Law and Standards Peer Review

TheImpactofPrivacyRegulationandTechnologyIncentivesTheCaseofHealthInformationExchanges.pdf

Home >Information Systems homework help > Law and Standards Peer Review

MANAGEMENT SCIENCE Vol. 62, No. 4, April 2016, pp. 1042–1063 ISSN 0025-1909 (print) � ISSN 1526-5501 (online) http://dx.doi.org/10.1287/mnsc.2015.2194

The Impact of Privacy Regulation and Technology Incentives: The Case of Health Information Exchanges

Idris Adjerid Mendoza College of Business, University of Notre Dame, Notre Dame, Indiana 46556, [email protected]

Alessandro Acquisti, Rahul Telang, Rema Padman H. John Heinz III Heinz College, Carnegie Mellon University, Pittsburgh, Pennsylvania 15213

{[email protected], [email protected], [email protected]}

Julia Adler-Milstein School of Information, University of Michigan, Ann Arbor, Michigan 48109 [email protected]

Health information exchanges (HIEs) are healthcare information technology efforts designed to foster coordi-nation of patient care across the fragmented U.S. healthcare system. Their purpose is to improve efficiency and quality of care through enhanced sharing of patient data. Across the United States, numerous states have enacted laws that provide various forms of incentives for HIEs and address growing privacy concerns associ- ated with the sharing of patient data. We investigate the impact on the emergence of HIEs of state laws that incentivize HIE efforts and state laws that include different types of privacy requirements for sharing healthcare data, focusing on the impact of laws that include requirements for patient consent. Although we observe that privacy regulation alone can result in a decrease in planning and operational HIEs, we also find that, when coupled with incentives, privacy regulation with requirements for patient consent can actually positively impact the development of HIE efforts. Among all states with laws creating HIE incentives, only states that combined incentives with consent requirements saw a net increase in operational HIEs; HIEs in those states also reported decreased levels of privacy concern relative to HIEs in states with other legislative approaches. Our results contribute to the burgeoning literature on health information technology and the debate on the impact of pri- vacy regulation on technology innovation. In particular, they show that the impact of privacy regulation on the success of information technology efforts is heterogeneous: both positive and negative effects can arise from regulation, depending on the specific attributes of privacy laws.

Keywords : privacy; information systems; IT policy and management; economics of information systems; healthcare

History : Received April 19, 2012; accepted December 16, 2014, by Anandhi Bharadwaj, information systems. Published online in Articles in Advance November 13, 2015.

1. Introduction The U.S. healthcare system is in the midst of an infor- mation technology revolution. Adoption of electronic medical record (EMR) systems is quickly rising (Office of the National Coordinator for Health Information Technology 2012). In parallel, health information exchanges (HIEs) have emerged. HIEs provide infor- mation technology solutions that allow electronic information sharing between otherwise disconnected healthcare organizations. They are intended to facil- itate the exchange of patient health information between hospitals belonging to different health sys- tems or distinct physician practices. In turn, this enables patients’ health records to electronically fol- low them between care settings. HIEs are viewed as a particularly critical investment because much of the anticipated efficiency and quality gains from EMRs come from the ability to support the electronic exchange of patient data across healthcare providers

(Walker et al. 2005). Without HIEs, data are trapped in individual institutions, thereby inhibiting coordina- tion of care, resulting in avoidable medical errors, and driving up costs from duplicative utilization. This has resulted in substantial legislative activity1 aimed at realizing the vision of nationwide adoption of EMRs coupled with the ability to exchange data between them (Blumenthal 2010).

Legislative efforts have focused on creating a favor- able environment in which HIEs can flourish. The rationale for government involvement is that HIEs have experienced both slow growth rates and high failure rates across the United States (Adler-Milstein et al. 2009, 2011). Research on the underlying causes of these failures revealed an array of barriers to the

1 See, e.g., the Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009, Pub. L. No. 111-5, 123 Stat. 226 (2009); and the Patient Protection and Affordable Care Act of 2010, Pub. L. No. 111-148, 124 Stat. 119 (2010).

1042

D ow

nl oa

de d

fr om

i nf

or m

s. or

g by

[ 14

0. 23

4. 25

5. 9]

o n

19 A

pr il

2 01

6, a

t 12

:2 3

. F or

p er

so na

l us

e on

ly , a

ll r

ig ht

s re

se rv

ed .

development of HIE efforts. Central among them are challenges related to financial sustainability (National eHealth Collaborative 2011, Vest and Gamm 2010, eHealth Initiative 2005–2010) and issues related to patient privacy (Simon et al. 2009, McDonald 2009, McGraw et al. 2009). These challenges have spurred 25 states (as well as the District of Columbia) to enact legislation to incentivize HIE efforts (e.g., by providing funding for HIE efforts), address privacy concerns, or, most often, both. However, the best approach to ameliorating the issues associated with HIE efforts remains unclear. In particular, HIEs have spurred significant debate over the appropriate bal- ance of patient privacy and the potential gains to healthcare providers and their patients. The sensitiv- ity of the digital health information that is exchanged by HIEs has made the role of patient consent espe- cially contentious.

One side of the debate is that consent require- ments add administrative costs and restrict the availability of patient information (National eHealth Collaborative 2011, Pritts et al. 2009). By contrast, Simon et al. (2009) find that patients felt that their consent should be obtained for the exchange of health information (i.e., an opt-in system); a system that assumed their willingness to participate with- out obtaining explicit consent (i.e., an opt-out system) would not be acceptable. Thus, policy makers seeking to foster the growth of HIE efforts face the same chal- lenge that emerges in other industries: how to address privacy concerns without overregulating the disclo- sure of personal information and stifling the growth and emergence of valuable information technology efforts reliant on it.

Careful empirical literature related to that chal- lenge has been recently emerging. Work by Miller and Tucker (2009) finds that the presence of privacy reg- ulation inhibits technology adoption by hospitals. In subsequent work, Miller and Tucker (2011) account for some of the variation in the statutory require- ments of privacy regulation and hospital character- istics, and they identify some heterogeneous effects of privacy regulation.2 Adopting a similarly granular approach to measuring privacy regulation, we explore whether different forms of privacy regulation enable or impede HIE efforts. Extending prior work, we dif- ferentiate between states that coupled privacy regula- tion with HIE incentives and those that did not. We posit that incentives could offset the significant costs associated with HIE efforts, including those that arise

2 For instance, they find that, although privacy regulation most often negatively impacted hospital technology adoption, it also had a positive effect on adoption in some cases (e.g., when laws had limits on redisclosure).

from varying degrees of privacy regulation. We eval- uate the impact of these laws compared to states with no laws pertaining to HIE efforts.

Our empirical strategy takes advantage of the fact that across different states policy makers have approached HIE challenges in different ways, enact- ing legislation that varied both in terms of the incen- tives they create for HIEs, and in terms of the types of privacy protections they afford to patient data exchanged through HIEs. Specifically, some states enacted legislation with HIE incentives alongside requirements for patient consent while other states enacted legislation with HIE incentives but with pri- vacy regulation that did not require consent. Yet other states enacted legislation with HIE incentives but no privacy regulation or only privacy regulation, or they did not enact relevant legislation at all. Our work leverages this variation to evaluate the impact of this legislation—in particular, the variation in privacy pro- tection afforded by these laws—on the propensity of regional healthcare markets to have an HIE working toward exchange capabilities (planning HIE) or an HIE that is actively exchanging patient health infor- mation between healthcare entities (operational HIE). We use semiannual data from a six-year period (2004– 2009) to compare the probability of a hospital refer- ral region (HRR)3 having an HIE in the planning or operational stage across states with variation in the extent to which legislation provided patients the right to consent to the exchange of their data by the HIE. We disentangle the impact of consent requirements from HIE incentives using between-state and across- time variation in consent requirements and regula- tions providing HIE incentives. We include HRR and time fixed effects and control for relevant observables (e.g., other elements of the laws, differences in HRR wealth, populations, health information technology (IT) adoption).

Although we show that privacy regulation without incentives had a negative effect on HIE efforts, we also find that privacy regulation, particularly regula- tion that includes consent requirements, was a nec- essary condition for incentives to positively impact HIE efforts. Incentives coupled with privacy regula- tion that included requirements for patient consent resulted in a 47% increase in the propensity of an HRR having a planning HIE and a 23% increase in the propensity of an HRR having an operational HIE. By contrast, incentives without any privacy regula- tion resulted in no measurable gain in the propensity of HRRs having planning or operational HIEs, and

3 HRRs are areas defined by the Dartmouth Atlas for Healthcare as regional healthcare markets for tertiary medical care that contain at least one hospital that performs major cardiovascular procedures and neurosurgery (Wennberg and Cooper 1996, p. 201).

D ow

nl oa

de d

fr om

i nf

or m

s. or

g by

[ 14

0. 23

4. 25

5. 9]

o n

19 A

pr il

2 01

6, a

t 12

:2 3

. F or

p er

so na

l us

e on

ly , a

ll r

ig ht

s re

se rv

ed .

incentives coupled with privacy regulation that did not include consent requirements resulted in either no gains (e.g., for planning HIEs) or comparably mod- est gains (a 9% increase in the propensity of an HRR having an operational HIE) that only offset but did not overcome the baseline negative effects of privacy regulation. As a result, of all attempts to incentivize HIE efforts, only those coupled with privacy regula- tion including consent requirements resulted in a net gain in HIE efforts. Specifically, HRRs in these states saw an 11% net increase in the propensity of having an operational HIE.

Our findings are bolstered by the fact that we do not find evidence that HIE laws are passed as a result of increased HIE activity (i.e., reverse causa- tion). We find consistent results when we consider the impact of unobservable state characteristics that may be correlated with the passage of HIE incentives (such as changes in political attitudes or public opin- ion toward the importance of health IT). Moreover, we find no correlation between consent requirements and the availability of funding or the number of patients covered by an HIE. We theorize that this sur- prising interplay between HIE incentives and consent requirements may be due to an association between incentives and privacy concerns. Specifically, we posit that incentives may be associated with an increased attention to and salience of HIE privacy concerns, which inhibits their effectiveness when they are not coupled with comprehensive privacy regulation (e.g., regulation with consent requirements). We find evi- dence in support of this interpretation: HIEs in states with incentives but no consent requirements were sig- nificantly more likely to report that privacy was a major challenge in their development relative to HIEs in states with other legislative approaches (includ- ing no law). By contrast, HIEs in states with con- sent requirements reported the lowest level of privacy concerns.

Our work contributes to two streams of literature. One stream relates to the adoption and the diffusion of IT in healthcare—in particular, the factors and bar- riers that impact their adoption (Angst and Agarwal 2009, Angst et al. 2010, Anderson and Agarwal 2011). Specific to HIEs, numerous national surveys have suggested that health privacy issues are some of the most significant barriers to HIE efforts (eHealth Initiative 2005–2010, Adler-Milstein et al. 2009, 2011). As a result, research has also focused on how to address privacy concerns associated with informa- tion technology in healthcare and HIE in particu- lar (Greenberg et al. 2009, McDonald 2009, McGraw et al. 2009). Within this stream of literature, which is largely nonempirical, experts disagree on the appro- priate solution for addressing privacy concerns. To our knowledge, our work is the first to empirically

evaluate the impact on the emergence of planning and operational HIEs of varying approaches to privacy regulation.

Another stream relates to the economic and policy literature evaluating the impact of privacy protections on technological progress. Numerous consumer ser- vices thrive today thanks to the exchange and use of personal—and sometimes sensitive—information. The risks associated with the potential misuse of that information, however, have fueled a debate over the best approach to protecting consumers’ privacy and the role of regulation in that protection (Solove 2004, Lenard and Rubin 2005). This has led to a small but growing body of careful empirical analy- ses of that relationship (e.g., Miller and Tucker 2009, 2011; Goldfarb and Tucker 2011). We extend that work in various ways. First, this literature has either focused on contexts where technology incentives did not exist or (as in the case of work in the context of health IT) predated a paradigm shift in the pol- icy approach toward promoting health IT. Focusing on the interaction of various forms of privacy reg- ulation with previously unstudied attempts to pro- mote information technology efforts in healthcare, we document a surprising interplay between state initia- tives aimed at incentivizing HIE efforts and privacy regulation. We find that HIE incentives consistently offset the negative baseline effects of privacy regu- lation on HIEs and, more surprisingly, that incen- tives were more effective in doing so when coupled with privacy regulation that included consent require- ments. This suggests that the potential fixed costs that arise from regulatory privacy protection may be proactively managed by accompanying incentives for information technology efforts. Interestingly, coupling more comprehensive privacy protections (e.g., con- sent requirements, which seemingly impose higher costs on HIEs) with HIE incentives may sometimes be preferred if those protections alleviate privacy con- cerns that dampen the propensity of incentives to enable HIE efforts. Furthermore, research is emerg- ing that points to heterogeneous effects of privacy regulation on information technology efforts (e.g., the net effect of privacy regulation on hospital IT adop- tion may depend on the number of hospitals in a county; see Miller and Tucker 2011). By documenting the differential impacts on HIE efforts of privacy reg- ulation with and without incentives, we extend the understanding of the heterogeneous effects of privacy regulation on technology efforts. Thus, the findings presented here suggest that regulators may have an opportunity to provide meaningful privacy protection to patients while encouraging the growth and suc- cess of valuable information technology efforts. For instance, legislative efforts such as the HITECH Act of 2009, which couple significant incentives for health

D ow

nl oa

de d

fr om

i nf

or m

s. or

g by

[ 14

0. 23

4. 25

5. 9]

o n

19 A

pr il

2 01

6, a

t 12

:2 3

. F or

p er

so na

l us

e on

ly , a

ll r

ig ht

s re

se rv

ed .

IT with enhanced privacy protections for patients, may offer an effective approach toward providing improved patient privacy protections while encourag- ing the growth of valuable health information tech- nology solutions.

2. Background The healthcare delivery system in the United States is highly fragmented. Most people, over their life- time, receive care from multiple medical providers who practice in unaffiliated settings. As a result, dif- ferent pieces of a patient’s medical history reside in the various places in which they received care, forcing medical providers to make clinical decisions with incomplete information. This can contribute to a range of negative patient consequences, includ- ing missed diagnoses, duplicative testing, dangerous combinations of medications, and poor care coordi- nation. Prompted by estimates of gains in quality4

and efficiency5 of patient care, enabling clinical data to electronically follow patients between care delivery settings has gained substantial support. In particular, in recent years, there has been an increase in efforts to facilitate electronic exchange of patient data via HIEs.

HIEs are information technology service organiza- tions that provide a governance framework and tech- nology solution for exchanging patient data. Entities with clinical data, such as hospitals, physician prac- tices, and laboratories (“healthcare entities”), are the most common participants in an HIE, and they most often send and receive test results as well as care summaries.

HIE development typically occurs in two stages: planning and operational. In the planning stage, a group of healthcare stakeholders in a given com- munity initially come together informally to discuss the problem of care fragmentation and how best to address it. This is typically initiated by a large stake- holder in the community, either a healthcare delivery organization (e.g., a large hospital) or a payer (e.g., an insurer or large employer). If there is agreement to

4 Gains in quality of care may be realized from the increased avail- ability of comprehensive health information, which should allow clinicians to make better treatment decisions and fewer mistakes. This benefit would be especially salient in the emergency care con- text, in which the patient may not be able to report preexisting conditions or drug allergies (Vest and Gamm 2010). 5 Health information exchanges have the potential to significantly decrease the costs of providing healthcare. Walker et al. (2005) esti- mate that, when fully implemented, health information exchanges could yield approximately $78 billion in annual savings from administrative efficiencies and reducing redundant utilization. Jha et al. (2009) estimate that, in the United States, eliminating avoid- able instances of injury to a patient resulting from a medical intervention, such as administering the wrong medication, and redundant medical tests would save over $24 billion per year.

move forward into a more formal planning phase, this often proceeds in one of two ways: either a third-party organization is established or identified to serve as a formal HIE entity or one of the stakeholders agrees to serve as the lead entity. In our data set, two-thirds of efforts operated as established, independent organi- zations and the remaining one-third operated directly from within another organization (typically a hospi- tal or health system that spearheaded the effort). The formal planning phase consists of an array of inter- related decisions that include conducting an envi- ronmental scan and needs assessment, establishing a mission and goals, setting up a governance struc- ture, establishing legal and information sharing agree- ments, deciding on an approach to protect patient privacy (including patient consent), developing a sus- tainability plan and identifying revenue streams that at least cover operating costs, marketing to a broader group of potential stakeholders, and developing a technical infrastructure.6

The second stage begins when an HIE effort reaches operational status with a functional technology and administrative infrastructure and data start to be exchanged between healthcare entities. Although this is considered a key milestone, HIEs in this stage con- tinue efforts to increase participation from healthcare entities: increasing the quantity and quality of patient data available through an HIE makes the expected benefits of exchange more likely and also helps HIEs to achieve financial sustainability (only 33% of opera- tional exchanges in our data set reported covering the cost of operating an HIE with participant fees alone).

The last decade has seen significant growth in HIE activity, including the number of planned HIEs and an increasing number of HIEs that are opera- tional: in our data, we observe 15 total HIEs nation- wide in 2004, compared to 143 by the end of 2009. Despite substantial potential benefits, HIEs are not yet widespread, and many attempts to establish HIEs have failed (Adler-Milstein et al. 2009, 2011). This has spurred a growing body of work evaluating barri- ers to HIEs, which suggests that they have been hin- dered by financial sustainability challenges stemming from misaligned incentives from competing health- care entities and patient privacy concerns (eHealth Initiative 2005–2010, Adler-Milstein et al. 2009, 2011).

2.1. HIE Incentives Numerous HIEs have struggled to develop a sustain- ability plan and identify revenue streams. In part, this is due to misaligned incentives for HIE partici- pants (who are the primary source of HIE revenue) and the significant cost attached to the administra- tive and technical infrastructure necessary to facili- tate exchange. Although healthcare entities can derive

6 See National Rural Health Resource Center (2015).

D ow

nl oa

de d

fr om

i nf

or m

s. or

g by

[ 14

0. 23

4. 25

5. 9]

o n

19 A

pr il

2 01

6, a

t 12

:2 3

. F or

p er

so na

l us

e on

ly , a

ll r

ig ht

s re

se rv

ed .

some value from participating in an HIE (e.g., bet- ter quality of patient care), under the predominant healthcare reimbursement model of fee-for-service, redundant care translates into revenue, and physi- cians have little incentive to avoid care if they believe it is of even marginal value. Worse, HIE makes it easier for patients to switch healthcare providers, potentially resulting in some hospitals and physicians losing patients. Moreover, healthcare entities (e.g., hospitals and physician practices) are expected to pay for HIE when those paying for care accrue much of the benefit. For example, if a physician avoids order- ing a redundant test because he or she has access to the results of a diagnostic test performed in a differ- ent setting, the physician (or laboratory) loses revenue while the payer (and, downstream, the patient) accrue the savings. The challenges in sustaining HIE efforts that stem from these misaligned incentives for health- care entities have been exacerbated by the high costs of HIE efforts, with considerable resources required to develop administrative and technical infrastructure that meets regulatory requirements (e.g., privacy reg- ulation) while also addressing the concerns and needs of various HIE stakeholders. These challenges have led some to argue that HIE should be treated as a public good with support from the government (e.g., Vest and Gamm 2010).

A number of states have heeded these calls, enacting legislation that attempts to alleviate these concerns by incentivizing HIE efforts. Specifically, various state legislations included general provisions aimed at reducing the costs (financial, legal, man- agerial, coordination, or otherwise) associated with pursuing a health information exchange effort in the state. These laws and their typical provisions are described in more detail in §4.2.

2.2. HIEs and Privacy Issues of privacy are among the most widely cited barriers to HIE formation (Simon et al. 2009) and have materialized as significant costs to HIEs. HIEs differ from other forms of health IT (e.g., EMRs) in ways that have important implications for patient privacy. First, HIEs facilitate the exchange of infor- mation between multiple, unaffiliated organizations; thus the risk to the privacy of health information and associated concerns expressed by consumers may be substantially greater than with other tech- nologies. Also, HIEs are predicated on the idea of exchanging individual personal health information as opposed to aggregated population-level data, mak- ing privacy concerns salient and relevant. These unique challenges have spurred a stream of liter- ature evaluating how to best address privacy con- cerns while still encouraging HIE efforts (Greenberg et al. 2009, McDonald 2009, McGraw et al. 2009).

Scholars have expressed differing opinions about the appropriate way to address privacy concerns asso- ciated with HIEs. For example, Greenberg et al. (2009) and McDonald (2009) agree that federal pro- tections need to be revisited in light of a poten- tial nationwide health information network, which is envisioned to ultimately link regional and state-level HIEs; however, they differ on the need to update state protections. McDonald (2009) suggests that new restrictions beyond the protection afforded by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) would interfere with efficient and safe care. Greenberg et al. (2009) advocate updates to state legislation to better address privacy issues spe- cific to HIEs. The ramifications of this debate can be observed in the significant heterogeneity in how states have tackled HIE privacy challenges. The variation in privacy regulation is described in more detail in §4.2.

3. Theory: Privacy Regulation, Incentives, and HIE Efforts

Although the stakeholders initiating HIE efforts and the specific model they pursue can vary, the mech- anism underlying the choice of stakeholders to start planning for exchange and whether or not an HIE becomes operational is the same: HIEs can only cre- ate value if healthcare entities (i.e., those with clinical data) participate in an HIE, which typically involves adhering to the terms set forth by the HIE and using its offered technology solutions to receive and send patient health information. The choice of healthcare entities to participate in an HIE is driven by an assessment of the costs and benefits that they will accrue. For example, a hospital would incur tech- nical costs, participation fees, and potential loss of patients as a result of reduced switching costs, as well as the increased legal risk from a data breach or misuse of patient data. This would be weighed against potential quality and efficiency gains from electronic access to more complete information about their patients, as well as reputational benefits from joining a community-based effort to improve care coordination. In addition, a broader group of stake- holders, which do not deliver care, may stand to benefit from cost reductions as a result of HIE and could also influence efforts to plan for an HIE and whether it becomes operational. For instance, a large payer may participate in an HIE effort and subsidize the costs to healthcare entities in order to encourage broader participation. This could be particularly likely if the net benefit to healthcare entities (absent these subsidies) was not sufficiently compelling to promote widespread participation (e.g., because of the mis- aligned incentives described earlier). In the remain- der of this section, we discuss how varying forms of

D ow

nl oa

de d

fr om

i nf

or m

s. or

g by

[ 14

0. 23

4. 25

5. 9]

o n

19 A

pr il

2 01

6, a

t 12

:2 3

. F or

p er

so na

l us

e on

ly , a

ll r

ig ht

s re

se rv

ed .

privacy regulation and incentives may have diverse effects on the expected benefits and costs of HIE.

3.1. Privacy Regulation and Consent Requirements

In principle, regulation that protects patients’ privacy may have a range of effects on the benefits and costs of HIE efforts. Consistent with early analysis of pri- vacy economics by scholars such as Stigler (1980) and Posner (1981), regulating the use of patient data may decrease availability of their information when it is needed by healthcare providers to make decisions, making promised benefits less likely. Regulation may also increase the cost of establishing and maintaining an HIE (for instance, by imposing additional techno- logical controls or administrative procedures to pro- tect individuals’ data). On the other hand, privacy regulation may have a positive effect on the choice to pursue an HIE. An established literature finds that privacy concerns can increase the cost of technol- ogy adoption and reduce its effectiveness (Angst and Agarwal 2009, Sheng et al. 2008). As a result, schol- ars have argued that assurances provided by regu- lation can assuage privacy concerns and positively impact the success of information technology efforts (Bamberger and Mulligan 2011, McGraw et al. 2009).

Naturally, privacy regulation is not monolithic; the extent to which privacy regulation impacts the ben- efits and costs of HIEs likely depends on the degree and type of reassurance it affords. In particular, one of the key differentiating features between regulatory approaches in the context of HIE is whether they include requirements for patient consent. Consent, or informed consent, is a cornerstone of the Organisa- tion for Economic and Cooperative Development’s privacy guidelines and the Federal Trade Commis- sion’s Fair Information Practice Principles. Generally speaking, consent in the context of HIE refers to the notion that patients should be informed about the risks and benefits associated with the electronic exchange of their health information and have the right to decide whether they would like to incur them. As in the case of privacy regulation in general, regu- lation specifically requiring consent can, in principle, produce an array of effects, both positive and nega- tive, on the emergence of planning and operational HIEs. A central concern relative to patient consent in the context of HIE is that it may result in lim- ited or patchy patient agreement to have their data included in the HIE (Lai and Hui 2006), in which case the potential benefits of HIE may be hindered. Healthcare entities may be less willing to participate in an HIE if they perceive a low likelihood of reaping efficiency and quality gains as a result of incomplete or low-quality patient data. Moreover, other stake- holders (e.g., payers) may be less willing to support

an HIE effort (i.e., subsidize the cost to healthcare entities) if they perceive the benefits to be unlikely. Furthermore, requirements for consent are also likely to impact HIEs’ technology and administrative costs (i.e., in establishing more stringent legal agreements) and participation costs for healthcare entities (i.e., costs for participants to adhere to them). For example, HIEs operating in states with consent requirements may need additional investment in technical and administrative controls to meet regulatory require- ments (e.g., clerical time by staff or technical controls to garner and track patient consent decisions). Hence, consent requirements may further reduce the propen- sity of a healthcare entity to participate in an HIE if they perceive participation to be too costly to justify their expected benefits.

On the other hand, regulations with consent requirements can reduce costs stemming from patient privacy concerns. Patients may demand the right to consent to the use of their data in the context of an HIE. Simon et al. (2009) find that patients felt that an HIE that assumed their willingness to participate without obtaining explicit consent (i.e., an opt-out system) would not be acceptable. As a consequence, healthcare entities may decide not to participate in HIEs if a lack of patient consent results in significant privacy costs and pushback from patients and advo- cacy groups. McGraw et al. (2009) argue in support of this notion and propose that a comprehensive frame- work that implements core privacy principles such as consent can bolster trust from patients and medical providers. In contrast to previously described effects of privacy regulation, a reduction in costs stemming from privacy concerns may encourage increased par- ticipation by healthcare entities, thus helping HIEs to reach the critical mass of participants to ensure that anticipated benefits are realized.

The role of privacy regulation that does not include consent requirements is also of interest because numerous states have privacy legislation that does not require patient consent before the exchange of health information between providers. For example, legislation in the state of Indiana does not include requirements for patient consent but instead, requires compliance “with the federal Health Insurance Porta- bility and Accountability Act (HIPAA)” and the pro- tection of “information privacy.”7 It is likely that the role of regulation that does not require consent is similar to consent-based regulation except that the impact on benefits and costs (and the propensity of community stakeholders to pursue HIE efforts) may be less pronounced. For example, privacy regulation that does not include consent requirements may still restrict (to some degree) the availability of patient

7 Ind. Code Ann. §5-31-6-1; Ind. Code Ann. §5-31-6-3 (West 2009).

D ow

nl oa

de d

fr om

i nf

or m

s. or

g by

[ 14

0. 23

4. 25

5. 9]

o n

19 A

pr il

2 01

6, a

t 12

:2 3

. F or

p er

so na

l us

e on

ly , a

ll r

ig ht

s re

se rv

ed .

information and also introduce additional costs to HIE efforts, but these effects may not be as pro- nounced when compared to regulation with consent requirements. It may also be the case that regulation without consent is not as effective in reducing costs to HIE efforts stemming from patient privacy con- cerns. In fact, we argue that this is likely the case. Recent experimental work suggests that providing consumers with choice relative to the use of their per- sonal information may be particularly vital in assuag- ing privacy concerns. Brandimarte et al. (2012) find that individuals who were provided increased choice perceived a lower privacy risk, even when the objec- tive risks were held constant, and were significantly more likely to make personal disclosures; Stutzman et al. (2013) find a strong positive correlation between the granularity of control provided to users of online social networks and the amount of disclosure by users (albeit to a narrower set of users). These mecha- nisms are also likely to be present in the context of HIEs, given the sensitivity of personal health infor- mation. Finally, policy makers have also recognized the unique role of providing choice by increasingly promoting more control for consumers with respect to online uses of their personal information (Federal Trade Commission 2012, White House 2012).

3.2. Incentives and Privacy Concerns The impact of HIE incentives on the benefits and costs of establishing an HIE seem, at first glance, com- paratively straightforward: all else equal, stakehold- ers with access to incentives that reduce the costs of pursuing an HIE effort should be more likely to start planning for exchange, and these HIEs should be more likely to become operational. For instance, stakeholders in communities with access to grant pro- grams associated with HIE incentives would have less of a challenge generating the required capital to initiate exchange efforts and be able to provide healthcare entities the opportunity to participate at a lower cost (thus increasing the likelihood of more widespread participation and the propensity of reap- ing expected benefits from exchange). Additionally, given the potential of privacy requirements to impose fixed costs on information technology efforts (e.g., Goldfarb and Tucker 2011, Miller and Tucker 2009) and the anecdotal evidence that privacy requirements have been key hurdles for HIE efforts, incentives may serve to offset some of these costs and attenuate some of the negative effects of privacy regulation on the propensity of HIE efforts to emerge.

However, there may also be a more nuanced and less obvious interplay between incentives, privacy concerns, and the impact of privacy regulation and incentives. Specifically, legislation intended to encour- age the pursuit of HIE efforts may also be associ- ated with elevated salience and awareness of privacy

concerns. We see examples of a similar phenomenon in other contexts: government subsidies for clean energy solutions have led to significant investment in these technologies but have simultaneously high- lighted the limitations and potentially adverse effects of these technologies (e.g., lack of cost effective- ness and efficacy); see Somaskanda (2013) and Cala (2013). With respect to HIE incentives, they may be seen to increase the probability that HIEs will be cre- ated and become operational and thereby increase the likelihood of patient privacy concerns being realized. Moreover, it may simply be the case that HIE incen- tives increase the attention paid to these efforts (e.g., by regulators, patient groups, and privacy advocates), including increased attention to associated privacy concerns. There is some anecdotal evidence in sup- port of this notion. For example, the American Civil Liberties Union brought suit against the legislatively created Rhode Island HIE on the grounds that it was not adequately soliciting consent from patients, and privacy advocates warned that states “will find them- selves embroiled in legal entanglements over privacy as they seek to implement HIEs” (Miliard 2010). This latter statement suggests that state-supported HIEs (such as those initiated or aided by state legislation) may receive disproportionate scrutiny from privacy advocates. It is also possible that the direction of causality is reversed: states in which the attention to health information exchange, including attention to privacy concerns, is high may be more likely to pro- vide HIE incentives.

3.3. Conceptual Model and Predictions Although we cannot directly observe the granu- lar benefits and costs to various stakeholders from HIE participation, we can observe variation in the propensity of healthcare stakeholders to start plan- ning for exchange capabilities (PlanningHIE) and whether these exchanges start actively exchanging patient health information between healthcare enti- ties (OperationalHIE). We argue that these observed variables are, in turn, a function of the unobserved expected benefit and costs of an HIE effort to poten- tial HIE stakeholders, NetRegionalBenefit. Moreover, we model the choice to pursue an exchange at the level of a state subregion j since HIEs have emerged predominately as regionally focused efforts.8 Schol- ars suggest that this regional focus is due to the sig- nificant variation between healthcare markets (even within a given state) and the nuanced challenges this variation can introduce for the pursuit of HIE efforts (Grossman et al. 2008). For example, the nec- essary collaborations, technology infrastructure, and

8 Of the 73 operational exchanges in our data set, 71 were exchang- ing data predominately in a single HRR.

D ow

nl oa

de d

fr om

i nf

or m

s. or

g by

[ 14

0. 23

4. 25

5. 9]

o n

19 A

pr il

2 01

6, a

t 12

:2 3

. F or

p er

so na

l us

e on

ly , a

ll r

ig ht

s re

se rv

ed .

the priorities of participating providers are likely to differ considerably between the healthcare market in metropolitan and rural regions of a state (e.g., Manhattan versus upstate New York). Moreover, an HIE’s goal is to enable clinical data to electronically follow patients between the settings in which they receive care, which also are predominantly within a defined geographic region. Hence, we utilize HRRs as our unit of analysis because they represent regional healthcare markets.9 In effect, HRRs are defined pre- cisely to capture the geographic regions in which patients are likely to receive the bulk of their care and thus require the exchange of information. Finally, and consistent with the preceding arguments, we suggest that various forms of privacy requirements (PrivConsent/PrivNoConsent) and legislative provisions intended to encourage the pursuit of HIE efforts (Incentives) can affect the benefits and costs of HIE efforts to stakeholders within the various healthcare markets in a state, impacting the choice of stake- holders to start planning for exchange and whether these HIEs becomes operational. This is summarized in the following conceptual model (based on Miller and Tucker 2009):

PlanningHIE∗ jst 1 OperationalHIE∗

jst

= f 4NetRegionalBenefit jst

� PrivConsentjst1

PrivNoConsentjst1 Incentivesjst50

This model assumes a latent variable construct where stakeholders in HRR j in state s at time t start planning for an HIE if the (unobserved) expected net benefit (NetRegionalBenefit) is positive. Moreover, we assume that an HIE effort in the region reaches operational status if the NetRegionalBenefit remains positive such that they are able to complete key planning activities (e.g., create data sharing agree- ments, develop the underlying technical infrastruc- ture, and gather the critical mass of participation by healthcare entities to make exchange feasible). Conversely, healthcare stakeholders will not form exchanges if they perceive the net benefit to be neg- ative, and healthcare entities will cease pursuing HIE efforts (resulting in failed exchange) if they perceive the net benefit from HIE to no longer be positive.

The arguments from this conceptual model and the various dynamics described in this section are summarized in Figure 1. This figure suggests that the net effect of privacy regulation on HIE efforts is a function of (1) the costs associated with pri- vacy regulation; (2) the extent to which privacy con- cerns are, in fact, barriers to the pursuit of HIE

9 Specifically, HRRs define healthcare markets determined by where most of the residents in a given area received treatment for major cardiovascular surgical procedures and for neurosurgery (Wennberg and Cooper 1996).

efforts; and (3) the likelihood of available regulation to alleviate these concerns. With this in mind, we first consider the simplest case where privacy reg- ulation is enacted without accompanying incentives (i.e., the left-hand side of Figure 1), where we con- sider it more likely that privacy regulation will have a negative overall effect on NetRegionalBenefit, thus reducing the likelihood that HIEs form and become operational (this is similar to what has been shown in the current empirical literature). This implies that the propensity of privacy regulation to reduce the NetRegionalBenefit from HIE as a result of increased implementation costs and the restrictions on the avail- ability of patient data (�11�25 are likely to outweigh any gains from reduced patient privacy concerns (�11�25. Moreover, taking into account the propen- sity of consent requirements to have more substantial negative effects on NetRegionalBenefit (�1 > �2), this effect may be more pronounced for legislation includ- ing consent requirements.

The introduction of HIE incentives, however, intro- duces a more complex and interesting dynamic. Focusing only on the propensity of incentives to reduce HIE costs (�35, incentives alone may positively impact NetRegionalBenefit, and, if passed alongside privacy regulation, HIE incentives could offset some of the costs of privacy regulation. However, if we also consider the potential of incentives to be associated with elevated privacy concerns (�35 that then offset the positive effects of HIE incentives on NetRegional- Benefit (�45, we may observe a more nuanced effect of both incentives and privacy regulation on HIE efforts. First, we may see a limited positive effect on Net- RegionalBenefit of incentives passed alone because of the dampening effect of the simultaneously elevated privacy concerns (�35. Moreover, this suggests that privacy regulation, and in particular consent regula- tion that can better alleviate patient privacy concerns (�1 > �25, may become a more prominent force in this dynamic and could play a critical role in unlock- ing the propensity of HIE incentives to positively impact the net benefits of exchange. The implication of this is that coupling consent requirements with HIE incentives may have a stronger positive impact on NetRegionalBenefit (and thus differentially increase the propensity of regional stakeholders to start planning for exchange and these exchanges becoming opera- tional) relative to incentives with privacy regulation that did not include consent requirements or with no accompanying privacy regulation. Further, this sug- gests that privacy regulation may have considerably different (and potentially opposite) effects on HIEs depending on whether incentives are also in place.

4. Data Our analysis uses a combination of a six-year panel data set and cross-sectional HIE survey data to assess

D ow

nl oa

de d

fr om

i nf

or m

s. or

g by

[ 14

0. 23

4. 25

5. 9]

o n

19 A

pr il

2 01

6, a

t 12

:2 3

. F or

p er

so na

l us

e on

ly , a

ll r

ig ht

s re

se rv

ed .

Figure 1 Effects of Legislation on HIE Formation

�

the impact of the different legislative approaches on planning and operational HIEs. Consistent with the literature, we define an HIE as any entity that facili- tates electronic health information exchange between independent healthcare entities in a defined geo- graphic region to improve health (Adler-Milstein et al. 2009). As a result, the HIEs in our data set predom- inately focused on the exchange of patient health information between medical providers for patient treatment purposes. Further, we consider facilitation to be providing a technical infrastructure to support clinical data exchange. Together, these criteria exclude efforts whose entire scope is limited to administrative data exchange as well as efforts working on issues related to HIE but not directly enabling it to occur.

4.1. Panel HIE Data To identify HIEs across regions and time, we used publicly available data from the eHealth Initiative’s annual compilation of state, regional, and local HIE efforts (eHealth Initiative 2005–2010). These data are based on yearly surveys of HIEs completed by the eHealth Initiative (eHI) and provide longitudinal information about planning and operational HIEs in the 2004–2009 period. We also used various online resources provided by health organizations and indi- vidual HIEs to determine their status as of the end of 2009 and collect any additional information on char- acteristics of these exchanges (e.g., profit status). As noted earlier, at the beginning of 2004, there were

only a handful of established HIEs. As of the end of 2009, we identified 220 HIEs that were in one of two stages.

• Planning: The HIE has been initiated but is in the planning stages of development and is not actively sharing health information 4n = 1325.

• Operational: The HIE is actively enabling the exchange of health information between healthcare entities 4n = 885.

We also identified 92 HIEs that had been initiated during this time period but had subsequently ceased operations. We do not have longitudinal data on these exchanges, and they are not included in our panel data. However, using cross-sectional data on the total number of failed HIEs in our time period of analysis, we find no significant differences in failed exchanges between legislative approaches.10 To identify the date on which HIEs were initiated and became operational and their geographic area of operation, we matched HIEs in the eHealth Initiative survey data with a national survey of HIEs collected in 2010 that cap- tured detailed information on HIEs as of the end of 2009 (Adler-Milstein et al. 2011). Our sample includes the 73 planning and 75 operational exchanges com- mon to both data sets minus 5 exchanges that were

10 Normalizing by state population, we find that during our time period, states with incentives and consent requirements had 2.5 failed HIEs compared with 2.9 failed HIEs for states with incentives but no consent and 3.7 for states without any HIE incentives.

D ow

nl oa

de d

fr om

i nf

or m

s. or

g by

[ 14

0. 23

4. 25

5. 9]

o n

19 A

pr il

2 01

6, a

t 12

:2 3

. F or

p er

so na

l us

e on

ly , a

ll r

ig ht

s re

se rv

ed .

dropped because they did not report detailed infor- mation on their geographic location, resulting in 143 exchanges (70 planning and 73 operational) in our panel data set.

On average, HIEs in our data set had been in exis- tence for approximately four years, and the subset of HIEs that were operational had been exchanging health information for three and a half years by the end of 2009. Most exchanges (86%) operated within a single state; nearly all exchanges (98%) were oper- ating in fewer than two states. HIE geographic cov- erage was measured at the more granular level of an HRR. HRRs are generally contained within a single state but can span multiple states and, in some cases, can also span legislative approaches (although this was not common).11 Of the operational exchanges, 70% reported covering a single HRR, and 60% of the planning exchanges anticipated covering a single HRR. The exchanges that were operational or plan- ning in multiple HRRs tended to have the major- ity of their coverage in a single HRR, and thus we considered only their primary HRR. For example, of the 22 exchanges that reported operating in multiple HRRs, 20 reported being primarily operational in a single HRR with more than 70% of their overall cov- erage in a single HRR.12 We aggregated HRR cover- age across individual HIEs to generate two primary dependent variables.13

• PlanningHIEjst: A binary measure of whether HRR j in state s at time t had one or more HIEs in the planning phase. This measure only includes HIEs that had not failed and were available to take the HIE survey in 2010.

• OperationalHIEjst: A binary measure of whether HRR j in state s at time t had one or more operational HIEs.

These variables are created semiannually over the period 2004–2009 to most accurately capture the impact of legislation on HIEs, which commonly went into effect at the beginning or the middle of the year.

To construct measures of HRR demographics, including measures of HRR population, income, and unemployment rates, we used a range of secondary sources (e.g., U.S. Census Bureau, U.S. Bureau of Eco- nomic Analysis, and the U.S. Department of Health

11 In our analysis we find that only 9% of HRRs had significant portions (more than 25%) of the populations they encompass in other states with different legislative approaches. Our results are robust to the exclusion of these HRRs. 12 On average, HIEs were operational in 9.5 hospital service areas (HSAs)—a collection of ZIP codes whose residents receive most of their hospitalizations from the hospitals in that area (Wennberg and Cooper 1996)—in their central HRRs compared with 1.5 HSAs in their secondary HRRs. 13 HRRs having multiple operational exchanges were uncommon, with only 4% of regions reporting multiple operational exchanges.

and Human Services’ Area Health Resources Files (AHRF)). Finally, we used the Health Information and Management Systems Society (HIMSS) Analytics™

Database (HADB) to create measures that enabled us to control for hospital-level health IT adoption. In addition to our semiannual panel data set, we con- structed a cross-sectional data set using HIE survey data. These data, which were only available for the final year of our data, offered a detailed snapshot of HIE activities, including a range of self-reported mea- sures that captured qualitative differences between HIEs. We used this cross-sectional data to exam- ine other dimensions of HIE progress that were not captured in our panel measures of HIE efforts. For example, these data include measures of the num- ber of patients covered by an exchange, organiza- tional structure, sources of funding, and challenges faced. We supplemented this with data from other sources to construct state-level measures of education levels, age structure, and political leaning. Table 1 includes the full list of measures and associated sum- mary statistics.

4.2. Legislation Protection of patients’ personal health information, as well as requirements for patient consent for the shar- ing of personal health information in the context of exchanges, is governed by a combination of federal and state laws.

At the federal level, patient consent is governed primarily by HIPAA14 and associated regulation. HIPAA was amended in 2009 by the HITECH Act, which added some privacy requirements, including breach notification requirements for entities covered by HIPAA.15 Although HIPAA laws impact the dis- closure of health information by HIEs, HIPAA applies to all states (our analysis relies on between-state vari- ation) and was passed before the time period of our analysis. HITECH was passed in our period of analy- sis, and its effect on HIE efforts is accounted for by the time fixed effects in our models. At the state level, two types of privacy legislation may affect HIE outcomes: (1) general privacy health laws, not HIE specific, that were largely enacted before the significant emergence of HIEs; and (2) HIE-specific laws aimed at promot- ing HIE activities and/or focusing on the disclosure of patient data and patient consent.

General health privacy laws (i.e., not HIE spe- cific) have historically been in place to deal with various aspects of health privacy, including disclo- sure of patient health information and consent. We

14 Health Insurance Portability and Accountability Act of 1996, 42 U.S.C. §1320d-9 (2011). 15 Health Information Technology for Economic and Clinical Health Act of 2009, U.S.C. §3013 (2011).

D ow

nl oa

de d

fr om

i nf

or m

s. or

g by

[ 14

0. 23

4. 25

5. 9]

o n

19 A

pr il

2 01

6, a

t 12

:2 3

. F or

p er

so na

l us

e on

ly , a

ll r

ig ht

s re

se rv

ed .

Table 1 Data Overview and Summary Statistics

Panel Cross section

Variable Description Mean SD Mean SD Source

Dependent variables PlanningHIEjst A binary measure of whether HRR j in state s at

time t is covered by one or more planning HIEs. 0015 0035 0018 0038 HIE/eHi survey

OperationalHIEjst A binary measure of whether HRR j in state s at time t is covered by one or more operational HIEs.

0010 003 0020 004 HIE/eHi survey

PrivChallengeis Binary variable indicating whether HIE i in state s reported that privacy concerns were a major challenge to their progress.

— — 0012 0033 HIE survey

FundChallengeis Binary variable indicating whether an HIE i in state s reported the lack of funding as a major challenge to their progress.

— — 0043 0049 HIE survey

HighPatientHIEis Binary variable of whether HIE i in state s covered more than 50,000 patients.

— — 0062 0048 HIE survey

Independent variables PrivConsentst Dummy variable indicating a state s at time t has

privacy legislation that requires consent for HIE. 0009 0028 0017 0038 Goldstein and Rein (2010);

Pritts et al. (2009) PrivNoConsentst Dummy variable indicating a state s at time t has

privacy legislation that does not require patient consent for HIE.

0039 0048 0047 005 Goldstein and Rein (2010); Pritts et al. (2009)

Incentivesst Dummy variable indicating whether a state s at time t enacted any law intended to encourage HIEs.

0016 0036 0045 005 Westlaw/LexisNexis

Controls BroadbandAccesss The percentage of households in state s with

high-speed Internet access. — — 0051 0006 U.S. Census Bureau

PerCapGDPs ($1,000) The total GDP of state s divided by the population of state s.

— — 4301 1308 U.S. Bureau of Economic Analysis

Fundingst Dummy variable indicating whether HIE-specific legislation at time t explicitly provides funding opportunities for HIEs in state s.

001 003 0021 0041 Westlaw/LexisNexis

StateDesignatedst Dummy variable indicating whether HIE-specific legislation in state s at time t creates or designates a statewide HIE.

0003 0015 0008 0027 Westlaw/LexisNexis

Populationjst (1,000s) Number of inhabitants in HRR j in state s at time t. 97604 1109609 1100205 1113201 AHRF MedianIncomejst ($1,000s) The median family income for HRR j in state s at

time t. 4501 1005 4703 1008 AHRF

UnempRatejst The unemployment rate for HRR j in state s at time t.

601 2003 905 204 AHRF

CPOEADOPTIONjst Percentage of hospitals in HRR j in state s at time t adopting computerized provider order entry systems (CPOEs) normalized by staffed beds.

0019 0022 0024 0024 HADB

MonthsPursuingis Months an HIE i in state s has been in existence. — — 48 38 HIE survey FormalGovis Binary indicator of whether an HIE i in state s has a

formal governance structure. — — 0081 0039 HIE survey

Democratics Dummy variable indicating whether a democrat has carried state s in the 2000, 2004, and 2008 presidential elections.

— — 0047 005 National Archives

TopMeds Dummy variable if state s had a hospital in the U.S. News & World Report hospital honor roll in 2009–2010.

— — 0031 0046 Comarow (2009)

AdvancedDegrees The percentage of individuals in state s with a graduate degree.

— — 001 0003 U.S. Census Bureau

Over 65s The percentage of individuals in state s over 65. — — 0012 0002 AHRF

identified state health privacy laws using the recent compilation by Pritts et al. (2009) and the earlier com- pilation of general state privacy laws by Pritts et al. (2002). However, we found that most state health pri- vacy laws, similar to HIPAA, were passed before our period of analysis. Moreover, there has been consid- erable debate over the applicability of patient consent requirements provided in general health privacy laws. Specifically, most HIEs in our data set focused on

the exchange of patient health information between providers for treatment purposes. However, patient consent requirements in the majority of state health privacy laws include exceptions to garnering patient consent for data disclosures between providers for treatment purposes, thus effectively precluding the majority of exchange activities. According to Pritts et al. (2009), only two states (Minnesota and New York) appear to generally require patient permission

D ow

nl oa

de d

fr om

i nf

or m

s. or

g by

[ 14

0. 23

4. 25

5. 9]

o n

19 A

pr il

2 01

6, a

t 12

:2 3

. F or

p er

so na

l us

e on

ly , a

ll r

ig ht

s re

se rv

ed .

to disclose all types of health information and only three (New York, Minnesota, and Vermont) usually require medical providers to obtain patient permis- sion before disclosing health information to other providers. Because general health privacy laws that are not HIE specific were passed before our period of analysis, and their requirements for consent have limited applicability to HIEs, we do not use them as focal independent variables. The states with require- ments relevant to the exchange of health information were included in our analysis as interactions with time-varying HIE-specific legislation. This accounts for states that may not provide explicit requirements for consent in HIE-specific legislation because their existing legislation already has relevant requirements.

Our primary independent variables capture HIE- specific laws that, unlike general health privacy laws, were passed in the period of our analysis and have direct applicability to exchange efforts. We identi- fied HIE-specific laws primarily through various legal search services (e.g., LexisNexis Academic and West- law) and supplemented these searches with recent reports on disclosure laws and HIEs (Goldstein and Rein 2010). We find that, in the past decade, vari- ous states enacted legislation that (1) incentivized HIE efforts, (2) addressed patient privacy and consent, or, most commonly, (3) some combination of both.

As we described earlier, we considered state leg- islation as providing HIE incentives if it included, at a minimum, general provisions aimed at reducing any of the costs (financial, legal, managerial, coor- dination, or otherwise) associated with pursuing a health information exchange effort in the state. Our review of state laws fitting this criterion yields a number of state laws with provisions to incentivize HIE efforts. For instance, the North Dakota state law directs its health information technology office to “facilitate and expand electronic health informa- tion exchange in the state, directly or by awarding grants”;16 West Virginia law requires the director of the Office of Health Enhancement and Lifestyle Plan- ning to work “through the West Virginia Health Infor- mation Network, the Bureau for Medical Services and other appropriate entities, to develop a collabora- tive approach for health information exchange”;17 and Kentucky state law tasks the Kentucky eHealth net- work board with responsibility for “the operation of an electronic health network in this Commonwealth” and, among other things, for making recommenda- tions related to “models for an electronic health net- work” and “financing the central interchange for the network.”18 Moreover, we reviewed the specific provi- sions in state laws incentivizing HIE efforts to identify

16 N.D. Cent. Code, §54-59-26. 17 W. Va. Code Ann. §16-29H-6. 18 Ky. Rev. Stat. Ann. §216.267.

any trends in the nature of HIE incentives. This effort yielded two broad categories of HIE incentives. First, we found that 11 states have laws designating explicit funds authorized for use in support of HIE efforts. For instance, Minnesota state law allocated funding for the commissioner of health to award grants for the purpose of implementing “regional or community- based health information exchange organizations.”19

North Dakota state law included provisions to create an “electronic health information exchange fund” and also instituted a “health information technology loan program.” We found seven states that had HIE incen- tives focused on creating or designating a specific statewide HIE as opposed to focusing on dispersed regional efforts (such provisions do not exclude other entities from creating additional exchanges in that state). For instance, Rhode Island state law estab- lished a “statewide HIE under state authority to allow for the electronic mobilization of confidential health care information,”20 and Vermont state law tasked the Vermont Information Technology Leaders (a non- profit organization within the state) with operating the “statewide health information exchange network for this state” that included “grant agreements” with the organization.21 We account for this variation in the specific provisions included as part of state laws incentivizing HIE efforts in our empirical analysis.

Similar to general health privacy laws, HIE-specific laws varied in the extent to which they provided patients with privacy protections and, in partic- ular, the extent to which they instituted require- ments for consent. Given that most states’ general health privacy laws22 do not include consent require- ments for disclosing health information23 to other providers (which are also the majority of HIE par- ticipants), requirements for consent in HIE-specific laws are especially relevant to the disclosure of health information by exchanges. As a result, we differentiate between legislation including provisions requiring consent, only general privacy requirements without consent, and no privacy requirements at all. Leveraging variation in HIE incentives and privacy requirements between states, we categorize states that

19 Minn. Stat. Ann. §144.3345. 20 RI Gen L §5-37.7-4. 21 18 V.S.A. §9352. 22 New York, Minnesota, and Vermont have some requirements that require consent for disclosure between providers. These states were treated as having consent requirements and are Incentives and PrivConsent states because they would all subsequently pass HIE- specific legislation. 23 States have passed more stringent laws for some specific and sometimes sensitive health data (e.g., mental health or HIV data). Because this data type is generally not the focus of HIEs, we focus only on laws restricting the exchange of general health information.

D ow

nl oa

de d

fr om

i nf

or m

s. or

g by

[ 14

0. 23

4. 25

5. 9]

o n

19 A

pr il

2 01

6, a

t 12

:2 3

. F or

p er

so na

l us

e on

ly , a

ll r

ig ht

s re

se rv

ed .

Figure 2 Overview of HIE-Specific Legislation

Incentives and PrivConsent

Incentives and PrivNoConsent

Incentives only

passed HIE-specific legislation into one of three main categories:24

• Incentives and PrivConsent: states with laws intended to encourage the pursuit of HIEs and that have requirements for patient consent (eight states).25

• Incentives and PrivNoConsent: states with laws intended to encourage the pursuit of HIEs and that make some mention of privacy protections but do not include requirements for consent (i.e., they rely on the status quo of no consent requirements for the exchange of health information between healthcare entities) (11 states).

• Incentives: states with laws intended to encour- age the pursuit of HIEs but that make no men- tion of privacy protections; these states also did not have any preexisting general health privacy laws that would require consent in the context of exchange (three states and the District of Columbia).

Figure 2 identifies the states that have enacted HIE- specific legislation. In addition, we identified three states that passed or amended health privacy laws that instituted privacy requirements for HIEs without accompanying incentives. During the time period of our analysis, Nevada and New Mexico passed health privacy legislation that explicitly mentioned exchange but did not institute consent requirements for the exchange of health information between healthcare entities for treatment purposes (similar to general health disclosure laws discussed previously). Con- versely, Maine amended existing privacy legislation to

24 See EC.1 in the electronic companion (available as supplemen- tal material at http://dx.doi.org/10.1287/mnsc.2015.2194) for addi- tional example statutes and text. 25 Specifically, under this category, we consider any law that man- dates that patients are provided with notice before the exchange of their personal health information in an HIE and, at a minimum, that patients are also provided with the choice to exclude their information from such an exchange as having consent requirements.

require patient consent prior to the exchange of patient health information. This leaves 25 states that did not pass HIE-specific legislation during our time period.

5. Methods Our empirical approach leverages time-series regres- sion using longitudinal data on planning and oper- ational HIEs across HRRs, as well ascross-sectional analysis using survey data on individual HIEs.

5.1. Model 1: Fixed Effects Model The first model we estimate is a panel linear prob- ability model that includes HRR and time fixed effects with reported standard errors clustered at the state level. This model evaluates the impact of HIE- specific legislation on HIE creation (PlanningHIEjst) and reaching operational status (OperationalHIEjst) in healthcare market j, in state s, at time t.26 This model identifies the baseline effects on these variables of

26 In our context, nonlinear models with fixed effects (e.g., logit) are not desirable because they leverage only variation across time. In our analysis, this precludes a significant portion of our data and would result in a specification with estimations using HRR fixed effects failing to converge. The central limitation to the lin- ear probability model is that the predicted probabilities are not constrained between 0 and 1, thus requiring some caution when interpreting coefficient estimates. However, prior work has shown little qualitative difference between the logit and linear probabil- ity specification (Angrist and Pischke 2008), and prior empirical work in this field has leveraged identical approaches (Miller and Tucker 2009, Goldfarb and Tucker 2011). In addition to the practical limitations associated with nonlinear fixed effects models, scholars (e.g., Neyman and Scott 1948) have demonstrated that estimates from nonlinear fixed effects models are inconsistent because the asymptotic variance of the main parameters is a function of a small and assumed fixed group size; this is also known as the inciden- tal parameter problem. Greene (2002) finds this problem to be of significant practical consequence with slope estimates from non- linear fixed effects models uniformly biased away from zero com- pounded by estimates of the standard errors biased toward zero.

D ow

nl oa

de d

fr om

i nf

or m

s. or

g by

[ 14

0. 23

4. 25

5. 9]

o n

19 A

pr il

2 01

6, a

t 12

:2 3

. F or

p er

so na

l us

e on

ly , a

ll r

ig ht

s re

se rv

ed .

privacy regulation with and without consent require- ments and the effects of HIE incentives while allowing for the differential impact of HIE incentives if privacy requirements are also in place (model 1):

PlanningHIE jst 1 OperationalHIE

jst

= �0 + �1 × PrivConsentst + �2 × PrivNoConsentst

+ �3 × Incentivesst + �4 × PrivConsentst × Incentivesst

+ �5 × PrivNoConsentst × Incentivesst

+ B6 × StateDesignatedst + �7 × Fundingst + � × Xjst + �js + �t + �jst0

Here, PrivConsentst is a dummy variable indicat- ing whether a state s at time t had a privacy law that also required patient consent in the context of exchange, and PrivNoConsentst is a dummy variable indicating whether a state had a privacy law in place but did not require patient consent in the con- text of exchange. In this model, PrivConsentst and PrivNoConsentst capture the impact of privacy regu- lation that was passed without accompanying incen- tives. Moreover, Incentivesst is a dummy variable indicating whether a state s had legislation provid- ing HIE incentives at time t (where t represents semiannual intervals). We also include the interac- tions PrivConsentst × Incentivesst and PrivNoConsentst × Incentivesst to identify any differential impact of incen- tives when varying degrees of privacy protections are present. These interactions take into account other potentially relevant privacy legislation. For example, if a state had passed legislation with HIE incentives during our time period of analysis without privacy provisions but either during or prior to our period of analysis also passed privacy requirements relevant to exchange in separate legislation, this interaction would be positive.

We also created variables to differentiate between the most common provisions in state laws incentiviz- ing HIE efforts. We found that states differed in terms of whether they provided explicit funding in legisla- tion incentivizing HIEs; some states provided funds explicitly authorized for use in support of HIE efforts, whereas other states directed responsible entities to identify sources of financial support for exchange efforts or were ambiguous regarding financial sup- port from the state. Thus, our first variable captures HIE incentives with explicit funding opportunities (Fundingst5. In addition, we captured differences in states’ propensity to focus HIE incentives on creating or designating a statewide exchange versus focusing HIE incentives on HIE efforts in disparate healthcare markets. Thus, our second variable captures states with laws that designate or create a state-sponsored HIE (StateDesignatedst5. We include these variables in

our model to address the concern that the variation in state strategies toward HIE incentives may correlate with a particular legislative approach. If this were the case, the effect of a given legislative approach could be driven by the intensity or nature of HIE incentives.

Finally, we include a vector of control variables, Xjst, which accounts for other factors relevant to the emer- gence of planning and operational HIEs. For exam- ple, HIE efforts may require that regional healthcare entities have some minimum level of patient record digitization and health IT infrastructure in order to engage in electronic exchange, which could be corre- lated with privacy regulation. As a result, we control for healthcare IT adoption in the HRR by includ- ing CPOEAdoptionjst to capture hospital adoption of computerized provider order entry (CPOE).27 CPOE is often a proxy for advanced adoption of health- care IT and is highly correlated with the adoption of other healthcare IT (e.g., electronic medical records). It is also a core component of the federal defini- tion of “meaningful use” of electronic health records (Blumenthal and Tavenner 2010). Other HRR-level controls include those capturing population, median income, and unemployment rates. HRR and time fixed effects are represented by �js and �t, respec- tively; �jst is the error term. We evaluate whether multicollinearity is a concern in the estimation of this model by calculating correlation tables and the vari- ance inflation factor (VIF) for each independent vari- able in the model. We find that all variables have a VIF well below the recommended maximum of 10 (Kennedy 1992), with a mean VIF of 1.9 for the vari- ables in our panel estimation (see EC.2 in the elec- tronic companion). Similar fixed effects models have been used in the literature to examine the effect of a policy intervention (Bertrand et al. 2004). HRR fixed effects allow us to control for time-invariant unob- served factors and time dummies allow us to control for time trends. Thus, the unbiased effect of varied regulatory approaches can be identified from varia- tion across HRRs and time. In an extended specifica- tion, we include one-year lagged variables to allow for a delayed effect on HIE outcomes of legislation aimed at incentivizing HIE efforts with and without privacy regulation. This accounts for the potential for resources provided by these laws to take time to reach entities interested in pursuing HIE.28

5.2. Model 2: Cross-Sectional Model The second model we estimate also uses a linear probability model and standard errors clustered at

27 Based on data obtained from HADB. 28 For clarity of exposition, we exclude the lagged terms for the binary indicators of states having privacy regulation alone (Priv- Consent and PrivNoConsent) since the lagged effect of this legislative approach is not of central interest and was rare in our data set.

D ow

nl oa

de d

fr om

i nf

or m

s. or

g by

[ 14

0. 23

4. 25

5. 9]

o n

19 A

pr il

2 01

6, a

t 12

:2 3

. F or

p er

so na

l us

e on

ly , a

ll r

ig ht

s re

se rv

ed .

the state level but uses cross-sectional survey data. Our survey data captured a detailed snapshot of HIEs’ status and activities as of the end of 2009. This model evaluates the association between relevant HIE characteristics (described below) and the vary- ing approaches toward incentivizing HIE efforts (i.e., those with and without consent-based regulation):

HIECharactersiticis = �0 + �1 × Incentivess

+ �2 × Incentivess × PrivConsents

+ � × Xs + � × Zis + �is0

Here, Incentivess is a binary indicator of whether an HIE is operating in a state s with HIE incentives. The interaction between Incentivess ∗ PrivConsents captures any differential impact of having consent require- ments alongside HIE incentives. Because states with privacy regulation without incentives had only two operational and three planning exchanges, we do not attempt to estimate effects for these legislative approaches. However, to avoid biased interpretation of our estimates, we exclude these HIEs from our estimation for model 2. This model does include a vector of state-level controls, Xs, which accounts for state political leaning, wealth, population, age struc- ture, and education levels, as well as a vector, Zis, of HIE-level controls including measures of the length of time an HIE has been pursuing exchange and whether they have a formal governance structure. Although we do include a number of state- and HIE-level con- trols, we cannot include HIE or regional fixed effects. As a result, the estimates from model 2 should be interpreted with some caution. However, we argue that the most problematic endogeneity concerns are unlikely in the context of our analysis.

For instance, we use this model primarily to eval- uate the association among HIE incentives, consent requirements, and HIE privacy challenges. Specifi- cally, we use a binary measure of whether an HIE i in state s reported that privacy concerns were a major challenge or impediment to their development (PrivChallengeis5 to evaluate our previous conjecture that incentives for HIEs may be associated with an increased attention to and salience of privacy con- cerns, which could materialize as barriers to the emer- gence of HIEs. In the context of this analysis, one concern may be that heterogeneity in states’ tastes for privacy would both impact their propensity to have consent requirements, as well as the pushback HIEs face from privacy concerns. However, our predictions would actually be made less likely by this effect, since we conjecture that HIEs in states with consent require- ments will, in fact, report less pushback as a result of patient privacy concerns. For a similar reason, we consider reverse causality in which low initial privacy

concerns resulted in states being more likely to pass consent requirements as also being unlikely.

Additionally, we use this model to evaluate whether relevant heterogeneity exists in key indi- vidual characteristics of HIEs across states with and without consent requirements. For example, because availability of funding (beyond that from the gov- ernment) has been shown to significantly affect the choice to pursue exchange (Adler-Milstein et al. 2009), we evaluate the correlation between consent requirements and the availability of funding to HIEs. Although our panel estimation controls for legisla- tion with explicit funding opportunities as part of their HIE incentives, this may not suffice, because HIEs may leverage a range of funding sources includ- ing those provided by the federal government and other private sources (e.g., large health systems or physician groups). As a result, we include the vari- able FundChallengeis as a binary measure indicating whether HIE i in state s reported that the lack of funding was a major challenge to their development. Finally, we evaluate whether HIEs in states with con- sent requirements varied with respect to other char- acteristics that are also indicative of HIE progress and their ability to achieve desired goals. Specifically, we evaluate differences in the number of patients covered by an exchange (HighPatientHIEis5 across states with and without consent requirements.

6. Results The results for the fixed effects model (model 1) are presented in Table 2. We find that privacy regulation without incentives had a negative effect on the pur- suit of HIE. However, this effect varied depending on the stage of HIE development. For privacy regula- tion with consent requirements (PrivConsent), we find a large negative and significant coefficient for Plan- ningHIE (column (A)). However, a similarly negative coefficient for OperationalHIE is not significant (p = 00171, column (B)). For privacy regulation without consent requirements (PrivNoConsent), we find a sig- nificant negative coefficient for OperationalHIE but a near-zero and insignificant estimate for PlanningHIE. This suggests that, although privacy regulation with- out consent had a significant effect on HIEs reaching operational status, it does not seem to dissuade enti- ties from initially pursuing HIE.

We find small and generally insignificant estimates on Incentives, suggesting that HRRs in states that pro- vided HIE incentives without accompanying privacy provisions did not see increases in HIEs. However, we do find a significant and positive coefficient on the interaction of PrivNoConsent and Incentives, but only for OperationalHIE. This suggests that incentives passed alongside regulation without consent require- ments resulted in a 9% increase in the probability

D ow

nl oa

de d

fr om

i nf

or m

s. or

g by

[ 14

0. 23

4. 25

5. 9]

o n

19 A

pr il

2 01

6, a

t 12

:2 3

. F or

p er

so na

l us

e on

ly , a

ll r

ig ht

s re

se rv

ed .

Table 2 Impact of Legislation on HIE Efforts

(A) (B) (C) (D) PlanningHIE OperationalHIE PlanningHIE OperationalHIE

PrivConsent −00360∗∗ −00116 −00342∗∗ −000773 40007235 40008315 40007415 40008465

PrivNoConsent 000282 −00104∗∗ 000302 −00100∗∗

40005905 40002435 40005885 40002285 Incentives 0000462 0000459 −0000598 −00000367

40005015 40002675 40003995 40002225 Incentives × PrivConsent 00466∗∗ 00230∗∗ 00432∗∗ 00135∗

4001125 40006915 4001005 40006685 Incentives × PrivNoConsent −000483 000908∗∗ −000410 000987∗∗

40009065 40003075 40007965 40003055 IncentivesLag 000412 000319

4001075 40002735 IncentivesLag × PrivConsentLag 000293 00117

4001195 40009885 IncentivesLag × PrivNoConsentLag −000297 −000344

4001235 40002885 StateDesignated −00162+ 00196∗∗ −00150 00218∗∗

40009015 40007205 40009065 40006965 Funding 000497 −000556∗ 000447 −000641∗

4001065 40002315 4001075 40002565 CPOEAdoption 0000659 000798 0000772 000815

40006665 40008055 40006585 40007985 OperationalHIE −00520∗∗ −00525∗∗

40005695 40005575

Observations 3,672 3,672 3,672 3,672 R-squared 00195 00113 00196 00120 Control variables Yes Yes Yes Yes Time fixed effects Yes Yes Yes Yes HRR fixed effects Yes Yes Yes Yes

Note. Robust standard errors are shown in parentheses. +p < 001; ∗p < 0005; ∗∗p < 0001.

of an HRR having an operational exchange but no measurable effect on the propensity of initiating an exchange. Finally, we find consistent and significant gains from HIE incentives when they were coupled with privacy regulation providing patient consent requirements. Specifically, we find a large and signif- icant coefficient on the interaction of PrivConsent and Incentives for both PlanningHIE (p < 0001) and Opera- tionalHIE (p < 0001), suggesting that incentives passed alongside privacy regulation with consent require- ments resulted in a 47% increase in the probability of HRRs having a planning exchange and a 23% increase in the probability of HRRs having an operational exchange. Moreover, the difference in the effective- ness of incentives coupled with consent requirements was statistically significant when compared with the incentives alone (Incentives) or incentives with reg- ulation without consent (Incentives × PrivNoConsent) for both PlanningHIE (p < 0001) and OperationalHIE (p < 0005).

Given that we find evidence of negative baseline effects of privacy regulation, we also consider the net

effect for states with legislative approaches that com- bined incentives and privacy regulation. For instance, although HIE incentives coupled with privacy regu- lation without consent requirements resulted in a 9% increase in the probability of HRRs having an opera- tional exchange, this effect was offset by the negative (10%) baseline effect of the privacy regulation, result- ing in a zero net effect on the propensity of HRRs in these states to have operational HIEs. By contrast, we find evidence of a net gain in operational HIEs for HRRs in states with both HIE incentives and privacy regulation with consent requirements. Specifically, we identify an 11% (p < 0005) net increase for Operational- HIE and also a 10% net increase (although insignifi- cant, p = 0022) for PlanningHIE. Within our data set, HIE incentives coupled with consent requirements was the only legislative approach with evidence of a net gain in OperationalHIE.

Estimates of our main model with lagged variables are presented in Table 2, columns (C) and (D). We find that estimates on our baseline interaction of Incentives and PrivConsent for PlanningHIE are of similar mag- nitude to our primary estimation and are significant

D ow

nl oa

de d

fr om

i nf

or m

s. or

g by

[ 14

0. 23

4. 25

5. 9]

o n

19 A

pr il

2 01

6, a

t 12

:2 3

. F or

p er

so na

l us

e on

ly , a

ll r

ig ht

s re

se rv

ed .

(p < 0005), whereas our lagged term has a small and insignificant coefficient. This suggests that new HIEs were planned within a short period of the passage of these laws and may reflect the relatively low costs of initiating an exchange and that parties interested in pursuing HIE closely tracked the progression of these laws. However, we may reasonably expect that the effect of legislation on the propensity of an exchange actually becoming operational may be less immediate, because the resources afforded by these laws may be critical in exchanges advancing their capabilities. We find some support for this notion, with the coefficient on our baseline interaction of Incentives and PrivCon- sent for OperationalHIE roughly half the magnitude of our primary estimation (13.5% versus 23.0%). Our lagged term, however, is larger (11.7%) but less pre- cisely estimated (p = 0024), suggesting some variabil- ity in the lagged effect of relevant legislation. We should note that we are not able to observe lagged effects for states that passed laws within the last year of our panel (Oregon and Alaska), which may also be contributing to higher standard errors for estimation of our lagged term.

The results from our cross-sectional model (see Table 3) offer some explanation for the differen- tial HIE gains from incentives coupled with consent requirements and also address alternative interpre- tations of our results. First, we evaluate the valid- ity of our earlier conjecture that the effectiveness of incentives with consent requirements is driven by the propensity of consent requirements to address ele- vated consumer privacy concerns associated with HIE incentives. We find evidence in support of this con- jecture with HIE incentives not coupled with consent requirements positively associated with increased scrutiny and privacy concerns. Specifically, we find that HIEs in states with HIE incentives but without consent requirements were 30% more likely to report that privacy was a major challenge compared with HIEs in states with incentives and consent require- ments (p < 0001) and 14% more likely to report that privacy was a major challenge in their develop- ment compared with states without any legislation (p < 0005). HIEs in states with incentives and consent requirements were least likely to report major pri- vacy challenges compared with all other legislative approaches (p < 0001).

Results from our cross-sectional model also help to rule out what we considered the most promi- nent confounding factors to the interpretations of our results. First, we consider whether our results merely reflect heterogeneity in the propensity of incentives coupled with consent requirements to pro- vide funding opportunities for HIE efforts (the lack of sufficient financial support has been a prominent barrier to HIE development). Although we account

Table 3 Consent Requirements and Key HIE Characteristics

(A) (B) (C) PrivChallenge FundChallenge HighPatientHIE

Incentives 00144∗ −00240∗ −00102 4000665 4001185 4001145

Incentives × PrivConsent −00302∗∗ −00102 00160 4000685 4001415 4001075

Population 00007∗ −00005 −00005 4000035 4000035 4000035

PerCapGDP −00007∗∗ −00007 00010+

4000025 4000055 4000065 BroadbandAccess −00001 00006 00008

4000035 4000075 4000095 Democratic −00015 −00019 00070

4000645 4001125 4001035 TopMed 00135∗ 00218+ 00087

4000535 4001175 4001275 AdvancedDegree 00030∗ 00019 −00078∗

4000145 4000295 4000345 Over65 00032∗∗ −00011 −00030

4000115 4000225 4000205 MonthsPursuing −00001+ −00002 00003∗∗

40000015 4000015 4000015 FormalGov −00087 −00104 00437∗

4000735 4001555 4001595

Observations 133 136 70 R-squared 0013 0011 0019

Notes. Robust standard errors are shown in parentheses. The number of observations varies because of some nonresponses in the survey; col- umn (C) only uses responses from operational exchanges.

+p < 001; ∗p < 0005; ∗∗p < 0001.

for this in our panel estimation by controlling for HIE incentives with funding opportunities (Funding), we address this concern further by evaluating any asso- ciation between HIE self-reported funding challenges and incentives that included consent requirements. We do not find support for the notion that HIEs in states with consent requirements significantly differed with respect to their access to sources of funding: col- umn (B) in Table 3 shows that, although HIEs in states with HIE incentives were 24% less likely to report that funding was a major challenge (p < 0005), there is no significant correlation between consent requirements and funding being a major challenge for HIEs with an insignificant estimate on Incentivess × PrivConsents.

In addition, we evaluate whether legislative ap- proaches coupling incentives with consent require- ments actually resulted in a positive effect on exchange capabilities in a healthcare market. Specif- ically, it may be the case that, although legislative approaches coupling incentives with consent result in a higher likelihood of an exchange being opera- tional, these exchanges may have less extensive or comprehensive exchange capabilities. We do not find evidence of this, however, with an insignificant esti- mate on Incentivess × PrivConsents for HighPatientHIE

D ow

nl oa

de d

fr om

i nf

or m

s. or

g by

[ 14

0. 23

4. 25

5. 9]

o n

19 A

pr il

2 01

6, a

t 12

:2 3

. F or

p er

so na

l us

e on

ly , a

ll r

ig ht

s re

se rv

ed .

(column (C)). In fact, the positive estimate on this coefficient suggests that HIEs in states with both incentives and consent requirements trended toward covering more patients, not fewer.

7. Robustness We evaluated the robustness of our primary results (model 1) by examining concerns regarding (1) the endogenous passing of legislation providing incen- tives and consent, (2) our assumption that HRRs are subject to only one legislative approach, and (3) incen- tive heterogeneity and high-impact states.

7.1. Endogeneity of Incentives and Consent The results presented in §6 highlighted the unique role of consent requirements combined with HIE incentives in spurring the emergence of planning and operational HIEs. The model we estimate was iden- tified using HRR and time fixed effects to isolate within-HRR variation over time and controls that could be correlated with the legislative initiatives of interest and the pursuit of HIE. However, a state’s choice of a particular legislative approach is certainly not random, exposing our estimates to potential bias if there exists time-varying heterogeneity between states with certain legislative approaches that also contributes to the success of HIEs. Although the direc- tion of this bias is ambiguous (i.e., it is possible that the potential bias in our results makes our results more conservative), we focus on the potential bias, which could result in the overestimation of our cen- tral result.

First, rather than HIE laws driving HIE activity, these laws could instead be passed as a result of increased HIE activity. To assess this possibility, we plotted the total number of attempted HIEs (plan- ning plus operational) for the main HIE legislative approaches we identified. Figure 3 reveals that states that ultimately passed consent requirements did not have elevated levels of HIE activity before the pas- sage of the law. In fact, they had the lowest level of HIE activity when compared with other legisla- tive approaches. More generally, before the period in which most HIE laws were passed (pre-2007), there were minor differences in the number of attempted HIEs. However, as we move into 2007, states with no legislation or incentives without consent main- tain a roughly constant rate of growth, whereas states that coupled incentives with consent requirements see a significant increase in attempted HIEs. We further evaluate possible reverse causality by estimating our main model with one-time-period lead variables for the legal requirements (see columns (A) and (B) in Table 4). This allows us to evaluate whether the trends of increased planning and operational HIEs were, in fact, in existence prior to the enactment of relevant

Figure 3 (Color online) Number of HIEs in States with Key Legislative Approaches

0.5

1.0

1.5

2.0

2.5

3.0

3.5

4.0

4.5

5.0

2004 2005 2006 2007 2008 2009 2010

T o ta

l H IE

Attempted HIEs

Incentives and PrivConsent

Incentives and PrivNoConsent

No HIE law

HIE laws. We find that our initial result is robust to the inclusion of lead variables and that the estimates on our lead variables, including the interaction of incentives and consent requirements, are insignificant.

In addition, our main estimation evaluates the impact on HIE efforts of legislation with HIE incen- tives compared with states without any such legisla- tion. However, HIE incentives may be correlated with time-varying state unobservables that also impact HIE outcomes. For example, HIE incentives may be cor- related with changes in political attitudes or public opinion toward the importance of health IT, which is likely to also have an impact on the emergence of HIE efforts. As a result, we evaluate whether our results are being driven by differences between states with and without HIE incentives. Specifically, we estimate our model using only the subset of states that have legislation with HIE incentives (columns (C) and (D) in Table 4). The results are consistent with those in our original estimation with a sizable and significant (p < 0005) impact of Incentives × PrivConsent on both Plan- ningHIE and OperationalHIE. In addition, we argue that the heterogeneous effects on HIE efforts of incen- tives (e.g., incentives without consent had a marginal or no effect on HIE efforts) make it less likely that unobserved factors, correlated over time with HIE incentives, are systematically driving HIE efforts.

With respect to the endogeneity of privacy regu- lation, prior work (e.g., Miller and Tucker 2011) has used privacy regulation limiting the disclosure of health information as an instrumental variable in the estimation of the effect of EMR adoption on health- care outcomes, arguing and presenting evidence that such regulations are likely exogenous to shifts in states’ focus on healthcare issues and political motiva- tions. Similar to such analysis, we find that states with consent requirements varied considerably in terms of geographic location, size, and state political affiliation. Moreover, we propose, similar to the case against the

D ow

nl oa

de d

fr om

i nf

or m

s. or

g by

[ 14

0. 23

4. 25

5. 9]

o n

19 A

pr il

2 01

6, a

t 12

:2 3

. F or

p er

so na

l us

e on

ly , a

ll r

ig ht

s re

se rv

ed .

Table 4 Robustness Checks

Lead variable analysis Only states with incentives Excluding overlapping HRR

(A) (B) (C) (D) (E) (F) PlanningHIE OperationalHIE PlanningHIE OperationalHIE PlanningHIE OperationalHIE

PrivConsent −00354∗∗ −00123∗ −00372∗∗ −00109 40006145 40005755 40008535 40008195

PrivNoConsent −000246 −000845∗∗ −00106∗∗ −00114∗∗

40004075 40002305 40003685 40003745 Incentives −0000114 000266 000172 000150

40003945 40002825 40005855 40002765 Incentives × PrivConsent 00389∗∗ 00164∗∗ 00248∗ 00160∗∗ 00445∗∗ 00221∗∗

4001045 40005695 40009235 40004915 4001225 40006735 Incentives × PrivNoConsent 000430 000630+ 000779 000904∗

40007175 40003465 40008265 40004115 IncentivesLead 000230 −000319

40003545 40003115 IncentivesLead × PrivConsentLead 00116 000798

40007005 40004815 IncentivesLead × PrivNoConsentLead −000601 000447

40004375 40003325 StateDesignated −00161+ 00245∗∗ −00246+ 00152+ −00156+ 00187∗

40009545 40004825 4001255 40007965 40008945 40007115 Funding 000433 −000662∗∗ 000568 −000656∗ 000503 −000590∗

4001195 40002105 40009635 40002905 4001175 40002395 CPOEAdoption 000128 000894 −000408 −000393 000160 000924

40006825 40007935 40009925 40009735 40007245 40008805 OperationalHIE −00530∗∗ −00526∗∗ −00523∗∗

40006385 40008855 40005775

Observations 3,366 3,366 1,584 1,584 3,384 3,384 R-squared 00197 00114 00219 00143 00198 00119 Control variables Yes Yes Yes Yes Yes Yes Time fixed effects Yes Yes Yes Yes Yes Yes HRR fixed effects Yes Yes Yes Yes Yes Yes

Note. Robust standard errors are shown in parentheses. +p < 001; ∗p < 0005; ∗∗p < 0001.

endogeneity of HIE incentives, that our results par- tially shield us from these concerns. If unobserved factors are powerfully driving HIE efforts and these factors are correlated, over time, with privacy reg- ulation, the divergent effects of privacy regulation (e.g., privacy regulation without incentives actually inhibited HIE efforts) would be considerably more difficult to identify. Since we focus on the interac- tion of privacy regulation with incentives, we are still concerned that specific legislative approaches, partic- ularly legislative approaches that couple incentives with consent requirements, could be differentially cor- related with other unobserved factors over time that could also drive the emergence of planning and oper- ational HIEs. For instance, it is possible that legisla- tive approaches coupling consent requirements with incentives are also associated with changes in atti- tudes toward health IT and the value of technol- ogy in healthcare settings. However, we consider this unlikely, because HIEs have expressed significant con- cerns over consent-based regulation. For instance, in

a recent report (National eHealth Collaborative 2011), HIE administrators suggested that requiring patients to opt in to an HIE was a barrier to achieving the critical mass of patient records needed to generate theorized benefits. As a result, we suggest that it is more likely that states that adopt consent require- ments signal a shift toward a more tempered atti- tude toward the trade-offs associated with health IT relative to states with HIE incentives alongside less stringent regulation, likely making our results more conservative.

Finally, the combination of incentives and con- sent requirements could reflect the sophistication of state legislative bodies in anticipating and proac- tively addressing the central concerns associated with increased HIE activity in the state. This sophistica- tion could also be correlated with better administered, managed, and otherwise executed incentive programs that yield improved HIE outcomes. To evaluate this concern, we leverage work by Squire (2007) that ranks state legislatures based on their professionalism. We

D ow

nl oa

de d

fr om

i nf

or m

s. or

g by

[ 14

0. 23

4. 25

5. 9]

o n

19 A

pr il

2 01

6, a

t 12

:2 3

. F or

p er

so na

l us

e on

ly , a

ll r

ig ht

s re

se rv

ed .

first find that measures of state legislative profession- alism do not vary considerably over time: all but one of the states ranking below the median in 1996 con- tinued to rank below the median in 2003 (the most recent ranking). Moreover, the states that passed con- sent requirements and incentives varied considerably in their legislative professionalism, with four of the eight states ranking below the median in 2003.

Although we take a number of steps to con- sider and evaluate potential endogeneity of legislative efforts, we acknowledge that these concerns may per- sist to some degree, as they often do with empirical work of this nature.

7.2. HRR Boundaries Measuring HIE activity at the level of an HRR allows us to identify the impact of legislation on the propen- sity of an HIE to be operational or in the plan- ning stage within relatively self-contained healthcare markets; it also allows for meaningful comparison across states with regions subject to varying legisla- tive approaches. This approach requires us to assume that each HRR is contained within a single state and thus a single legislative approach. However, HRR boundaries can sometimes span multiple states that may have different legislative approaches. We find that this is fairly uncommon, with 80% of HRRs either being fully contained in a single state or overlapping with states that had the same legislative approach. An additional 11% of HRRs had minor overlap (less than 25% of their population) in states with different leg- islative approaches. When we exclude the remaining 9% of HRRs, which had significant overlap in states with different legislation approaches, and estimate our main model (see Table 4, columns (E) and (F)), we find consistent results with our original estimation.29

7.3. Incentive Heterogeneity and High-Impact States

Although we control for the most prominent variation in the strategies that states take toward HIE incen- tives, there may also be other HIE incentives that are less common in our analysis but may still have an impact on the nature of HIE incentives and also on HIE outcomes. Specifically, we identified four other features of HIE incentives that were less frequent but still of potential interest: whether HIE incentives were directed to an existing private organization as opposed to a government entity, whether HIE incen- tives instituted a pilot program, whether incentives addressed existing regulation viewed as an impedi- ment to HIE progress, and whether incentives had

29 Although not presented here for clarity, our results are also con- sistent when using a state-level ordinary least squares estimation approach with aggregated count measures of HIE activity, state and time fixed effects, and state-level controls.

an interstate dimension. To evaluate whether these less common features of HIE incentives impact our estimation, we estimate our main model with addi- tional controls capturing these less frequent features of HIE incentives and find consistent results with our main estimation (see EC.3 in the electronic compan- ion). Because our analysis relies on a limited num- ber of states, it is also possible that our results are not due to a correlation between consent requirements and incentives but by a single state with unique HIE incentives or with disproportionate HIE success as a result of factors not captured in our model. To address this concern, we limit our analysis to states with HIE incentives and sequentially exclude all regions in a given state that coupled incentives with consent requirements from our estimation for PlanningHIE and OperationalHIE (see EC.3 in the electronic com- panion). We find that our results for PlanningHIE and OperationalHIE are robust to sequential exclusion of states with incentives and consent requirements. Excluding New York seems to have the largest impact on estimates of the effect of incentives coupled with consent requirements, but these estimates are still sig- nificant for OperationalHIE and marginally significant for PlanningHIE.

8. Discussion and Conclusions We evaluated the impact of legislation that varied in whether it included requirements for patient con- sent and provided HIE incentives over a span of six years. We document a surprising interplay between state attempts to incentivize HIE efforts and pri- vacy regulation. Specifically, although privacy regula- tion alone—and, in particular, regulation with consent requirements—resulted in a negative effect on HIE efforts, coupling HIE incentives with consent require- ments was the only legislative approach intended to encourage HIE efforts that actually resulted in an increase in operational HIEs. We find that this result is robust to considerations of reverse causality, endo- geneity of HIE incentives and consent requirements, considerations of HRR legislative boundaries, incen- tive heterogeneity, and a single state driving the effect. We also find that HIEs in states with both incen- tives and consent requirements reported lower lev- els of concern about patient privacy issues, whereas exchanges in states with HIE incentives but with- out consent requirements reported higher levels of patient privacy concerns. We propose that this ele- vated concern may be due to an association between HIE incentives and privacy concerns that inhibit the effectiveness of such incentives when consent require- ments are not in place.

There are limitations to this research. The depen- dent variables presented in this work may not cover

D ow

nl oa

de d

fr om

i nf

or m

s. or

g by

[ 14

0. 23

4. 25

5. 9]

o n

19 A

pr il

2 01

6, a

t 12

:2 3

. F or

p er

so na

l us

e on

ly , a

ll r

ig ht

s re

se rv

ed .

the full breadth of potential measures of success for HIEs. For instance, prior research on HIEs has noted that sharing by HIEs has been limited in breadth and scope (Adler-Milstein et al. 2009). We evaluate these measures using cross-sectional data, but future work may evaluate the impact of various legislative approaches on these measures in more substantive terms. Moreover, an increase in regional HIE efforts may not necessarily be a positive outcome. For exam- ple, a better outcome might be to have only one exchange that facilitates exchange for all providers in the state. However, the current national strategy for the exchange of health information involves spurring small regional efforts and then linking them as build- ing blocks of state and national exchange (Vest and Gamm 2010). As is true in prior work, we can thus view a higher probability of HIEs in planning and operational stages in HRRs as a positive indicator of HIE progress. Moreover, our work focuses specifically on the role of providing patients with the choice to consent in the context of HIEs, but other key con- cerns with HIEs may also be relevant. For example, it may be prudent in future work to evaluate the role of information security requirements on the develop- ment and progress of HIEs. Finally, this paper focuses on regional models of HIE and, although alternative approaches to HIE exist (e.g., national EMR vendor HIE networks), we use an inclusive and widely held definition of clinical data exchange between unaffil- iated entities (i.e., those with no shared ownership or governance). Moreover, regional efforts are more likely to capture the full benefits of HIE because the other approaches (e.g., vendor driven) restrict data exchange in some way. It is therefore critical to under- stand the conditions under which the HIE efforts included in our study can succeed and, in particular, the policy conditions that foster their success.

Our results help to inform the large national effort underway to achieve the broad-based exchange of health information. Given that HIEs offer innova- tive healthcare technology solutions with the poten- tial to alleviate two of the most pressing concerns of the current healthcare system—rising costs and inconsistent quality—this study proposes a comple- mentarity of technology incentives and substantive consumer privacy protections, highlighting the poten- tial for future efforts to incentivize HIE growth while balancing patient privacy concerns. Such results may help to inform the broader debate on the role of privacy regulation in information technology efforts. First, the findings highlight the potential for the neg- ative effects of privacy regulation on information technology efforts to be counteracted by technology incentives. Additionally, the focus on both the impact of technology incentives and privacy requirements extends the growing body of empirical work in this

space and bolsters the notion that privacy regulation can have heterogeneous and complex effects on infor- mation technology efforts. Specifically, we suggest that a symbiotic relationship may exist between tech- nology incentives and substantive privacy regulation with simultaneous benefit to both consumers and pro- ponents of information technology efforts. This yields a possible lesson for regulators and policy makers: legislative approaches that both incentivize technol- ogy efforts and provide consumer privacy protections may be one approach for enabling the growth of valu- able information technology efforts while addressing consumer privacy concerns.

Supplemental Material Supplemental material to this paper is available at http://dx .doi.org/10.1287/mnsc.2015.2194.

Acknowledgments The authors thank their reviewers for helpful comments and suggestions and their associate editor for exceptional effort and guidance throughout the review process. They thank HIMSS Analytics for providing some of the data used in this study and multiple discussants and seminar par- ticipants for their insights. In particular, the authors are grateful for the useful feedback from participants at the 2013 National Bureau of Economic Research Workshop on the Economics of IT and Digitization, with distinct grati- tude for the insightful feedback of Avi Goldfarb, Catherine Tucker, and Amalia Miller. The authors also thank Sasha Romanosky, Zia Hydari, and Corey Angst for their review of early drafts of the manuscript. In addition, the authors thank their research assistants Megan McGovern, Danning Chen, and Kara Cronin for their diligent work in support of this manuscript. Finally, Alessandro Acquisti gratefully acknowledges support from the Carnegie Corporation of New York via an Andrew Carnegie Fellowship. The state- ments made and views expressed in this paper are solely the responsibility of the authors. All errors are the authors’ own.

References Adler-Milstein J, Bates DW, Jha AK (2009) U.S. regional health

information organizations: Progress but challenges remain. Health Affairs 28(2):483–492.

Adler-Milstein J, Bates DW, Jha AK (2011) A survey of health infor- mation exchange organizations in the United States: Impli- cations for meaningful use. Ann. Internal Medicine 154(10): 666–671.

Anderson CL, Agarwal R (2011) The digitization of healthcare: Boundary risks, emotion, and consumer willingness to disclose personal health information. Inform. Systems Res. 22(3):469–490.

Angrist JD, Pischke JS (2008) Mostly Harmless Econometrics: An Empiricist’s Companion (Princeton University Press, Prince- ton, NJ).

Angst CM, Agarwal R (2009) Adoption of electronic health records in the presence of privacy concerns: The elaboration likelihood model and individual persuasion. MIS Quart. 33(2):339–370.

Angst CM, Agarwal R, Sambamurthy V, Kelley K (2010) Social con- tagion and information technology diffusion: The adoption of electronic medical records in U.S. hospitals. Management Sci. 56(8):1219–1241.

Bamberger K, Mulligan D (2011) Privacy on the books and on the ground. Stanford Law Rev. 63(274):274–315.

D ow

nl oa

de d

fr om

i nf

or m

s. or

g by

[ 14

0. 23

4. 25

5. 9]

o n

19 A

pr il

2 01

6, a

t 12

:2 3

. F or

p er

so na

l us

e on

ly , a

ll r

ig ht

s re

se rv

ed .

Bertrand M, Duflo E, Mullainathan S (2004) How much should we trust differences-in-differences estimates? Quart. J. Econom. 119(1):249–275.

Blumenthal D (2010) Launching HITECH. New Engl. J. Med. 362(5):382–385.

Blumenthal D, Tavenner M (2010) The “meaningful use” regulation for electronic health records. New Engl. J. Med. 363(6):501–504.

Brandimarte L, Acquisti A, Loewenstein G (2012) Misplaced confi- dences: Privacy and the control paradox. Soc. Psych. Personality Sci. 4(3):340–347.

Cala A (2013) Renewable energy in Spain is taking a beating. New York Times (October 8), http://www.nytimes.com/2013/ 10/09/business/energy-environment/renewable-energy-in-spain -is-taking-a-beating.html.

Comarow A America’s best hospitals: The 2009–2010 honor roll. U.S. News & World Report (July 15), http://health.usnews.com/ health-news/best-hospitals/articles/2009/07/15/americas-best -hospitals-the-2009-2010-honor-roll.

eHealth Initiative (2005–2010) Annual survey of Health Informa- tion Exchange at the state and local levels. Report, eHealth Initiative, Washington, DC. https://www.ehidc.org/articles/ reports.

Federal Trade Commission (2012) Protecting consumer privacy in an era of rapid change: Recommendations for businesses and policy makers. Report, Federal Trade Commission, Wash- ington, DC. https://www.ftc.go/reports/protecting-consumer -privacy-era-rapid-change-recommendations-businesses-policy makers.

Goldfarb A, Tucker CE (2011) Privacy regulation and online adver- tising. Management Sci. 57(1):57–71.

Goldstein M, Rein A (2010) Consumer consent options for elec- tronic health information exchange: Policy considerations and analysis. Report, Office of the National Coordinator for Health Information Technology, U.S. Department of Health and Human Services, Washington, DC.

Greenberg MD, Ridgely MS, Hillestad RJ (2009) Crossed wires: How yesterday’s privacy rules might undercut tomorrow’s nationwide health information network. Health Affairs 28(2): 450–452.

Greene W (2002) The behavior of the fixed effects estimator in non- linear models. Working Paper EC-02-05, New York University, New York.

Grossman JM, Kushner KL, November EA (2008) Creating sus- tainable local health information exchanges: Can barriers to stakeholder participation be overcome? Res. Brief February(2): 1–12.

Jha AK, Chan DC, Ridgway AB, Franz C, Bates DW (2009) Improv- ing safety and eliminating redundant tests: Cutting costs in U.S. hospitals. Health Affairs 28(5):1475–1484.

Kennedy P (1992) A Guide to Econometrics (Blackwell, Oxford, UK). Lai Y, Hui K (2006) Internet opt-in and opt-out: Investigating the

roles of frames, defaults and privacy concerns. Proc. 2006 ACM SIGMIS CPR, (ACM, New York), 253–263.

Lenard TM, Rubin PH (2005) Slow down on data secu- rity legislation. Progress Snapshot (Release 1.9), https://www .techpolicyinstitute.org/files/ps1.9.pdf.

McDonald C (2009) Protecting patients in health information exchange: A defense of the HIPAA privacy rule. Health Affairs 28(2):447–449.

McGraw D, Dempsey JX, Harris L, Goldman J (2009) Privacy as an enabler, not an impediment: Building trust into health infor- mation exchange. Health Affairs 28(2):416–427.

Miliard M (2010) ACLU brings suit against Rhode Island HIE. it Healthcare IT News (December 1), http://www.healthcareit news.com/news/aclu-brings-suit-against-rhode-island-hie-0.

Miller AR, Tucker C (2009) Privacy protection and technology dif- fusion: The case of electronic medical records. Management Sci. 55(7):1077–1093.

Miller AR, Tucker CE (2011) Can health care information technol- ogy save babies? J. Political Econom. 119(2):289–324.

National eHealth Collaborative (2011) Secrets of HIE success revealed: Lessons from the leaders. Report, HIE Networks, Tallahassee, FL. http://www.nationalehealth.org/ckfinder/ userfiles/files/REPORT%20-SecretsofHIESuccessRevealed.pdf.

National Rural Health Resource Center (2015) Health informa- tion exchange—First considerations. Report, National Rural Health Resource Center, Duluth, MN. Accessed September 1, 2015, https://www.ruralcenter.org/sites/default/files/rhitnd/ HIE-First%20Considerations-National%20Rural%20Health%20 Resource%20Center.pdf.

Neyman J, Scott EL (1948) Consistent estimates based on partially consistent observations. Econometrica 16(1):1–32.

Office of the National Coordinator for Health Information Technol- ogy (2012) Electronic health record adoption and utilization: 2012 highlights and accomplishments. Report, Office of the National Coordinator for Health Information Technology, U.S. Department of Health and Human Services, Washington, DC.

Posner R (1981) The economics of privacy. Amer. Econom. Rev. 71(2):405–409.

Pritts J, Choy A, Emmart L, Hustead J (2002) The State of Health Privacy: A Survey of State Health Privacy Statutes (Georgetown University, Washington, DC).

Pritts J, Lewis S, Jacobson R, Lucia K, Kayne K (2009) Privacy and security solutions for interoperable health information exchange: Report on state law requirements for patient per- mission to disclose health information. Report, Office of the National Coordinator for Health Information Technology, U.S. Department of Health and Human Services, Washington, DC.

Sheng H, Nah FH, Siau K (2008) An experimental study on ubiq- uitous commerce adoption: Impact of personalization and pri- vacy concerns. J. Assoc. Inform. Systems 9(6):Article 15.

Simon S, Evans JS, Benjamin A, Delano D, Bates DW (2009) Patients’ attitudes toward electronic health information exchange: Qualitative study. J. Medical Internet Res. 11(3):e30.

Solove DJ (2004) The Digital Person: Technology and Privacy in the Information Age (New York University Press, New York).

Somaskanda S (2013) Renewable energy losing its shine in Europe. USA Today (March 23), http://www.usatoday.com/story/ money/business/2013/03/21/europe-renewable-energy/ 2006245/.

Squire P (2007) Measuring state legislative professionalism: The Squire index revisited. State Politics Policy Quart. 7(2):211–227.

Stigler G (1980) An introduction to privacy in economics and poli- tics. J. Legal Stud. 9(4):628–633.

Stutzman F, Gross R, Acquisti A (2013) Silent listeners: The evolu- tion of privacy and disclosure on Facebook. J. Privacy Confiden- tiality 4(2):7–41.

Vest JR, Gamm LD (2010) Health information exchange: Persis- tent challenges and new strategies. J. Amer. Medical Informatics Assoc. 17(3):288–294.

Walker J, Pan E, Johnston D, Adler-Milstein J, Bates DW, Middleton B (2005) The value of health care information exchange and interoperability. Health Affairs 24(2):10–18.

Wennberg JE, Cooper MM (1996) The diagnosis and surgical treat- ment of common medical conditions. The Dartmouth Atlas of Healthcare (American Hospital Publishing, Chicago), 113–144.

White House (2012) Consumer data privacy in a networked world: A framework for protecting privacy and promoting innovation in the global digital economy. Report, U.S. Government Print- ing Office, Washington, DC.

D ow

nl oa

de d

fr om

i nf

or m

s. or

g by

[ 14

0. 23

4. 25

5. 9]

o n

19 A

pr il

2 01

6, a

t 12

:2 3

. F or

p er

so na

l us

e on

ly , a

ll r

ig ht

s re

se rv

ed .

Copyright 2016, by INFORMS, all rights reserved. Copyright of Management Science is the property of INFORMS: Institute for Operations Research and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use.