On June 9 the Maine legislature voted to allow individuals to opt-out of having their medical records shared in a health information exchange (HIE). Although initially introduced with a consent requirement, the bill was passed and signed into law with an opt-out provision instead.

Opt-out, or dissent, laws allow data collection and sharing unless individuals remove themselves from the system; the burden is on patients. Consent laws prohibit all data collection and sharing unless individuals choose to opt into the system; the burden is on doctors and facilities. Last year during a meeting of the Health Information Technology Policy Committee, Judy Faulkner from Epic Systems said the policy about opt-in versus opt-out “should be based on evidence, not on the ‘vocal minority’ of privacy activists,” according to the Westside Public Relations blog.

Maine’s new law requires all health care practitioners and facilities to provide each patient the following:

• Information on the state-designated statewide HIE, including risks and benefits of participation;
• A description of how and where to obtain more information about the HIE and how to contact it;
• An opportunity for the patient to decline participation in the HIE, and
• A declaration that the practitioner and facility may not deny treatment based solely on the provider’s or patient’s decision not to participate in the HIE.

The new law also requires the HIE to establish a secure website that allows patients to opt out, consent to participate if they had previously opted out, and request information on who has accessed their records and when.

Maine joins other states in allowing patients to opt out of health information exchanges, including Colorado, Idaho, Kentucky, Nebraska, New Hampshire, Ohio, Oregon, and South Carolina. Tennessee’s HIE Operational Plan allows providers to decide whether to use the opt-in or the opt-out approach. Most have elected to enroll their patients without their express consent. Vermont switched from opt-out to opt-in.

Minnesota has a partial opt-out provision. The HIE is allowed to use a record locator service (RLS) to electronically locate and list the location of the various medical records of each patient without patient consent. However, under state law, health care providers may not view the computerized list of locations without patient consent. Nothing in state law requires that consent to be written or informed.

Sources:

“An Act To Ensure Patient Privacy and Control with Regard to Health Information Exchanges,” (Public Law, Chapter 373), State of Maine, Signed June 16, 2011.

“EHR Policy: Opt-In or Opt-Out,” Westside PR Blog, July 22, 2010.

“Opt-in Versus Opt-out: Consent Models for Health Information Exchange through Missouri’s Statewide Health Information Exchange Network,” Missouri Department of Social Services, DRAFT 4-14-10.

Tennessee Health Information Exchange: Operational Plan, Version 2.0 (Submitted to Office of the National Coordinator for Health Information Technology (ONCHIT) June 7, 2010), p. 124.

” Participating Health Care Provider Policies and Procedures,” Vermont Information Technlogy Leaders [HIE for Vermont] November 22, 2010.

Minnesota Statutes 144.293, subd. 8, “Record Locator Service.”

* The newsletter is not on the CCHF’s site yet, but will be here.

• House Bill 1330: The All-Payer Database is a Transparency Trojan Horse, by Linda Gorman
• tracking how doctors treat you is the first step toward government’s rewarding and punishing doctors for not practicing according to government’s judgment, rather than their own.