The federal Heath Information Technology Policy Committee is considering regulations governing how patient privacy should be protected as when healthcare providers share electronic health records nationally.

Healthcare providers should be "ultimately responsible for maintaining privacy and security of patient records," but may delegate some decisions to others, including IT partners such as health informaiton exchange organizations and IT vendors, according to recommendations sent to the committee, as reported by ModernHealthcare.com.

The committee also received a recommendation "that 'patient expectations' be considered when developing policies about how personal healthcare information will be used and shared so that patients will 'not be surprised to learn what happens to their data,'" ModernHealthcare.com said.

The committee received its recommendations from its privacy and security "tiger team," formed in June when Office of the National Coordinator of Health Information Technology at the U.S. Department of Health and Human Services furloughed two privacy and security working groups, in favor of one smaller, and hopefully more nimble privacy and security tiger team.

The tiger team was split on whether to adopt an opt-in or opt-out model for patients sharing records with health information exchanges. Under the opt-in model, patient information would be withheld from the exchanges unless patients gave their explicit permission. The reverse would be true under the opt-out model; the exchanges would get patient information by default, but information could be withheld if patients actively opt out, ModernHealthcare.com said.

The issue of opt-in vs. opt-out may not be settled, according to Government Health IT.

Ultimately there may not be a default policy, said Deven McGraw, tiger team chair and director of the Health Privacy Project at the Center for Democracy and Technology. Instead, the committee may consider “endorsing choice in certain circumstances as a requirement and that the choice fulfill certain elements and, from there, there just may be some judgment calls that the agency may have to make given all the rich discussion that we’ve had,” she said.