Information Handling Practice

The eHealth Exchange Data Use Reciprocal Support Agreement (DURSA) requires every eHealth Exchange Participant to only request, use, or disclose patient information if the request, use, or disclosure is permitted by law.  In order to effectively operate the eHealth Exchange Network, the eHealth Exchange operates as a business associate of each Participant, where the business associate contract requires the eHealth Exchange to protect the privacy and security of patient information.

Some uses and disclosures that are permitted by law require patient consent or authorization, while others do not.  HIPAA generally permits providers, health plans, and other covered entities to use and disclose patient information for purposes of Treatment, Payment, and Healthcare Operations without obtaining the individual’s consent or authorization.  Some states, however, may impose addition consent requirements where HIPAA does not.  Before exchanging patient data for any purpose that requires patient consent, it is the responsibility of covered healthcare providers and health plans to ask patients whether their healthcare data should be exchanged or, if authorization is required, to obtain the patient’s written authorization.

Some healthcare organizations collect patient consents via an “opt-in” model, where patients must affirmatively elect to share their data as specified. Other healthcare organizations utilize an “opt-out” process, where they share data with other trusted organizations unless the patient explicitly chooses to not have his/her data exchanged.  Some states have laws that require either an opt-in or opt-out model, while other states leave it up to the provider or other healthcare organization to determine its own consent process.