Getting Your Own Health Records Online: The Good and the Not So Good

Lygeia RiccardiMaking Sense of Blue Button, Meaningful Use, and What’s Going on in Washington  …

At the recent Health 2.0 Conference in Santa Clara, co-chair Matt Holt expressed frustration about the difficulty of getting copies of his young daughter’s medical records. His experience catalyzed a heated discussion about individuals’ electronic access to their own health information. Many people are confused about or unaware of their legal rights, the policies that support those rights, and the potential implications of digital access to health data by individuals. The Health 2.0 conference crowd included 2000 entrepreneurs, consumer technology companies, patient advocates, and other potentially “disruptive” forces in healthcare, in addition to more traditional health system players.

Why is this topic so important? Until now, most people haven’t accessed their own health records, whether electronically or in paper, and I believe that making it easier to do so will help tip the scales toward more meaningful consumer/patient engagement in healthcare and in health. Access by individuals and their families to their own health records can empower them to coordinate care among multiple healthcare providers, find and address dangerous factual errors, and take advantage of a growing ecosystem of apps and tools for improving health-related behaviors, saving money on health services, and getting more convenient, personalized care.

A shorthand phrase for this kind of personal empowerment through access to digital health data is “Blue Button,” which is also the name of a public-private initiative in which hundreds of leading healthcare organizations across the US participate. The Blue Button Initiative is bolstered by the electronic access to health information requirements for patients in the “Meaningful Use” EHR Incentive Program, which is administered by CMS (the Centers for Medicare & Medicaid Services) with companion standards and certification requirements set by ONC (the Office of the National Coordinator for Health Information Technology).

The Good News

HIPAA Guarantees Individuals’ Rights to Get Their Health Records. The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is the bedrock of patient access rights, providing individuals a legal right to access their own health data held by providers, hospitals and other healthcare players, and to get it in electronic format if available (which, increasingly, it is). HIPAA also requires that a provider send a copy of records to a designated third party at an individual’s request (although this requirement doesn’t specify that it be electronic).

Stage 2 Meaningful Use Certified EHRs Must Have the Technical Capability to Let Individuals Get their Health Data.  The certification rules associated with Stage 2 of the Meaningful Use program require that electronic health records have the capability to enable patients/consumers to view, download, AND transmit their own health information. Further, at least 50% of patients in a particular practice or hospital must have access to all three of these functions in a particular reporting period.

Woah, Wait a Second! Look at the two points above. Together they provide what we’re looking for–individuals’ ability to get their own health records electronically. So what’s the problem?

The Not-So-Good News

Meaningful Use has its Limitations when it Comes to Patient Access. Some folks at Health 2.0 were upset to learn that providers who apply for Meaningful Use incentive payments, and are thus required to report how they are actually using their certified EHRs, aren’t required to show that their patients view, download, AND transmit their own health information. The provider’s EHRs must have the capability to let patients do all three, but when it comes to use, only 5% of a provider  or hospital’s  patient population needs to actually view, download OR (not AND) transmit their health data within a given time period.

Implementation Is Harder and More Time Consuming than Hoped. In response to technical challenges faced by providers and hospitals in implementing the requirements for Stage 2, the government has recently provided flexibility regardintimelines   for the Meaningful Use program. Among the implementation challenges is confusion regarding details of the patient access requirements, many of which are addressed in this ONC blog post

The Bigger Picture & What You Can Do

If you feel frustration about the “not-so-good news,” I hear you. But, having recently worked at ONC myself, in my opinion the fact that Meaningful Use includes any patient engagement/access requirements is a big win. And the truth is, the essence of what’s needed from a legal perspective is provided by HIPAA. Want to further support individual access to health information and engagement?  Here are some steps you can take today:

Listen In & Speak Up. Many members of the Health 2.0 community are underrepresented in Washington DC. You don’t have to set up expensive lobbying and federal affairs offices, but you should dedicate some resources to keeping track of what’s going on in Congress and a few key agencies. Keep your eyes peeled for a new resource that may be coming out of ONC to support you (wink wink, nudge nudge). And remember that Meaningful Use is just one part of a bigger picture. In my opinion emerging payment models associated with the Affordable Care Act (ACA) are the key to getting health data flowing digitally, both directly to individuals and among providers.

Walk the Talk: Share & Use Health Data via the Blue Button Initiative. You don’t need a federal mandate or incentive program to share health data electronically with individuals. The Blue Button Initiative is a voluntary public private effort through which diverse organizations that collect and hold health-related data are making it available digitally to consumers, whether they “have to” via Meaningful Use or HIPAA or not. If you are sharing personal data with the public, make sure you’re listed on the Blue Button Connector . If you’re building apps and tools, integrate Blue Button data others are sharing via APIs  and make sure your app is listed on the Connector site. Need help using the Blue Button recommended standards and other resources? Use the Blue Button toolkit

Harness the Power of the Public. If a large number of members of the general public started exercising their rights to get their own health information electronically, providers, hospitals, payers, labs and others would be under much greater pressure to provide it. But most people have no idea about their legal rights or an appreciation of why they’d want to access their health records. ONC and its partners in the private sector are trying to change that through a national outreach campaign  via the Blue Button Initiative. If this matters to you, please join them! Another way to tip the scales is to build consumer health tools and services so compelling that people start clamoring to get their own data so they can make the most of them.

 Lygeia Ricciardi is a consumer engagement and digital health expert. Until recently, she served as the Director of the Office of Consumer eHealth at ONC.



27 replies »

  1. People who want their medical records don’t know where to start. I don’t think “meaningful use” or “Blue Button” mean a heck of a lot to people in need of their records now. It’s too technical, irrelevant. People need pragmatic info like cost info, rights, process, rules in their state, info on entities, which disclosure here, I am pulling together right now. The topic here is useful to a pretty specialized audience (SPM, other professionals), not the person on the street who doesn’t know how to proceed.

  2. I like what you guys are usually up too. This sort of clever work and exposure! Keep up the superb works guys I’ve you guys to my own blogroll.

  3. There is already a much more powerful model of collaboration with patients called Open Notes that is rolling out across the country. It allows patients to view their entire clinical record and it was was validated by a clinical trial a few years ago –

    All of the health care systems in Portland for example are now using it as well as the VA and it being implemented without any government mandates or incentives. http://www.myopennotes.org/clinical-innovation-and-technology-delbanco-opennotes-is-contagious/

  4. Yikes even after ONC let this woman go she is still trying to sell the failed blue button? Yes people want to see it but honestly a silly marketing meme isn’t the solution nor is some list of insurance companies on a govt website. Did we pay for this? How many providers are using portals or secure messaging? What happened to “direct”?

    Also how is it possible that millions of people have access to their records at the same time they don’t? ONC wasted years with this silly blue button marketing campaign and it failed.. Downloading your insurance EOB is NOT accessing your health information.

    Implementation is not harder there just isn’t any business reason to do it for providers and hospitals but – Kaiser did it years before any MU incentives because it penciled out.

    It is time for the government and former government employees to be quiet and let the market finally figure this out.

  5. Ok here’s my same old complaint, tell seniors about it beyond creating a tool kit and talking aobut Vets using it as doctors and hospitals are too busy to use the toolkits, which were very well done but speaking reality here as to what works. Seniors need people to help them. Every senior I have asked, and have asked a lot of them don’t know what it is and are interested to learn.


  6. I agree with Dr. Palmer’s observation “during the next 100 years we will be worried about making it difficult to allow the leakage of medical records to unauthorized persons.” and I would add to his list of people with an interest in obtaining illicit access reporters and political rivals. [For House of Cards fans, consider the plot line of the politician’s wife (Claire Underwood) having her medical hx exposed, revealing her lies to the press].

    I think a second ongoing issue will be inappropriate authorized users getting access…..[i.e you get referred to a podiatrist and suddenly he and his staff get to see all kinds of things about your medical hx that have no relevance to your presenting dx]. This concern/fear will limit patients’ willingness to confide in their physician….a serious erosion to a fundamental element of Medicine….trust.

  7. “payment reform should explicitly include incentives for patient use of portals and accessed to EHRs, holding providers accountable”

    Right now, my patients are more concerned about jobs, transportation, food, shelter, and clean needles. I guess I should drop all that and start haranguing them about using the portal. Oh, I guess that means I have to get them computers . . . hold me responsible for that too.

  8. Good update piece Lygeia, and good dialogue. Per the last point by Edward in Ohio, I wonder about access to EHR data by the large data firms, like Equifax, etc. They must be lobbying for full access to de-identified data…and then would they have the tools to reidentify? A potential major issue, even in the near term. There’s stiff competition right now for “big data” and to gain advantage in that marketplace.

    I agree that payment reform should explicitly include incentives for patient use of portals and accessed to EHRs, holding providers accountable, over time. Lygeia, that would be a great area in which to develop policy and models. Just a thought.

  9. Many persons may remember the old MIB (Medical Information Bureau). When you applied for various forms of insurance (life, health and disability), typically your MIB records were pulled. Of course, accuracy and availability were always a concern.

    At least, we have moved the bar quite a bit above the MIB days. And of course, accuracy and availability are still important…as they should.

  10. Hi William Palmer MD —

    You make a great point. Even today our health data is shared in ways that may not benefit us and that we often don’t know about. Particularly given that context I think it’s essential that we have access to our own health records…at minimum I’d like to know what information about me is being shared and ensure that it’s correct–beyond that, of course, I’d like to make decisions about who is accessing it and for what purposes. I think efforts to empower individuals to get their own health records are actually very consistent with the way the world is evolving toward greater info exchange generally. If others are going to have data about you, shouldn’t you have AT LEAST an equivalent level of access to your own information?

  11. Most of the time during the next 100 years we will be worried about making it difficult to allow the leakage of medical records to unauthorized persons. Encryption, data ownership issues, IT interoperability, pass codes, biosensors and patient autonomy will haunt these pages, IMHO.

    As you mention above, there are many good reasons to make it easy for patients to obtain their own records. This will happen and will be a blip on the history of HIT.

    There are many reasons why other people would want to see these records: employers, political competitors, worried spouses and lovers, competing job applicants, insurers, sports organizations and gamblers, competiting health plans, hackers for fraud and other crimes, and advertisers.

    The big picture is thus going to be the reverse of your current efforts. But it was a fine article, good luck and go for it.

  12. Hi Andy —

    Thanks for commenting! Sorry to hear about your wife’s experience–I fear many people have had a similarly difficult and frustrating time.

    I totally agree with you that we’ll progress from simple tasks to more complex ones involving use of our own health records, and that identifying errors is one of the easiest (and most fruitful) places to start.

  13. It’s great to see you back in public talking about health, Lygeia. My wife had a recent experience bolstering the importance of VDT. Her specialist committed the sin of moving to a different provider, and the old one threw every barrier in her way to getting her records, including telling her to show up at a particular time and not being there, leaving her with a locked office. I think most patients will start with checking for errors, and be rewarded with a bunch of them. The kinds of sophisticated processing we’re all hoping for will have to come later, when the environment with all these open records will lead application developers to provide easy-to-use tools for behavior and health management.

  14. Hi Scott Briggs —

    I think the main reason for low levels of electronic exchange of health care records both among providers and between providers and patients today is the lack of financial incentives to do so. Most providers are paid via the “fee for service” model — they are paid according to the number of patients they see or procedures they perform, regardless of the health outcomes. Some may actually perceive a disincentive to sharing their patients’ records — they may fear losing patients to another provider, or have concerns about opening themselves to increased liability. At the very least, they may not want to spend the time (for which they are not directly paid) finding and transferring records, and perhaps answering questions that come up as a result.

    Among the most promising aspects of the Affordable Care Act, IMHO, is that it’s testing new payment models such as Accountable Care Organizations (ACOs), in which a group of providers from across the continuum of care (including acute care, long term care, and behavioral and mental health care) collaborate. They are held “accountable” for the health of their patients. If the quality of patient care for the people they are treating improves or stays the same but costs decrease, the providers get to keep a share of the savings. Given that providers can provide better care if they are well informed about their patients’ health, providers have a financial incentive to collaborate (including sharing records electronically) with each other–and with patients–to improve health and keep costs low.

  15. @ Lygeia

    Can you provide more detail about “In my opinion emerging payment models associated with the Affordable Care Act (ACA) are the key to getting health data flowing digitally, both directly to individuals and among providers.”

  16. BobbyGvegas & Granpappy Yokum — There are multiple studies that show that people do in fact want access to their health records — I replied to Bubba with a couple of them, but my comment is “awaiting moderation,” presumably because it includes links.

    Despite these surveys, I’ll grant you that many people are less interested in their health in general when they are healthy, but there are aspects of it they may in fact care a lot about — like controlling their weight, for example, or managing meds, or saving $ on routine and preventive care. Also, you can go from “healthy” to “unhealthy” very quickly with an illness or injury. Even if someone may not choose to access his or her health info today, they may need it urgently tomorrow. Whether or not they may take advantage of it extensively, the fact is, it’s a legal right for people to access their health records. Let’s make it easier to exercise that right, and hopefully improve both health and healthcare in the process.

  17. “Access by individuals and their families to their own health records can empower them to coordinate care among multiple healthcare providers, find and address dangerous factual errors, and take advantage of a growing ecosystem of apps and tools for improving health-related behaviors, saving money on health services, and getting more convenient, personalized care.”


    Maybe not.

  18. At the 2014 Health 2.0 Conference, IIRC, it was athenahealth CEO Jonathan Bush who said “no one gives a shit about their health when they’re healthy.”

  19. Hi Bubba For President — Thanks for your question. Yes, actually, repeated surveys show that the average person DOES want access to his or her medical records. For example, last May Accenture released a report ( at http://www.healthcareitnews.com/news/patients-want-online-access-records ) that underscores the point that the majority of Americans, particularly those with chronic conditions, do want access. See also research by the OpenNotes initiative that shows that 99% of patents who participated in a study in which they were able to access their records (including their doctors’ notes) wanted to continue to do so after the study ended (http://www.myopennotes.org/research/ )

  20. Has anybody actually scientifically established that the average person wants their medical records? I don’t think they have.