A proposal for shoring up Federal Trade Commission protections for electronic health record–connected consumer apps under 21st Century Cures. (11th December 2020)

• Record Type: Journal Article
• Authors: Sayeed, Raheel; Jones, James; Gottlieb, Daniel; Mandel, Joshua C; Mandl, Kenneth D
• Is Part Of: Journal of the American Medical Informatics Association. Volume 28:Number 3(2021)
• Page Start: 640
• Page End: 645
• Publication Date: 2020-12-11
• Subjects: patient data privacy -- applications -- medical informatics -- health information system; Medical informatics -- Periodicals; Information Services -- Periodicals; Medical Informatics -- Periodicals; Médecine -- Informatique -- Périodiques; Informatica; Geneeskunde; Informatique médicale; Computer network resources; Electronic journals; 610.285
• DOI: 10.1093/jamia/ocaa227
• Languages: English
• ISSNs: 1067-5027

Abstract

Abstract: Under the 21st Century Cures Act and the Office of the National Coordinator for Health Information Technology (ONC) rule implementing its interoperability provisions, a patient's rights to easily request and obtain digital access to portions of their medical records are now supported by both technology and policy. Data, once directed by a patient to leave a Health Insurance Portability and Accountability Act–covered health entity and enter a consumer app, will usually fall under Federal Trade Commission oversight. Because the statutory authority of the ONC does not extend to health data protection, there is not yet regulation to specifically address privacy protections for consumer apps. A technologically feasible workflow that could be widely adopted and permissible under ONC's rule, involves using the SMART on FHIR OAuth authorization routine to present standardized information about app behavior. This approach would not bias the patient in a way that triggers penalties under information blocking provisions of the rule.