Sharing ICU Patient Data Responsibly Under the Society of Critical Care Medicine/European Society of Intensive Care Medicine Joint Data Science Collaboration: The Amsterdam University Medical Centers Database (AmsterdamUMCdb) Example

OBJECTIVES

Critical care medicine is a natural environment for machine learning approaches to improve outcomes for critically ill patients as admissions to ICUs generate vast amounts of data. However, technical, legal, ethical, and privacy concerns have so far limited the critical care medicine community from making these data readily available. The Society of Critical Care Medicine and the European Society of Intensive Care Medicine have identified ICU patient data sharing as one of the priorities under their Joint Data Science Collaboration. To encourage ICUs worldwide to share their patient data responsibly, we now describe the development and release of Amsterdam University Medical Centers Database (AmsterdamUMCdb), the first freely available critical care database in full compliance with privacy laws from both the United States and Europe, as an example of the feasibility of sharing complex critical care data.

SETTING

University hospital ICU.

SUBJECTS

Data from ICU patients admitted between 2003 and 2016.

INTERVENTIONS

We used a risk-based deidentification strategy to maintain data utility while preserving privacy. In addition, we implemented contractual and governance processes, and a communication strategy. Patient organizations, supporting hospitals, and experts on ethics and privacy audited these processes and the database.

MEASUREMENTS AND MAIN RESULTS

AmsterdamUMCdb contains approximately 1 billion clinical data points from 23,106 admissions of 20,109 patients. The privacy audit concluded that reidentification is not reasonably likely, and AmsterdamUMCdb can therefore be considered as anonymous information, both in the context of the U.S. Health Insurance Portability and Accountability Act and the European General Data Protection Regulation. The ethics audit concluded that responsible data sharing imposes minimal burden, whereas the potential benefit is tremendous.

CONCLUSIONS

Technical, legal, ethical, and privacy challenges related to responsible data sharing can be addressed using a multidisciplinary approach. A risk-based deidentification strategy, that complies with both U.S. and European privacy regulations, should be the preferred approach to releasing ICU patient data. This supports the shared Society of Critical Care Medicine and European Society of Intensive Care Medicine vision to improve critical care outcomes through scientific inquiry of vast and combined ICU datasets.

A legal overview of the use of messaging platforms in healthcare

Medical interventions are becoming more complex day by day. Moreover, compared with the past, more healthcare professionals take part in the same intervention in the field of medicine. The use of technology in medical interventions has also increased. This change in the health sector brings together several legal discussions. In this study, the legal consequences that arise from the treatment processes carried out by the residents and resident educators (registerers / attending physicians), the exchange of information between them, and the usage of some messaging platforms, especially WhatsApp, in this process will be analyzed.

The Association Between State-Level Health Information Exchange Laws and Hospital Participation in Community Health Information Organizations

Evidence suggests that health information exchange (HIE) is an effective strategy to improve efficiency and quality of care, as well as reduce costs. A complex patchwork of federal and state legislation has developed over time to encourage HIE activity. Hospitals and health systems have adopted various HIE models to meet the requirements of these statutes and regulations. Given the complexity of HIE laws, it is important to understand how these legal levers influence HIE engagement. We combined data from two unique data sources to examine the association between state-level HIE laws and hospital engagement in community HIEs. Our results identified three legal provisions of state laws (HIE authorization, financial & non-financial incentives, opt-out consent) that increased the likelihood of community HIE engagement. Other provisions decreased the likelihood of engagement. This analysis provides foundational evidence about the utility of HIE laws. More research is needed to determine causal relationships.

Access and Disclosure of Personal Health Information: A Challenging Privacy Landscape in 2016-2018

OBJECTIVES

 To assess the current health data access and disclosure environment for potential privacy-protecting mechanisms that enable legitimate use of personal health information while preserving the rights of individuals. To identify the gaps and challenges between increasing requests and expanding uses of such information and the regulations, technologies, and management practices that permit appropriate access and disclosure while guarding against harmful misuse of such information.

METHODS

 A scoping literature review focused on (1) regulations affecting access and disclosure of personal health information, (2) the uses of health information that challenge access and disclosure boundaries, and (3) privacy management practices that may help mitigate gaps in protecting patient privacy.

RESULTS

 Countries and jurisdictions are developing laws, regulations, and public policies to balance the privacy rights of individuals and the unprecedented opportunities to advance health and health care through expanded uses of health data. Regulations and guidance are evolving, but they are outpaced by the increasing demand for and the challenges of managing access and disclosure. Mechanisms such as consent and authorization may not always be adequate. Mechanisms that advance principled stewardship are more important than ever.

CONCLUSIONS

 Access and disclosure management are important dimensions of privacy management practices. This is a volatile period in which diverging public policies may reveal how best to balance access and disclosure of personal health information by individuals and by institutional custodians of the information. Approaches to access and disclosure management, including the roles of individuals, should be a focus for research and study in the years ahead.

Legal Barriers to the Growth of Health Information Exchange-Boulders or Pebbles?

Policy Points: Historically, in addition to economic and technical hurdles, state and federal health information privacy laws have been cited as a significant obstacle to expanding electronic health information exchange (HIE) in the United States. Our review finds that over the past decade, several helpful developments have ameliorated the legal barriers to HIE, although variation in states' patient consent requirements remains a challenge. Today, health care providers' complaints about legal obstacles to HIE may be better understood as reflecting concerns about the economic and competitive risks of information sharing.

CONTEXT

Although the clinical benefits of exchanging patients' health information electronically across providers have long been recognized, participation in health information exchange (HIE) has lagged behind adoption of electronic health records. Barriers erected by federal and state health information privacy law have been cited as a leading reason for the slow progress. A comprehensive assessment of these issues has not been undertaken for nearly a decade, despite a number of salient legal developments.

METHODS

Analysis of federal and state health information privacy statutes and regulations and secondary materials.

FINDINGS

Although some legal barriers to HIE persist, many have been ameliorated-in some cases, simply through improved understanding of what the law actually requires. It is now clear that the Health Insurance Portability and Accountability Act presents no obstacles to electronically sharing protected health information for treatment purposes and does not hold providers who properly disclose information liable for privacy breaches by recipients. The failure of federal efforts to establish a unique patient identifier number does slow HIE by inhibiting optimal matching of patient records, but other action to facilitate matching will be taken under the 21st Century Cures Act. The Cures Act also creates the legal architecture to begin to combat "information blocking." Varying patient consent requirements under federal and state law are the most important remaining legal barrier to HIE progress. However, federal rules relating to disclosure of substance-abuse treatment information were recently liberalized, and development of a technical standard, Data Segmentation for Privacy, or DS4P, now permits sensitive data requiring special handling to be segmented within a patient's record. Even with these developments, state-law requirements for patient consent remain daunting to navigate.

CONCLUSIONS

Although patient consent requirements make HIE challenging, providers' expressed worries about legal barriers to participating in HIE likely primarily reflect concerns that are economically motivated. Lowering the cost of HIE or increasing financial incentives may boost provider participation more than further reducing legal barriers.

[Legal considerations of telemedical care]

Telemedical methods are on the rise in patient care. In addition to the actual changes for both sides in the physician-patient relationship, the use of information and communication technology also involves legal challenges. This article deals with the legal framework of telemedical care. Thereby the article discusses the prohibition of remote treatment (§ 7 Abs. 4 MBO-Ä) and the question to what extent the omission of a telemedical method of treatment can fulfill a medical breach of duty. A distinction must be drawn between the question as to whether telemedical monitoring shall be executed and the question how to use telemedical systems, in order to mitigate liability risks for the physicians. The physician can for example violate his/her medical duties by not sufficiently informing the patient about all essential circumstances concerning the consent, by not adequately monitoring the functioning of the telemedical devices, or by not reacting fast enough to telemedical occurrence reports. All this may lead to a case of liability.

Explanation of the Nagoya Protocol on Access and Benefit Sharing and its implication for microbiology

Working with genetic resources and associated data requires greater attention since the Nagoya Protocol on Access and Benefit Sharing (ABS) came into force in October 2014. Biologists must ensure that they have legal clarity in how they can and cannot use the genetic resources on which they carry out research. Not only must they work within the spirit in the Convention on Biological Diversity (https://www.cbd.int/convention/articles/default.shtml?a=cbd-02) but also they may have regulatory requirements to meet. Although the Nagoya Protocol was negotiated and agreed globally, it is the responsibility of each country that ratifies it to introduce their individual implementing procedures and practices. Many countries in Europe, such as the UK, have chosen not to put access controls in place at this time, but others already have laws enacted providing ABS measures under the Convention on Biological Diversity or specifically to implement the Nagoya Protocol. Access legislation is in place in many countries and information on this can be found at the ABS Clearing House (https://absch.cbd.int/). For example, Brazil, although not a Party to the Nagoya Protocol at the time of writing, has Law 13.123 which entered into force on 17 November 2015, regulated by Decree 8.772 which was published on 11 May 2016. In this case, export of Brazilian genetic resources is not allowed unless the collector is registered in the National System for Genetic Heritage and Associated Traditional Knowledge Management (SisGen). The process entails that a foreign scientist must first of all be registered working with someone in Brazil and have authorization to collect. The enactment of European Union Regulation po. 511/2014 implements Nagoya Protocol elements that govern compliance measures for users and offers the opportunity to demonstrate due diligence in sourcing their organisms by selecting from holdings of 'registered collections'. The UK has introduced a Statutory Instrument that puts in place enforcement measures within the UK to implement this European Union Regulation; this is regulated by Regulatory Delivery, Department for Business, Energy and Industrial Strategies. Scientific communities, including the private sector, individual institutions and organizations, have begun to design policy and best practices for compliance. Microbiologists and culture collections alike need to be aware of the legislation of the source country of the materials they use and put in place best practices for compliance; such best practice has been drafted by the Microbial Resource Research Infrastructure, and other research communities such as the Consortium of European Taxonomic Facilities, the Global Genome Biodiversity Network and the International Organisation for Biological Control have published best practice and/or codes of conduct to ensure legitimate exchange and use of genetic resources.

Information Blocking: Is It Occurring and What Policy Strategies Can Address It?

Context

Congress has raised concerns about providers and electronic health record (EHR) vendors knowingly engaging in business practices that interfere with electronic health information exchange (HIE). Such “information blocking” is presumed to occur because providers and vendors reap financial benefits, but these practices harm public good and substantially limit the value to be gained from EHR adoption. Crafting a policy response has been difficult because, beyond anecdotes, there is no data that captures the extent of information blocking.

Methods

We conducted a national survey of leaders of HIE efforts who work to enable HIE across provider organizations. We asked them about the frequency of information blocking, its specific forms, and the effectiveness of various policy strategies to address it. We received responses from 60 individuals (57% response rate). We calculated descriptive statistics across responses.

Findings

Half of respondents reported that EHR vendors routinely engage in information blocking, and 25% of respondents reported that hospitals and health systems routinely do so. Among EHR vendors, the most common form of information blocking was deploying products with limited interoperability. Among hospitals and health systems, the most common form was coercing providers to adopt particular EHR or HIE technology. Increasing transparency of EHR vendor business practices and product performance, stronger financial incentives for providers to share information, and making information blocking illegal were perceived as the most effective policy remedies.

Conclusions

Information blocking appears to be real and fairly widespread. Policymakers have some existing levers that can be used to curb information blocking and help information flow to where it is needed to improve patient care. However, because information blocking is largely legal today, a strong response will involve new legislation and associated enforcement actions.

2015 Edition Health Information Technology (Health IT) Certification Criteria, 2015 Edition Base Electronic Health Record (EHR) Definition, and ONC Health IT Certification Program Modifications. Final rule

This final rule finalizes a new edition of certification criteria (the 2015 Edition health IT certification criteria or "2015 Edition'') and a new 2015 Edition Base Electronic Health Record (EHR) definition, while also modifying the ONC Health IT Certification Program to make it open and accessible to more types of health IT and health IT that supports various care and practice settings. The 2015 Edition establishes the capabilities and specifies the related standards and implementation specifications that Certified Electronic Health Record Technology (CEHRT) would need to include to, at a minimum, support the achievement of meaningful use by eligible professionals (EPs), eligible hospitals, and critical access hospitals (CAHs) under the Medicare and Medicaid EHR Incentive Programs (EHR Incentive Programs) when such edition is required for use under these programs.