By David Bucciferro, Chair, EHR Association

In previous installments of this five-part blog series on the EHR Association’s concerns with ONC’s Health Data, Technology, and Interoperability: Certification Program Updates, Algorithm Transparency, and Information Sharing Proposed Rule (HTI-1), we discussed our overarching concerns, as well as concerns specific to the Insights Condition program, transition to USCDI v3, and Decision Support Interventions (DSI) and Predictive Models. In this blog, we take a closer look at our issues with the proposed Patient Requested Restrictions provisions.

Beware of Unintended Consequences

The proposed rule would require the new “patient requested restrictions” certification criterion for the Privacy and Security Framework by Jan. 1, 2026, which is too broad as proposed for the timeframe. It also needs a targeted use case to focus on for the deadline. 

Importantly, the provider community has expressed concerns about pronounced negative unintended consequences that could result from broad requirements to support segmentation. These include heightened risks of preventable medical errors from incomplete records and increased burden on providers. 

Focusing on a targeted use case could mitigate those unintended consequences. For example, ONC could refocus its certification capability requirement around the ability of patients to request that certain sensitive notes or lab results not be shared with proxy users in the patient portal. Doing so would give patients more granular control over data sharing without jeopardizing their care by preventing other clinicians from viewing the information.

Finally, focusing only on data segmentation has a high risk of adding changeable flags (e.g., something is marked “confidential” now, but could or should change to “shareable” later, or vice versa). As such, there must be the opportunity to adjust privacy and patient consent rules and infrastructure over time to keep pace with the long-term impacts of chances under HTI-1 – something that is not addressed in the proposed rule but is nonetheless critical to success.

Multiple Concerns

Other blogs in this series delve into our concerns with HTI-1’s Insights Condition program, the transition to USCDI v3, and DSI/predictive models. 

By sharing the issues the EHR Association has identified in our review of HTI-1, our hope is that ONC will give full consideration to our concerns – which we share with other impacted stakeholders – as it moves forward with finalizing the rule to ensure its end goals can be achieved without unrealistic deadlines and without placing an undue burden on healthcare providers and health IT developers.