The massive federal stimulus law enacted last month includes unprecedented funding to transition toward the use of electronic medical records. Privacy protection measures—especially important to psychiatric care patients—were included in the measure.

The American Recovery and Reinvestment Act of 2009 (ARRA, PL 111-5), signed by President Barack Obama on February 17, includes provisions to encourage the use of electronic health records (EHRs), health information technology (HIT, which includes both the software and hardware needed to operate EHRs), and e-prescribing.

The law, considered part of Obama's overall health reform effort (see Stimulus Law Directs Funds to Health Care Improvement), requires the government to take a leadership role in developing standards by 2010 that will allow for the nationwide electronic exchange and use of health information that aims to improve the quality and coordination of care. The measure requires Department of Health and Human Services (HHS) officials to establish interoperability standards, implementation specifications, and certification criteria by December 31, as well as to provide financial resources to current and future physician users of HIT systems.

The measure provides $19 billion for health information technology infrastructure grants from HHS and for Medicare and Medicaid incentives to encourage physicians, hospitals, and health care providers to use HIT for the electronic exchange of patients' health information.

Community mental health centers are eligible for grants from HHS and incentive payments under Medicare and Medicaid. Specifically eligible for grants and incentive payments to upgrade their HIT systems are those community mental health centers that meet federal criteria, child mental-health programs, psychosocial rehabilitation programs, mental health peer-support programs, and mental health primary consumer-directed programs.

In terms of funding, the law includes Medicare incentive payments for physicians who adopt HIT, defined as "hardware, software, integrated technologies or related licenses, intellectual property, upgrades, or packaged solutions sold as services that are designed for or support the use by health care entities or patients for the electronic creation, maintenance, access, or exchange of health information."

The payments are up to $15,000 for the first payment year, with incentive payments in subsequent years of up to $12,000, $8,000, $4,000, and $2,000, respectively, ending in 2015. Physicians who report already using an EHR that is also capable of e-prescribing will no longer be eligible for earlier e-prescribing bonuses but will be eligible for HIT incentives.

Physicians who have already implemented HIT systems and those who adopt them by 2012 will be eligible for an initial, larger incentive payment of up to $18,000. By 2014 the maximum payment for physicians who begin using the technology at that point will drop to $12,000.

Physicians in a federally designated rural health professional shortage area will have their Medicare incentive payments for HIT increased by 10 percent.

Also included are incentives for eligible physicians, hospitals, federally qualified health centers, rural health clinics, and other providers under Medicaid.

The incentive ends and penalties begin for physicians who accept Medicare and have not adopted HIT by 2015, including a 1 percent reduction in Medicare physician payments, increasing to a 3 percent reduction in 2017 and beyond.

Federal health officials can increase penalties up to a 5 percent reduction in Medicare payments after 2018. The measure allows exceptions on a case-by-case basis for "significant hardships," such as rural areas without sufficient Internet access.

The new measure includes many features long advocated by APA that are designed to strengthen federal privacy and security law, including protections against misuse of identifiable health information. The privacy measures had long been downplayed in the Senate, where the advancing legislation last year emphasized creation of a nationwide EHR network despite privacy and interoperability concerns. So inclusion of strong privacy measures in the final stimulus measure was seen as a win for psychiatry and mental health care recipients.

Among the privacy measures is a new HIT Policy and Standards Committee that will include public and private representatives, including physicians. The committee will provide recommendations on the HIT policy framework, standards, implementation specifications, and certification criteria for electronic exchange and use of health information.

The law expands on the privacy and security provisions of the Health Insurance Portability and Accountability Act (HIPAA) to protect patient health information by defining which actions constitute a breach. Also, restrictions have been added on certain disclosures, sales, and marketing of protected health information. The law requires an accounting of disclosures to patients upon request and authorizes increased civil monetary penalties for HIPAA violations. State attorneys general also are authorized to enforce HIPAA.

The law expands HIPAA rules and penalties to "business associates" of health care entities, such as the technology firms involved in electronic records creation and data storage.

Another provision supported by APA establishes that physicians or others sharing information with insurers or other payers must limit the information to the "minimum necessary" to fulfill the request for information. Insurers will no longer be allowed to decide what information is the minimum necessary as the new law directs HHS to promulgate guidelines to define that. A 2002 APA position statement called for such a "minimum necessary" provision on information released to third parties to be a part of federal medical privacy rules.

The "minimum necessary" provision of the law does not affect the information physicians can share with other clinicians treating that patient. Instead, the law serves as a floor for privacy rights, and some state laws go beyond it to restrict information physicians can share with other physicians, if requested by patients.

A "right to request" allows patients to request that physicians not share their information with other medical providers, and if physicians agree, they cannot later change their mind and release data from the period during which they agreed to restrict such information.

Laura Fochtmann, M.D., chair of APA's Corresponding Committee on Electronic Health Records, described the privacy protection provisions of the law as" a major step forward."

"Confidentiality is at the heart of the therapeutic relationship between a patient and a psychiatrist," Fochtmann told Psychiatric News. "Without the means to preserve confidentiality—whether it is in the paper record or the electronic record—there will be additional impediments to developing a trusting and therapeutically beneficial alliance."

Patient privacy issues are not unique to psychiatry, Fochtmann said, but psychiatrists have been at the forefront of calling attention to these issues.

The text of the stimulus measure can be accessed at<http://thomas.loc.gov> by searching on the law number, PL 111-5. ▪