HIPAA Data Sharing Regulations Present SDOH Referral Challenges

HIPAA data sharing regulations present challenges to cross-sector interoperability for social determinants of health (SDOH) referrals, according to a study published in the American Journal of Managed Care.

Researchers examined data sharing for Mid-Ohio Farmacy (MOF), a collaboration between The Ohio State University Wexner Medical Center (OSUWMC) and the Mid-Ohio Food Collective, a community-based organization.

MOF seeks to address food insecurity for at-risk patients with a referral from their healthcare provider to access fresh produce through a local network of food banks.

Interviews with leaders from both organizations revealed that HIPAA policies related to the exchange of personal health information (PHI) between covered entities (ie, OSUWMC) and noncovered entities (ie, the Food Collective and associated food pantries) was a preliminary challenge to the creation of the partnership.

“Although HIPAA allows for data sharing of PHI between covered and noncovered entities for the purpose of coordinating patient care (eg, as in the MOF) through a business associate agreement (BAA), Food Collective interviewees expressed concerns regarding what specifically is allowable under HIPAA and whether partner food pantries could be HIPAA compliant, ultimately resulting in their reluctance to enter into a BAA,” the study authors explained.

The organizations resolved these concerns by requiring patients to consent to the release of information. However, this decision entailed significant legal discussion between entities which presented an initial hurdle to the partnership’s creation.

The release of information also created a more detailed clinical workflow and an additional potential barrier to patient participation in the MOF, as individuals may be hesitant to share their PHI with external organizations.

Additionally, the organizations had to create a unique, partnership-specific patient identifier in order to link patients across entities.

“Our findings suggest that more work is needed to develop approaches for integrating data fully across sectors,” the study authors wrote. “Although the MOF partners successfully developed a unique patient identifier enabling longitudinal tracking of patients in aggregate, the partnership lacks a shared database, preventing more nuanced integration of data into patient care and programming.”

Recent industry efforts have sought to increase community partner participation in cross-sector data sharing toward the development of shared databases.

For example, the Robert Wood Johnson Foundation Data Across Sectors for Health initiative and the Centers for Medicare and Medicaid Innovation Accountable Health Communities program aim to create greater linkages between healthcare and social services agencies, the study authors noted.

“As with our efforts, data sharing has emerged as a key facet of the studied models, yet additional guidance on creating fully integrated, shared databases at the point of care is still needed to leverage cross-sector alignment toward health equity,” they wrote.

The study authors said that their findings are limited as they studied a limited sample of stakeholders in a single SDOH referral partnership.

“We chose to focus on OSUWMC’s experience given its stage in development of bidirectional data exchange with the Food Collective, whereas other partners in the MOF, including FQHCs and Medicaid managed care plans, are less far along in their implementation and have different goals and resources to support the development of the data exchange,” they said.

“There is vast potential for integration of social risk data to enhance population health by permitting greater diagnostic precision, facilitating shared decision-making, and promoting prevention and referral activities,” the study authors wrote. “Greater evaluation of use cases, such as the MOF, is needed to inform the integration of social risk data into EHRs and to identify best practices.”