Legal and Regulatory Landscape in Healthcare PDF

12/5/23 Legaland Regulatory Landscape Key regulations: 1. HIPAA (U.S.): Protects patient health information, sets standards for data security and privacy. 2. GDPR (EU): Safeguards personal data, requires consent, and imposes data breach notification. 3. CCPA (California): Grants Californians contro...

12/5/23 Legaland Regulatory Landscape Key regulations: 1. HIPAA (U.S.): Protects patient health information, sets standards for data security and privacy. 2. GDPR (EU): Safeguards personal data, requires consent, and imposes data breach notification. 3. CCPA (California): Grants Californians control over personal data and mandates disclosure practices. 4. PIPEDA (Canada): Governs data collection and usage, emphasizes consent and individual rights. 5. HITECH Act (U.S.): Expands HIPAA, enforces data breach notifications and electronic health records security. 1 Legaland Regulatory Consequences Consequences of non-compliance with healthcare data protection laws: 1.Fines: Hefty penalties, e.g., GDPR fines up to 4% of global annual revenue. 2.Lawsuits: Legal actions from affected individuals for privacy breaches. 3.Reputational Damage: Loss of trust, credibility, and patient 3 confidence. 4.Remediation Costs: Financial burden of addressing breaches, audits, and compliance. 5.Criminal Charges: Potential for criminal charges against negligent organizations or individuals. 2 1 12/5/23 GDPR’s Rightsof individuals § The need for an individual's clear consent to the processing of his or her personal data § Easier access for the data subject to his or her personal data the right to rectification, to erasure and ‘to be forgotten’ § The right to object, including to the use of personal data for the purposes of ‘profiling’ § The right to data portability from one service provider to another https://www.consilium.europa.eu/en/policies/data-protection/data-protectionregulation/#:~:text=The%20GDPR%20establishes%20the%20general,data%20processing%20operations%20they%20perform . 3 3 HIPAA Compliance in US • Stands for Health Insurance Portability and Accountability Act of • 1996 Rules published December 2000, compliance by 2004 • Set National Standards for protection of individually identifiable health information •Health plans •Healthcare clearing houses • Healthcare providers who conduct healthcare transactions electronically https://www.hhs.gov/hipaa/for-professionals/index.html 6 4 2 12/5/23 10 Core principles of data protection 1.Lawfulness, Fairness and transparency: data processed in that sense 2.Purpose limitation: data collected for specific, legitimate purposes 3.Data minimization: collect only necessary, relevant data 4.Accuracy: rectify inaccuracies 5.Storage limitation: personal data should not be kept no longer than necessary 6. Accountability: compliance to laws 7. Consent: obtain consent from individuals 8. Individual Rights: individuals’ rights to access, rectify, erase, or restrict processing the data. 9. Data portability: allow individuals to transfer their data between services or organizations 10. Automated decision-making: inform individuals of change in decision making 5 Data classification Personal data: any information relating to an identified or identifiable natural person (names, numbers, location, online identifiers..) •Sensitive data: needs extra protection like racial or ethnic origin, political opinions, religious or philosophical beliefs, genetic data, biometric data, or health data. 6 3 12/5/23 Security Measures and protocols •Different ways to take security measures: • • • • encryption, access controls, authentication, and audit trails. •How these measures contribute to data protection. 1 1 7 Security Measures: Encryption 1.Data encryption: Encode/convert data at rest and in transit to prevent unauthorized access. 2.Device encryption: Ensure mobile devices and storage media are encrypted to protect data if lost or stolen. 1 2 8 4 12/5/23 Security Measures: Endpoint security • Antivirus and anti-malware software: Regularly update and scan systems for malicious software. • Patch management: Keep operating systems and software up to date to address vulnerabilities. 9 Data breach response •Steps to take in the event of a data breach: containment, notification, investigation, and recovery. • Importance of having a well-defined incident response plan. •Ongoing employee training 10 5 12/5/23 1990s. . •Adoption of health insurance portability and accountability (HIPAA) in 1996 •This laid groundwork for privacy and security standards in the US healthcare system 11 Qatar’s laws in data privacy •Qatar’s data protection and privacy obligations are governed by a number of national level laws and sector specific regulations. •Qatar’s Constitution guarantees the sanctity of human privacy. Article 37 holds that: “The sanctity of human privacy shall be inviolable, and therefore interference into privacy of a person, family affairs, home of residence, correspondence, or any other act of interference that may demean or defame a person may not be allowed save as limited by the provisions of the law stipulated therein.” https://securiti.ai/qatar-personal-data-protection-law/ https://smex.org/wpcontent/uploads/2021/02/210210_JoeyShea_Report_Covid- 19ContactTracingApps_EN_Draft5.pdf 12 6 12/5/23 Qatar’s laws in data privacy •Other provisions pertaining to privacy and data protection can be found in the Penal Code, Civil Code, Labour Law, Banking law, Electronic Commerce and Transactions Law, Telecommunications Law, Cybercrime Prevention Law, and the 2005 Data Protection Regulations for the Qatar Financial Center •Qatar’s data protection and privacy framework is governed mainly by Law no. 13 of 2016 on the Protection of Personal Data. The law was adopted on December 29, 2016 and lays out the application rules for the processing of data in Qatar. On January 2, 2018, a resolution from the Council of Ministers extended the compliance period until January 29, 2018. https://securiti.ai/qatar-personal-data-protection-law/ https://smex.org/wp-content/uploads/2021/02/210210_JoeyShea_Report_Covid- 19ContactTracingApps_EN_Draft5.pdf 5 13 Qatar’s data protection principles •The Ministry of Transport and Communications is the responsible authority for data protection. •Personal data is required only be processed within the principles of transparency, honesty, respect for human dignity, and acceptable practices, as outlined in article 3. •The appropriate administrative, technical and material precautions must be taken to protect personal data, as determined by the competent department https://securiti.ai/qatar-personal-data-protection-law/ https://smex.org/wpcontent/uploads/2021/02/210210_JoeyShea_Report_Covid19ContactTracingApps_EN_Draft5.pdf 14 7 12/5/23 Are there exemptions in Qatar? • There are broad exemptions that allow personal data to be processed • without obtaining consent from the data subject: • Protecting national and public security • Protecting the international relations of the State • Protecting the economic or financial interests of the State; and Preventing any criminal offense, collecting data about it or investigating it. 7 15 10 reasons why big databases are important? 1.Informed Decisions:Data-driven insights guide informed decision-making. 2.Advanced Analytics:Enables AI and machine learning for trend identification. 3.Research and Innovation:Supports medical research and personalized medicine. 4.Efficient Operations:Optimizes healthcare management and resource allocation. 5.Early Detection:Identifies disease outbreaks and enables preventive measures. 16 8 12/5/23 10 reasons why big databases are important? 6. Drug Development:Facilitates drug discovery and understanding disease mechanisms. 7. Patient Care:Predicts patient outcomes, supports evidence-based practices. 8. Regulatory Compliance:Safely manages patient data in line with regulations. 9. Real-Time Insights:Offers rapid responses to emerging health challenges. 10. Challenges:Address security, privacy, scalability, and data quality concerns 17 Types of big databases 1. Public health datasets 2. Electronic health records datasets 3. Medical imaging data 4. Pharmaceutical drug datasets 5. Health surveys and studies 6. Genomic and biomedical data 7.Social determinants of health data 8.Wearable and sensor data 18 9 12/5/23 Social determinants of health datasets •CDC Social Vulnerability Index (SVI):Data on social vulnerability factors that may impact health outcomes. • US Census Data:Demographic and socioeconomic data that can help analyze health disparities. 19 HCMT3002 Technology in Healthcare Dr. DoaaFarid, RD PhD Assistant Professor Department of Healthcare Management Fall 2023 20 10 12/5/23 •Spreadsheet management, and email; System Applications and Apps in Health Care with data attached to it • Budget systems to manage expenses and income; • Cost accounting systems to model the profit (or loss) of key services/products; • Enterprise resource planning (ERP) systems, which include human resource • payroll, accounts payable, materials management, and general ledger functions; •Time and attendance, staffing and scheduling, and productivity; Buchbinder (019), p. 163. 21 •Marketing systems: organization’s website, Facebook, and other social media accounts; System Applications and Apps in Health Care •Fund-raising systems managing the contributions of donors; • Billing and accounts receivable systems used to bill clients and customers; •Decision support systems (DSS) to help with clinical, quality, and population health goals. 22 11 12/5/23 Benefits of Technology in Data Easier access to data information (e.g., Electronic health record –EHR) • •Better patient care (e.g., pacemakers, health trackers, appointment and medication reminders) In case of any problems arising, data monitoring • • Improves medication administration process Improves access to patient information • • Increases documentation efficiency and organization Squired et.al, 2005 ; Yoder-Wise, 2015, p. 199 23 Tracking & analyzing data Health Information Technology: Healthcare Quality and Patient Safety •Reducing human error •Clinical outcomes are improving •Aiding in the care coordination •Boosting practice effectiveness •Time spent on documentation has decreased •Errors in medicine delivery are being reduced •Documentation quality has improved, as has communication and workflow •Integration of technological systems into workflow processes has been improved (patient discharges and transfers) Feldman, S. S., Buchalter, S., & Hayes, L. W. (2018). Health information technology in healthcare quality and patient safety: literature review.JMIR medical informatics,6(2), e10264. Tanwar, S., & Bhardwaj, M. S. (2022). The Impact of Information Technology on Patient Health and Safety.JOURNAL OF ALGEBRAIC STATISTICS,13(2), 779-787. 24 12 12/5/23 Technologies have significant cost • implications! Benefit vs Cost • Needs to balance the benefits to patients and healthcare professional and cost • Questions to ask: o Benefits the patient? o Is it cost effective? o Improves diagnosis? o Increases clinical productivity? Erdal(2018) 25 Role of Information Technology Storing , organizing , retrieving , and communicating digital data with accuracy and speed Sharing clinical information from different healthcare settings •E.g., HMC hospitals and Primary Healthcare Centres use the same technology (Cerner) to share patient information Easier documentation and access of data (graphing vital signs; Cerner patient record sysem) Facilitate access for research Providing more timely response to patients’ needs Yoder-Wise, 2015, p. 1190191 26 13 12/5/23 Role of Knowledge Technology Improve clinical decision making Expedite care Patient safety Yoder-Wise, 2015, p. 192 27 Ethical Issues using AI in Healthcare protection of patient privacy •gaining the trust of clinicians ••gaining the trust of the general public in the use of AI in health care AI bias •“Garbage in, garbage out” >>> “biases in, biases out” •How such biases arise? • when data used for training are not representative of the target population • when inadequate or incomplete data are used for training the AI models. • Unrepresentative data can occur due to, for example, societal discrimination (eg, poor access to health care) and relatively small samples (eg, minority groups). Reddy, S., Allan, S., Coghlan, S., & Cooper, P. (2020). A governance m odel for the application of AI in health care. 497. Journal of the Am erican M edical Inform atics (3), 491- Association,2 7 28 14 12/5/23 Privacy •Healthcare data are some of the most sensitive information one can hold about a person. •Respecting a person’s privacy is a vital ethical principle in health care •Privacy is bound up with patient autonomy or self-rule, personal identity, and well-being. • For these reasons, it is ethically essential to obtain genuine informed consent from patients both for health interventions and for the usage of their personal health data. • AI systems should be protected from privacy breaches to prevent psychological and reputational harm to patients 29 Threat of healthcare data •Unauthorized access •Data breaches •Malware and ransomware •Inside threats •Manipulations •Vulnerabilities 30 15 12/5/23 Definition of big data breach Unintentional exposure of patient data due to inadequate security measures or cyberattacks, leading to privacy violations and reputational damage. 31 Threat of healthcare data •Malware and ransomware: Malicious software can infect healthcare systems, encrypt data, and demand a ransom for its release, disrupting patient care and compromising data integrity. 32 16 12/5/23 Threat of healthcare data •Social engineering: Manipulation of individuals to divulge sensitive information, like passwords or access credentials, through tactics like phishing or pretexting. Ex: • human hacking • A social engineer manipulates staff members into giving access to their computers, routers, or Wi-Fi, where the social engineer can thensteal Protected Health Information (PHI) and/or install malware. 33 Big vs. conventional data breach? 1. Scale: involve massive data volumes, while conventional breaches compromise smaller datasets. 2. Complexity: use sophisticated methods; conventional breaches often rely on common attack vectors. 3. Impact: affect organizations, industries, and geopolitics; conventional breaches primarily impact individuals. 4. Regulation: trigger extensive compliance concerns; conventional breaches may trigger legal responses based on data type. 34 17 12/5/23 What happens to individuals when there is a data breach? •Identity Theft:Personal information exposed can lead to identity theft and fraudulent activities. •Financial Loss:Stolen financial data can result in unauthorized transactions and financial harm. •Privacy Violation:Breached sensitive data infringes on personal privacy and may be misused. •Reputation Damage:Data exposure erodes trust, affecting personal and professional reputation. 35 Personal identifiable information Refers to any information that can be used, either on its own or in combination with other information, to identify an individual. •Full name, Address, date of birth •Contact details •National Identification Number •Passport number •Driver’s license •Biometric data 36 18 12/5/23 Reasons for Increasing Popularity of Analytics in Healthcare • Technology advances •Cloud storage • Smartphones •American Recovery and Reinvestment Act (2009) •Installation of EHR systems •EHR systems allow for data collection from patients, which offer insights and the ability to improve decision making 37 What does this tell you? 38 19 12/5/23 This? 39 What does this tell you? Fraction of diabetes cases that are due to obesity, smoking, physical inactivity, and other factors by 2050, according to projections by WCMQ researchers. 40 20 12/5/23 Seven Ways Predictive Analytics Can Improve Healthcare 1. Improves diagnosis 2.Helps with preventive medicine and public health efforts 3.Provides answers to physicians for the treatment of individual patients 4.Provides employers and hospitals tools to predict insurance product costs 5.Allows smaller test cases to be used to prove models 6.Helps pharmaceutical companies meet the needs of the public for medication 7. Potentially helps improve outcomes 41 Data Analytics Goal: to obtain actionable insights that result in smarter decisions and better business outcomes Build a data framework Gathering data Building information Gaining actionable insights Statistical thinking and the three phases of analytics Descriptive analytics Predictive analytics Prescriptive analytics 42 21 12/5/23 Descriptive Analytics Condense large data sets into more meaningful and useful information Examine past performance and summarize data to discern trends and patterns to explain behavior Necessary because raw data alone is not typically usable to managers Examples Business intelligence reports Key performance indicators (KPIs) Descriptive statistics Traditional data visualization techniques 43 Predictive Analytics Builds models with data that can help forecast the future in terms of probabilities Popular in disease management and population health Examination of early indicators of diabetes to help with prevention and cost management More than 75 percent of total healthcare spending is related to chronic disease Hennepin County Medical Center Analysts discovered HIV patients also suffered from poor nutrition Predictive model showed positive impact of improved nutrition Now distributes healthy food with HIV medication, lowering overall costs 44 22 12/5/23 Predictive Tools Regressions Decision trees Useful for explaining prediction to nonanalysts Neural networks Attempt to mimic the human brain Can be used to predict outputs on basis of new inputs Sensitive to initial data and are difficult to diagnose errors 45 Data Visualization •Help extract value from raw data •Many forms of data visualization • • • • • • Bar graph Line graph Histogram Scatter plot Dashboards Scorecards Reports 46 23 12/5/23 Dashboard Components • Metrics • A direct numerical measure that represents a piece of business data in relationship with one or more dimensions (e.g., gross sales by week) • Measuring across more than one dimension (e.g., gross sales by territory and time) is called multidimensional analyses. • Most dashboards do not use multidimensional analyses, although more dynamic tools that do so are available • KPIs • • A metric tied to a target Most often, the distance of a metric is above or below target • Grain • The association of a measure with a specific hierarchal level in a dimension 47 Scorecards, Dashboards, and Reports Scorecards • Highest, most strategic level of decision making • Used to help align operational execution and strategy • Use KPIs to monitor execution and map results back to strategy • Dashboards • • Less focused on strategic objective and more on operational goals Used to provide actionable business information that is intuitive and insightful • Reports • Simple and static • Allow users to analyze specific data underlying metrics and KPIs 48 24 12/5/23 Data Mining is to Data explored without a specific hypothesis being established Relies on general sense that data may reveal insights Data mining tools Clustering Text mining Cognitive computing 49 50 25 12/5/23 Text Mining •Gathering of text data from EHRs, doctors’ and nurses’ notes •Minnesota State Fair example • Set up booth providing multiple services (e.g., flu shots, blood pressure readings, eye and ear exams) • Asked participants, “Why did you choose to get health screening at the state fair?” • Prediction—low cost or convenience • Results—used text miner and found the word “fun” appeared • frequently Insight—fairgoers felt empowered and engaged in the screening, as they were in control and traditional barriers to healthcare were gone 51 What is data mining and warehousing Data mining is the process of discovering patterns, relationships, and insights from large datasets.It involves using various techniques: to extract valuable and previously unknown information from data, often to make informed decisions, predict future trends, or identify patterns that might not be apparent through conventional analysis. Data warehousing involves the collection, integration, and storage of large volumes of diverse data from multiple sources into a central repository. This centralized database is designed for analytical purposes and supports reporting, querying, and decisionmaking. Data warehousing aims to provide a unified view of data that is optimized for complex queries and historical analysis Farid, S. F. (2019). Conceptual framework of the impact of health technology on healthcare system. Frontiers in Pharmacology,10 , 933 (p. 1). 3 52 26 12/5/23 Real-world examples of data mining 53 Definition of Data governance The overall administration, through clearly defined procedures and plans, that assures the availability, integrity, security, and usability of the structured and unstructured data available to an organization. AHIMA’s definition of Data Governance 3 54 27 12/5/23 Why is data governance important? Ensure patient safety and privacy by maintaining the accuracy and consistency of their healthcare . information 2 Promotes transparency, accountability and compliance . 1 • Example: in a big hospital, you’ll want to calculate the average length of stay. But across so many different people and departments, there’s likely to be more than one way to calculate this figure. That makes it impossible to calculate an accurate average across the whole hospital. On top of this, data governance also enables healthcare organizations to make informed decisions based on reliable data. This can lead to improved patient outcomes, cost savings, and better resource allocation. 55 Benefits of Data governance in healthcare •Without it, data is very segregated and hence can be confusing since coming from different locations •Ensuring quality= improve patient outcomes, cost savings, and better resource allocation •A Data governance implementation plan is needed • By giving consistent data metrics and reporting across departments • Decision making becomes easier because of precise and reliable data 56 28 12/5/23 Greater support for innovation and research Data governance establishes processes and policies for data access and sharing, making it easier for researchers and innovators to access relevant and reliable healthcare data.. 1 2 57 Data-driven decision-making -Predicting where and how fast an illness will spread -Allocating inevitably scarce resources -Identifying so-called infection clusters -Tracking and tracing the contacts of those who have been found to be 1 3 carriers 58 29 12/5/23 The various functional components of a data governance initiative in healthcare. Source: IGIQ.org 59 Figure: Health Catalyst Data Governance Model Source: https://www.healthcatalyst.com/ d emystifying-healthcare-datagovernance/5/ 60 30 12/5/23 How do you know there is poor data governance? Three signs of poor governance: •Duplication of data across clinical systems •Localized access and privacy policies •Additional costs, stemming from storing and maintaining data in multiple places and from making mistakes 61 31