1. 1 Electronic Records & Confidentiality (Focus on Research) Lawrence H. Muhlbaier, PhD Assistant Professor Biostatistics & Bioinformatics Duke University School of Medicine 24 March 2007

2. 2 This talk is NOT specifically about: n 21 CFR 11 Compliance n Genetics Data Bases n Specimen Repositories n Technology of Databases

3. 3 Possible Electronic Records: n Primary Data Collection n Clinical Systems (LIS, CPOE, …) n Billing Systems/Admin Data n Electronic Medical Record, NHIN, RHIO n Outside Systems (PHIN, Tumor Registry,…) n "Old" Research Data n Physician "personal" logs

4. 4 Possible Electronic Records: Clinical Systems n LIS l Laboratory Information Systems l HL7 Export (2 Flavors) l Coding differs by Institutions/Vendors n CPOE l Computerized Physician Order Entry l Prescriptions l Meds

5. 5 Possible Electronic Records: Billing Systems/Admin Data n Coarse measures of consumption l Demographics l ICD coded Dx & Procedures l CPT coded Procedures l Meds billed (not administered) l Resource use l Vent hours, blood, room use, OR use

6. 6 Do you use and Electronic Health Record at your Hospital: 1. No 2. Yes 3. Maybe 4. Don't work with Hospital

7. 7 Do you use and Electronic Health Record at your Hospital: 1. No 2. Yes 3. Maybe 4. Don't work with Hospital

8. 8 Possible Electronic Records: Electronic Medical Record n Rich data source n Often text based n Difficult to extract data n Extends to l RHIO (Regional Health Information Organizations) l NHIN (National Health Information Network)

9. 9 Possible Electronic Records: Outside Systems n PHIN (CDC) l Public Health Information Network l Bioterrorism, ED usage, … n Tumor Registry (State) n Compliance/QA Registries l JCAHO (Premier) l Specialty (ACC, STS, MI, Ortho)

10. 10 Confidentiality confidentiality /con·fi·den·ti·al·i·ty/ (kon?fi- den?she-al´i-te) the principle in medical ethics that the information a patient reveals to a health care provider is private and has limits on how and when it can be disclosed to a third party.

11. 11 Security n Implements Confidentiality n Cannot do it itself n Currently not very integrated

12. 12 Pessimists View "You have no privacy anyway. Get over it." Scott McNealy, Sun Microsystems (1/25/1999)

13. 13 At work, how many UserID + Passwords do you have? 1. 0 2. 1 3. 2 4. 3-5 5. 6-10 6. 11+

14. 14 At work, how many UserID + Passwords do you have? 1. 0 2. 1 3. 2 4. 3-5 5. 6-10 6. 11+

15. 15 Security n Moving toward 1 ID/person n  Biometric IDs n  HR tie-in

16. 16 Thorny Issues n Follow-Up n Access to data n Queries n Access Tracking n HIPAA/Common Rule Interactions

17. 17 Thorny Issues: Follow-Up n HIPAA vs OHRP (Death) n Permission to Follow n Passive vs Active Follow-Up

18. 18 Follow-up when Authorization Revoked n OK for FDA Regulated Studies n " n "for the purpose of activities related to the quality, safety or effectiveness of such FDA- regulated product or activity." 45CFR164.512(b)(1)(iii) l l Part of Public Health Reporting l Requires Disclosure Accounting

19. 19 Thorny Issues: Access to Data n Read/Write/Change n Ownership n Gatekeeper/"Trusted Broker" n Administration (non-IRB review committees)

20. 20 Thorny Issues: Queries n Who can query n Tools to query n Technical Controls n Administrative Controls

21. 21 Thorny Issues: Access Tracking n P&P: HIPAA security n HIPAA Privacy: Disclosure Accounting n Technical Controls l What to track l How long to store n Administrative Controls l Who does it

22. 22 Thorny Issues: OHRP/HIPAA Interactions n HIPAA largely technical n Definition differences n Scope differences

23. 23 Advantages n Records available to all care givers n All meds available (  drug interactions) n NHIN and Research l Long tem follow-up l Post marketing surveillance l How much sooner would we have known the cardiac risks of Vioxx?

24. 24 Specimen Registries vs Data Registries n HIPAA treats them the same n Common Rule/Ethical Concerns l Future Risk l Ownership l Limited Resource l Source (leftover, study specific, …) n n NCI draft guidance on Biorepositories http://a257.g.akamaitech.net/7/257/2422/01jan20061800/e docket.access.gpo.gov/2006/pdf/06-3997.pdf

25. 25 Public Health & Privacy n PHIN l How much detail does it really have? l (Disclosure Accounting) l http://www.cdc.gov/phin/

26. 26 Summary n Electronic Health Data are Everywhere n Confidentiality challenges abound n Security tools still evolving n Very large Health Data Systems coming l Require strong security tools l BUT flexible access!

27. 27 Resources on the Web n NCHICA: http://www.nchica.org/ n PHIN: http://www.cdc.gov/phin/ n HIPAA: (Databases under HSR) http://privacyruleandresearch.nih.gov/

28. 28 Selected Acronyms ACC: American College of Cardiology STS: Society of Thoracic Surgeons ED: Emergency Department HR: Human Resources OHRP: Office of Human Research Protections NCHICA: North Carolina Healthcare Information & Communications Alliance

29. 29 Contact Information Doc Muhlbaier DUMC 3865 Durham, NC 27710-7510 919-668-8774lawrence.muhlbaier@duke.edu