Any American that has encountered the US healthcare system is likely to be familiar with HIPAA, the Health Insurance Portability and Accountability Act of 1996. Initially enacted to enhance the portability and continuity of healthcare coverage, it has come to symbolize patient privacy and security protections thanks to the enactment of the Privacy Rule (2003) which among other things identifies and outlines the use of Personal Health Information (PHI) and PHI access for patients and the Security Rule (2006) which sets guidelines for electronically stored PHI (ePHI) and data security protections.
The HITECH ACT
In 2009, the Health Information Technology for Economic and Clinical Health Act (HITECH), expanded patient access to electronic records and set the stage for a healthcare data revolution.
The HITECH Act spawned new interest in data access with both Federal funding through incentives, together with penalties for failing to digitize medical records based on Meaningful Use criteria.
Providers were required to allow patients to “view, download and transmit” a minimum record set and to prove that patients were actually doing it. The patient portal was born with technology to facilitate patient access with a defined focus on “patient experience”. Health systems and providers that received federal funds were suddenly forced to make patient engagement a priority.
The Obama Administration mandated that The Office of the National Coordinator for Health Information Technology (ONC), another department within Health and Human Services (HHS),
implement a Nationwide Health Information Technology infrastructure that allows for electronic use and exchange of information.
The 21st Century Cures Act
In the fall of 2016, the sweeping 21st Century Cures Act was passed and mandated the ONC to address this serious issue. In March 2019 it proposed a new rule to support seamless and secure access, exchange, and use of electronic health information (EHI). The final rule of the Cures Act issued in September of 2020 mandates a strong focus on a patient’s ability to access their health information through a provision requiring that patients can electronically access all of their EHI (structured and/or unstructured) at no cost. Finally, to further support access and exchange of EHI”.