HIM 400 Module 6 Data Sharing Short Paper Example

Permitted, Required or Blocked? Three Data Sharing Decisions at Cold Brook Health

[Student Name]

Southern New Hampshire University

HIM 400: Communication and Technologies II

Module Six Short Paper

[Instructor Name]

[Date]

The organization, setting and figures below are a composite written as a model document. No real employer, client, colleague or patient is described.

Permitted, Required or Blocked? Three Data Sharing Decisions at Cold Brook Health

For most of the history of health information management, the safest answer to a request for records was to slow down. HIPAA permitted many disclosures but required few, so delay rarely broke a rule. That changed once Congress, through the 21st Century Cures Act, turned interference with sharing into a violation. At Cold Brook Health, three situations from the past month show how the rules now interact. This paper explains the frameworks, applies them to each case and recommends changes to Cold Brook's policies.

Two Frameworks

HIPAA's Privacy Rule sets when protected health information may be used or disclosed. Sharing to treat a patient, obtain payment or run the organization is allowed without the patient's authorization, and individuals may obtain copies of their own records, which a covered entity must usually supply within 30 days of the request. The information blocking regulations, written by the federal health IT coordinator's office to carry out the Cures Act, work the other way. They bar conduct that an actor knows, or should know, will probably get in the way of electronic health information moving to those entitled to it, unless a law requires the conduct or it fits a defined exception. The rules apply to three groups of actors: health care providers, developers of certified health IT and health information networks or exchanges. For developers and networks, penalties can reach $1 million per violation, and since 2024 providers face disincentives through Medicare programs.

Why Exchange Matters

Sharing is not only a legal duty. Across the exchange evaluations reviewed by Menachemi et al. (2018), most reported benefits, such as fewer repeated tests and imaging studies and lower emergency department costs, although study quality varied. Adler-Milstein and Pfeifer (2017) surveyed leaders of exchange organizations and found that about half believed electronic record vendors routinely engaged in information blocking, and about a quarter believed hospitals and health systems did, often for competitive reasons. The rules exist because voluntary sharing had not been enough.

Case 1: The Seven-Day Hold

Cold Brook's portal releases lab results to patients seven days after they are finalized, so clinicians can call with abnormal results first. The policy is well meant, but a blanket delay for all results is likely to interfere with patients' access to their information, and no exception clearly covers it. The preventing harm exception needs a licensed clinician's judgment about a particular patient that releasing the information would put someone's life or physical safety at real risk, and separately a patient may ask for their own results to be held. Neither describes an automatic hold on every cholesterol panel.

The recommended fix is to release most results immediately, let patients choose in the portal whether they want certain results held until their clinician calls and allow a clinician to document an individualized harm determination for a specific result when justified. Clinicians should also be prepared for patients reading results first by writing brief interpretive comments on common tests.

Case 2: A Request Through the Exchange

A federally qualified health center that now treats a Cold Brook patient requested her records through the statewide exchange. The disclosure is for treatment, so HIPAA permits it without authorization, and refusing or slowing a routine treatment request could be information blocking. One part of her record is different. She received care in Cold Brook's opioid treatment program, whose records fall under a stricter federal regulation for addiction treatment programs, known as Part 2. Those records need her written consent. A 2024 federal rule now allows a single consent to cover future treatment, payment and operations disclosures, and she had signed one at intake.

The problem was technical: Cold Brook's exchange feed did not tag Part 2 records, so the analyst could not be sure whether they were flowing without the needed consent. Cold Brook should tag and segment Part 2 data in its record and exchange interface, confirm consent status before release and send the rest of the record promptly.

Case 3: A Patient's App

A patient asked to connect a consumer app to her record through Cold Brook's patient access interface. Certified record systems must now offer standard application programming interfaces based on HL7 FHIR. Mandel et al. (2016) described how the SMART on FHIR platform lets outside applications connect to many record systems through shared standards for data and authorization, and those standards underlie today's patient access interfaces. The compliance officer worried that the app's privacy policy allowed it to share data with advertisers.

Under the information blocking rules, Cold Brook may not refuse the connection because it dislikes the app's privacy terms, as long as the app meets security requirements. It may educate the patient in a fair, factual way about the app's practices. Once data reach the app, HIPAA generally no longer protects them, because the app is not a covered entity or a business associate. Cold Brook added a short notice to its portal explaining this, and the patient chose to connect.

Summary of Decisions

Table 1 summarizes the three cases.

Table 1. Three Data Sharing Decisions

Note. Prepared by the author for Cold Brook Health's policy review.

What Cold Brook Will Change

The analyst's recommendations went to the compliance committee as four policy changes. The portal release policy will be rewritten so that results post as soon as they are final, with a patient-controlled option to wait for a call and a documented clinician review for individual exceptions. The exchange interface will tag Part 2 data at the source so that consent can be checked automatically. The release of information team will receive a one-page guide that sorts common requests into permitted, required and exception categories. Finally, every refusal or delay of an electronic request will be logged with the exception relied on, so the organization can show its reasoning if a complaint reaches regulators.

Conclusion

The three cases share a lesson: HIPAA tells an organization what it may share, but the information blocking rules now expect it to share unless a specific reason applies. For health information management professionals, the safest answer is no longer delay. It is a policy that releases information promptly, applies exceptions case by case, protects specially regulated records through technical tagging and gives patients clear information about where their data will go.

References

Adler-Milstein, J., & Pfeifer, E. (2017). Information blocking: Is it occurring and what policy strategies can address it? Milbank Quarterly, 95(1), 117-135. https://doi.org/10.1111/1468-0009.12247

Mandel, J. C., Kreda, D. A., Mandl, K. D., Kohane, I. S., & Ramoni, R. B. (2016). SMART on FHIR: A standards-based, interoperable apps platform for electronic health records. Journal of the American Medical Informatics Association, 23(5), 899-908. https://doi.org/10.1093/jamia/ocv189

Menachemi, N., Rahurkar, S., Harle, C. A., & Vest, J. R. (2018). The benefits of health information exchange: An updated systematic review. Journal of the American Medical Informatics Association, 25(9), 1259-1265. https://doi.org/10.1093/jamia/ocy035