Patient Data Access
by Kristin Rowan, Editor
Access to Patient Data
Tighter than Fort Knox
Access to patient data has always been tricky, even for the patient. Every doctor’s office, hospital, urgent care center, home health agency, and nursing facility uses their own system to house medical records. With concerns over HIPAA violations, that data is secured, sometimes in several ways simultaneously. A breach in that system could spell big trouble for the medical agency and the software company that provided it. Even in the age of electronic medical records, it is difficult to access those records without proof of identity, a signature in triplicate, and an oath punishable by death that you are allowed access to the information. (Okay, I may be exaggerating on that last one just a bit.)
3rd Party Access
Even more difficult than accessing patient data as the patient or the patient’s doctor or caregiver is accessing the data as a service provider:
- Consultants who help agencies with operational efficiency, documentation, software implementation, etc.
- QAPI advisors who help with reporting and training
- Data analytics companies who interpret information and provide meaning behind numbers.
Who Owns the Data?
One of the big questions in these cases is who owns the data. Each party seems to claim some ownership. Medical agencies believe they own the data because the information doesn’t exist without inputing it during a patient visit. Electronic medical records claim ownership based on housing the information in the system they created, designed, and built. I, along with many others I assume, believe the data belongs to the patient. It is being used by the medical agency to perform services and housed by the software company much like a storage facility. But, the information should travel with the patient.
It's a Bot!
Skilled nursing facilities and other providers often hire data analytics companies to help assess their business. One such company, Real Time, provides data analytics services using facility and patient data. Real Time accesses this data using log-in credentials provided by the facilities. Due to the volume of data and the time it takes to sift through a robust EHR system, Real Time uses bots to comb through the system and download the necessary information.
Roadblock
This system works well for analytics companies and consultants to access more data quickly and provide faster, more thorough answers to their clients. The system doesn’t work well when the software housing the data enables CAPTCHA on its log-in page. CAPTCHA is specifically designed to keep bots out. In 2022, PointClickCare started using CAPTCHA on users they thought were bots. In 2023, PointClickCare used images so indecipherable that even humans couldn’t solve.
Request Denied
Real Time was losing access to its accounts. Agencies were losing the data analytics they contracted to receive. Real Time and PointClickCare entered discussion to provide access to the data. Real Time alleges that the solutions PointClickCare agreed to would only allow access to 30% of the data needed. Additional negotiations ended without an agreement. It seems PointClickCare ended the negotiations.
Fight for Your Right to...Data
In January of 2024, Real Time sued PointClickCare claiming unfair competition and tortious interference, among others. A district court issued an injunction to stop PointClickCare from using indecipherable CAPTCHA images and from deactivating Real Time’s accounts. PointClickCare appealed the decision to the Fourth Circuit.
Interpreting the Law
The Fourth Circuit upheld the district court ruling. The significance in the ruling is that the court interpreted some previously ambiguous language in the Cures Act exceptions to the information blocking rules. Specifically, the court interpreted the phrase “cannot reach agreeable terms” to mean that both parties attempt to reach an agreement in “good faith” using “reasonable” and “genuine” effort. The court also stated that the parties must have “articulable reasons why the parties cannot come to an agreement.” While this may seem like a minor ruling, the impact of the interpretation of the exceptions could reach much farther than this law suit.
I Object!
PointClickCare requested a rehearing after the Fourth Circuit decision. The American Hospital Assocition and Electronic Health Record Association filed briefs supporting PointClickCare in the lawsuit and in the petition for a rehearing. On April 23, 2025, The US Court of Appeals for the Fourth Circuit denied the petition for review.
Paving the Way for Interoperability
The Fourth Circuit decision upholds the final rule from HHS implementing the Cures Act disincentives for information blocking. This decision and the denial of the petition for en banc review could have widespread implications. EHR companies must use the same access rules for every user. No more tricky images to stump consultants. No limiting access to 30% of the data.
The use of artificial intelligence-based software that can access EHR data without standard API connectivity could be the next step. Without needing permission to access and download data, switching software companies becomes easier. Sharing patient data with other medical providers is now a simple task. A patient could access their medical records with a single log-in.
Final Thoughts
I anticipate this will not be a decision that is accepted easily. I see more objections, lawsuits, and arguments from the AHA, the EHRA, and individual software providers and consultants. The decision has the potential to reach into other industries. AI will continue to evolve in ways we haven’t even anticipated. This certainly will not solve the issues of access to data or interoperability, but it’s a good first step.
Read the related articles on interoperability from Netsmart. Part 1 | Part 2
# # #
Kristin Rowan has been working at The Rowan Report since 2008. She is the owner and Editor-in-chief of The Rowan Report, the industry’s most trusted source for care at home news, and speaker on Artificial Intelligence and Lone Worker Safety and state and national conferences.
She also runs Girard Marketing Group, a multi-faceted boutique marketing firm specializing in content creation, social media management, and event marketing. Connect with Kristin directly kristin@girardmarketinggroup.com or www.girardmarketinggroup.com
©2025 by The Rowan Report, Peoria, AZ. All rights reserved. This article originally appeared in The Rowan Report. One copy may be printed for personal use: further reproduction by permission only. editor@therowanreport.com
