health, etc.) or narrowly applicable
Resources The State of Health Privacy: A Survey of State Health Privacy
Statutes, Georgetown University, Washington, DC, 2002 Compilation of State Privacy Laws by the Privacy Journal,
Updated 2010 Various state legislative references In our data we find 21 states with health disclosure laws and
29 (and D.C.) without