| HOME | HELP | FEEDBACK | SUBSCRIPTIONS | ARCHIVE | SEARCH | TABLE OF CONTENTS |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
White Paper |
a American Medical Informatics Association, Bethesda, MD
* Correspondence: Meryl Bloomrosen, Associate Vice President, American Medical Informatics Association, 4519 St Elmo Avenue Suite 401, Bethesda, Maryland 20814 (Email: meryl{at}amia.org).
Received for publication: 06/19/08; accepted for publication: 08/14/08.
 |
Abstract |
|---|
 Top Abstract IntroductionAMIA's 2006 and 2007...Summary and ConclusionsAMIA Board of Directors...References |
|---|
|
Introduction |
|---|
|
TopAbstractIntroductionAMIA's 2006 and 2007...Summary and ConclusionsAMIA Board of Directors...References |
|---|
Through this paper, the American Medical Informatics Association (AMIA) seeks to stimulate discussion about and action on a national framework on the uses of health data. We define the concept of data stewardship and offer a rationale for its central role in appropriate use of health data. We urge stakeholders to deepen their understanding of data stewardship principles and encourage them to debate the viability and efficacy of the data stewardship approach. While this paper reflects the discussions at AMIA conferences, the views expressed are the responsibility of the authors and of AMIA and its Board of Directors.
|
AMIA's 2006 and 2007 Conferences Focus on Health Data Use |
|---|
|
TopAbstractIntroductionAMIA's 2006 and 2007...Summary and ConclusionsAMIA Board of Directors...References |
|---|
The 2006 panel also offered recommendations aimed at providing the substance and detail to flesh out these components but much work remained to be done. As a result, in June 2007 AMIA convened an expanded group of experts to further development of the framework (http://www.amia.org/inside/initiatives/healthdata/2007/index.asp). Attendees confirmed that the conversations about health data reuse and the related opportunities and challenges are not simply theoretical issues but must be addressed in the context of a complex and fluid societal environment.
In an effort to learn from other nations grappling with similar health data use issues, the meeting included discussions about the U.K.'s and Switzerland's experience with secondary uses of health data. Two presentations illustrated how collection of electronic health data in primary care settings and submission of the data for selected secondary uses (e.g., health status monitoring, practice performance) are already in place in Britain's increasingly integrated national health service. The presenters stressed that legislation, policy development, and technical security measures are needed to ensure that secondary uses of data are carried out within a safe, ethical framework.2 A third presentation highlighted relevant aspects of the Swiss healthcare system. In Switzerland, the authorization to use anonymized personal health information for retrospective research is based on an explicit, audited institutional process, with the medical directors of hospitals serving as the data stewards.
During the meeting, participants reviewed work products of the pre-conference Data Stewardship and Taxonomy Working Groups. The work products included a data stewardship definition and data stewardship principles, and a taxonomy depicting dimensions of data use and users. Participants also reviewed a framework tool which partitioned data uses into the four domains of research, quality, public health, and commercial applications.3 (These products are described later in this paper.) The 2007 meeting resulted in presentations and testimony by AMIA to the American Health Information Community (AHIC), the Office of the National Coordinator on Health Information Technology (ONC), and the National Committee on Vital and Health Statistics (NCVHS).
Refining the Terminology
AMIA's exploration into data uses began with the approach taken by the 1991 Institute of Medicine (IOM) computer-based patient record report, which acknowledged the growth in the types and numbers of uses and users of patient data.4 While the IOM recognized that patient record uses extend beyond direct patient care, the report focused on certain high-priority uses rather than on all possible functions of the record. The IOM defined primary use as patient care and all other uses as secondary. As a matter of U.S. public policy, HIPAA legislation has de facto broadened the definition of primary use to include business operations and quality of care.
Leveraging the IOM's discussions, AMIA initially made a distinction between primary and secondary data users and uses. Primary use data were defined as data collected about and used for the direct care of a patient. Secondary use data were defined as non-direct care use of PHI including, but not limited to, analysis, research, quality/safety measurement, public health, payment, provider certification or accreditation, and marketing and other business uses including strictly commercial activities. However, as we reflected on the evolution of the health system over the past two decades and the accompanying growing dependence of successful patient care on uses of PHI, we concluded that a simple division into primary and secondary use had outlived its value. We further concluded that policies and procedures should focus instead on how such data are used, reused, and protected. AMIA asserts that the concept of data stewardship should be the choice for expressing this notion. AMIA proposed the following clarification of the primary/secondary data concept in testimony before the NCVHS in August 2007.
Reuse of health data occurs when personal health data are used for purposes other than those for which they were originally collected.
A single category of ‘secondary use’ did persist among the majority of participants at the 2007 AMIA meeting. This category refers to the use of personal health information, whether individual or collective, when the aim is to generate profits that are outside the bounds of the healthcare system or related health research. Today, the types of uses of data solely for commercial purposes are evolving and attention needs to be paid to the continuum of these uses. The issues surrounding the buying and selling of data are not clear cut since some ‘for-profit' companies are integrally involved in essential healthcare operations or research. Different issues come into play depending on whether the purpose of the sale of data is for research and quality or purely for marketing purposes. More discussion is needed to determine the best way to categorize these uses.
Benefits and Challenges of Health Data Use
Biomedical, health services, and policy research, particularly in the areas of population studies and public health, depend heavily on the ready availability of data about patients and populations. Examples of these data include health surveys, clinical trials data, hospital, physician, and laboratory records, state and federal billing and registration data, birth and death records, socio-demographic data, and cancer registry data. Researchers need large volumes of such data to be able to draw meaningful conclusions that are representative of populations.5 It is problematic if data on certain groups of people are missing, and in some instances, even hypothesis-generating research may be impossible.
There is a natural tension caused by conflicting objectives inherent in many data use and exchange situations. Examples of these tensions include:
Despite the challenges posed by these tensions, it is generally believed that health data access and sharing are essential for continued progress in promoting quality and continuity of care, patient safety, and research on better treatments.
Developments in the Fields of Data Reuse and Data Stewardship
Discussions about use of health data are not new. The social implications of the growing use of information, computer, and communications technologies are much broader than privacy concerns, encompassing economic, political, legal, and technical issues that cannot be resolved in isolation.7 Key policymaking groups and stakeholders over the past ten years have issued studies and reports related to health data reuse and data stewardship. For example, the NCVHS has held hearings and workshops on privacy and confidentiality issues including discussion of a stewardship framework for secondary uses of health data. In 2007, the Agency for Healthcare Research and Quality (AHRQ) issued a Request for Information on a National Health Data Stewardship Entity and received 136 responses from stakeholders.
Policy changes, innovations in technology, and other recent events have pushed the discussion about health data use in new directions. For example, state legislation addressing the legality of selling health data8 and the launch of an array of consumer-targeted products and services illustrate the potential transformative power of emerging trends. Microsoft launched HealthVault (www.healthvault.com), a set of search and personal health record (PHR) tools that enable consumers to control the data that is entered and shared with others. Google is bringing its data storage and organization capacities to the field of medical care and patient records via Google Health ( https://www.google.com/health). Intuit (http://quickenhealth.intuit.com) has also entered this field. In 2006, a consortium of companies (Intel, Wal-Mart, Pitney Bowes, British Petroleum America Inc. and Applied Materials) announced a PHR initiative for approximately 2.5 million employees, families, and retirees.9 Patients and caregivers are creating personal health information systems to help manage chronic illnesses such as "Follow Me" (www.followme.com) and "PatientsLikeMe," www.patientslikeme.com). The potential for profits from these services and products that aim to help consumers manage an increasingly complex and confusing healthcare system often attracts the new players operating in the commercial sphere. The impact of the entry into this field by non-medically-based entrepreneurs is likely to affect the use of data in unforeseen ways.
Reuse of Health Data and Data Stewardship
Data stewardship is pivotal to advancing discussions about the legitimate and appropriate use of health data. Access to personal health data often involves many different data stewards or custodians, such as hospitals, public health clinics, laboratories, physicians' offices, research centers, pharmaceutical companies, third party payers, employers, registries, health information producers, and federal, state, and local government agencies. Variations exist among data stewards and custodians regarding access, control, and data integrity processes that need to be harmonized. Data stewardship encompasses the breadth of activities carried out in varying degrees by all entities that interact with health data, including collection, use, disclosure, management and security of that information. Within each of these aspects there are medical-legal, ethical, and best practice considerations that an individual or organization should consider in the management of health information.5 It will take the combined efforts of many stakeholders to establish a working environment that promotes acceptance of responsibility, awareness of risk, and establishment of trust for health data use.
The growing volume of health data collected and stored electronically dramatically heightens the importance of data stewardship issues. As described above, these data are at the center of many ongoing scientific, biomedical, and health services research and policy efforts and are critical to quality assessment and improvement projects, which in turn are key to value-based purchasing initiatives. This information is also seen as a critical component of surveillance systems to detect outbreaks of disease, bioterrorism, and adverse events due to drugs or devices.
With an increased interest in reuse of health data, concerns about security and privacy are rising to the forefront. While various state and federal regulations address many of these concerns, they cannot adequately deal with the full range of current or contemplated data reuse scenarios. The biomedical and health informatics community would benefit from the articulation and application of a data stewardship paradigm to enable creditable uses of data while addressing legitimate concerns of privacy and security. Without such a paradigm, it is possible that privacy and security concerns could prohibit or curtail the use of health information, thus inhibiting the benefits this use can bring.
Data stewardship has emerged as a means to balance the rights of individuals to have their personal information protected and their desire for improved health, more effective health services, and a strengthened and sustainable health system. Widespread acceptance of a set of consistent data stewardship principles and application of data handling guidelines for health data collection, storage and exchange would help establish a "chain of trust." In turn, the chain of trust would facilitate transactions and build confidence among consumers that their privacy interests are being given due consideration. Thus, data stewardship is a key building block in the construction of a national framework to guide the reuse of health data. AMIA proposes the following definition of data stewardship:
Data stewardship encompasses the responsibilities and accountabilities associated with managing, collecting, viewing, storing, sharing, disclosing, or otherwise making use of personal health information. Principles of data stewardship apply to all the personnel, systems and processes engaging in health information storage and exchange within and across organizations.
Data stewardship principles comprise:
The involvement of data stewards and the application of data stewardship principles (including enforcement mechanisms when necessary) would provide sufficient safeguards for legitimate downstream uses of health data. "Trusted data stewards" who adhere to these principles should be able to share data without having to create anew ad hoc data handling guidelines for each transaction. Each partner in the provider/supply chain of health data should accept, both in practice and spirit, an appropriate share of responsibility for maintaining the quality, security, and confidentiality of the data.
The application of sound data analytic principles, as utilized by health services researchers and analysts and clinical researchers (e.g., National Institutes of Health guidelines) is central to the data stewardship paradigm.10,11 Data must be of a minimum quality (accurate, reproducible, complete, timely, and credible) and data limitations should be acknowledged and described. Organizations and individuals must take an active interest in the accuracy, consistency, and timeliness of their health data.12 Data stewardship is a multi-faceted function which assigns ultimate responsibility for data quality and integrity to the organization holding the data.13 Trusted data stewards would be expected to establish, support, and maintain agreed-upon standards of data quality and data management.
Examples of the concept and application of stewardship can be found in the healthcare field as well as in other fields.14 In 1979, the Department of Health and Human Services Secretary's Advisory Committee on Automated Personal Data Systems analyzed the consequences of using computers to keep records about people15 and proposed enactment of a federal "Code of Fair Information Practice" for all automated personal data systems. Over the past quarter century, government agencies in the U.S., Canada, and Europe have studied the ways in which entities collect and use personal information, and the safeguards required to assure that these practices are fair and provide adequate privacy protection. The resulting series of reports, guidelines, and model codes represent widely-accepted principles concerning fair information practices.16–19 For example, the concepts of "circle of trust" and "chain of trust" are central to the data stewardship framework developed by the College of Physicians and Surgeons of British Columbia.20 The Liberty Alliance, formed in 2001 by 30 organizations to establish open standards, guidelines and best practices for identity management, has promulgated the concept of Circle of Trust as a legal entity and provides guidance on suggested business structures and terminology for a Liberty-enabled technology (http://www.projectliberty.org/liberty/about).21
A Taxonomy on Dimensions of Data Use
Discussions about reuse of health data can benefit from ongoing identification of uses and users of PHI. An AMIA working group presented a draft taxonomy at the 2007 meeting. By documenting a comprehensive (albeit not exhaustive) array of data users and users, the working group sought to build consensus around working definitions of these uses and to provide a guide for those developing policy related to health data reuse. The taxonomy is an important tool for sharpening definitions and terminology and helping to inform the greater community about data use terminology; it will require expansion and maintenance to sustain its usefulness. Table 1
presents a selection from this taxonomy.
|
|
Areas for Additional Exploration
The opportunities and challenges discussed in this paper require elaboration in the context of a complex and fluid societal environment. Breakthroughs in medical treatments, advances in biomedical and informatics technologies, new legal challenges and pending legislation, consumer health initiatives, and emerging commercial trends are just some of the factors that will affect the dialogue. AMIA identified several areas deserving further policy analysis and dialogue, based on work done at the 2007 conference. It is worth noting that the status in federal or state laws of the concept of health data stewardship, while an important aspect of the overall topic, was outside of the scope of the discussions at the 2007 AMIA meeting and of this paper. Nevertheless, the deliberations of the meeting should be useful to the legal community as they consider the evolving landscape of data stewardship.
What factors need to be considered in developing a healthcare data "chain of trust?" How can a robust "chain of trust" be implemented to authenticate an organization's participation? What trust model(s) should be adopted? |
Summary and Conclusions |
|---|
|
TopAbstractIntroductionAMIA's 2006 and 2007...Summary and ConclusionsAMIA Board of Directors...References |
|---|
While health data have been used for many purposes beyond direct patient care for decades, the advent and increased deployment of health information technology is complicating the use of such data. One of the key challenges facing the healthcare industry is to reach a workable balance among the value we place on good health care, the effectiveness of healthcare services, and the sustainability of the healthcare system, and the equally compelling value we place on our right to stewardship and confidentiality with respect to our personal health information.25,26
|
AMIA Board of Directors (BOD) Response and Action |
|---|
|
TopAbstractIntroductionAMIA's 2006 and 2007...Summary and ConclusionsAMIA Board of Directors...References |
|---|
|
Acknowledgments |
|---|
|
References |
|---|
|
TopAbstractIntroductionAMIA's 2006 and 2007...Summary and ConclusionsAMIA Board of Directors...References |
|---|
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| HOME | HELP | FEEDBACK | SUBSCRIPTIONS | ARCHIVE | SEARCH | TABLE OF CONTENTS |
