Purposes of Use

Overview

In order to connect to the networks, a querying entity requires a reason, or Purpose of Use (POU), be provided to retrieve a patient's data. This ensures that only relevant parties have access to a patient's PHI for specific use cases. These Purposes of Use are outlined in the HIPAA Privacy Rule and the HIPAA Security Rule.

Under HIPAA, a covered entity is permitted (but not required) to use and disclose protected health information, without an individual's authorization, for TPO (Treatment, Payment, Operations) uses. For these essential activities, entities do not need consent from the patient whose records they are requesting. Per the U.S. Department of Health and Human Services, "Ready access to treatment and efficient payment for health care, both of which require use and disclosure of protected health information, are essential to the effective operation of the health care system. In addition, certain health care operations—such as administrative, financial, legal, and quality improvement activities—conducted by or for health care providers and health plans, are essential to support treatment and payment.”

Access via Particle

To access data via Particle, your Purpose of Use must be supported by the implementer and the network you are querying. For example, an organization within Carequality needs to support the Patient Access Purpose of Use for us to gather data from that implementer, but also Carequality themselves must support that same Purpose of Use.

Treatment

Network members widely support the Treatment Purpose of Use, which represents the most prevalent use case on Particle's platform. According to the HIPAA Privacy Rule, "Treatment is the provision, coordination, or management of health care and related services for an individual by one or more health care providers, including consultations between providers regarding a patient and referrals of a patient from one provider to another."

Payment

Payment refers to the activities undertaken by health care providers to secure reimbursement for their services and by health plans to collect premiums, fulfill coverage obligations, provide benefits, and manage reimbursement processes for health care delivery. Essentially, it encompasses the financial and administrative processes involved in ensuring that organizations receive compensation—whether through direct payments or reimbursements—and address the complexities of insurance operations that occur behind the scenes.

Operations

“Health care operations” refer to specific administrative, financial, legal, and quality improvement activities undertaken by a covered entity to efficiently manage its business and support the core functions of treatment and payment. These activities, while often less visible, are essential to ensuring the seamless functioning of the organization. Examples include policy development, audits, data requests, claims adjudication, and risk adjustment. These behind-the-scenes tasks are critical for maintaining compliance, operational efficiency, and the overall effectiveness of the organization’s healthcare delivery and payment systems.

Expansion of POUs

Following the ONC’s (Office of the National Coordinator for Health Information Technology) Anti-Information Blocking Rule, outlined in the Cures Act Final Rule, Patient Request (in some networks, Patient Access or Individual Access) is becoming increasingly supported by implementers across the healthcare landscape.

In practical terms, this means the ability to engage with customers beyond those who have direct patient care use cases, requiring providers actively to utilize data retrieved to treat or manage patient care.

Individual Access

The HIPAA Privacy Rule underscores the importance of individual access, stating that it, "...generally requires HIPAA-covered entities (health plans and most health care providers) to provide individuals, upon request, with access to the protected health information (PHI) about them in one or more 'designated record sets' maintained by or for the covered entity. This includes the right to inspect or obtain a copy, or both, of the PHI, as well as to direct the covered entity to transmit a copy to a designated person or entity of the individual’s choice."

Before the Anti-Information Blocking provisions, patients technically had the right to access and share their health information. However, healthcare providers and their systems often leveraged loopholes or provided insufficient justification to withhold this data. There were no significant penalties for noncompliance, limited transparency around refusals, and minimal oversight to enforce patient rights effectively.

The Anti-Information Blocking Rule changes this paradigm. Now, rather than requiring a reason to share information, providers and systems must have a valid reason not to share it. This ensures that patients have a legally protected right to access their medical records. Providers and electronic medical record (EMR) systems can no longer arbitrarily withhold this information, except under specific, legally defined exceptions.

However, under these expanded Purposes of Use (POUs), patient consent is required. Obtaining patient consent is a multifaceted process, but it can be summarized as follows: patients must provide explicit authorization to disclose their medical records. This process has two key components:

1. Consent to Disclosure: The patient must explicitly agree to the release of their medical records.
2. Identity Verification: It must be ensured that the individual providing consent is indeed the patient or an authorized representative.

Patient consent is required for the Individual Access POU because it falls outside the scope of Treatment, Payment, and Health Care Operations (TPO) purposes as defined under HIPAA. TPO purposes are exempt from the explicit consent requirement, whereas other POUs necessitate explicit patient authorization to ensure compliance with HIPAA regulations.