The Patient Record Scorecard and Survey Explained Hosted by: Deven - - PowerPoint PPT Presentation

1

The Patient Record Scorecard and Survey Explained

Hosted by:

Deven McGraw

Chief Regulatory Officer at Ciitizen

(Former Deputy Director, Health Information Privacy at OCR)

2

Slide Title

Goals

• Yesterday (8/14/19), Ciitizen announced the publication of the following tools that

evaluate health care provider’s compliance or likely compliance with the HIPAA Right of Access:

• Scorecard: patientrecordscorecard.com
• Survey: ciitizen.com/survey
• Whitepaper: https://www.medrxiv.org/content/10.1101/19004291v1
• We will present overall findings and share why we did this work and how we did it
• We will also talk about about what’s next for the scorecard and survey

3

Slide Title

Ciitizen: who we are

• Help cancer patients collect,

summarize and share medical data free of charge

• Enable patients to get

second opinions, coordinate with caregivers and donate to research

4

Slide Title

Why we did this

• OCR released extensive guidance on the Right of Access in 2016 - but through
• ur work of helping patients request their medical records we saw it didn’t appear

to have made much of a difference

• Recently OCR announced more robust enforcement of the Right of Access
• We want to raise the bar on compliance with the Right of Access – and get

processes improved before OCR knocks on the door

• We’re taking a page out of the quality measurement playbook – what gets

measured and publicly reported gets improved

5

Slide Title

The Patient Record Scorecard

• We sent medical record and radiology requests to 51 healthcare providers, based
• n actual requests by 30 Ciitizen users - patientrecordscorecard.com
• All patients requested digital copies to be sent (through an encrypted portal or by

e-mail for text and CD for images) to Ciitizen. They acknowledged security risks

• f unencrypted e-mail and the possibility of sharing sensitive health information
• We rated medical providers from 1-5 stars
• Score is based on the latest request (not averaged) - many scores based on only
• ne request

Scorecard: About

6

Slide Title

Four key right of access components

• Accepts requests by email or fax: Providers may not create a barrier to access by

requiring patients to submit requests in person or by mail

• Sent in format requested to the patient’s designated recipient: The provider

sends the records in the format the patient requests, which is in digital form by email for text, CD for images, and sends it to the third party designated by the patient

• Sent within 30 days: The provider responds to the request within 30 days of

receipt.

• No unreasonable fees: Providers may only charge reasonable, cost-based

7

Slide Title

Star rating key

8

Slide Title

Ciitizen Five-Star badge

• Our goal is to help providers

understand where record release processes can be improved to become patient-focused

• We will be highlighting Five-Star

providers and sharing stories of providers who put effort into improving the way they process patient requests

9

Slide Title

Patient Record Scorecard analysis

10

Slide Title

Primary reason of non-compliance: records not sent in form and format requested

11

Slide Title

Too much intervention needed to get records

Without intervention to HIM Supervisors and/or Privacy Officers, 71% of our requests would not have been fulfilled pursuant to HIPAA requirements.

12

Slide Title

• We called healthcare institutions in order to assess likelihood of compliance -

ciitizen.com/survey

• During the period of August 2018-May 2019 we called and obtained reportable

data on ~3,000 institutions

• We asked a set of consistent questions to medical records and radiology

departments

• We summarized our findings in a whitepaper -

https://www.medrxiv.org/content/10.1101/19004291v1

HIPAA Right of Access Survey

13

Slide Title

• Will you accept a patient’s access requests by email or by fax?
• Some institutions required the patient to come in person or to mail a request.
• Will you send the records directly to the patient?
• Some institutions reported they would only send the records to another medical

professional.

• Will you send the records to a patient by email?
• Some institutions refused to send electronic records by e-mail.
• Do you charge patients for these records – and if so, how much?
• Some institutions shared a fee amount, more details on next slide.

Survey questions asked to healthcare providers

14

Slide Title

Per OCR guidance on the Right of Access:

• We considered an institution to be charging “reasonable fees” if they:
• did not charge patients,
• charged a flat fee of $6.50 or less, or reported fees that seemed to be based on reasonable

labor costs for copying

• We considered an institution to be charging “unreasonable fees” if they:
• charged per page fees, including fees for records retrieval, or charged a flat fee higher than

$6.50

• Institutions who did not answer this question are reported as NA (not applicable)
• When answers suggested compliance, we gave institutions credit

Analysis of reasonable fees:

15

Slide Title

HIPAA Right of Access Survey analysis

16

Slide Title

What we also found

• Based on responses, medical records departments are four times more non-compliant than

radiology departments

• However, radiology departments are much more non-compliant in terms of sending records

directly to the patient, insisting on only sending to a doctor’s office (77%)

• When a provider indicates non-compliance in terms of charging fees, the majority (72%) also

had responses indicating non-compliance with another aspect of the right of access

17

Slide Title

Our scorecard and survey show similar results

18

Slide Title

Healthcare provider compliance with HIPAA critical to patients over next few years

• Still too much noncompliance out there – too hard for patients to exercise their right of access,

particularly when they both don’t know enough about HIPAA to push back or have the time and energy to fight these battles

• Direct access by patients to their records in Electronic Health Records (EHRs), particularly

through open, standard APIs, will become more robust – but it will take years before this is fully implemented, especially for the entire “designated record set”

• We will still need medical records offices – and their vendors – to be compliant with the Right
• f Access for some time to come

19

Slide Title

Potential limitations of scorecard and survey

• Many providers were scored based on one request
• For HIPAA compliance with the right of access, being compliant with each

request matters

• But makes meaningful statistical analysis more difficult
• We took detailed notes but did not record interactions (either for

scorecard or survey)

• Phone surveyors worked from scripts but we lacked reporting

conventions for fee information

• Providers evaluated separately by location

20

Slide Title

What’s next?

• We will continue to do rolling updates to the scorecard - updating the

scores of existing providers and adding new providers

• Continue free monthly webinars to educate providers on the right of

access; private webinars and assessments also possible.