Humetrix's iBlueButton app won the ONC's Blue Button Mashup Challenge in January.

With new, tougher HIPAA privacy regulations set to take effect in less than a week, the HHS Office for Civil Rights (OCR), which enforces the rules, is trying to educate consumers and healthcare entities alike about a longstanding but much-ignored policy.

"There is a clear right [in the HIPAA privacy rule] not only of patient access, but patient control over everything in their records," OCR Director Leon Rodriguez said Monday. He said this was a "revelation" even to some HIPAA enforcement officers.

Meantime, the Office of the National Coordinator for Health Information Technology (ONC) is preparing its own outreach campaign to encourage patients to download their own medical records through the Blue Button Plus initiative.

"Your providers are required to give you your record in electronic form if that's how it's maintained," Rodriguez said at the ONC Consumer Health IT Summit at HHS headquarters in Washington, to kick off the annual National Health IT Week.

On Friday, Rodriguez issued a memo to HHS staff and the general public about this "right to access," and two articles he authored – one in conjunction with national health IT coordinator Dr. Farzad Mostashari – appeared on Medscape's continuing medical education site. (One article was about HIPAA security risk management and the other specific to privacy and security on mobile devices.)

"I also know that, all too often, consumers face barriers to getting their health information – and the first barrier is that many do not know their rights," Rodriguez wrote.

"You should know you have the right to: ask to see and get a copy of your health records from most doctors, hospitals, and other health care providers such as pharmacies and nursing homes, as well as from your health plan; get either a paper or, if records are kept electronically, an electronic copy of your records; and have your provider or health plan send a copy of your records to someone else," he continued.

To these ends, OCR has produced a series of new videos about patient rights under HIPAA and also just published a model notice of privacy practices for healthcare entities to use as a basis of updating their own privacy notices for the new rules. "That needs to go viral," Rachel Seeger, senior OCR health information privacy outreach specialist, said Monday.

"This isn't just the right thing to do," Mostashari added. "It is their civil right to their records."

Also at the Monday conference, ONC previewed an update to its current Blue Button website, tentatively called Blue Button Connector, to encourage patient engagement in their own care. Stage 2 of the federal Meaningful Use EHR incentive program, which starts as soon as next month for some hospitals, requires at least 5 percent of a provider's patients to "view, download or transmit" health information through a portal or personal health record.

ONC is banking on Blue Button Plus to make this activity easy for consumers. "Blue Button is really quite core to everything we've been doing," said Lygeia Ricciardi, director of ONC's Office of Consumer eHealth. "It's really become a symbol of a movement."

Ricciardi said Blue Button Plus creates structure out of the plain text in the original Blue Button format and also automates updating of patient information. Blue Button Connector, which she said will debut around Jan. 15, is intended to be a hub for consumers to find sources of data to download as well as technology to facilitate it; about 500 organizations and vendors have pledged to support Blue Button, according to ONC.

Ricciardi previewed a public-service announcement that will run on TV when the campaign starts. Ricciardi said that at least one Blue Button Connector partner, whom she would not reveal, is "potentially interested in running it on a Jumbotron in Times Square."

In all, ONC is producing three PSAs, one for caregivers, one for cancer patients and one for people with diabetes.

The Blue Button Connector site is working now, but ONC is not publicizing the URL just yet as the office populates the page and works out the kinks in order to deliver what Ricciardi called a "clean user experience." She said ONC is working on developing guidelines to make the user experience work easily through various sites.

Erin Poetter Siminerio, a policy analyst in the Office of Consumer eHealth, said to expect at least a dozen apps on the site when it does go public. According to Siminerio, a third of all Americans now have access to Blue Button data through their health plans. Medicare beneficiaries currently can download three years of personal data via the mymedicare.gov portal, she said.

Ricciardi noted that drug-maker Pfizer is allowing patients to download data from clinical trials through the Blue Button Plus interface.