A standard-based model for the sharing of patient-generated health information with electronic health records

This paper proposes a standard-based model for the automated collection of patient data using personal health devices and the secure sharing of these data with authorized providers’ electronic health records (EHRs). The model addresses a number of important requirements for the practical collection and exchange of such data between patients and providers. The technical elements of the model are based on the features of personal health devices, health data repositories, and interoperability standards that already exist. For the automated collection of data from patients’ personal health devices (such as wireless glucometers or smartphone-based applications), the model suggests a set of content standards developed by the Continua Alliance and already implemented in a number of commercial products. For the sharing of collected data with providers’ EHRs, the model specifies a secure transport layer based on the DIRECT Project’s secure email standards and an application data layer based on HL7 v2.5.1 query-response messages combined with the clinical document architecture Release 2.0 personal healthcare monitoring report implementation guide. All of these standards have been implemented and are in current use, although they have not yet been combined to meet the specific use case of sharing patient-generated health information with providers EHRs. The proposed standard-based model constitutes a “straw man” intended to foster thought, discussions, and refinement through pilot implementations and improvements.

1. Because providers (and/or background processes acting on their behalf) initiate the retrieval of PGHI, providers can customize their data-retrieval patterns to match their organizational capabilities for evaluating and acting on the incoming data. As such, this model can accommodate a wide range of preferences regarding how often PGHI is retrieved and evaluated, from infrequent access (e.g., ad hoc querying of PGHI or retrieval of PGHI in preparation for a specific patient visit) to frequent automated “polling” for PGHI and rule-based processing of it such as an Accountable Care Organization might use for case management.

2. Simple Mail Transport Protocol.

3. Public Key Infrastructure (PKI) and S/MIME (Secure Multipurpose Internet Mail Extensions).

4. For example, a number of vendors now offer web-based email programs that can send and receive DIRECT messages and attachments.

5. Rather than immediately returning an error response when the patient has not already authorized the PGHI repository to respond to queries from the provider’s DIRECT address, an alternative approach would be for the PGHI repository to prompt the patient about whether the request should be granted at the time the request is received. In this variation, the PGHI repository would wait a predetermined amount of time before rejecting the request if the patient does not authorize it.

This work was supported by a grant from the Robert Wood Johnson Foundation through Project HealthDesign (http://www.projecthealthdesign.org). We would like to thank the following individuals for their assistance in our research and preparation of this publication: Liora Alschuler, Lantana Group, Keith Boone, GE Healthcare, Patricia Brennan, University of Wisconsin School of Nursing and College of Engineering, Gail Casper, University of Wisconsin School of Nursing, Bob Dolin, Lantana Group, Steven Downs, Robert Wood Johnson Foundation, Igor Gejdos, Roche Diagnostics Corp., Gillian Hayes, University of California, Irvine, Sen Hirano, University of California, Irvine, Sean Nolan, Microsoft, Inc., Martin Rosner, Philips N.A. Corp., Steve Wheeler, IDEAL LIFE, Inc.

Authors and Affiliations

1. Sujansky & Associates, LLC, San Carlos, CA, USA

   Walter Sujansky & Douglas Kunz

Corresponding author

Correspondence to Walter Sujansky.

Reprints and permissions