Are You Who You Say You Are?

NCHICA 22nd Annual Conference & Exhibition August 30, 2016

Vivian West, PhD, MBA, RN; Associate Director, Duke Center for Health Informatics W. Ed Hammond, PhD; Director, Duke Center for Health Informatics

http://howmanyofme.com/

Vivian = 190,681 West = 225,789 Vivian West =133

James = 5,377,842 Smith = 2,846,806 James Smith= 47,371

Numerous encounters

Numerous locations

Numerous providers

Need a common key—access all data

Right person

Right location

Right encounter

Right provider

Legislative action • Health Insurance Portability and Accountability

Act (HIPAA) legislation in 1996 – mandate for HHS to develop a system of unique

healthcare patient identifiers (UHID…now referred to as NPID—National Patient ID)

– help promote privacy and safe/secure means to share personally identifiable health information

– codes for employers, health plans, physicians, hospitals

• Legislation passed in 1998 denied funding for HHS to implement a patient ID program – “smacks of Big Brother”

Consequences without this…. • Research (duplicate data)

– Redundancy – Within research site – Across institutions

• Research integrity: Inaccuracy/missing data in

data collection – Duke data: dead receiving care – Harvard Pilgrim Health Care (HPHC)*

• Offsite care= 45% - 60% visits missing from EHR • >27% Study diagnoses from EHR structured data

missing

Madden JM, Lakoma MD, Rusinak D, Lu CY, Soumerai SB. Missing clinical and behavioral health data in a large electronic health record (EHR) system. Journal of the American Medical Informatics Association. 2016 Apr 14:ocw021.

Consequences without this…. • Inclusive numbers for public health research

– Environmental data – Social variables

• Mobile health data

Today’s climate • Still controversial

– What to use – Who should be responsible, cost – Security: access to data, audit logs, encryption, authentication

MEDICAL DATA NOT LINKED The privacy of my data is more important than any

value of sharing it with my healthcare providers

MEDICAL DATA LINKED Sharing my health

information appropriately is important to me

• Increased realization for need • Impact from patient matching inaccuracies

(diagnoses, treatments, tests) ‾ Clinical, financial, and operational performance ‾ Medical errors / patient safety

Advanced algorithms are not 100%

Various data around patients

From Winkler WE, Thibaudeau Y. An application of the Fellegi-Sunter model of record linkage to the 1990 US decennial census. US Bureau of the Census. 1991 Jan:1-22.

First name House number Middle initial Street name Last name Rural route number Telephone number Postal box number Birthdate Health insurance numbr Sex Employer Marital status Relationship to head of household Race Relationship to other family members SSN

Alternative: Biometric Identification* • Fingerprints (aging, environment, occupation) • Hand geometry (aging, jewelry, dexterity) • Retinal scans (requires user cooperation) • Palm-vein scans (aging, occupation, seasonal changes,

disease) • Facial recognition (based on location and shape of

attributes, lighting, pose) • Facial thermogram (emotional state, temperature)

Problems – Changes in age, injury, disease – Require presence of the individual (only 20% times

accessed**) Jain A, Hong L, Pankanti S. Biometric identification. Communications of the ACM. 2000 Feb 1;43(2):90-8. **US Department of Health and Human Services. Unique Health Identifier for Individuals: A White Paper. Washington, DC: US Government Printing Office, July. 1998 Jul 2;2.

Growing Support Fiscal Yr. 2017, House Appropriations Committee

subcommittee on Labor, Health, Human services, and Education bill clarifies funding restrictions on NPID:

_____________________________________________________________________________________________________

“Although the Committee continues to carry a prohibition against HHS using funds to promulgate or adopt any final standard providing for the assignment of a unique health identifier for an individual until such activity is authorized, the Committee notes that this limitation does not prohibit HHS from examining the issues around patient matching. Accordingly, the Committee encourages the Secretary, acting through the Office of the National Coordinator for Health Information Technology and CMS, to provide technical assistance to private-sector led initiatives to develop a coordinated national strategy that will promote patient safety by accurately identifying patients to their health information.”………..........................

• CHIME (College of Healthcare Inform Mgmt Exec) – National Patient ID Challenge — a $1 million crowdsourcing

competition to find viable and scalable solution to accurate PID – June Concept Blitz Round: 113 innovators submitted entries – 2 winners, Final Round, November 10, 2016

• AHIMA (March 2016) – Mismatched patients greater risk with EHRs, potential cause

for costly/dangerous errors + critical for sharing EHR data – MyHealthID—lift ban on USDHHS to find PID solution – Voluntary patient safety identifier

• Natural disasters, displaced persons • Disease discoveries

Growing Support

So…..

So, The Big Picture • We want a unique person identifier for universal use

– Perpetual number – Assigned at birth – As error free as possible

• Check digit • Biometric verification when owner present

– Irreputable Authentication – Used whenever person unique identifier is required – Accommodate non-citizens and undocumented

immigrants – Assigned and managed by a trusted authority

VERHOEFF Method for Check Digit

• The Verhoeff method is based on a group known as the dihedral group D5, represented by the symmetries of a pentagon. Multiplication in this group is not commutative (that is, a*b is not always the same as b*a), a characteristic that is exploited in this algorithm to identify more errors than simple addition modulo methods.

• The resulting algorithm is difficult to understand, but not difficult to implement. The C or Java source code is three lines.

• The probability of detecting a data entry error of the NPID is 99.95%.

Issues that need to be addressed • NPID will be publically available • Potential for abuse and misuse

– Privacy issues – Identity theft

• Authentication and authorization • What might be contained in each persons PID

record – Single function purpose – Multiple function purpose

• Distribution system • Centralized or federated database

Consideration for use of SSN as root number

• Positives – SSN is used for a number of purposes such as IRS – Social Security is a trusted agency – People are familiar with the number

• Negatives – There are gaps in numbers assigned – Many units enter 999-99-9999 – High error rate

• No perceived economic value in using SSN as base

Proposed new NPID • Ten digit identifier plus a check digit • Add a 3 digit prefix which would identify the

location of that person’s Patient-Centric EHR – If that person moved, the 3 digit prefix would be

changed and PC-EHR would be moved to new location

• NPID database would be linked to PC-EHR but access to clinical data protected. – May be an opportunity for block-chaining

• Data elements in NPID-DB would be determined by the multiple needs supporting the many uses of the number.

HIE model

HIE 2

HIE 1 HIE 3

•Each HIE provides backup for other HIEs.

•NPID prefix identifies home HIE

Prefix 101

Prefix 100

Prefix 102

Assignment and Management

• Assignment by federal organization – Registration of births – Real time issue of number – Distribution to PC-EHRs and NPID-DBs – Reporting of deaths

Proposal • The NPID-DB replace the 10-year census process. • Census

– The 2010 Census cost approximately $14 billion or a per capita cost of around $45.

– After the 2010 census, a number of lawsuits based on perceived and real errors in the count added to the cost.

• Advantages – Census would be available constant in real time – Count should be as close to accurate as possible – Money saved would offset the cost of managing the NPID.

Additional value - 1 • NPID could be used for SSA, IRS, CMS Medicare and

Medicaid, Passport, state driver license, military, student number and any other system that uses a number for person identity. Savings would result from eliminating the need for assigning, updating, and maintaining the registry.

• Additional uses – Death registry

• Prefix reassigned to indicate death – Immunization registry – Voting – Others

Additional value - 2 • President Obama’s Precision Medicine Initiative has as one

of its initiatives creating a Consent Database of one million persons.

• We propose using the NPID-DB to include a section for the document of Consent for that individual.

• Each person would be asked to indicate their level of consent for using their data for research. The levels may range from: – No way, no time, never ever – … – Yes, I am willing for any of my data to be used for research

without contacting me. • For age minorities, parents would be responsible for consent.

Costs

• Cost must be shared by public and private sector. • Cost of issuance and setting up total system will include

software, hardware. Identification cards, personnel, education of all, and overhead. This cost will be largest but likely to be in millions not billions.

• Maintenance and operational costs will continue. • Multiple uses of system will considerably reduce the

impact of converting to such a system.

Reality -1 • Precision Medicine – it’s all about providing health

and health care precisely to an individual. Doesn’t seem to apply to a de-identified person.

• A glance at the contents of my mailbox or noting the number of unsolicited calls, I clearly am not de-identified.

• Remember the barkers at the county fairs guessing your weight and age – not so private. A glance tells me a lot about a person.

• Look at posting on social media. Are any secrets a thing of the past?

• It’s not so much privacy; it’s fear of personal harm.

Reality - 2 • We use work-arounds such as algorithm approaches, hash

codes, optional PIDs, Master Patient Identifiers within an Enterprise, or the VA’s Integration Control Number.

• Algorithms depend on identifiable demographic data contained within the EHR that are often missing or in error. Those errors are often subtle – wrong day of birth. People get married and change names.

• Original HIPAA required a personal identifier for individuals, employers, health plans, and health care providers.

• We confuse identity of persons with an invasion of privacy. • Why make identity of an individual a highly complex when

a simple solution exists?

Final Words • The value of knowing who and where a person is and

access to key data has far more benefit than harm. • Not having a PID results in more violation of privacy

than anything else. Who does not have someone else’s data in their EHR.

• The PID is only the key that provides access to the data. How that data is used can be governed by other methods.

• With a PID, I can finally have an accurate medication history and know your allergies.

• If you still have doubts, ask a horse.