EHR & BIG DATA – RISKS AND ADVANTAGES OF AMASSING MEDICAL DATABASES

Sandra GardinerTechnology Law SectionOctober 24, 2014

AGENDA

•Intersection of the Healthcare industry and technology•Regulatory Touchstone – HIPAA, HITECH and the Omnibus Rule at a glance• Data use in Research• Data use in Commercial Settings

HEALTHCARE INDUSTRY

Why your technology clients continue to be interested in servicing healthcare:

HEALTHCARE INDUSTRYMany big data opportunities in healthcare market • Enterprise HIE - Large Health Systems want visibility across their system at all levels• Physician Alignment – use a common technology platform to improve ease of doing business with a health system and to communicate with affiliated practices and facilities• Care Coordination – enables entire patient record to be shared and viewed by all care providers; requires access to health care records across disparate technology systems/providers• Population Management - address/manage health outcomes of a group, relies heavily on data analytics• ACO/Outcome Reimbursement - reimbursement and payment models based on outcomes for physicians or facilities, relies on data analytics and tracking data across providers/points of care

DEFINING BIG DATABig data is an all-encompassing term for any collection of data sets so large and complex that it becomes difficult to process using traditional data processing applications.The challenges include analysis, capture, curation, search, sharing, storage, transfer, visualization, and privacy violations. Analytics of large related data sets can allow for correlations to be found

URE

REGULATORY LANDSCAPE

Federal Legislation:

• HIPAA• HITECH• Privacy Rule• Safeguards Rule• Omnibus Rule

State legislation – can include more obligations more protective of PHI, esp. around sensitive conditions (such as HIV or mental health) and minors

Net, Net: Technology vendors with access to PHI are Business Associates, and now have direct liability for compliance with federal HIPAA requirements

HEALTHCARE INDUSTRY

• EMR – Electronic Medical Record• PHI – Protected Health Information

o Names; All geographical subdivisions smaller than a State, including street address, city, county, precinct, zip code, and their equivalent geocodes, All elements of dates (except year) for dates directly related to an individual, including birth date, admission date, discharge date, date of death; and all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older; Phone numbers; Fax numbers; Electronic mail addresses; Social Security numbers; Medical record numbers; Health plan beneficiary numbers; Account numbers; Certificate/license numbers; Vehicle identifiers and serial numbers, including license plate numbers; Device identifiers and serial numbers; Web Universal Resource Locators (URLs)

REGULATORY LANDSCAPE

Fast tour of HIPAA requirements:

• Requires patient notifications and consent to the collection, use and disclosure of PHI to allow for meaningful consent

• Technical, physical and administrative safeguards

• Provide notices of security breaches/incidents

• Thou shall not sell PHI

• Fines and penalties for violations

CASE STUDY

B.I.G. Data Company is an emerging tech company with a business intelligence technology offering (i.e. data collection and analytics). For performance, infrastructure, cost and redundancy , B.I.G. Data’s technology resides in a Amazon Tier 1 data center. To date, the company has a successful track record with a number of marquee clients outside of the healthcare industry. The CEO of B.I.G. Data had a college roommate who is now the CIO at a large, multi-facility health system. Some of the facilities are owned in whole or part by the parent corporation, some are affiliated by contract. The CIO has been told by the Board to use technology to:a. Facilitate care coordination, which requires all employed and affiliated physicians to access patient data across the entire enterpriseb. Provide data analytics to allow for pay for performance or accountable care at the physician level and department levelc. Provide data analytics to provide visibility on how various aspects of the enterprise are performing and benchmark them across the organization

The CEO of B.I.G. Data has called you – what are some of the challenges unique in the healthcare setting?

CHALLENGESONE OF THE CHALLENGES

Technology is only one of the challenges