Access Health Records

It is important to note that third-party app developers fall outside of standard healthcare data management requirements under the Health Insurance Portability and Accountability Act (HIPAA).  Aspire Health Plan does not maintain a contractual relationship with third-party app developers and therefore (by CMS policy) is not able to audit or otherwise control app experiences.

However, in an effort to best protect member information, under the provisions of the CMS Interoperability Rule Aspire does require third-party app developers to register and attest to how they handle and protect member data.  This includes:

• How a patient’s PHI may be accessed, exchanged, or used by any person or other entity, including whether the PHI may be shared or sold at any time (including in the future) ∙ A requirement for express consent from a patient before PHI is accessed, exchanged, or used,  including receiving express consent before a patient’s PHI is shared or sold (other than  disclosures required by law or disclosures necessary in connection with the sale of the  application or a similar transaction)
• If an app will access any other information from a patient’s device
• How a patient can discontinue app access to their data and what the app’s policy and process is for disposing of a patient’s data once the patient has withdrawn consent

Apps can agree, revise or reject this attestation.  Additionally, App developers are asked to attest to:

• NOT store data outside of the United States
• Conformance with the FTC Model Health Best Practice
• Conformance with the ONC Model Privacy Policy
• Conformance with the CARIN Code of Conduct

Any application that does not attest to these items must supply a satisfactory description as to why they do not/will not attest to them.  Based on these responses, the application will be granted access if they are deemed adequate and not believed to subject member data to any unnecessary risk of harm