You are the owner of this article.
You have permission to edit this article.
Federal rules impacting Epic Systems Corp., patient data released
breaking topical

Federal rules impacting Epic Systems Corp., patient data released

Epic Deep Space Auditorium lobby

Some 7,000 visitors and 10,000 Epic employees attended Epic's annual Users Group Meeting in August.

Long-expected federal electronic medical records rules opposed by Verona-based Epic Systems Corp. were released Monday, but it was unclear how much changes made to the original proposals appeased Epic or upset supporters including Apple and Microsoft.

One observer and former Epic worker said Epic didn’t gain much from the changes.

The two rules, designed to make the sharing of patient health data easier, including on smartphone apps, were proposed in February 2019 by the Office of the National Coordinator for Health Information Technology (ONC) and the Centers for Medicare and Medicaid Services (CMS), both part of the Department of Health and Human Services.

“Together, these final rules mark the most extensive healthcare data-sharing policies the federal government has implemented, requiring both public and private entities to share health information between patients and other parties while keeping that information private and secure,” HHS said in a statement.

Epic released a brief statement Monday, saying in part: “We have been working closely with HHS and ONC to try to improve the rule, and we appreciate their willingness to hear our feedback. The rule is very important to health systems and their patients, so we will read it carefully to understand its impact before making judgments.”

The company is paying special attention to certain aspects of the final rules, including their impact on hospitals and physicians, and implementation timelines, the Epic statement said.

Rick Pollack, CEO of the American Hospital Association, said in a statement Monday that the final ONC rule fails to protect patient information. “The rule lacks the necessary guardrails to protect consumers from actors such as third-party apps that are not required to meet the same stringent privacy and security requirements as hospitals,” he said.

Nick Hatt, a product designer at Madison-based health care data-sharing company Redox and a former Epic employee, said Epic “didn’t really get very much in the final (ONC) rule. The content did not change substantially, so it was kind of a win for the patient-access side.”

The rule requires full exports of patient data, beginning in three years, to patients or hospitals if requested, Hatt said. “You’re being asked to develop something that helps your customers switch from your software to someone else,” he said.

Also, screen shots of electronic medical records will become more public, which Epic didn’t want, Hatt said. “They really don’t want to have screen shots of their software out on the internet, and now essentially it’s illegal for them to put those kinds of clauses in their contracts,” he said.

But the scope of data that must be shared will be limited for two years, and companies such as Epic will be able to warn patients about the dangers of sharing data with third-party apps — changes that were in Epic’s favor, Hatt said.

The rules apply to scenarios such as patients wanting to share clinical data and check lab results with Apple’s Health app, Hatt said.

Epic’s concerns

Epic has said the proposed ONC rule could threaten patient privacy and intellectual property, and increase health care costs. CEO Judy Faulkner urged customers to support a letter in opposition to the rule. More than 60 health system CEOs, including those at UW Health, UnityPoint Health-Meriter and Gundersen Health System, signed the letter sent in February to HHS Secretary Alex Azar.

Epic, a privately owned company with $2.9 billion in annual revenue and nearly 10,000 employees, provides electronic medical records to more than a quarter of U.S. hospitals and more than half of large hospitals.

Both Wisconsin senators, Democrat Tammy Baldwin and Republican Ron Johnson, wrote to Azar in November expressing concerns. In a State Journal guest column in January, former Republican Gov. Tommy Thompson, also a former HHS secretary, said the proposals would “threaten the booming health care tech economy that helps all of Wisconsin.”

Apple and Microsoft joined more than 80 other major health information stakeholders — such as Humana, Walgreens and Cerner, an electronic medical records vendor that competes with Epic — in supporting the original proposals. The group also includes Wisconsin’s Marshfield Clinic Health System.

Calling itself Creating Access to Real-time Information Now through Consumer-Directed Exchange, or the CARIN Alliance, the group of supporters said it was trying to “advance the ability for consumers and their authorized caregivers to easily get, use and share their digital health information when, where and how they want to achieve their goals.”

The group’s founders on Monday praised the new rules. In a statement, Cerner CEO Brent Shafer said the release of the rules “marks an important milestone in a decades-long pursuit of improving consumers’ access to their own personal health data and clearing unnecessary hurdles that have stood in the way.”


The rules aim to make electronic medical records more “interoperable,” or shared easily across various platforms.

“Delivering interoperability actually gives patients the ability to manage their health care the same way they manage their finances, travel and every other component of their lives,” Dr. Don Rucker, national coordinator for health information technology, said Monday in the HHS statement.

“A core part of the rule(s) is patients’ control of their electronic health information which will drive a growing patient-facing healthcare IT economy, and allow apps to provide patient-specific price and product transparency,” Rucker said.

Epic has said the ONC rule as proposed would threaten patient privacy by requiring health systems to send patient data to any app requested by patients.

Many apps share or resell data, “and there is not regulation requiring patients’ approval of this downstream use,” Epic said on its website in January.

Epic also said the scope of the ONC rule was too broad, applying to thousands of data elements in medical records that shouldn’t be included.

In addition, the rule “removes trade secret protection that (electronic medical record) developers have used for decades to safeguard their intellectual property,” Epic said in a summary of its concerns in December.

Be the first to know

* I understand and agree that registration on or use of this site constitutes agreement to its user agreement and privacy policy.

Related to this story

Get up-to-the-minute news sent straight to your device.


News Alerts

Badger Sports

Breaking News