“HIE. Not for me.”
The chant echoed around the steps of the state capitol March 18.
The crowd had marched from the Oklahoma Health Care Authority’s office parking lot, down Lincoln Boulevard before several hours of speeches under a sun fierce enough to burn but too cold to free them from their coats and sweaters.
The protest’s focus?
The implementation of Senate Bill 1369—a law creating a statewide health information exchange (HIE) and requiring health care providers to participate.
The text of the bill defines health information exchange as “the electronic movement of health-related information among organizations according to nationally recognized standards for purposes including, but not limited to, payment, treatment, and administration.”
It requires that the state appoint “an entity whose primary business activity is health information exchange and which is governed by its stakeholders” to run it.
“Beginning July 1, 2023, all health care providers as defined by the rules promulgated by the Oklahoma Health Care Authority Board and who are licensed by and located in this state shall report data to and utilize the state-designated entity,” according to SB1369.
SB1369 passed in both legislative bodies and was signed into law by Gov. Kevin Stitt on May 11, 2022.
Provider protests
The universal nature of the HIE caused a large number of mental health care providers to become concerned that their clients’ right to privacy would be affected.
“Our goal is to focus on preserving a client’s right to consent and a client’s right to privacy over what is shared,” Oklahoma Providers for Privacy Representative and Board Member and Licensed Professional Counselor and board approved Licensed Professional Counselor Supervisor Shay Espinosa said.
Oklahoma Providers for Privacy organized the March 18 protest at the capitol, which was scheduled the Saturday before the Oklahoma Health Care Authority (OHCA) Board of Directors approved a revised version of APA WF 22-16 Statewide HIE, on March 22.
“The proposed revisions will implement the changes required by OK Senate Bill 1369 to the Oklahoma statewide Health Information Exchange (HIE),” according to the OHCA website.
When discussions surrounding APA WF 22-16 began to circulate in the time leading up to the March 22 meeting, a portion of the mental health professionals community realized that mental health care providers would be included in the mandate to participate in the HIE system.
Espinosa emphasized the importance of total confidentiality in providing mental health care to clients.
“There is such a stigma about obtaining mental health services that many clients will stop seeking services if they’re worried who is going to know that they’re even obtaining therapy,” Espinosa said.
Opponents of SB1369 listed several reasons that an individual may need to keep their mental health records private, including possibly from healthcare professionals.
“Unfortunately, there are providers where if somebody comes in and says, ‘Hey, I’m having this physical symptom,’ if their chart says that they have anxiety or that they have bipolar disorder, or that they have ADHD or some—you know, any mental health diagnosis, there’s an unfortunate possibility that physical symptoms might be misattributed to those diagnoses,” Kimberlea Harlow said.
Harlow is a master’s student pursuing Licensed Professional Counselor licensure and was a member of the temporary board for Providers for Privacy when the March 18 protest was held.
Other reasons individuals might need their mental health information protected are the negative effects a data breach could have on women, children, LGBTQ+ individuals, immigrants and minority groups.
Marriage and Family Therapist Candidate April Starr spoke at the protest, sharing the story of her experiences providing therapy to women who had been victims of domestic violence.
“Not only are these women isolating in their houses because they fear being found by their ex-partner, but they also hide in their houses because their PTSD symptoms are so extreme that they can’t hardly leave the house,” she said. “They are on fire and drowning.”
Starr said that she is waiting to tell her clients about the possibility of the HIE requirements until she knows that she has no other choice.
“I haven’t discussed this mandate with most of my clients because they’re in a place that even the threat of their privacy going away would likely cause suicide,” she said.
The bill endangers her clients, Starr said.
“The carelessness with which this bill was written speaks to the privileged position of those who wrote it and the lack of care for anyone with mental health issues, but even more so, a lack of care for the lives of women and children in the state,” Starr said.
Legislative response
Oklahoma State Representative Jacob Rosecrants (D-Norman) acknowledged the protestors’ concerns in his speech to Oklahoma Providers for Privacy.
“It does suck—the fact that everybody was not talked to about this before they rolled it out. This is why this happened,” Rosecrants said.
He said he supports the creation of a statewide HIE in general but believes mental health care should be exempt.
“It makes sense when you’re talking about medical, because you’re talking about okay, this person comes in and you just pull it up real quick; you’re like ‘Oh, they have this history of a knee problem or whatever else,’ right?” Rosecrants said. “It doesn’t make sense when it comes to those private conversations that you’re having with your mental health therapist.”
Other legislators responded less favorably to protests.
“I’m astounded by some of the unprofessional conduct with some of our counseling association and some of our counselors,” Oklahoma State Rep. Marcus McEntire (R-Duncan) said at a press conference March 21. “They’ve chosen to react emotionally and unethically toward the HIE by telling their clients that it’s something nefarious and that their sensitive data is somehow compromised or at risk.”
McEntire said that the new HIE system will be in compliance with all existing laws and regulations protecting sensitive health data.
“The law is and has been clear on this data,” McEntire said. “And I’m concerned that those who have worked to destigmatize mental health for the last 10-20 years have been thwarted, those efforts have been thwarted, by this. And it’s been done by those administering the care. And so I’m kind of angry about it.”
Another HIE bill
Meanwhile, a second bill—House Bill 1688, that’s first reading in the House on Feb. 6—passed out of the House and into the Senate on March 22.
Among other things, this bill would expand the role of the Office of the State Coordinator for Health Information Exchange to include implementing the Oklahoma Health Care Transparency Initiative Act of 2023.
To implement this act, the office would “collect, validate, analyze, and present health data, including claims data” among other tasks, according to the version of HB1688 being considered by the Senate.
If this version of the Bill is signed into law, it would allow a more specific set of exemptions to SB1369, including “financial hardship, size of the practice, technological capability, type of health care provider, or such other bases as may be provided by rules promulgated by the Board.”
HB1688 would also require the creation of penalties up to $1,000 per day for healthcare provider entities who fail to submit data to the HIE system, with the only listed exception to these penalties being for state or federal health care entities.
Backing the bills
Proponents of the statewide HIE have said that it will improve the quality of care that patients receive.
According to OHCA’s Health Information Exchange Fact Sheet, “With the statewide HIE, the state can vastly improve public health, care coordination, records exchange, and address care fragmentation and care gaps for providers.”
When healthcare providers are able to access a statewide database of patient records, they will be able to gather information on behalf of unconscious patients in emergency situations.
“I live in Duncan, Oklahoma,” McEntire said at the press conference. “If for some reason I’m in Tulsa on a legislative thing and I have a wreck and I’m in the ER and I am unconscious, then the medical professionals in the ER in Tulsa would be able to pull up my medical records, know what drugs I am taking.”
Additionally, access to patients’ mental health records specifically, could allow primary care physicians and others to better support patients’ mental health needs.
Oklahoma Department of Mental Health and Substance Abuse Services (ODMHSAS) Chief Communications Officer Heath Hayes said that half of the more than 800 people who died by suicide within the last year saw a primary care physician during the week before their death.
HIE implementation
The health information exchange program that SB1369 mandates will be implemented through two companies: MyHealth, a Tulsa-based nonprofit, and Orion Health, based out of Auckland, New Zealand.
“MyHealth has the contract for the State Designated Entity and provides all day-to-day operations activities for the HIE, including governance and policies and procedures,” Oklahoma Health Care Authority Public Affairs Coordinator Emily Long said. “Orion Health has the technology contract for software and state systems integration.”
The awarding of the contracts was a complex process.
“The original HIE effort was first announced by the Health Care Authority back in 2020,” according to the Oklahoma State Medical Association website. “At that time, the Health Care Authority contracted with an out-of-state platform called Orion to set the program up.”
MyHealth responded by filing a complaint “pointing out their bid was approximately $30 million lower than Orion’s. After several months of negotiation and legal wrangling, OHCA and MyHealth reached an agreement,” according to the Oklahoma State Medical Association.
Both Orion Health and MyHealth were contracted to provide services for the HIE.
“Orion Health was selected as the HIE technology vendor through a competitive bidding process,” Long said. “MyHealth Access Network was designated as the State Designated Entity through a sole source contract justified based on their unique qualifications.”
According to MyHealth’s website, the nonprofit’s Board of Directors includes three state employees: Oklahoma Secretary of Health and Mental Health Kevin Corbett, Oklahoma Health Care Authority State Coordinator for Health Information Exchange Stephen Miller, and Oklahoma State Department of Health Commissioner of Health Keith Reed.
A spokesperson representing MyHealth stated that the board members are not financially compensated for their service.
“All of MyHealth’s funding is from subscription revenue,” Oklahoma City University Assistant Professor of Accounting Robin L. Walker said in a brief written analysis of MyHealth’s tax forms from 2015 to 2019.
According to OHCA’s Health Information Exchange factsheet, “There is a one-time connection fee to establish EHR [electronic health record] system interoperability. This is a variable cost dependent on a provider’s system, and the estimated average is $5,000,” and providers will also need to pay an ongoing subscription fee.
Providers unable to meet this requirement such as due to financial reasons may request an exemption, according to the factsheet.
Patient consent
Healthcare providers will receive training in how to handle relevant consent paperwork for the HIE.
“As part of on-boarding to the HIE, behavioral health providers/staff are trained to present to the patient a notice of privacy statement that describes the HIE and asks for the patient’s consent by signing a consent form,” Long said. “Only if the patient consents is their data sent to the HIE, otherwise the HIE has no knowledge of their visit or encounter with that clinic/provider.”
While behavioral health will operate on an opt-in basis, other health records may be on an opt-out basis.
“All patients have the ability to block access to their data,” Long said. “This can be requested at their provider or requested directly to the HIE using the opt-out form. For behavioral health providers, licenses and other state laws require them to gain patient consent prior to sharing information. These providers will offer an opt-in form.”
Forms where patients can opt-out or revoke previously opting in to MyHealth’s system are available at myhealthaccess.net/opt-out.
Additionally, patients can ask to have only certain information withheld from the HIE system.
“Patients can request to have specific information marked as sensitive and not included with the rest of their information,” Long said. “Patients will need to make this request to their provider during their appointment.”
This policy appears to have some mental health practitioners wondering why they’re being included in the HIE at all.
According to a statement by the Oklahoma Counseling Association (OCA), “Our belief is that very few, if any, of our clients will ever opt-in to the system. If our members have no records to submit to the system then why are we being required to pay $5,000 and still join the HIE? In addition, the ongoing monthly fees will cause a significant financial burden to our private counseling agencies, which generally operate on very thin profit margins.”
The organization said that no OCA members prescribe medication, so there is no risk of a drug interaction if information from OCA members’ practices is withheld from the HIE.
Data security
“Access to the data within the HIE is strictly governed by HIPAA and audited in real time,” McEntire said.
Unauthorized access to records will be flagged.
“If somebody looks into your health record and they are not in the chain of your primary care physician, and they’re somebody outside of that, that instant will be logged and will be investigated,” he said. “Nobody should be looking at health data that does not pertain to their patient.”
When asked to provide information regarding how information usage will be monitored and any kind of potential breach of confidentiality might be addressed, (ODMHSAS) Chief Communications Officer Heath Hayes said that he didn’t know how to respond.
“You can have all the faith and confidence and all of the firewalls and protection of a system but that doesn’t give you any guarantees or safeguards at the end of the day,” Hayes said.
Meanwhile, according to MyHealth’s website, “MyHealth systems were designed and continue to be evaluated by a third-party world-class information technology security company, and are regularly scheduled for secondary independent professional review.”
Some opponents of the HIE said that these measures aren’t enough.
“Part of HIPAA was to assure the public that their medical records would be kept private,” Oklahoma City University School of Law Professor Emeritus and Health Law Program Director Vicki Lawrence MacDougall said. “When you look at the wall of shame, which you can access on any computer, you have to wonder how well that’s working.”
The “HIPAA wall of shame” is an unofficial name for an online list kept by the U.S. Department of Health and Human Services Office for Civil Rights, documenting data breaches affecting the health information of at least 500 individuals.
As of April 28, seven incidents are listed as currently under investigation in the state of Oklahoma. Nationwide, 867 entries are in the currently under investigation section of the list.
The list’s archives section shows a OHCA data breach in 2022, affecting the health information of 8,629 people, “including names, dates of birth, addresses, social security numbers, and account information.”
“I do not think that Oklahoma is necessarily any better or worse than other states at the present time, as far as maintaining confidentiality,” MacDougall said.
With HB1688 having passed the House but not yet passed in the Senate, the HIE could change a lot, or not at all, depending upon the bill’s fate.
Unless modified by further legislation, the current Oklahoma HIE system will take effect July 1.
