Accessing EHI
Taking effective public health action depends on timely, secure access to clinical data. As healthcare providers (HCPs) increasingly document patient information electronically, public health authorities (PHAs) must be equipped to access this EHI in ways that are both legally authorized and operationally feasible.
This section provides a high-level overview of the primary methods PHAs use to directly access EHI focusing on direct access to electronic health record (EHR systems), health information exchanges (HIEs), and hybrid approaches.
The sections on Partner Engagement Strategies and Communication Best Practices contain resources that can be used in planning your initial contact with healthcare organizations (HCOs), and ongoing communications and relationship building.
Direct Access via EHR Systems
Public health professionals can be granted user-level access to a HCO’s EHR system, typically through a web-based portal. How it works:
- The HCO or provider creates a secure login for public health professionals (e.g., epidemiologists, investigators).
- Public health professionals may be asked to take trainings and sign user agreements in order to access the portal.
- Access is typically read-only – PHAs are not allowed to add data or information to the EHR.
- Public health professionals may be able to search and view patient records related to reportable conditions or investigations, or may be granted access limited to specific public health events, specific patients, or specific PHA roles.
Example use cases include:
- Retrieving additional information about cases during outbreak investigations, such as immunization status during vaccine-preventable disease outbreaks. In recent investigations of lead contamination in a public water supply, epidemiologists used EHRs to review high blood lead test results and identify those individuals in need of filters or long-term monitoring.
- Verifying/collecting clinical data for surveillance of reportable conditions.
- Accessing EHRs for contact tracing.
Pros and Cons of Direct Access
PROS
- Can provide real-time access to full records
- Minimal provider workload after setup
- Reduce burden to healthcare staff for responding to public health requests for information
CONS
- Requires credentialing and training
- May be restricted to only certain health records contained in the system
- Public health professionals must maintain many logins for access
- Public health professionals must still manually review data before entering it into their systems
Health Information Exchanges (HIEs)
A HIE is a system that facilitates the secure, authorized sharing of health data among different providers, health systems, and PHAs. How it works:
- HIEs aggregate data from multiple providers into a shared system.
- HIEs can also send automated data to PHAs on a regular basis.
- PHAs either:
- Connect to the HIE by logging into a portal and submitting queries (typically to access data in repository model HIEs), or
- Receive automated data and alerts to the PHA from HCOs that are part of the HIE, or from the HIE directly.
Examples of use cases:
- Case finding for reportable conditions.
- Monitoring population health trends.
Pros and Cons of HIEs
PROS
- Centralized data from multiple providers
- Often includes real-time or near real-time feeds
CONS
- Varies significantly by state and region
- May require complex agreements or fees
- May present technology challenges for the PHA, such as the need to have adopted current technology standards
Similar to an HIE, Regional Health Information Organizations (RHIOs) are local or regional versions of HIEs that serve specific geographic areas. They often have close relationships with local PHAs and stakeholders. RHIOs operate in a similar fashion to HIEs. Many of the RHIOs that previously existed are now part of the statewide HIE.
Hybrid Approaches
PHAs can opt for a hybrid approach that combines methods of EHI access to create a flexible and resilient data-sharing model. One example of this occurs when the PHA has direct access to one HCO’s EHR, while using an HIE to monitor outpatient encounters and emergency departments across a wider region.
Examples of use cases:
- Expanding coverage across different provider types.
- Backing up one method when another is delayed or restricted.
- Aligning with provider capabilities and preferences.
Pros and Cons of Hybrid Approaches
PROS
- Adaptable to different provider partnerships
- Reduces dependency on a single method
CONS
- Requires more coordination and oversight
- Potential for data about the same patient being spread across multiple systems and not contained in one complete record
Success Story : Kristen Row, Kansas Department of Health and Environment
Faced with limited direct access to hospital EHR systems, the Kansas Department of Health and Environment’s STI and HIV surveillance team, led by epidemiologist Kristen Row, turned to HIEs as a powerful alternative — connecting to both the Kansas Health Information Network and the Lewis and Clark Information Exchange (LACIE) to view patient data from across state lines. This strategy transformed their disease investigation workflows by allowing staff to quickly trace patients’ care histories, access encounter notes, and identify previous HIV diagnoses across multiple health systems without needing individual hospital logins. The broader view offered by HIE data not only accelerated investigations but also produced unexpected public health wins— the team has intercepted potential congenital syphilis cases by spotting births during HIV record searches and reduced “lost-to-care” cases by confirming that patients were still receiving medical services elsewhere. “Instead of looking at one specific area, we can search a person and see if they’ve ever been tested anywhere — and even find historical addresses or encounter notes we’d otherwise never see,” Row explained.
