The recently proposed New York state consent guidelines seek to define the requirements for patients to establish or grant per practice consent to their medical information through a health information exchange. Such patient control is a reasonable expectation and is also proposed by the US Dept of Health in the Consumer Use Case as published by ONCHIT. While the goal of such patient control is reasonable, the paper based and manual methods envisioned by the State of New York to support such control of an otherwise electronic exchange could result in significant additional effort on the part of healthcare providers and represent a continuing annoyance to consumers.

Based on our initial experience with our pilot practices, physician offices do not want to have to query yet another system just to determine the consent status of a patient on the HIE. While some practice management systems and EHR systems have a field to track when a HIPAA form was filled out, there is no such field for RHIO consent in these systems, so practices would have to log into the HIE even if they were not looking up clinical results just to determine a patient's consent status. In working with our pilot practices, the preferred approach has been to have the initial RHIO consent form filled out in the office, at which point a pre-printed RHIO sticker is affixed to their health insurance card. This allows the office staff to avoid continually asking patients to fill out the RHIO consent form. Seeking to avoid the introduction of new work flows, most practices have opted to send in these initial consent forms to the RHIO and have the RHIO set the patients consent flags.

For subsequent practices seeking to access clinical results for such consented patients, our approach is that they must acknowledge and attest to an on-screen challenge that they have the patient's consent or are providing treatment or co-ordination of care on behalf of the patient. This on-screen challenge also reminds requesting offices that their access to such patient records will be made available to patients on request.

To meet the requirements of a per practice paper based consent workflow, each practice will have to query the patient on the HIE at each office visit to determine if they have been previously consented in their particular office setting. This additional lookup step is not something even our more tech-savy, self selected pilot practices are willing to do at this time. Alternatively practices will have to always provide a new RHIO consent form and send that in to the RHIO to establish the patient's consent. Again our experience thus far indicates that practices will opt to take this approach and always provide a new RHIO consent form on the patient clipboard. The RHIO will then receive a consent form for every physician visit and query the HIE to see if that practice has already established a patient consent and set the flag if that is not the case. Patient satisfaction in the face of such repeated questioning could be significantly impacted as will confidence in such a system.

Additionally, requiring a written consent per practice will make it impossible for consulting physicians, referred to physicians or potentially covering physicians to access information prior to a visit, a practice which currently is supported in the analog world where results and records are faxed over in advance of a physician consult or where physicians can log onto an institutional portal.

A further impediment to the proposed solution is the requirement to have the participating institutions and providers listed on the consent form or in some other fashion available in the physicians office at time of consenting. Enrollment in an RHIO is dynamic and ever changing, making preprinted forms or rosters impossible to keep current.

Our recommendation is to support patient management of consent by allowing patients the option of choosing various levels of per practice consent controls, through both web based patient portals and centralized customer service call centers. The patient portal will also provide a more current roster of participating providers.

The initial level of consent control would conform to a per RHIO written consent followed by per practice on-line affirmative attestations that can be audited and reported back to patients. For patient consent management to be truly informed and truly dynamic and to match the dynamic nature of electronic health information exchange all efforts should be made to move any greater granularity of consent management out of the physicians office, while allowing such granularity to occur under direct patient control.

As an example of the levels of practice control envisioned, while some patients may request that they fill out one consent form and that subsequent access be provided to health providers as needed, some patients may have a preference to provide access to their primary care physician and then allow their primary physician to provide subsequent access to consulting physicians as required (a parallel to the analog world). And lastly some may want more granular practice by practice control as a practice orders a clinical test or as the patient schedules an appointment and approves access.

To support per practice consent granularity through a paper based process would appear to make workflows more complicated, further stress physician offices and potentially reduce the adoption of a nascent yet very useful capability, while also potentially undermining consumer confidence.