EHR & BIG DATA – RISKS AND ADVANTAGES OF AMASSING MEDICAL DATABASES Sandra Gardiner Technology Law Section October 24, 2014

A GENDA Intersection of the Healthcare industry and technology Regulatory Touchstone – HIPAA, HITECH and the Omnibus Rule at a glance Data use in Research Data use in Commercial Settings

H EALTHCARE I NDUSTRY Why your technology clients continue to be interested in servicing healthcare:

H EALTHCARE INDUSTRY Many big data opportunities in healthcare market Enterprise HIE - Large Health Systems want visibility across their system at all levels Physician Alignment – use a common technology platform to improve ease of doing business with a health system and to communicate with affiliated practices and facilities Care Coordination – enables entire patient record to be shared and viewed by all care providers; requires access to health care records across disparate technology systems/providers Population Management - address/manage health outcomes of a group, relies heavily on data analytics ACO/Outcome Reimbursement - reimbursement and payment models based on outcomes for physicians or facilities, relies on data analytics and tracking data across providers/points of care

D EFINING BIG DATA Big data is an all-encompassing term for any collection of data sets so large and complex that it becomes difficult to process using traditional data processing applications. The challenges include analysis, capture, curation, search, sharing, storage, transfer, visualization, and privacy violations. Analytics of large related data sets can allow for correlations to be found

URE

R EGULATORY LANDSCAPE Federal Legislation : HIPAA HITECH Privacy Rule Safeguards Rule Omnibus Rule State legislation – can include more obligations more protective of PHI, esp. around sensitive conditions (such as HIV or mental health) and minors Net, Net: Technology vendors with access to PHI are Business Associates, and now have direct liability for compliance with federal HIPAA requirements

H EALTHCARE INDUSTRY EMR – Electronic Medical Record PHI – Protected Health Information o Names; All geographical subdivisions smaller than a State, including street address, city, county, precinct, zip code, and their equivalent geocodes, All elements of dates (except year) for dates directly related to an individual, including birth date, admission date, discharge date, date of death; and all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older; Phone numbers; Fax numbers; Electronic mail addresses; Social Security numbers; Medical record numbers; Health plan beneficiary numbers; Account numbers; Certificate/license numbers; Vehicle identifiers and serial numbers, including license plate numbers; Device identifiers and serial numbers; Web Universal Resource Locators (URLs)

R EGULATORY LANDSCAPE Fast tour of HIPAA requirements: Requires patient notifications and consent to the collection, use and disclosure of PHI to allow for meaningful consent Technical, physical and administrative safeguards Provide notices of security breaches/incidents Thou shall not sell PHI Fines and penalties for violations

C ASE S TUDY B.I.G. Data Company is an emerging tech company with a business intelligence technology offering (i.e. data collection and analytics). For performance, infrastructure, cost and redundancy, B.I.G. Data’s technology resides in a Amazon Tier 1 data center. To date, the company has a successful track record with a number of marquee clients outside of the healthcare industry. The CEO of B.I.G. Data had a college roommate who is now the CIO at a large, multi-facility health system. Some of the facilities are owned in whole or part by the parent corporation, some are affiliated by contract. The CIO has been told by the Board to use technology to: a. Facilitate care coordination, which requires all employed and affiliated physicians to access patient data across the entire enterprise b. Provide data analytics to allow for pay for performance or accountable care at the physician level and department level c. Provide data analytics to provide visibility on how various aspects of the enterprise are performing and benchmark them across the organization The CEO of B.I.G. Data has called you – what are some of the challenges unique in the healthcare setting?

C HALLENGESONE OF THE CHALLENGES Technology is only one of the challenges