THE IMPACT OF HEALTH DISCLOSURE LAWS ON HEALTH INFORMATION EXCHANGES

WEIS 2011

Idris AdjeridAlessandro Acquisti

Rema PadmanRahul Telang

Julia Adler-Milstein

2

Introduction & Motivation HIE - A project or initiative focused around

electronic health data exchange between two or more disparate organizations or stakeholders

Increased digitization and sharing of patient health records raise privacy concerns

Evidence suggests that privacy concerns have been and continue to be a significant concern for HIEs: Consistently ranks first or second in terms of HIE

concerns on the annual eHealth Initiative Survey In 2010, ACLU brought suit against the Rhode Island

HIE on privacy grounds

3

Research Objective Evaluate the impact of health disclosure laws on

the emergence and success of Health Information Exchanges

Two alternative hypotheses: Laws limiting disclosure of health information

negatively affect HIE growth and success. Stronger privacy protections may increase the cost of

technology adoption and risks involved in health information sharing

Limiting disclosure of health information positively affects HIE growth and success

Stronger assurances to patient groups, privacy advocacy groups, and regulatory bodies resulting in increased cooperation and participation

4

HIE Dynamics Common HIE models

Regional health leaders form independent initiatives to facilitate health information sharing Subscription/Transaction based models Treated as Public Good

Relatively Homogeneous in Organization Types 85/88 Operational HIEs are independent non-profits or

function under a non-profits Incentives for HIE Adoption

Efficiency gains for payers and insurers Quality and Competitive gains for providers Federal Incentives (HITECH) State Incentives

5

HIE Formation - Overview

Health Information Exchange

Urgent Care

Hospitals

Clinic

Home HealthInsurer

GroupPractice

Lab

Long termCare

Pharmacy•Administrative Framework•Payment, Funding, TOU Agreements•Technological Infrastructure•Community Outreach & Support

6

HIE Data – Definition & Sources Publicly available data from the E-Health Initiative

Survey on Health Information Exchanges Includes a list of Health Information Exchanges by

state from year to year, and other metrics We use data from 2004 to 2009

We validated and augmented this list through online research and communications with HIE representatives

HIE Survey Data from 2007, 2008, and 2009 (Adler-Milstein et al 2009)

Total HIEs Operational Planning Failed312 88 132 92

7

Health Privacy Disclosure Laws

1996 - HIPAA Enacted

State Health Disclosure

Laws

State Health Disclosure

Laws

2009

2004 HIE Data

State HIE Laws: Privacy

and Others

HITECH ActFebruary 2009

Consent and Disclosure of Health Information governed by: Federal Laws

Health Insurance Portability and Accountability Act (HIPAA) Health Information Technology for Economic and Clinical Health Act (HITECH)

State Statutes: General Health Disclosure Legislation (Not HIE specific, Prior to Data) HIE-Specific Legislation

Combination of state HIE and General Health Disclosure Laws define between-state variation in disclosure requirements

8

Legal Data – State HIE Laws HIE Laws - Legislation pertaining to HIEs and generally

involve spurring or encouraging HIE activities in a state Passed in More Recent Years Interesting Variation for Disclosure Requirements We categorized states into one of five groups:

ProHIE and No Consent (11 states) “Evaluate Any changes in State laws that are necessary to protect the

privacy and security…” (Md. Code Ann., § 19-143 ) ProHIE and Consent (7 states)

“Patients and health care providers shall have the choice to participate in the HIE…” (R.I. Gen. Laws § 5-37.7-4 )

ProHIEOnly (3 states and D.C.) Privacy Only (3 states) No HIE Law (26 states)

9

Analysis - Overview

Cross-Sectional Analysis Summary Statistics Econometric Model Results

Panel Analysis Econometric Model Results

10

Cross-Sectional Analysis Motivation for Cross-Sectional Analysis

Evaluate HIE Outcomes of Interest Explore the relationship between HIE

outcomes and Health Disclosure Laws Cross-Sectional Data as of the end of 2009

Covariate of Interest: General Health Disclosure Legislation Passed prior to the prevalence of HIE efforts Control for subsequent HIE legislation Endogeneity concerns

11

Cross-Sectional Analysis – Key Measures

Measure Description

Total HIE The total number of attempted HIEs

Operational HIE The total number of HIEs actively exchanging data

Failed HIEs The total number of failed HIEs

Operational Rate Total operational HIEs relative to the total attempted

Failure Rate Total failed HIEs relative to the total attempted

We identified five key indicators of HIE activity in any given state

12

Cross-Sectional Analysis – Econometric Model Because other factors may affect the development of

HIEs in a state, we performed additional analysis to better model this correlation with our various dependent variables

TotalHIEstate = 0 + 1*DisclosureLaw + 2*Population + 3*PopulationSquared+

4*BroadbandAccess + 5* DemocraticState+ 6*PerCapitaGDP+i*HIELaw+

Estimate Via Poisson Regression Our data is best categorized as count data which are

highly non-normal and poorly estimated by OLS

Results – HIE Counts13

Total HIE Operational HIE Failed HIE

Standard Normalized Standard Normalized Standard NormalizedDisclosure Law

0.031(0.19)

0.245(1.23)

0.654(2.03)**

1.114(3.04)***

-0.513(1.95)*

-0.977(2.85)***

Population 0.161(8.44)***

-0.099(3.15)***

0.158(4.49)***

-0.115(1.72)*

0.157(6.08)***

-0.063(1.27)

Population Squared

-0.003(6.68)***

0.002(2.35)**

-0.003(3.37)***

0.002(1.29)

-0.002(3.42)***

0.002(1.53)

Democratic State

0.269(1.64)*

-0.135(0.67)

0.340(1.15)

0.519(1.38)

0.135(0.55)

-0.245(0.68)

Broadband Access

-0.002(0.23)

0.008(0.68)

-0.011(0.46)

-0.024(0.87)

0.018(0.95)

0.063(2.94)***

Per Capita GDP

0.009(2.08)**

0.016(7.33)***

0.007(0.82)

0.025(3.06)***

0.005(1.06)

0.004(0.87)

Observations 51 51 51 51 51 51

* significant at 10%; ** significant at 5%; *** significant at 1%

14

Results – Operational and Failure Rates

Operational Rate

Failure Rate

Disclosure Law

0.722(2.03)**

-0.533(1.74)*

Population -0.015(0.27)

0.005(0.11)

Population Squared

0.000(0.19)

0.000(0.35)

Democratic State

0.384(0.98)

-0.220(0.66)

Broadband Access

-0.021(0.80)

0.030(1.45)

Per Capita GDP

0.009(0.86)

-0.006(0.95)

Observations 51 51

* significant at 10%; ** significant at 5%; *** significant at 1%

We find a consistent Positive Association between Health disclosure Laws

Correlation does not fade with the inclusion of various state controls

Other considered covariates were measures of GDP (Health & Computer), measures of legislative professionalism, and state education levels

15

Panel Analysis - Motivation Our Cross-sectional model can only provide some

evidence of correlation between health disclosure laws and HIE activity, but we cannot make any claim about causation

IV approach may mediate some of these concerns, but IV’s from previous literature raise concerns (IV Analysis in Appendix of presentation)

Panel-Analysis allows us to at least address fixed-effects and controls for other factors Covariate of Analysis: HIE Laws vary in the time period

with differing privacy protections Captures health disclosure laws as fixed effects

(passed prior to our dataset)

16

Panel Analysis – Econometric Model Two Dependent Variables (Semi-Annual 2004-2009)

Operational HIEs Total HIEs – Does not include failed HIEs (successful entrants)

Fixed Effects Regression used to estimate basic model for evaluating the effect of various HIE Laws

TotalHIEst& Operational HIEst = o + i*HIELawst+i* HIELawst*HealthDisclosureLawss +

1*Fundingst+2*StateDesignatedHIEst+3*Populationst+4*PopulationSquaredst +5*PerCapitaGDPst +θs +λt+st

Control for other aspects of law that may be encouraging HIE growth Funding State Designated Entity State Scale Effects θsState Fixed Effects and λtTime Fixed Effects

17

Panel Analysis - ResultsTotal HIE Operational HIE

Pro HIE and Consent 2.151 0.692(2.28)** (1.69)*

Pro HIE and No Consent -0.047 0.021(0.14) (0.07)

Pro HIE Only -0.224 -0.122(0.54) (0.35)

Privacy Only -2.791 -1.131(1.94)* (1.95)*

State-Designated Entity -1.974 -0.197(2.59)* (0.51)

Controls YES YESTime Fixed Effects YES YESState Fixed Effects YES Yes* significant at 10%; ** significant at 5%; *** significant at 1%;

18

Panel Analysis – ResultsTotal HIE Active

Pro HIE and Consent -0.063 -0.370(0.16) (1.32)

Pro HIE and No Consent -0.189 -0.281(0.51) (0.62)

Pro HIE Only -0.182 -0.086(0.45) (0.26)

Privacy Only -1.091 -0.743(2.82)*** (4.33)***

Pro HIE and Consent * Health Disclosure Law

2.309 1.276

(3.46)*** (3.03)***Pro HIE and No Consent * Health Disclosure Law

0.293 0.592

(0.56) (1.17)Privacy Only * Health Disclosure Law

-3.504 -0.685

(1.52) (0.65)Controls YES YESTime Fixed Effects YES YESState Fixed Effects YES YES* significant at 10%; ** significant at 5%; *** significant at 1%;

19

Panel Analysis – Results Robust to Inclusion of Various Other Measures:

HIT Adoption Measures EMR Adoption CPOE adoption

Healthcare Characteristics State Measures Managed Care Penetration Over65

No Significant Difference in HIEs between conditions Breadth of Sharing (Results, Inpatient, Outpatient) Amount of Patients Covered Percent of Hospital Beds covered in region Independent vs. Subsidiary Organization

20

Summary of Results So How do Privacy Protections Impact HIE

Progress? It Depends:

Find that of all HIE promoting initiatives, only those that include strong privacy considerations (consent) encourage growth and success This effect is driven strongly by the states that also

have pre-existing health disclosure legislation Find that privacy protections without incentives

has a strong detrimental effect on HIE growth and success However, effect based on a small number of states (3)

21

Limitations Data limitations

Although a comprehensive dataset, still a small dataset

Measurement of some outcomes difficult, such as failed HIEs

Effects based on sometimes small number of “policy interventions” across states Analytical limitation common to other

studies examining cross-state differences

22

Questions?

23

Appendix: HIE and Consent Patient consent has been a central concern with respect

to privacy and HIEs Opt In, Opt Out, No Consent

Federal and State Laws don’t provide requirements for consent for many HIE contexts Covered Entities under HIPAA are not required to solicit

consent prior to disclosure of health information for treatment purposes

State Health Disclosure Laws generally echo these requirements with few states going beyond HIPAA requirements However, state laws do provide additional enforcement power

HIE Laws may apply more broadly than general health disclosure laws (beyond providers and payers) and also may provide requirements beyond current state statutes

24

Appendix: IV ResultsTotal HIE Operational

HIEFailed HIE Operational

RateFailure Rate

Disclosure Law

0.691(1.49)

1.491(1.91)*

-0.047(0.07)

0.513(2.25)**

-0.421(1.83)*

Population 0.199(6.37) ***

0.179(2.56)**

0.226(3.31) ***

0.006(0.20)

0.001(0.02)

Population Sq

-0.004(5.33) ***

-0.004(2.05)**

-0.004(2.62) ***

-0.000(0.28)

0.000(0.89)

Blue -0.103(0.47)

0.178(0.42)

-0.479(1.19)

0.159(0.84)

-0.154(0.80)

Broad Access

0.003(0.28)

-0.028(0.74)

0.037(1.48)

-0.006(0.35)

0.017(0.76)

Per Capita GDP

0.008(3.07) ***

0.009(1.49)

0.003(0.69)

-0.002(0.25)

-0.002(0.22)

N 51 51 51 312 312

* significant at 10%; ** significant at 5%; *** significant at 1%

25

Appendix: Endogenous Passing of HIE Laws

Prior to the passage of these laws (2004-2006), there are small differences between the states

A growing difference between states with and without HIE laws (Not Significant)

Trend of Operational HIEs relative to HIE Laws

2003 2004 2005 2006 2007 2008 2009 20100

0.2

0.4

0.6

0.8

1

1.2

1.4

1.6

1.8

No HIEAny HIEDifference

Year

Ope

ratio

nal H

IEs

26

Appendix: Endogenous Passing of HIE Laws

HIE promoting legislation with weak privacy protections seem to have initially more activity but maintain trajectory

HIE promoting and strong privacy projections seem to display a sharp increase in HIE activity around the passage of these laws

Little growth for states with HIE only and Privacy Only legislation

Trend of Operational HIEs relative to Specific HIE Law Type

2003 2004 2005 2006 2007 2008 2009 20100

0.5

1

1.5

2

2.5

3

ProHIE and ConsentProHIE and No ConsentProHIE OnlyPrivacy Only

Year

Ope

ratio

nal H

IEs

27

Appendix: Potential Causes Given that health data privacy sensitivities exist

even in states with weaker legislative protections, state with more prescriptive legislation dealing with privacy may result in a less ambiguous operating environment for HIEs

Restrictive legislative environments force the “privacy issue” resulting in HIEs that are foresighted in terms of handling privacy concerns, engaging the local community, and developing mitigating technologies and policies

Privacy protections without accompanying incentives may inhibit HIE entry and success due to fears of overly restrictive regimes (all stick and no carrot)

28

Overview of Operational HIEs (2009)

Legal Data - Health Disclosure Laws

State Health Disclosure Law: Laws that (at a minimum) limit the disclosure of patient health

information (through consent requirements) by physicians, hospitals, health management organizations, and insurers

Didn’t include laws that restrict only specific types of data (HIV, Mental Health, etc.) or narrowly applicable

Resources The State of Health Privacy: A Survey of State Health Privacy

Statutes, Georgetown University, Washington, DC, 2002 Compilation of State Privacy Laws by the Privacy Journal,

Updated 2010 Various state legislative references In our data we find 21 states with health disclosure laws and 29

(and D.C.) without

30

Overview of Health Disclosure Laws