March 7, 2016

Privacy regulation can improve adoption of health information exchanges

Health information exchanges (HIEs) use information technology to allow patients’ medical records to be shared among unconnected health care organizations. These exchanges seek to improve efficiency and quality of care, but they can also raise substantial concerns regarding the privacy of patients’ data.

To date, 25 states and the District of Columbia have attempted, through legislation, to incentivize HIE efforts (most often by providing funding), to address patient privacy concerns, or both. Often, privacy regulation is seen as an obstacle to technological innovation and the adoption of new services.

Julia Adler-Milstein
Julia Adler-Milstein

In a study forthcoming in the INFORMS journal Management Science, however, researchers from the University of Michigan, University of Notre Dame and Carnegie Mellon University found that among states with HIE laws, only those that combined incentives with privacy requirements for patient consent saw a net increase in HIEs that were actively exchanging information (operational HIEs).

“Two of the most significant barriers to planning and operating a health information exchange are cost and patient privacy,” said Julia Adler-Milstein, assistant professor of information and health management and policy at the University of Michigan’s School of Information and School of Public Health.

“Conventional wisdom suggests that increased privacy regulation impedes technological innovation. We provide evidence that this is not always the case,” said Idris Adjerid, assistant professor of management at the Mendoza College of Business at the University of Notre Dame.

“To understand the impact of privacy regulation on innovation, we must not treat regulation coarsely, as a binary, yes/no variable. Our findings show that privacy regulatory interventions can take many forms, and produce a nuanced array of effects on technological adoption,” said Alessandro Acquisti, professor of information technology and public policy at Carnegie Mellon University’s H. John Heinz III College.

The researchers analyzed semi-annual data from 2004 to 2009 to compare the probability of a health care market having a HIE in the planning or operational stages with different legislative approaches to offering incentives and patient privacy protections.

“States that offer incentives to alleviate some of the financial burden of building the technical and administrative infrastructure of a HIE and require that patients opt-in to the exchange of their personal data are encountering the most success,” said Rahul Telang, professor of information systems at Carnegie Mellon University’s Heinz College.

During the period studied, a number of states passed legislation that provided the optimal provisions for HIE growth — incentives combined with patient consent. Of all attempts to incentivize HIE efforts, only those coupled with privacy regulation including consent requirements resulted in a net-gain in HIE efforts: health care markets in these states saw an 11 percent net increase in the propensity of having an operational HIE.

States that offered incentives without any privacy regulation saw no measurable gain in the propensity of a health care market to have an HIE in the planning or operational stages. HIE efforts were negatively affected when states enacted privacy regulation without providing incentives for their creation.

“We also found that health information exchanges in states that offered incentives and required patient consent reported fewer challenges from patient privacy concerns than those in states with other legislative approaches,” said Rema Padman, professor of management science and health care informatics at CMU’s Heinz College.

The results suggest that privacy regulation can act as an enabler for incentives aimed at subsidizing the deployment of technologies that may be privacy-sensitive.